Class IssuerInfo
- Namespace
- Tessio.Verifier.Core
- Assembly
- Tessio.Verifier.Core.dll
Information about the credential's issuer as observed during verification.
public sealed record IssuerInfo : IEquatable<IssuerInfo>- Inheritance
-
IssuerInfo
- Implements
- Inherited Members
Remarks
FROZEN contract (contracts-v0). Forward-compatible: new optional inputs may be added as init-only properties, which is how TrustListSource, TrustAnchorSubject and TrustAnchorThumbprint arrived. No existing member changes.
Properties
ClaimedIssuer
The credential's iss claim when it is NOT the Identifier. Null otherwise.
public string? ClaimedIssuer { get; init; }Property Value
Remarks
Set on an SD-JWT VC carrying x5c whose end-entity certificate does not name its iss
in a subjectAltName. The certificate is what the trust verdict rests on, so its subject is the
Identifier (draft-ietf-oauth-sd-jwt-vc-13 section 3.5: "the Issuer of the Verifiable
Credential is the subject of the end-entity certificate"). The iss value is the credential's
own claim about itself, which nothing here verified. Show it, but do not identify an issuer by it.
Identifier
The issuer identifier from the credential (e.g., HTTPS URI or X.509 subject).
public required string Identifier { get; init; }Property Value
KeyResolutionMethod
How the issuer's signing key was resolved. Canonical values:
"jwt-vc-issuer-metadata" (web resolution via the iss HTTPS URI) or
"x5c" (the X.509 route: a chain carried in the credential header, or, with
ResolveX5u on, fetched from its x5u).
public required string KeyResolutionMethod { get; init; }Property Value
TrustAnchorSubject
Subject of the trust anchor that vouched for this issuer's key, when a certificate did.
public string? TrustAnchorSubject { get; init; }Property Value
Remarks
Null on the identifier route, where the list carried the identifier and no certificate was involved, and null on a refusal where nothing matched. Both are facts about the mechanism rather than missing values. A refusal that DOES know its anchor sets this, which is how "we trusted this exact certificate and its window had closed" stays distinguishable from "nothing matched". A subject is not an identity: compare TrustAnchorThumbprint, because distinguished names are not unique and a same-name impostor is what a subject comparison accepts. This is also the platform's rendering of the name rather than its DER, so it may not be string-equal across operating systems.
TrustAnchorThumbprint
SHA-256 over that anchor's DER bytes, uppercase hex. Null in the same cases as TrustAnchorSubject.
public string? TrustAnchorThumbprint { get; init; }Property Value
Remarks
Not the platform's Thumbprint property, which is SHA-1. It identifies the certificate
rather than the key, so a certificate authority that rotates its certificate produces a different
value here, which is correct: a different artefact was relied on.
TrustListSource
Which trust list produced the verdict, on both a trusted and an untrusted one.
public string? TrustListSource { get; init; }Property Value
Remarks
Null carries two different meanings and cannot distinguish them. Either the resolver in use reports no source, or the verdict carries no trust attribution: a malformed credential, a bad signature or a synthesised result all report none. A bad signature reports none even where the seam was asked first, which on the SD-JWT VC metadata route it is. So null is "no attribution available", never "no list accepted this". A caller storing an audit record should treat a null source as unevaluated rather than as a negative finding.
Trusted
Whether the issuer chains to a trusted root. See IsValid for the overall verdict.
public required bool Trusted { get; init; }Property Value
Unknown
Placeholder issuer for results produced before any issuer could be resolved (for example a
structurally malformed credential). Trusted is false and
KeyResolutionMethod is "none".
public static IssuerInfo Unknown { get; }