Global Trust Registry by the PathCheck Foundation

PathCheck's Global Trust Regitry serves as main repository of trusted issuers of COVID Credentials from multiple standards (EU's DCC, DIVOC, Smart Health Cards, Good Health Pass, ICAO VDS, LAC Pass etc). This repository merges different Trust List formats in a main registry and exports the entire key set in several formats and in two main environments: production and testing.

Structure

We offer 6 static content formats and 1 dynamic server. Users can simply import the entire database from the JSON or CSV files directly or load records one by one from the NodeJS app.

The main production repository leaves on registry.json. This file is updated every day with keys from the EU DCC Gateway and the VCI directory. ICAO's updates happen monthly. Keys that are not part of any external Trust Framework are updated manually by the team. There is also a registry for test keys test_registry.json.

After registry.json is updated, our scripts generate equivalent registries in several formats, including:

did.json: A Signed DID Document referenced by a DID:WEB URI and signed by a second DID Document in the signer directory
registry_normalized.json: A JSON file with only the leaf public keys in a PEM format without headers/footers
registry_normalized.csv: A CSV table with only the leaf public keys in a PEM format without headers/footers
registry_normalized_jwks.json: A JSON structure with public keys as JWKs and the certificate chains as x5c properties inside each key
registry_normalized_jwks.csv: A CSV table with public keys as DID:JWKs and the certificate chains as x5c properties inside each key

The same structure is created for the test_registry.json.

KeyID Mappings

In order to merge all certificates into one list while correctly representing each specification's key Id resolving needs, the repository makes the following changes:

ICAO Seals: keyID is the certificate's issuer CN (OID 2.5.4.6) + # + the SubjectKeyIdentifier (e.g. BE#0PFBaOWBSJ+lLM1O1/iDtarttAs=)
SmartHealth Cards: keyID is the certificate's issuer URL + # + the key ID from the JWKs (e.g. https://spec.smarthealth.cards/examples/issuer#EBKOr72QQDcTBUuVzAzkfBTGew0ZA16GuWty64nS-s)
EU DCC: keyID remains the same, first 8 bytes of the SHA-256 fingerprint of the DSC encoded in DER (raw) format (e.g. pgM4dDtABSg=)
DIVOC: keyID remains the same, the DID of the country's root of trust (e.g. did:india)
CRED: keyID remains the same, the domain name reference for the DNS TXT record (e.g. 1A9.PCF.PW)

The DID Document (did.json) file prefixes all keyIDs with the DID:WEB URI of the DID Document controller with the framework being used (e.g. did:web:raw.githubusercontent.com:Path-Check:trust-registry:main#DCC#mtvkV3qrrDQ=)

Main Data Model

The registry requests/returns entities specified as:

governanceFramework: [CRED, EUDCC, SmartHealthCards, ICAO, DIVOC]
identifier: The DID identifier of a W3C VC, the public key id of CRED and the EU DCC or the Issuer#kid of the SmartHealth Cards Framework
credentialType: The credential type according to the Standard:
- CRED: Payload type [BADGE, STATUS, PASSKEY, ...]
- EU DCC: [v,t,r]
- SmartHealth Cards: [https://smarthealth.cards#immunization, ...]
- ICAO: [icao.vacc, icao.test]
- DIVOC: [VerifiableCredential, ProofOfVaccinationCredential]
entityType: One of [issuer, verifier, trustregistry]
status: the status of the identifier.
- current: active
- expired: not renewed after the previous valid registration period
- terminated: voluntary termination by the registered party
- revoked: involuntary termination by the governing authority
statusDetail: Optional free text that expands on the status parameter. Generally, this is a message to show to the user.
validFromDT: Indicates that the Identifier status only starts at the indicated time. It should match the date on the certificate
validUntilDT: Indicates the the Identifier validity ends/ended at this date and time. It should match the date on the certificate
displayName: i18n Display Names
displayLogo: link to the logo in SVG.
displayURL: link to the issuers main website

CSV Formats

The CSV file has the following collumns, formatted accordingly:

  const FRAMEWORK    = 0 // oneOf[`CRED`, `DCC`, `SHC`, `ICAO`, `DIVOC`]
  const KID          = 1 // 
  const STATUS       = 2 // oneOf[`current`, `expired`, `terminated`, `revoked`]
  const DISPLAY_NAME = 3 // Base64 of the displayName.en UTF-8 string 
  const DISPLAY_LOGO = 4 // Base64 of the displayLogo UTF-8 string
  const VALID_FROM   = 5
  const VALID_UNTIL  = 6
  const PUBLIC_KEY   = 7 // PEM content without -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- or a DID:JWK
  const DISPLAY_URL  = 8 // Base64 of the displayURL UTF-8 string

Supported Issuers:

Live API Server

Check an issuer live on our databases:

https://registry.pathcheck.org/query/issuer?governanceFrameworkURI=SmartHealthCards&identifier=https://myvaccinerecord.cdph.ca.gov/creds%237JvktUpf1_9NPwdM-70FJT3YdyTiSe2IvmVxxgDSRb0&credentialType=https://smarthealth.cards%23immunization

Development Overview

This is a NodeJS + Express app

Running

Install modules: npm install

To run, do: npm run dev

Testing

Check an issuer with the following command

curl http://localhost:8000/query/issuer?governanceFrameworkURI=SmartHealthCards&identifier=https://myvaccinerecord.cdph.ca.gov/creds%237JvktUpf1_9NPwdM-70FJT3YdyTiSe2IvmVxxgDSRb0&credentialType=https://smarthealth.cards%23immunization

To run all tests, do:

npm tests

Generating new Version

GitHub Actions generates a new Release when npm version is run and pushed to the repo.

npm version <version number: x.x.x>

Contributing

Issues and pull requests are very welcome! :)

Name		Name	Last commit message	Last commit date
Latest commit History 1,585 Commits
.github/workflows		.github/workflows
logos		logos
scripts		scripts
signer		signer
tests		tests
.gitignore		.gitignore
LICENSE		LICENSE
Procfile		Procfile
README.md		README.md
did.json		did.json
package-lock.json		package-lock.json
package.json		package.json
registry.json		registry.json
registry_normalized.csv		registry_normalized.csv
registry_normalized.json		registry_normalized.json
registry_normalized_jwks.csv		registry_normalized_jwks.csv
registry_normalized_jwks.json		registry_normalized_jwks.json
server.mjs		server.mjs
test_registry.json		test_registry.json
test_registry_normalized.csv		test_registry_normalized.csv
test_registry_normalized.json		test_registry_normalized.json
test_registry_normalized_jwks.csv		test_registry_normalized_jwks.csv
test_registry_normalized_jwks.json		test_registry_normalized_jwks.json

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Global Trust Registry by the PathCheck Foundation

Structure

KeyID Mappings

Main Data Model

CSV Formats

Supported Issuers:

Live API Server

Development Overview

Running

Testing

Generating new Version

Contributing

About

Releases

Packages

Languages

License

Path-Check/trust-registry

Folders and files

Latest commit

History

Repository files navigation

Global Trust Registry by the PathCheck Foundation

Structure

KeyID Mappings

Main Data Model

CSV Formats

Supported Issuers:

Live API Server

Development Overview

Running

Testing

Generating new Version

Contributing

About

Resources

License

Stars

Watchers

Forks

Releases

Packages 0

Languages

Packages