sync

Author: fabianekc

cli/docker/Dockerfile-local

@@ -4,7 +4,8 @@ LABEL org.opencontainers.image.authors="Christoph Fabianek <christoph@ownyourdat
 RUN addgroup -S user && \
     adduser -S user -G user && \
     apk add --no-cache libsodium-dev openssl openssl-dev git make gcc musl-dev jq bash curl gdbm gdbm-dev enscript ghostscript && \
-    gem install httparty ed25519 multibases multihashes multicodecs optparse rbnacl dag uri json-canonicalization openssl oydid securerandom && \
+    gem install httparty ed25519 multibases multihashes multicodecs optparse rbnacl dag uri json-canonicalization oydid securerandom && \
+    gem install openssl -v "~> 3.3.2" && \
     apk add --update --no-cache python3 pipx py3-setuptools py3-pytest py3-requests && \
     ln -sf python3 /usr/bin/python && \
     apk add --no-cache py3-pytest-subprocess --repository=https://dl-cdn.alpinelinux.org/alpine/edge/testing
@@ -16,7 +17,6 @@ COPY docker/welcome.txt /tmp/welcome.txt
 COPY docker/etc/profile /etc/profile
 RUN chmod 755 /usr/local/bin/oydid && \
     gem install /tmp/*.gem && \
-    gem update && \
     gem cleanup && \
     sed -e "s/\${oydid}/`oydid --version | head -n 1`/" -e "s/\${jq}/`jq --version`/" /tmp/welcome.txt > /etc/motd && \
     mkdir -p /usr/src/pytest

cli/docker/local-gem/oydid-0.5.9.gem

@@ -9,7 +9,7 @@
 
 LOCATION_PREFIX = "@"
 DEFAULT_LOCATION = "https://oydid.ownyourdata.eu"
-VERSION = "0.5.8"
+VERSION = "0.6.1"
 LOG_HASH_OPTIONS = {:digest => "sha2-256", :encode => "base58btc"}
 
 # internal functions -------------------------------
@@ -515,6 +515,7 @@ def print_help()
     puts "  log        - print relevant log for given DID or log entry hash"
     puts "  logs       - print all available log entries for given DID or log hash"
     puts "  pubkeys    - list all authorized public keys for specified DID"
+    puts "  sign       - sign payload with provided private key"
     puts "  toW3C      - read OYDID internal document and convert to W3C-conform"
     puts "               DID document"
     # puts "  challenge - publish challenge for given DID and revoke specified as"
@@ -525,6 +526,9 @@ def print_help()
     puts "  jws        - output signed DIDComm message, reads from STDIN"
     puts "  jws-verify - read JWS and verify signature"
     puts ""
+    puts " -- JWK handling --"
+    puts "  jwks       - create JSON Web Key Set"
+    puts ""
     puts "Semantic Container operations:"
     puts "  auth       - retrieve OAuth2 bearer token using DID Auth"
     puts "  sc_init    - create initial DID for a Semantic Container "
@@ -762,12 +766,12 @@ def print_help()
 
 case operation.to_s
 # JSON input
-when "create", "confirm", 
+when "create", "confirm",
      "fromW3C", "toW3C",
      "message", "jws", "encrypt-message", "sign-message",
      "vc", "vc-proof", "vc-push", "vc-verify",
      "vp", "vp-push", "vp-verify",
-     "dri", "encrypt"
+     "dri", "encrypt", "jwks", "jwk2mb"
     input_content = []
     ARGF.each_line { |line| input_content << line }
     content = JSON.parse(input_content.join("")) rescue nil
@@ -812,8 +816,8 @@ def print_help()
             exit(-1)
         end
     end
-# JWT input
-when "decrypt-jwt", "verify-jws", "verify-signed-message", "decrypt"
+# JWT/raw input
+when "decrypt-jwt", "verify-jws", "verify-signed-message", "decrypt", "sign"
     content = []
     ARGF.each_line { |line| content << line }
     content = content.join('').strip
@@ -1158,6 +1162,41 @@ def print_help()
             end
         end
     end
+when "sign"
+    # checks---
+    # require --doc-enc
+    if options[:doc_enc].to_s == ''
+        if options[:silent].nil? || !options[:silent]
+            if options[:json].nil? || !options[:json]
+                puts "Error: require private key provided as --doc-enc"
+            else
+                puts '{"error": "require private key provided as --doc-enc"}'
+            end
+        end
+        exit(-1)
+    end
+    retVal, msg = Oydid.sign(content, options[:doc_enc].to_s)
+    if retVal.nil?
+        if msg.to_s != ""
+            if options[:silent].nil? || !options[:silent]
+                if options[:json].nil? || !options[:json]
+                    puts "Error: " + msg.to_s
+                else
+                    puts '{"error": "' + msg + '"}'
+                end
+            end
+        end
+        exit(-1)
+    else
+        if options[:silent].nil? || !options[:silent]
+            if options[:json].nil? || !options[:json]
+                puts "Signature: " + retVal.to_s
+            else
+                puts "{\"sig\": \"#{retVal.to_s}\"}"
+            end
+        end
+    end
+
 when "pubkeys"
     retVal, msg = Oydid.getDelegatedPubKeysFromDID(input_did, options[:pubkey_type])
     if retVal.nil?
@@ -1696,6 +1735,17 @@ def print_help()
         end
     end
 
