Skip to content

Commit b41a82a

Browse files
authored
Merge branch 'main' into fix/return-processing-no-response
2 parents b1131d8 + f0b2719 commit b41a82a

66 files changed

Lines changed: 1652 additions & 594 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/codeql.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ jobs:
1010
CodeQL-Build:
1111
# CodeQL runs on ubuntu-latest and windows-latest
1212
runs-on: ubuntu-latest
13+
if: (github.event_name == 'pull_request' && github.repository == 'hyperledger/aries-cloudagent-python') || (github.event_name != 'pull_request')
1314

1415
steps:
1516
- name: Checkout repository

.github/workflows/pip-audit.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: pip-audit
2+
3+
on:
4+
workflow_dispatch:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
selftest:
11+
runs-on: ubuntu-latest
12+
if: (github.event_name == 'pull_request' && github.repository == 'hyperledger/aries-cloudagent-python') || (github.event_name != 'pull_request')
13+
steps:
14+
- uses: actions/checkout@v3
15+
- name: install
16+
run: |
17+
python -m venv env/
18+
source env/bin/activate
19+
python -m pip install .
20+
- uses: trailofbits/gh-action-pip-audit@v0.0.4
21+
with:
22+
virtual-environment: env/
23+
local: true

CHANGELOG.md

Lines changed: 90 additions & 38 deletions
Large diffs are not rendered by default.

DevReadMe.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ See the [README](README.md) for details about this repository and information ab
1818
- [Developing](#developing)
1919
- [Prerequisites](#prerequisites)
2020
- [Running Locally](#running-locally)
21+
- [Logging](#logging)
2122
- [Running Tests](#running-tests)
2223
- [Running Aries Agent Test Harness Tests](#running-aries-agent-test-harness-tests)
2324
- [Development Workflow](#development-workflow)
@@ -148,7 +149,7 @@ To enable the [ptvsd](https://github.com/Microsoft/ptvsd) Python debugger for Vi
148149
Any ports you will be using from the docker container should be published using the `PORTS` environment variable. For example:
149150

150151
```bash
151-
PORTS="5000:5000 8000:8000 1000:1000" ./scripts/run_docker start --inbound-transport http 0.0.0.0 10000 --outbound-transport http --debug --log-level DEBUG
152+
PORTS="5000:5000 8000:8000 10000:10000" ./scripts/run_docker start --inbound-transport http 0.0.0.0 10000 --outbound-transport http --debug --log-level DEBUG
152153
```
153154

154155
Refer to [the previous section](#Running) for instructions on how to run the software.

PUBLISHING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Once ready to do a release, create a local branch that includes the following up
88

99
1. Create a PR branch from an updated `main` branch.
1010

11-
2. Update the CHANGELOG.md to add the new release. If transitioning for a Release Candidate to the final release for the tag, do not create a new section -- just drop the "RC" designation. Check the date of the new release.
11+
2. Update the CHANGELOG.md to add the new release. Only create a new section when working on the first release candidate for a new release. When transitioning from one release candidate to the next, or to an official release, just update the title and date of the change log section.
1212

1313
3. Include details of the merged PRs included in this release. General process to follow:
1414

README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,19 @@ An ACA-Py instance puts together an OpenAPI-documented REST interface based on t
7878

7979
Technical note: the administrative API exposed by the agent for the controller to use must be protected with an API key (using the --admin-api-key command line arg) or deliberately left unsecured using the --admin-insecure-mode command line arg. The latter should not be used other than in development if the API is not otherwise secured.
8080

81+
## Troubleshooting
82+
83+
There are a number of resources for getting help with ACA-Py and troubleshooting
84+
any problems you might run into. The [Troubleshooting](Troubleshooting.md)
85+
document contains some guidance about issues that have been experienced in the
86+
past. Feel free to submit PRs to supplement the troubleshooting document!
87+
Searching the [ACA-Py GitHub
88+
issues](https://github.com/hyperledger/aries-cloudagent-python/issues) will
89+
often uncover challenges that others have experienced, often with answers to
90+
solving those challenges. As well, there is the "aries-cloudagent-python"
91+
channel on the Hyperledger Discord chat server ([invitation
92+
here](https://discord.gg/hyperledger)).
93+
8194
## Credit
8295

8396
The initial implementation of ACA-Py was developed by the Government of British Columbia’s Digital Trust Team in Canada. To learn more about what’s happening with decentralized identity and digital trust in British Columbia, a new website will be launching and the link will be made available here.

