Skip to main content

v0.7.0

Release Information​

OP Inspector​

You can now view warnings and information related to validation on the details screen. Additionally, the validation method for the Profile Annotation Issuer Registration PA has been revised.

Added​

  • Warnings and Info generated during verification are now displayed on the detailed information screen. You can check for things like the use of deprecated Certificate models or missing and mismatched digestSRI without opening the browser console.
  • "Site Profile not found" is now displayed for sites that have Content Attestation but no Site Profile.
  • Added support for the cssSelector property of External Resource Target. → Documentation With cssSelector, you can identify the target element without adding the integrity attribute to the HTML element.

v0.6:

{
  "type": "ExternalResourceTargetIntegrity",
  "integrity": "sha256-OYP9B9EPFBi1vs0dUqOhSbHmtP+ZSTsUv2/OjSzWK0w="
}
<img
  src="https://example.com/image.jpg"
  integrity="sha256-OYP9B9EPFBi1vs0dUqOhSbHmtP+ZSTsUv2/OjSzWK0w="
/>

v0.7:

{
  "type": "ExternalResourceTargetIntegrity",
  "cssSelector": "#hero-image",
  "integrity": "sha256-OYP9B9EPFBi1vs0dUqOhSbHmtP+ZSTsUv2/OjSzWK0w="
}
<img src="https://example.com/image.jpg" id="hero-image" />

Changed​

  • For Profile Annotation Issuer Registration PA, the exception rule exempting registrations issued by the OP Registry (trust anchor) from authorization checks has been removed. → Documentation
  • If the authorization of a PA issuer cannot be verified, the system now issues an informational notification instead of a warning. This is because an inability to verify authorization does not necessarily mean the PA is invalid.
  • The message displayed for sites lacking a Site Profile has been changed to "This site does not yet support OP."
  • The link destination verification feature (which checks if the destination of an ad link belongs to the site operator declared in the content) now also verifies the OP signature of the destination site.
  • Icons are now bundled with the extension instead of being fetched via the Iconify API.
  • Even if a portion of the Website Profile contained within the Site Profile cannot be decoded, the system now proceeds to verify the remaining parts of the Website Profile. The error message indicates the location of the undecodable Website Profile (e.g., sites[1]).

Deprecated​

  • VisibleTextTargetIntegrity has been deprecated. Rendering results based on innerText vary across browsers, making it unsuitable for integrity verification. A warning is now displayed when verifying Content Attestation that includes this Target Integrity. Please migrate to TextTargetIntegrity (or HtmlTargetIntegrity). → Documentation

v0.6:

{
  "type": "VisibleTextTargetIntegrity",
  "cssSelector": "#main",
  "integrity": "sha256-GYC9PqfIw0qWahU6OlReQfuurCI5VLJplslVdF7M95U="
}

v0.7:

{
  "type": "TextTargetIntegrity",
  "cssSelector": "#main",
  "integrity": "sha256-GtNUUolQVlwIkQU9JknWkwkhfdiVmHr/BOnLFFHC5jI="
}

The integrity value needs to be recalculated.

Removed​

  • Removed the functionality to access the registry API using Basic authentication with credentials bundled at build time. Consequently, removed webRequest and webRequestAuthProvider from the permissions requested by the extension.

Fixed​

  • Fixed an issue where the reason for the error was missing from the "unsupported screen" and detailed information for pages where content scripts cannot be injected (such as the Chrome Web Store).
  • Fixed an issue where an incorrect organization name was displayed on the link verification warning screen and in the detailed information.
  • Fixed an issue where the warning would reappear after a period of inactivity, even if the user had selected "Proceed anyway" on the link verification warning screen.
  • Fixed a typo (outilne) in the overlay CSS.

