feat(iso-passkeys): export parseAttestationObject and unwrapEC2Signature - #543
Open
NiKrause wants to merge 1 commit into
Open
feat(iso-passkeys): export parseAttestationObject and unwrapEC2Signature#543NiKrause wants to merge 1 commit into
NiKrause wants to merge 1 commit into
Conversation
Both functions already exist and are exported from their own modules, but neither is reachable from the package entry point. Relying parties that verify assertions themselves need both: - parseAttestationObject, to read the COSE public key out of the attestation object at registration time. getPublicKey() covers the common case, but it is registration-only and absent on older authenticators. - unwrapEC2Signature, to convert the ASN.1 DER signature a P-256 authenticator returns into the raw r||s WebCrypto's ECDSA verify requires. Without it subtle.verify rejects every valid P-256 assertion. Purely additive: no behaviour changes, nothing renamed or removed, and no new dependency. Export order follows biome's organizeImports.
NiKrause
added a commit
to Le-Space/orbitdb-identity-provider-webauthn-did
that referenced
this pull request
Aug 15, 2026
Three claims no longer held. The varsig paragraph pointed at two issues for "the non-recursive varsig layout it will follow". Both are closed and the layout shipped in 0.2.0, so it described finished work as pending and sent readers to dead links. What is actually unresolved is the header: webauthn-varsig-header is still TODO in ChainAgnostic/varsig#11, which makes the 0x300001 marker this package writes a private-use codepoint of our own choosing. That is now what the paragraph says, with the pointer that matters. "these forks can go away, and the pnpm.overrides block with them" stopped being true when conf>ajv and ajv>fast-uri were added there to clear the production advisories. Those stay, as does iso-web. Only the three fork entries go. And the upstream proposal now exists — hugomrdias/iso-repo#543 — so it is linked rather than described as a someday.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Both functions already exist and are exported from their own modules, but neither is reachable from the package entry point. Relying parties that verify assertions themselves need both:
Type of change
Purely additive: no behaviour changes, nothing renamed or removed, and no new dependency. Export order follows biome's organizeImports.