kych

OAuth 2.0 API for Swiyu to enable Taler integration of Swiyu for KYC (experimental)
Log | Files | Refs | Submodules | README | LICENSE

control (3990B)

      1 Source: kych
      2 Section: net
      3 Priority: optional
      4 Maintainer: Taler Systems SA <deb@taler.net>
      5 Uploaders: Christian Grothoff <grothoff@gnu.org>
      6 Rules-Requires-Root: no
      7 Build-Depends:
      8  debhelper-compat (= 13),
      9  cargo,
     10 # The crate is edition 2024, which needs rustc 1.85 or newer.  Trixie ships
     11 # 1.85, so no backport is required.
     12  rustc (>= 1.85),
     13 # reqwest is built with its default TLS backend (native-tls -> openssl-sys).
     14  pkg-config,
     15  libssl-dev,
     16 # Builds the man pages from documentation/taler-docs/manpages/ using the
     17 # minimal configuration in documentation/sphinx-man/.  No Sphinx extensions
     18 # are needed; keep it that way.
     19  python3-sphinx,
     20 # For the swiyu-verifier package: the SWIYU Generic Verifier in
     21 # swiyu-verifier/upstream/ is a Spring Boot application, built for Java 25
     22 # since its 5.0.0 release.  Trixie has the JDK; the pom's wrapper would pin
     23 # Maven 3.10.0, but the build is fine with the 3.9.9 the distribution ships,
     24 # which is preferred over letting the wrapper download one.
     25  maven,
     26  openjdk-25-jdk-headless
     27 Standards-Version: 4.7.2
     28 Vcs-Git: https://git.taler.net/kych.git
     29 Homepage: https://taler.net/
     30 
     31 Package: kych
     32 Architecture: any
     33 Depends:
     34  ${misc:Depends},
     35  ${shlibs:Depends},
     36 # kych-dbconfig needs createdb/createuser/psql, and so does the postinst to
     37 # find out whether there is a database to upgrade at all.
     38  postgresql-client,
     39  adduser
     40 Recommends:
     41  nginx | apache2 | httpd,
     42  postgresql (>= 14.0),
     43  swiyu-verifier
     44 Description: OAuth 2.0 gateway for SWIYU identity verification
     45  KyCH bridges OAuth 2.0 clients -- primarily a GNU Taler exchange performing
     46  KYC -- to the Swiss SWIYU e-ID trust infrastructure.  The client speaks a
     47  plain OAuth 2.0 authorization code flow, while KyCH speaks OpenID4VP to a
     48  SWIYU verifier, so that the user's SWIYU wallet presents an SD-JWT verifiable
     49  credential with selective disclosure.  The OAuth 2.0 scope names the
     50  credential claims to be disclosed.
     51  .
     52  This package provides the gateway daemon, its systemd unit, the database
     53  schema with the kych-dbconfig and kych-dbinit tools that create and migrate
     54  it, and kych-client-management for registering OAuth 2.0 clients.
     55  .
     56  The SWIYU verifier that the gateway speaks OpenID4VP to is packaged
     57  separately as swiyu-verifier; it can equally well be operated on another
     58  host, or by somebody else entirely.
     59 
     60 Package: swiyu-verifier
     61 Architecture: all
     62 Depends:
     63  ${misc:Depends},
     64 # The jar is built for Java 25, which is what its 5.0.0 release moved to;
     65 # an older runtime cannot load it.
     66  openjdk-25-jre-headless | java25-runtime,
     67  postgresql-client,
     68  adduser
     69 Recommends:
     70  nginx | apache2 | httpd,
     71  postgresql (>= 14.0)
     72 Suggests:
     73  kych
     74 Description: SWIYU Generic Verifier for e-ID credential verification
     75  The SWIYU Generic Verifier is the service that performs the actual
     76  verification of a credential presented by a SWIYU wallet: it publishes the
     77  OpenID4VP endpoints the wallet talks to, checks the presented SD-JWT
     78  verifiable credential against the issuer's key from the Swiss Base Registry
     79  and its revocation status from the Status Registry, and reports the result to
     80  the business application that asked for the verification -- KyCH, in this
     81  case.
     82  .
     83  It exposes two interfaces that belong on different sides of a firewall: the
     84  OID4VP interface, which wallets must reach over HTTPS with a publicly
     85  trusted certificate, and the management interface under /management/api/,
     86  which must not be reachable from outside the organisation.
     87  .
     88  This package builds the upstream Spring Boot application maintained by the
     89  Swiss Confederation (https://github.com/swiyu-admin-ch/swiyu-verifier),
     90  pinned to a release in the swiyu-verifier/upstream/ submodule of the KyCH
     91  source package, and adds a systemd unit, a configuration under
     92  /etc/swiyu-verifier and swiyu-verifier-dbconfig for the database.
     93  .
     94  Operating a verifier requires onboarding to the SWIYU trust infrastructure
     95  first: the service needs its own DID and signing key before it can serve a
     96  single verification.