WordPress Plugin​

Added​

  • Added a setting to CA Manager to exclude articles matching specified URL patterns from automatic CA issuance. For example, if /blog/** is set, CAs will not be issued when articles under /blog/ are published or updated. The setting applies to future publications or updates; existing CAs are neither deleted nor revoked.
  • Added logging for cases where signing fails because the image integrity value cannot be retrieved.
  • Added a notice in the admin interface indicating that VisibleTextTargetIntegrity is deprecated.
  • Added a "Tools > Bulk CA Issuance" screen to issue CAs in bulk for published articles. You can filter targets by post type, publication date, and category, and choose to issue CAs for "Unissued Only" or "All Items." Processing proceeds article by article, supporting pause, resume, and cancel functions, as well as retries for failed articles. Exclusion settings based on URL patterns are also applied.
  • Included cssSelector in the External Resource Target for images. The selector (e.g., img.wp-image-123) is derived from the wp-image-{attachment ID} class that WordPress assigns to the <img> element in image blocks. The integrity attribute continues to be added to <img> elements to ensure previously signed CAs remain verifiable.

Changed​

  • Changed the default CA server hostname to playground.originator-profile.org.
  • Explicitly stated in the README the policy that supported PHP versions must have active security support.

Fixed​

  • Fixed an issue where the API authentication (OIDC) screen would result in a 404 error in WordPress 7.x when the permalink setting was set to "Plain." Changes to the OIDC redirect URL are scheduled to be addressed in the next release of the CA server.

npm package​

Added​

  • Added a client library, @originator-profile/ca-client, for signing Content Attestations on the CA server.
    • createCaClient: Generates a client that requests the CA server to sign unsigned CAs (sign) or re-sign existing CASs (reSign).
    • writeCasFile / readCasFile: Reads and writes Content Attestation Set files.
    • detectDrift: Recalculates Target Integrity from the post-build HTML and detects discrepancies against the values recorded in the CAS.
  • @originator-profile/verify: Added verifyWebsite (for sites) and verifyDocuments (for documents). This allows other applications to utilize the same verification processes used by OP Inspector.
  • @originator-profile/verify: Added a serializable verification result type modeled after the VC Data Model 2.0 verification results. Errors are recorded as "Problem Details" objects—where the type field contains the URL from the Error Reference—along with a pointer indicating the location. Warnings and informational messages are recorded in warnings and info fields, respectively.
  • @originator-profile/verify: Made it possible to override the output destination for warnings and informational messages during verification using the logger option (accepting { warn, info }; defaults to console).
  • @originator-profile/presentation / @originator-profile/verify: Added the retrieval path (source) to the VC retrieval results and the OPS/CAS verification results. The retrieval path can be a registry, a Site Profile, or an HTML embedding.
  • @originator-profile/sign: Updated the key arguments for signJwtVc, signWsp, signCp, and signCa to accept CryptoKey or KeyObject instances, as well as JwtSigner objects representing external signers. This enables signing in environments where private keys cannot be extracted, such as HSMs or cloud KMS.
  • @originator-profile/model: Added a cssSelector property to the External Resource Target.
  • @originator-profile/model: Made the credentialSubject.id field in UnsignedContentAttestation optional. If omitted, the CA server assigns the CA ID.

Changed​

  • Breaking Change @originator-profile/verify: Consolidated the optional trailing arguments (fetcher, validator, verifyOrigin) for verifyImageDigestSri, OpsVerifier, and SpVerifier into an options object.

v0.6:

await verifyImageDigestSri(image, fetcher);

OpsVerifier(ops, keys, issuer, validator);

SpVerifier(sp, keys, issuer, origin, verifyOrigin, validator);

v0.7:

await verifyImageDigestSri(image, { fetcher });

OpsVerifier(ops, keys, issuer, { validator });

SpVerifier(sp, keys, issuer, origin, { verifyOrigin, validator });
  • @originator-profile/verify: Updated SpVerifier to continue verification even if parts of the Website Profile cannot be decoded; it now returns the verification results for all parts within SiteProfileInvalid, preserving their original order.

Deprecated​

  • @originator-profile/model: Deprecated VisibleTextTargetIntegrity.

