Fix SD-JWT signature verification - #564
Open
cykoder wants to merge 2 commits into
Open
Conversation
Signed-off-by: Sam Hellawell <sshellawell@gmail.com>
cykoder
force-pushed
the
fix/sdjwt-verify
branch
from
July 26, 2026 18:08
f9e3d4e to
fce2c25
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the WASM credential verification flow to correctly verify SD-JWT credentials cryptographically (including signature verification), and improves error propagation to callers.
Changes:
- Route SD-JWT verification through
@docknetwork/crypto-utils(verifySDJWTCredential) and pass a DID document loader into SD-JWT verification from the WASM credential service. - Replace the custom compact SD-JWT detection/decoding logic with library utilities (
isSDJWTCredential,decodeSdJwt) and add new cryptographic verification tests. - Update dependencies to
@docknetwork/credential-sdk@0.56.2, add@docknetwork/crypto-utils@0.2.2, and adjust@sd-jwt/*versions.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/wasm/src/services/credential/service.ts | Adds SD-JWT compact-serialization handling and verifies SD-JWTs using a document loader from the blockchain resolver. |
| packages/wasm/src/services/credential/sd-jwt.ts | Switches SD-JWT decode/detect/verify to @docknetwork/crypto-utils primitives. |
| packages/wasm/src/services/credential/sd-jwt.test.ts | Adds cryptographic SD-JWT issuance + verification tests using a keyResolver. |
| packages/wasm/src/services/credential/index.test.js | Adds a guard test for SD-JWT credentials missing compact serialization. |
| packages/wasm/package.json | Bumps credential-sdk, adds crypto-utils, and pins sd-jwt packages to 0.9.2. |
| packages/core/src/credential-provider.ts | Normalizes error extraction to improve status mapping and returned error strings. |
| package.json | Bumps @docknetwork/credential-sdk version at the workspace root. |
| package-lock.json | Updates lockfile to match dependency changes (including new engines/deprecations). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+378
to
394
| if (credential?._sd_jwt) { | ||
| const encoded = credential._sd_jwt.encoded; | ||
| if (typeof encoded !== 'string' || !encoded) { | ||
| return { | ||
| verified: false, | ||
| error: | ||
| 'SD-JWT credential is missing compact serialization required for verification', | ||
| }; | ||
| } | ||
| credential = encoded; | ||
| } | ||
|
|
||
| if (typeof credential === 'string' && checkIsSDJWT(credential)) { | ||
| return verifySDJWT(credential); | ||
| return verifySDJWT(credential, undefined, { | ||
| documentLoader: documentLoader(blockchainService.resolver), | ||
| }); | ||
| } |
Comment on lines
+33
to
+34
| "@sd-jwt/crypto-nodejs": "0.9.2", | ||
| "@sd-jwt/sd-jwt-vc": "0.9.2", |
Comment on lines
+115
to
+119
| const errorMessage = | ||
| typeof error === 'string' | ||
| ? error | ||
| : error?.message || error?.errors?.[0]?.message || error; | ||
|
|
Comment on lines
+26
to
28
| "@docknetwork/credential-sdk": "0.56.2", | ||
| "@docknetwork/crypto-utils": "0.2.2", | ||
| "@docknetwork/universal-wallet": "^2.0.1", |
| "@scure/bip39": "^1.6.0", | ||
| "@sd-jwt/crypto-nodejs": "^0.15.0", | ||
| "@sd-jwt/sd-jwt-vc": "^0.15.1", | ||
| "@sd-jwt/crypto-nodejs": "0.9.2", |
Collaborator
There was a problem hiding this comment.
is there any issue with using 0.15.0?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.