SupportedRFCs.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,11 @@ A summary of the Aries Interop Profiles and Aries RFCs supported in ACA-Py can b
4545
| Issuer | :white_check_mark: | |
4646
| Holder | :white_check_mark: | |
4747
| Verifier | :white_check_mark: | |
48-
| Mediator Service | :white_check_mark: | Coming Soon: An `aries-mediator-service` repository that is a pre-configured, production ready Aries Mediator Service based on a released version of ACA-Py. |
48+
| Mediator Service | :white_check_mark: | See the [aries-mediator-service](https://github.com/hyperledger/aries-mediator-service), a pre-configured, production ready Aries Mediator Service based on a released version of ACA-Py. |
4949
| Mediator Client | :white_check_mark: |
5050
| Indy Transaction Author | :white_check_mark: | |
5151
| Indy Transaction Endorser | :white_check_mark: | |
52+
| Indy Endorser Service | :construction: | Help Wanted! See the [aries-endorser-service](https://github.com/bcgov/aries-endorser-service), an under-construction, pre-configured, production ready Aries Endorser Service based on a released version of ACA-Py. On completion, we expect this repository to be moved into the Hyperledger GitHub organization. |
5253

5354
## Credential Types
5455

@@ -65,13 +66,14 @@ A summary of the Aries Interop Profiles and Aries RFCs supported in ACA-Py can b
6566
| `did:web` | :white_check_mark: | Resolution only |
6667
| `did:key` | :white_check_mark: | |
6768
| `did:peer` | :warning:| AIP 1.0-based `did:peer` DIDs are used, meaning the DIDs are not prefixed with `did:peer` and are not following the conventions of AIP 2.0's [RFC 0627: Static Peer DIDs](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0627-static-peer-dids) |
69+
| Universal Resolver | :construction: | A [plug in](https://github.com/sicpa-dlab/acapy-resolver-universal) from [SICPA](https://www.sicpa.com/) is available that can be added to an ACA-Py installation to support a [universal resolver](https://dev.uniresolver.io/) capability, providing support for most DID methods in the [W3C DID Method Registry](https://w3c.github.io/did-spec-registries/#did-methods). |
6870

6971
## Secure Storage Types
7072

7173
| Secure Storage Types | Supported | Notes |
7274
--- | :--: | -- |
75+
| [Aries Askar](https://github.com/hyperledger/aries-askar) | :white_check_mark: | Recommended - Aries Askar provides equivalent/evolved secure storage and cryptography support to the "indy-wallet" part of the Indy SDK. When using Askar (via the `--wallet-type askar` startup parameter), other Indy SDK functionality is handled by [Indy Shared RS](https://github.com/hyperledger/indy-shared-rs) (AnonCreds) and [Indy VDR](https://github.com/hyperledger/indy-vdr) (Indy ledger interactions). |
7376
| [Indy SDK "indy-wallet"](https://github.com/hyperledger/indy-sdk/tree/master/docs/design/003-wallet-storage) | :white_check_mark: | Full support for the features of the "indy-wallet" secure storage capabilities found in the Indy SDK. |
74-
| [Aries Askar](https://github.com/hyperledger/aries-askar) | :warning: | Aries Askar provides equivalent/evolved secure storage and cryptography support to the "indy-wallet" part of the Indy SDK. Available in ACA-Py (activated using a startup parameters but not yet widely used. When using Askar, other Indy SDK capabilities are handled by [Indy Shared RS](https://github.com/hyperledger/indy-shared-rs) (AnonCreds) and [Indy VDR](https://github.com/hyperledger/indy-vdr) (Indy ledger interactions). |
7577

7678
## Miscellaneous Features
7779

@@ -86,8 +88,8 @@ A summary of the Aries Interop Profiles and Aries RFCs supported in ACA-Py can b
8688
| Connection-less (OOB protocol / AIP 2.0) | :white_check_mark: | Only for present proof |
8789
| Signed Attachments | :white_check_mark: | Used for OOB |
8890
| Multi Indy ledger support (with automatic detection) | :white_check_mark: | Support added in the 0.7.3 Release. |
89-
| Persistence of mediated messages | :construction: | Messages are currently stored in an in-memory and so are subject to loss in the case of a sudden termination of an ACA-Py process. The in-memory queue is properly handled in the case of a graceful shutdown of an ACA-Py process (e.g. processing of the queue completes and no new messages are accepted). Work is underway to add useful external queues handling, including support for multiple external queue implementations (e.g., redis and kafka). |
90-
| Storage Import & Export | :warning: | Supported by directly interacting with the indy-sdk or Aries Askar (e.g., no Admin API endpoint available for wallet import & export). Aries Askar support includes the ability to import storage exported from the Indy SDK's "indy-wallet" component. |
91+
| Persistence of mediated messages | :construction: | Work is mostly complete to add external, persistent queue handling, including support for multiple external queue implementations (notably, plugins for [Redis](https://github.com/bcgov/aries-acapy-plugin-redis-events) and [Kafka](https://github.com/sicpa-dlab/aries-acapy-plugin-kafka-events)). Documentation for that is being worked on. Without persistent queue support, messages are stored in an in-memory queue and so are subject to loss in the case of a sudden termination of an ACA-Py process. The in-memory queue is properly handled in the case of a graceful shutdown of an ACA-Py process (e.g. processing of the queue completes and no new messages are accepted). |
92+
| Storage Import & Export | :warning: | Supported by directly interacting with the indy-sdk or Aries Askar (e.g., no Admin API endpoint available for wallet import & export). Aries Askar support includes the ability to import storage exported from the Indy SDK's "indy-wallet" component. However, a full migration approach from a production ACA-Py using the Indy-SDK storage to use Aries Askar storage has not been implemeted and documented. |
9193