Removed​

  • Breaking Change @originator-profile/opvc: Removed signByServer. Please use createCaClient from @originator-profile/ca-client instead. Authentication has shifted from access tokens to OAuth client credentials (ccspConfig). issuedAt and expiredAt can no longer be specified; the resulting CA is valid for one year from the time of signing.

v0.6:

import { ContentAttestation } from "@originator-profile/opvc";

const jwt = await ContentAttestation.signByServer(uca, {
  endpoint: "https://example.com/ca",
  accessToken: process.env.CA_SERVER_ACCESS_TOKEN!,
});

v0.7:

import { createCaClient } from "@originator-profile/ca-client";

const client = createCaClient({
  endpoint: "https://example.com/ca",
  issuer: "dns:example.com",
  ccspConfig: process.env.CA_SERVER_CCSP_CONFIG!,
});
const jwt = await client.sign(uca);

What's Changed​

Details
  • docs: Add npm version / jsDocs.io badges to the published package's README by @kou029w in (#438)
  • feat(inspector): Display warning logs encountered during validation on the details screen by @kou029w in (#437)
  • feat(opvc): Allow CA ID assignment to be delegated to the server during CA server signing by @knokmki612 in (#439)
  • Migrate to oxlint by @Sa-R390 in (#440)
  • chore(deps): update dependency turbo to v2.9.14 [security] by @renovate[bot] in (#446)
  • chore(inspector): Add build-for-amo script for AMO submission by @kou029w in (#443)
  • chore(deps): update dependency vite to v8.0.16 [security] by @renovate[bot] in (#447)
  • chore: Remove type-check task and integrate it into oxlint typeCheck by @kou029w in (#441)
  • chore(deps): update dependency dompurify to v3.4.11 [security] by @renovate[bot] in (#444)
  • chore(deps): update dependency astro to v6.4.6 [security] by @renovate[bot] in (#448)
  • chore(deps): update dependency react-router to v7.15.1 [security] by @renovate[bot] in (#450)
  • chore(deps): update dependency nuxt to v4.4.7 [security] by @renovate[bot] in (#445)
  • chore(deps): lock file maintenance by @renovate[bot] in (#451)
  • chore(deps): update dependency react-router to v7.18.2 [security] by @renovate[bot] in (#459)
  • chore(deps): update dependency dompurify to v3.4.13 [security] by @renovate[bot] in (#454)
  • chore(deps): update dependency nuxt to v4.5.1 [security] by @renovate[bot] in (#458)
  • chore(deps): update dependency astro to v7 [security] by @renovate[bot] in (#460)
  • feat(wordpress): add logging for cases where image signing fails by @YuukiTsuchida in (#462)
  • feat: extend signJwtVc key argument to accept Jwk | JwtSigner by @kou029w in (#463)
  • add display for cases with only CA and no SP by @Sa-R390 in (#465)
  • ca-client: add placeholder empty directory to package directory by @YouheiNozaki in (#466)
  • iconfiy Stop retrieving icon data via iconify API by @santarts in (#452)
  • chore(deps): update dependency esbuild to v0.28.1 [security] by @renovate[bot] in (#449)
  • chore(deps): update dependency js-yaml to v5.2.2 [security] by @renovate[bot] in (#455)
  • chore(deps): update dependency postcss to v8.5.23 [security] by @renovate[bot] in (#456)
  • chore(deps): update dependency wp-coding-standards/wpcs to v3.4.1 [security] by @renovate[bot] in (#457)
  • chore(deps): lock file maintenance by @renovate[bot] in (#461)
  • feat(ca-client): create createCaClient by @YouheiNozaki in (#470)
  • feat(cas-client): Create writeCasFile by @YouheiNozaki in (#471)
  • feat(ca-client): Release detectDrift by @YouheiNozaki in (#473)
  • fix(wordpress): Clarify PHP support policy by @kou029w in (#481)
  • feat: Remove trust anchor exemption for PA Issuer Registration and add authorization status notification by @kou029w in (#476)
  • feat(ca-client): Organize error codes and retry samples by @YouheiNozaki in (#478)
