digitalbazaar / vc-revocation-list Goto Github PK

guessing from tests about how to use this, encountering this error.

❯ node -v
v12.16.0

Our team was looking into the code and noticed that there's no check to make sure the revocationListCredential issuer matches the verifiable credential issuer. This creates the potential for the revocation list to be issued by a separate party which in the case where the server hosting the revocation list is compromised, it would allow for the adversary to create their own DID and to change the status of the credential to revoked or un-revoke it as well.

Should this check be added or was it intentionally left out?

I tried all varieties of imports and tsconfigs, but the outcome stays the same:

// @ts-ignore
import * as vcRevocationList from 'vc-revocation-list';
import vcRevocationList from 'vc-revocation-list';
import * as pkg from 'vc-revocation-list';
const { createList } = pkg;

When trying to use the library in a typescript project the only thing that is imported is an Object with empty defaults

[Module: null prototype] { default: {} } which then of course results in the error TypeError: vcRevocationList.createList is not a function when running the code

What am i getting wrong using the library here?

Hello,

I have installed vc-revocation-list via npm install digitalbazaar/vc-revocation-list and tried to create a revocation list in my TypeScript project:

import * as vcRevocationList from 'vc-revocation-list';
const list = await vcRevocationList.createList({ length: 100000 });

Which results in the following error:

TypeError: Bitstring is not a constructor
    at new RevocationList (node_modules/vc-revocation-list/RevocationList.js:8:22)
    at Object.createList (node_modules/vc-revocation-list/main.js:13:10)

I have tried installing and importing @digitalbazaar/bitstring directly:

import Bitstring from '@digitalbazaar/bitstring';
const bitstring = new Bitstring({length: 100000, buffer: null});

Which results in a very similar error:

TypeError: bitstring_1.default is not a constructor

Does someone know what causes this error and how to resolve it?

Thank you very much!

From the w3c documentation it says:

The revocationListCredential property MUST be a URL to a verifiable credential. When the URL is dereferenced, the resulting verifiable credential MUST have type property that includes the RevocationList2020Credential value.

It also gives an example where the credential's credentialStatus.revocationListCredential points to the RevocationList2020 Credential's id.

However, in the package's markdown shows another link and not the one stated in the documentation.

Shouldn't the link of credentialStatus.revocationListCredential be https://example.com/credentials/status/3 rather than https://did.actor/alice/credentials/status/3 ?

Thank you in advance

https://did.actor/alice/credentials/status/3.json
https://did.actor/bob/credentials/3732.json

did web resolver: https://did-web.web.app/

removal of this API was a breaking change but was released in v1.1.0. v1.1.0 needs to be patched to put that export back in. The export will be exporting the Class from the new module @digitalbazaar/bitstring

Once that's patched, that export should be removed and we should make a 2.0 release.

Remove Bitstring.js file and use @digitalbazaar/bitstring instead.