Feature/credential proxy jwt #5957
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
jstuczyn
force-pushed
the
feature/upgrade-mode-lib
branch
2 times, most recently
from
b13fe0d to
71480d0
Compare
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
37b18a8 to
953aaa0
Compare
jstuczyn
modified the milestones:
Halloumi (est. mainnet 2.09.2025),
Isabirra (est. mainnet 16.09.2025)
jstuczyn
force-pushed
the
feature/upgrade-mode-lib
branch
from
71480d0 to
9e258d9
Compare
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
953aaa0 to
44ccae5
Compare
jstuczyn
force-pushed
the
feature/upgrade-mode-lib
branch
from
9e258d9 to
98b9b99
Compare
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
4 times, most recently
from
99585ec to
55b39c4
Compare
jstuczyn
force-pushed
the
feature/upgrade-mode-lib
branch
from
b576d95 to
bc97c9c
Compare
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
55b39c4 to
5f8be2d
Compare
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
5f8be2d to
df54ef8
Compare
jstuczyn
added a commit
that referenced
this pull request
Oct 30, 2025
post rebasing fixes clippy changed obtain-async endpoint to conditionally return jwt instead of pending zk-nym watching for the attestation file and issuing jwt
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
17259f6 to
106cba0
Compare
jstuczyn
added a commit
that referenced
this pull request
Oct 30, 2025
post rebasing fixes clippy changed obtain-async endpoint to conditionally return jwt instead of pending zk-nym watching for the attestation file and issuing jwt
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
106cba0 to
8c15a5c
Compare
benedettadavico
modified the milestones:
Leerdammer (est. mainnet 11.11.2025),
Mozzarella (est. mainnet 25.11.2025)
mmsinclair
requested changes
Oct 31, 2025
Contributor
mmsinclair
left a comment
mmsinclair
left a comment
There was a problem hiding this comment.
- in the attestation add:
- trusted JWT issuer pubkeys
nym-credential-proxy/nym-credential-proxy/src/attestation_watcher.rs
Outdated
Show resolved
Hide resolved
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
7d44e08 to
a0eafc0
Compare
post rebasing fixes clippy changed obtain-async endpoint to conditionally return jwt instead of pending zk-nym watching for the attestation file and issuing jwt
jstuczyn
force-pushed
the
feature/credential-proxy-jwt
branch
from
a0eafc0 to
737b465
Compare
jstuczyn
added a commit
that referenced
this pull request
Nov 3, 2025
post rebasing fixes clippy changed obtain-async endpoint to conditionally return jwt instead of pending zk-nym watching for the attestation file and issuing jwt
mmsinclair
approved these changes
Nov 3, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR is part of the 'Upgrade Mode' (NET-341) that should allow usage of the network in a situation where ecash credentials are unissuable, because, for example, we have lost signing quorum (i.e. we have fewer than the required number of threshold signers responding to requests).
It partially implements NET-448, however, this version is more naive. Instead requesting actual 'emergency credentials' that would have been issued by a subset of ecash signers, the credentials proxy creates a JWT, signed with its key, attesting the upgrade mode has been enabled.
In the current iteration it is expected to work as follows
attestation.jsonfile that dictates whether the upgrade mode has been enabled. this is expected to be under Nym's control and signed with the corresponding keythis is as far as the flow goes in this PR. once fully implemented (via subsequent changes), it will continue as follows:
This change is