  • Modified e2e tests to allow separate specification of issuer and holder by @Sa-R390 in (#482)
  • docs(cas-client): Cleaned up README by @YouheiNozaki in (#483)
  • fix(wordpress): Updated default CA server hostname by @kou029w in (#485)
  • Added cssSelector to External Resource Target by @knokmki612 in (#480)
  • Extracted verifier targeting web content (sites, documents) by @knokmki612 in (#501)
  • [opvc] Removed signByServer by @YouheiNozaki in (#508)
  • [ca-client] Exposed readCasFile by @YouheiNozaki in (#511)
  • style: Fixed wording for cases where SP is missing by @YuukiTsuchida in (#442)
  • feat: Serializable return value styled like VC DM 2.0 verification results by @knokmki612 in (#506)
  • chore: remove TypeDoc and Astro build for docs by @kou029w in (#516)
  • fix(wordpress): resolve 404 error on WordPress plugin API authentication (OIDC) screen by @xkanei in (#518)
  • fix(wordpress): fix alignment of assignment operators in admin.php by @kou029w in (#519)
  • refactor: move implementation logic (excluding inspector display) to extension-common by @knokmki612 in (#515)
  • refactor(extension-common): clean up code moved in #515 by @knokmki612 in (#520)
  • add acquisition path information to VC by @YuukiTsuchida in (#484)
  • feat: deprecate VisibleTextTargetIntegrity by @kou029w in (#524)
  • fix(ci): explicitly specify npmClient and syncWorkspaceLock in lerna.json by @kou029w in (#526)
  • fix(extension-common): Fix organization resolution for link verification and refine terminology and structure by @knokmki612 in (#521)
  • refactor(extension-common): Move tab badge update logic to tab-badge by @knokmki612 in (#522)
  • fix(inspector): Fix typo in overlay CSS: outilne → outline by @kou029w in (#532)
  • fix(inspector): Fix issue where the error reason disappeared on the unsupported screen and details view by @knokmki612 in (#528)
  • feat(op-lens): Create the OP Lens codebase by duplicating the Inspector by @knokmki612 in (#531)
  • fix(op-lens): Incorporate a bug fix applied only to the Inspector after duplication by @knokmki612 in (#538)
  • skill: Remove annotation now that migration from clsx to twMerge is complete by @knokmki612 in (#542)
  • fix(inspector): Change destination check in link verification E2E test to require an exact hostname match by @knokmki612 in (#541)
  • refactor: Remove unused extension implementation and fix Menu placement by @knokmki612 in (#539)
  • feat!: Remove registry Basic Auth path functionality by @knokmki612 in (#540)
  • CAS Monitor: Create CLI tool by @Sa-R390 in (#547)
  • chore: remove unnecessary public directory by @kou029w in (#551)
  • feat(wordpress): add filtering for CA issuance targets based on URL patterns by @xxj in (#544)
  • fix(deps): update dependency dompurify to v3.4.16 [security] by @renovate[bot] in (#553)
  • chore(deps): update dependency js-yaml to v5.4.1 [security] by @renovate[bot] in (#555)
  • chore(deps): update dependency vitest to v4.1.11 [security] by @renovate[bot] in (#552)
  • chore(deps): update dependency astro to v7.2.8 [security] by @renovate[bot] in (#554)
  • feat(wordpress): add bulk CA issuance for existing articles by @xxj in (#545)
  • feat(verify): return successfully decoded content to the caller even if WSP decoding fails by @YuukiTsuchida in (#548)
  • feat(wordpress): Add cssSelector to the External Resource Target for images by @kou029w in (#556)

Full Changelog: v0.6.1...v0.7.0

Download​

tip

If you use Google Chrome, it is available from the Chrome Web Store. If you use Mozilla Firefox, it is available from Firefox Add-ons.

Please download it from the Assets section on the GitHub Releases page linked below.

Installation Instructions​