[java-idp-plugin-vci] branch main updated: Simpler explanation only referring to RFC

Thu Oct 29 15:18:26 UTC 2026

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/718a384e1aedd71065703a5b9e4a3b8d9359739e

The following commit(s) were added to refs/heads/main by this push:
     new 718a384  Simpler explanation only referring to RFC
718a384 is described below

commit 718a384e1aedd71065703a5b9e4a3b8d9359739e
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Oct 29 17:18:11 2026 +0200

    Simpler explanation only referring to RFC
---
 README.md | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index d68fdee..a1b938a 100644
--- a/README.md
+++ b/README.md
@@ -535,7 +535,7 @@ It goes inside the credential's own configuration, next to `format` and `vct`:
 | `issuer` | String | `openidvci.issuer` | What the credential says issued it. `did:jwk`, `did:web` or `url`. See [Step 2](#step-2-add-a-did-web-credential) and [Step 3](#step-3-add-a-plain-url-credential). |
 | `oidfed` | Boolean | `true` | Whether the credential states the Entity Identifier of this deployment, once the deployment is in OpenID Federation. See [Step 4](#step-4-make-the-url-credential-an-openid-federation-credential). |
 | `claim_types` | Array | | Type of a claim value in an mdoc where JSON has none, a date for example, `{"path": [...], "type": ...}`. See [The mdoc credential](#the-mdoc-credential) and [Complex claims](#complex-claims). |
-| `sd` | Array | | Elements of an array in a `dc+sd-jwt` or `vc+sd-jwt` credential that are disclosed one by one, `{"path": [..., null], "sd": "always"}`. See [Complex claims](#complex-claims). |
+| `sd` | Array | | Arrays disclosed element by element as in [Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) of SD-JWT, `{"path": [..., null], "sd": "always"}`. See [Complex claims](#complex-claims). |
 
 All of them are optional and so is the member itself.
 
@@ -4283,15 +4283,10 @@ How deep a path goes decides what a wallet can disclose:
 
 An object that holds values you give gets an `_sd` of its own. The objects on the way to it,
 `verified_claims` here, are not selectively disclosable, a wallet always shows that they are there.
-A path you give has names only, no `null` and no index, an array is always given as a whole value.
-It is disclosed as a whole, as in
-[Disclosures for Object Properties](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/).
-To disclose its elements one by one, as in
-[Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/),
-name it in `sd` of `_issuance_configuration`. An entry is a claim of
-[SD-JWT VC Type Metadata](https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/) with
-`"sd": "always"`, see its Claim Selective Disclosure Metadata. Only arrays, path ending in `null`,
-and only `always`:
+
+[Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) of SD-JWT shows
+`nationalities` with each element disclosed on its own. To issue an array like that, name it in
+`sd` of `_issuance_configuration`:
 
 ```json
 "_issuance_configuration": {
@@ -4301,7 +4296,9 @@ and only `always`:
 }
 ```
 
-For a `vc+sd-jwt` credential the path starts with `credentialSubject`.
+For a `vc+sd-jwt` credential the path starts with `credentialSubject`. An array not named in `sd`
+is one value, as in [Disclosures for Object Properties](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/).
+You give an array always as one value, the path has no `null` and no index.
 
 #### mdoc values
 
@@ -4424,7 +4421,7 @@ The offer is refused when a `mandatory` claim of the metadata is not in it, here
 | Date and time | a string | a string or epoch seconds with `tdate` in `claim_types` |
 | Bytes | a string, a `data:` url for example | base64 or base64url with `bstr` in `claim_types` |
 | Object | a JSON object, disclosed as a whole, or a path per member, each disclosed | a JSON object or a path per member, both one element |
-| Array | a JSON array, disclosed as a whole, or each element on its own with `sd` | a JSON array, a `claim_types` entry on it types every item |
+| Array | a JSON array, disclosed as a whole, or element by element as in [Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) with `sd` | a JSON array, a `claim_types` entry on it types every item |
 | Typed value inside an array | | a `claim_types` path with `null` for the array |
 | Null | not supported, refused | not supported, refused |
 
@@ -4610,7 +4607,7 @@ Member `_issuance_configuration` of a credential configuration. It is not publis
 | `issuer` | String | `openidvci.issuer` | `did:jwk`, `did:web`, `url` or the identifier itself. |
 | `oidfed` | Boolean | `true` | Whether the credential states the Entity Identifier, when *conf/openid-vci-oidfed.xml* is imported. |
 | `claim_types` | Array | | `{"path": [...], "type": ...}` per claim of an mdoc. `full-date`, `tdate`, `bstr`, `int` or `bool`. The path is a Claims Path Pointer, `null` for every element of an array, see [Complex claims](#complex-claims). |
-| `sd` | Array | | `{"path": [..., null], "sd": "always"}` per array of a `dc+sd-jwt` or `vc+sd-jwt` credential whose elements are disclosed one by one. The path is names followed by `null`, for `vc+sd-jwt` starting with `credentialSubject`. `always` is the only value. See [Complex claims](#complex-claims). |
+| `sd` | Array | | `{"path": [..., null], "sd": "always"}` per array of a `dc+sd-jwt` or `vc+sd-jwt` credential that is disclosed as in [Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) of SD-JWT. For `vc+sd-jwt` the path starts with `credentialSubject`. See [Complex claims](#complex-claims). |
 
 Members of a `vc+sd-jwt` credential, [W3C VCDM 2.0](https://www.w3.org/TR/vc-data-model-2.0/). The ones you set are members of
 `credential_definition`. Their content is purely yours, the plugin does not check it. Only

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