9294
## Supported RFCs
9395

@@ -109,12 +111,9 @@ are fully supported in ACA-Py **EXCEPT** as noted in the table below.
109111
| RFC | Supported | Notes |
110112
--- | :--: | -- |
111113
| [0023-did-exchange](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0023-did-exchange) | :warning: | Not using DIDDoc conventions yet, still using DID format of 0160-connections (which is incorrect and outdated). Also using incorrect format for `did:peer` (or not using a `did:` prefix at all) |
112-
| [0183-revocation-notification](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0183-revocation-notification) | :white_check_mark: | :new: This was added in release 0.7.3 and will be removed from this list with the next update. |
113114
| [0211-route-coordination](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0211-route-coordination) | :warning: | Only pre-AIP 2.0 version. Must be updated to use `did:key` for full AIP 2.0 support |
114115
| [0317-please-ack](https://github.com/hyperledger/aries-rfcs/tree/main/features/0317-please-ack) | :x: | |
115116
| [0360-use-did-key](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0360-use-did-key) | :warning: | Creating and resolving `did:key` DIDs is supported, but not all protocols are updated yet to use `did:key`. This is a breaking change for AIP 1.0 -> AIP 2.0. |
116-
| [0519-goal-codes](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/concepts/0519-goal-codes) | :white_check_mark: | :new: This was added in release 0.7.3 and will be removed from this list with the next update. |
117-
| [0557-discover-features-v2](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0557-discover-features-v2) | :white_check_mark: | :new: This was added in release 0.7.3 and will be removed from this list with the next update. |
118117
| [0587-encryption-envelope-v2](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0587-encryption-envelope-v2) | :construction: | Support for the DIDComm V2 envelope format is a work in progress, including the PRs ([AIP-2 base64url consistency](https://github.com/hyperledger/aries-cloudagent-python/pull/1188) and [Small AIP-2 updates](https://github.com/hyperledger/aries-cloudagent-python/pull/1056)) |
119118
| [0627-static-peer-dids](https://github.com/hyperledger/aries-rfcs/tree/b3a3942ef052039e73cd23d847f42947f8287da2/features/0627-static-peer-dids) | :x: | |
120119