+when "jwks"
+    result, msg = Oydid.build_jwks(content, input_did, options)
+    if msg.to_s != ''
+        if options[:json].nil? || !options[:json]
+            puts msg
+        else
+            puts {"error" => msg}.to_json
+        end
+    end
+    puts result
+
 # internal helper
 when "dri"
     result = Oydid.hash(Oydid.canonical(content.to_json))
@@ -1714,6 +1764,22 @@ def print_help()
     puts "private key: " + privateKey.to_s
     puts "signing public key: " + signgingPublicKey.to_s
     puts "encryption public key: " + encryptionPublicKey.to_s
+when "jwk2mb"
+    privateKey, msg = Oydid.private_key_from_jwk(content, options)
+    if msg.to_s != '' || privateKey.nil?
+        if options[:json].nil? || !options[:json]
+            puts msg
+        else
+            puts {"error" => msg}.to_json
+        end
+    else
+        if options[:json].nil? || !options[:json]
+            puts "private key: " + privateKey.to_s
+        else
+            puts '{"private_key": "' + privateKey.to_s + '"}'
+        end
+    end
+
 when "encrypt"
     key_type = options[:key_type]
     if input_did.to_s != ''

cli/docker/local-gem/oydid-0.6.1.gem

@@ -1,7 +1,7 @@
 @startuml
 start
 note
-  Read DID
+  Request DID
 end note
 partition Invocation {
   note
@@ -22,19 +22,21 @@ partition Invocation {
   end split
 }
 :get Location;
-note right
-  default location: https://oydid.ownyourdata.eu
+note
+  default location: 
+  https://oydid.ownyourdata.eu
 end note
-:retrieve DID Document from
-repository at location via GET;
-
-:retrieve DID Log from
-repository at location via GET;
+:retrieve information from
+repository at location
+(DID Document and Log
+from trustless repository);
 
 :build DAG from DID Log;
 
-:get current & validated
-DID Document based on DAG;
+:verify DID Document based on DAG;
 
 stop
+note right
+  Validated DID Document
+end note
 @enduml

cli/oydid.rb

@@ -12,7 +12,7 @@ partition Invocation {
     :API;
   end split
 }
-partition Preprocessing {
+partition Preprocessing (requires private key) {
     note
         internal data format
         ----
@@ -23,7 +23,8 @@ partition Preprocessing {
     end note
   :generate base data;
 }
-partition Store Data {
+partition Store Data (trustless, does not require private key) {
+:validate input;
 if (write method) then (local storage)
   :write to disc;
   note left
@@ -34,16 +35,15 @@ if (write method) then (local storage)
      *.log - DID Logs
   end note
 else (online repository)
-  :validate input;
   partition Transaction {
-  :write DID Document;
-  :write DID Logs;
+    :write DID Document;
+    :write DID Logs;
   }
 endif
 }
 :Response;
-note left
-DID Identifier
-end note
 stop
+note right
+  DID Identifier
+end note
 @enduml

