BUILD: Move owid-js to the key selection fix at 9aeb0d24 - #190
Merged
Conversation
The 51Degrees/owid-js fork took SWAN-community/owid-js#11 on 5 September 2026, which selects the creator's signing key by the start of its period rather than the moment it was generated, and asks the creator end point for the OWID's own version. package.json, remote_package.json and the readme sentence that explains the reference now name 9aeb0d24. FodId verifies offline against a supplied key, so its behaviour is unchanged; the bundled OWID source now matches the other 51Did clients. Jest: 139 passed, 2 skipped. Fixture check: the real 4 September identifier verifies under the key starting 31 August 2026 and answers Invalid on the schedule shifted a week.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the
owiddependency offiftyone.pipeline.didfromgithub:51Degrees/owid-js#8363541etogithub:51Degrees/owid-js#9aeb0d24, the head of the 51Degrees fork after it took SWAN-community/owid-js main at 9cf95fea. The three lines that name the commit change (package.json, remote_package.json and the readme sentence that explains the reference). package-lock.json is not tracked in this repository.Why
On 4 September 2026 the OWID ports were found to select a creator's signing key by the moment the key was generated rather than by the start of its period. The 51Degrees cloud writes thirteen weeks of keys in one run, so an identifier dated 4 September selected the key starting 7 September and genuine identifiers were reported as forged. The rule was corrected in the OWID specification (SWAN-community/owid#7) and in every port on 5 September 2026. The JavaScript fix is SWAN-community/owid-js#11, which also makes the creator request name the version the OWID carries (a version 2 OWID asks the
/owid/api/v2/end point), and adds a test against the real published schedule and a real identifier.FodId.verify()andFodId.checkSignature()in this package verify offline against a key the caller supplies, so their behaviour does not change. The bump keeps the bundled OWID source (seebundleDependencies) identical to what the other 51Did clients compile in, and picks up the version segment fix for anyone who uses the OWID network path directly.Verification
npm ciinfiftyone.pipeline.did, thennpx jest: 139 passed, 2 skipped (the live tests), 3 of 4 suites run (1 skipped).node_modules/owidcarries the newowid.published-key.test.jsandtestdata/, andv1.jsbuilds the creator path from the OWID's own version byte.id/keyverifies under the key starting 31 August 2026, and the same schedule with every start moved a week later answers Invalid.Notes
fiftyone.pipeline.did/package.jsonandremote_package.json. Whichever of the two merges second needs a one line rebase.Produced with AI assistance and checked against the outputs above.