Troubleshooting.md

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Troubleshooting Aries Cloud Agent Python <!-- omit in toc -->
2+
3+
This document contains some troubleshooting information that contributors to the
4+
community think may be helpful. Most of the content here assumes the reader has
5+
gotten started with ACA-Py and has arrived here because of an issue that came up
6+
in their use of ACA-Py.
7+
8+
Contributions (via pull request) to this document are welcome. Topics added here
9+
will mostly come from reported issues that contributors think would be helpful
10+
to the larger community.
11+
12+
## Table of Contents <!-- omit in toc -->
13+
14+
- [Unable to Connect to Ledger](#unable-to-connect-to-ledger)
15+
- [Local ledger running?](#local-ledger-running)
16+
- [Any Firewalls](#any-firewalls)
17+
- [Damaged, Unpublishable Revocation Registry](#damaged-unpublishable-revocation-registry)
18+
19+
## Unable to Connect to Ledger
20+
21+
The most common issue hit by first time users is getting an error on startup "unable to connect to ledger". Here are a list of things to check when you see that error.
22+
23+
### Local ledger running?
24+
25+
Unless you specify via startup parameters or environment variables that you are using a public Hyperledger Indy ledger, ACA-Py assumes that you are running a local ledger -- an instance of [von-network](https://github.com/bcgov/von-network).
26+
If that is the cause -- have you started your local ledger, and did it startup properly. Things to check:
27+
28+
- Any errors in the startup of von-network?
29+
- Is the von-network webserver (usually at `https:/localhost:9000`) accessible? If so, can you click on and see the Genesis File?
30+
- Do you even need a local ledger? If not, you can use a public sandbox ledger,
31+
such as the [Dev Greenlight ledger](), likely by just prefacing your ACA-Py
32+
command with `LEDGER_URL=http://dev.greenlight.bcovrin.vonx.io`. For example,
33+
when running the Alice-Faber demo in the [demo](demo) folder, you can run (for
34+
example), the Faber agent using the command:
35+
`LEDGER_URL=http://dev.greenlight.bcovrin.vonx.io ./run_demo faber`
36+
37+
### Any Firewalls
38+
39+
Do you have any firewalls in play that might be blocking the ports that are used by the ledger, notably 9701-9708? To access a ledger
40+
the ACA-Py instance must be able to get to those ports of the ledger, regardless if the ledger is local or remote.
41+
42+
## Damaged, Unpublishable Revocation Registry
43+
44+
We have discovered that in the ACA-Py AnonCreds implementation, it is possible
45+
to get into a state where the publishing of updates to a Revocation Registry
46+
(RevReg) is impossible. This can happen where ACA-Py starts to publish an update
47+
to the RevReg, but the write transaction to the Hyperledger Indy ledger fails
48+
for some reason. When a credential revocation is published, aca-py (via indy-sdk
49+
or askar/credx) updates the revocation state in the wallet as well as on the
50+
ledger. The revocation state is dependant on whatever the previous revocation
51+
state is/was, so if the ledger and wallet are mis-matched the publish will fail.
52+
(Andrew/s PR # 1804 (merged) should mitigate but probably won't completely
53+
eliminate this from happening).
54+
55+
For example, in case we've seen, the write RevRegEntry transaction failed at the
56+
ledger because there was a problem with accepting the TAA (Transaction Author
57+
Agreement). Once the error occurred, the RevReg state held by the ACA-Py agent,
58+
and the RevReg state on the ledger were different. Even after the ability to
59+
write to the ledger was restored, the RevReg could still not be published
60+
because of the differences in the RevReg state. Such a situation can now be
61+
corrected, as follows:
62+
63+
To address this issue, some new endpoints were added to ACA-Py in Release 0.7.4,
64+
as follows:
65+
66+
- GET `/revocation/registry/<id>/issued` - counts of the number of issued/revoked
67+
within a registry
68+
- GET `/revocation/registry/<id>/issued/details` - details of all credentials
69+
issued/revoked within a registry
70+
- GET `/revocation/registry/<id>/issued/indy_recs` - calculated rev_reg_delta from
71+
the ledger
72+
- This is used to compare ledger revoked vs wallet revoked credentials, which
73+
is essentially the state of the RevReg on the ledger and in ACA-Py. Where
74+
there is a difference, we have an error.
75+
- PUT `/revocation/registry/<id>/fix-revocation-entry-state` - publish an update
76+
to the RevReg state on the ledger to bring it into alignment with what is in
77+
the ACA-Py instance.
78+
- There is a boolean parameter (`apply_ledger_update`) to control whether the
79+
ledger entry actually gets published so, if you are so inclined, you can
80+
call the endpoint to see what the transaction would be, before you actually
81+
try to do a ledger update. This will return:
82+
- `rev_reg_delta` - same as the ".../indy_recs" endpoint
83+
- `accum_calculated` - transaction to write to ledger
84+
- `accum_fixed` - If `apply_ledger_update`, the transaction actually written
85+
to the ledger
86+
87+
Note that there is (currently) a backlog item to prevent the wallet and ledger
88+
from getting out of sync (e.g. don't update the ACA-Py RevReg state if the
89+
ledger write fails), but even after that change is made, having this ability
90+
will be retained for use if needed.
91+
92+
We originally ran into this due to the TAA acceptance getting lost when
93+
switching to multi-ledger (as described
94+
[here](https://github.com/hyperledger/aries-cloudagent-python/blob/main/Multiledger.md#a-special-warning-for-taa-acceptance).
95+
Note that this is one reason how this "out of sync" scenario can occur, but
96+
there may be others.
97+
98+
We add an integration test that demonstrates/tests this issue [here](https://github.com/hyperledger/aries-cloudagent-python/blob/main/demo/features/taa-txn-author-acceptance.feature#L67).
99+
100+
To run the scenario either manually or using the integration tests, you can do the following:
101+
102+
- Start von-network in TAA mode:
103+
- `./manage start --taa-sample --logs`
104+
- Start the tails server as usual:
105+
- `./manage start --logs`
106+
- To run the scenario manually, start faber and let the agent know it needs to TAA-accept before doing any ledger writes:
107+
- `./run_demo faber --revocation --taa-accept`, and then you can run through all the transactions using the Swagger page.
108+
- To run the scenario via an integration test, run:
109+
- `./run_bdd -t @taa_required`

0 commit comments

Comments
 (0)