docs/diagrams/read.txt

@@ -1,51 +1,45 @@
 PATH
   remote: .
   specs:
-    oydid (0.5.9)
-      ed25519 (~> 1.3.0)
-      httparty (~> 0.23)
-      json (~> 2.8.2)
+    oydid (0.6.1)
+      ed25519 (~> 1.4.0)
+      httparty (~> 0.24)
+      json (~> 2.18.1)
       json-canonicalization (~> 1.0.0)
       json-ld (~> 3.3.2)
-      jwt (~> 2.4.1)
+      jwt (~> 3.1.2)
+      jwt-eddsa (~> 0.9.0)
       multibases (~> 0.3.2)
       multicodecs (~> 1.0.0)
-      openssl (~> 3.3.0)
-      rbnacl (~> 7.1.1)
-      rdf (~> 3.3.2)
+      openssl (~> 3.3.2)
+      rbnacl (~> 7.1.2)
+      rdf (~> 3.3.4)
       rdf-normalize (~> 0.7.0)
+      securerandom (~> 0.4.1)
       simple_dag (~> 0.0.1)
-      stringio (~> 3.0.4)
+      stringio (~> 3.2.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    base64 (0.3.0)
     bcp47_spec (0.2.1)
     benchmark-ips (2.14.0)
     bigdecimal (3.2.3)
     byebug (12.0.0)
     csv (3.3.5)
     diff-lcs (1.6.2)
     docile (1.4.1)
-    ed25519 (1.3.0)
+    ed25519 (1.4.0)
     ffi (1.17.2)
-    ffi (1.17.2-aarch64-linux-gnu)
-    ffi (1.17.2-aarch64-linux-musl)
-    ffi (1.17.2-arm-linux-gnu)
-    ffi (1.17.2-arm-linux-musl)
     ffi (1.17.2-arm64-darwin)
-    ffi (1.17.2-x86-linux-gnu)
-    ffi (1.17.2-x86-linux-musl)
-    ffi (1.17.2-x86_64-darwin)
-    ffi (1.17.2-x86_64-linux-gnu)
-    ffi (1.17.2-x86_64-linux-musl)
     htmlentities (4.3.4)
-    httparty (0.23.1)
+    httparty (0.24.2)
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
     io-console (0.8.1)
-    json (2.8.2)
+    json (2.18.1)
     json-canonicalization (1.0.0)
     json-ld (3.3.2)
       htmlentities (~> 4.3)
@@ -55,7 +49,12 @@ GEM
       rack (>= 2.2, < 4)
       rdf (~> 3.3)
       rexml (~> 3.2)
-    jwt (2.4.1)
+    jwt (3.1.2)
+      base64
+    jwt-eddsa (0.9.0)
+      base64
+      ed25519
+      jwt (>= 2.9.0)
     link_header (0.0.8)
     logger (1.7.0)
     mini_mime (1.1.5)
@@ -64,7 +63,7 @@ GEM
       bigdecimal (~> 3.1)
     multibases (0.3.2)
     multicodecs (1.0.0)
-    openssl (3.3.0)
+    openssl (3.3.2)
     ostruct (0.6.3)
     rack (3.2.1)
     rake (13.3.0)
@@ -97,6 +96,7 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.6)
+    securerandom (0.4.1)
     simple_dag (0.0.1)
     simplecov (0.22.0)
       docile (~> 1.1)
@@ -105,20 +105,10 @@ GEM
     simplecov-html (0.13.2)
     simplecov-lcov (0.9.0)
     simplecov_json_formatter (0.1.4)
-    stringio (3.0.9)
+    stringio (3.2.0)
 
 PLATFORMS
-  aarch64-linux-gnu
-  aarch64-linux-musl
-  arm-linux-gnu
-  arm-linux-musl
   arm64-darwin
-  ruby
-  x86-linux-gnu
-  x86-linux-musl
-  x86_64-darwin
-  x86_64-linux-gnu
-  x86_64-linux-musl
 
 DEPENDENCIES
   benchmark-ips
@@ -130,4 +120,4 @@ DEPENDENCIES
   simplecov-lcov (~> 0.8)
 
 BUNDLED WITH
-   2.6.9
+  4.0.6

docs/diagrams/write.txt

@@ -0,0 +1,13 @@
+Copyright 2026 OwnYourData.eu
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.