init: claude
This commit is contained in:
Prad Nukala committed
1 parent
2def250609
commit
3b87993d60
150 files changed
+29191
No files matched your search
@@ -0,0 +1,90 @@
|
||||
# Repository README
|
||||
|
||||
|
||||
# Web Authentication Specification
|
||||
|
||||
This is the repository for the W3C WebAuthn Working Group, producing the draft **"Web Authentication"** specification.
|
||||
|
||||
* [The editor's copy is available at https://w3c.github.io/webauthn/](https://w3c.github.io/webauthn/), or in the [`gh-pages` branch of this repository](https://github.com/w3c/webauthn/blob/gh-pages/index.html).
|
||||
- The current *offically published working-draft snapshot* [is here: https://www.w3.org/TR/webauthn/](https://www.w3.org/TR/webauthn/).
|
||||
* [The build history is available from the repo Actions tab](https://github.com/w3c/webauthn/actions)
|
||||
* [W3C WebAuthn Blog](https://www.w3.org/blog/webauthn/)
|
||||
* [Web platform tests repository](https://github.com/web-platform-tests/wpt/tree/master/webauthn)
|
||||
|
||||
# Contributing
|
||||
|
||||
To materially contribute to this specification, you must meet the requirements outlined in [CONTRIBUTING.md](/CONTRIBUTING.md). Also, before submitting feedback, please familiarize yourself with [our current issues list](https://github.com/w3c/webauthn/issues) and review the [mailing list discussion](https://lists.w3.org/Archives/Public/public-webauthn/).
|
||||
|
||||
# Building the Draft
|
||||
|
||||
Formatted HTML for the draft can be built using `bikeshed` (see below for instructions for `bikeshed` installation):
|
||||
|
||||
```
|
||||
$ bikeshed spec
|
||||
```
|
||||
|
||||
You may also want to use the `watch` functionality to automatically regenerate as you make changes:
|
||||
|
||||
```
|
||||
$ bikeshed watch
|
||||
```
|
||||
|
||||
# Bikeshed Installation and Setup
|
||||
|
||||
See the full instructions at https://tabatkins.github.io/bikeshed/#installing.
|
||||
|
||||
You will need to have the Python 3.7 or later installed. Once you do have Python 3.7 or later installed, to install Bikeshed itself, run the following:
|
||||
|
||||
```
|
||||
pip3 install bikeshed && bikeshed update
|
||||
```
|
||||
|
||||
When that is completed, Bikeshed should be installed, and the `bikeshed` command should work in your shell.
|
||||
|
||||
# Continuous Integration & Branches
|
||||
|
||||
https://w3c.github.io/webauthn/ is autopublished from the `gh-pages` branch on every push to the `main` branch, using https://github.com/w3c/webauthn/blob/main/.github/workflows/build-validate-publish.yml to configure the autopublishing behavior.
|
||||
|
||||
# Creating a new Working Draft
|
||||
|
||||
To build a new WD and upload it to the W3C publishing system:
|
||||
- Register as a W3C member and join the Web Authentication working group. Note down your W3C USERNAME and PASSWORD to use in the command below. If you don't remember either one, please go [here](https://www.w3.org/accounts/recover) to retrieve it.
|
||||
- Copy the url of the meeting minutes in which the working group decided to publish a new draft as the DECISION_URL to be used below
|
||||
- Make sure Bikeshed is installed locally (follow the Bikeshed Installation and Setup section above)
|
||||
- Go into the ./bikeshed directory and use git pull to update Bikeshed.
|
||||
- Run the following command to update Bikeshed's datafiles:
|
||||
```
|
||||
bikeshed update
|
||||
```
|
||||
- Edit the Bikeshed metadata to change the status from ED to WD (do not commit this change)
|
||||
- Ensure Bikeshed can compile without any error or warning by running through the following command:
|
||||
```
|
||||
bikeshed spec
|
||||
```
|
||||
- Build and upload the new draft with
|
||||
```
|
||||
bikeshed echidna --u USERNAME --p PASSWORD --d DECISION_URL
|
||||
```
|
||||
|
||||
The command above will create a tarball of the HTML and images, and upload to Echidna, W3C's automated publishing system. The command should return a url, through which you can know whether you successfully publish the draft. Status of the request can also be tracked through the [Mailing List Archive](https://lists.w3.org/Archives/Public/public-tr-notifications/). You can also use W3C API [as described in the Echidna documentation](https://github.com/w3c/echidna/wiki/How-to-use-Echidna). Note that on Windows, this will give an error about failing to delete a temporary file because it is in use by a different process. This error is harmless; it happens after the submission has completed.
|
||||
|
||||
If the publication through the process is unsuccessful, it's likely because of [Specberus](https://github.com/w3c/specberus), a spec compliance checker. Echidna automatically runs through Specberus and will reject the publication if any error is reported by Specberus. You can run your document through [Pubrules](https://www.w3.org/pubrules/) to understand why your document is rejected. You may modify either the index.bs file or the index.html file to ensure compliance.
|
||||
|
||||
More often than not, you will discover the [Pubrules](https://www.w3.org/pubrules/) errors are due to bugs in either Bikeshed or Specberus. If so, you will have to modify the compiled index.html file to bypass Echidna and use the [manual process](https://github.com/w3c/echidna/wiki/How-to-use-Echidna) to publish. While you are editing the html file to avoid errors, you should also check to ensure the document still renders correctly.
|
||||
|
||||
The [manual process](https://github.com/w3c/echidna/wiki/How-to-use-Echidna) requires you to first create a tar file. To create the tar file, you need to first copy the index.html file and rename the copied file as Overview.html. This is because Echidna doesn't recognize index.html. You can then use the following command to create a tar file:
|
||||
```
|
||||
tar -cvf WD.tar Overview.html image1 image2 image3
|
||||
```
|
||||
|
||||
Then you can run the following command curl to publish to Echidna (use the command at the same directory as your tar file):
|
||||
```
|
||||
curl 'https://labs.w3.org/echidna/api/request' --user '<username>:<password>' -F "tar=@WD.tar" -F "decision=<decisionUrl>"
|
||||
```
|
||||
|
||||
Feel free to contact your chair or any W3C staff when you are stuck. Overall info on echidna is here: https://github.com/w3c/echidna/wiki and here https://labs.w3.org/echidna/.
|
||||
|
||||
# Taking meeting minutes
|
||||
|
||||
* [Scribe instructions from the W3C Guidebook](https://www.w3.org/2008/04/scribe.html)
|
||||
* [Alternate instructions from the XML Security WG](https://www.w3.org/2008/xmlsec/Group/Scribe-Instructions.html)
|
||||
@@ -0,0 +1,124 @@
|
||||
# GitHub Issues
|
||||
|
||||
74 recent issues.
|
||||
|
||||
## #2340: Discovery of migrated credentials
|
||||
|
||||
**State**: open
|
||||
**Labels**: stat:Discuss, subtype:FeatureProposal, TPAC 2025
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2340
|
||||
|
||||
## #2302: Merge changes since L3WD2 into changes since L2
|
||||
|
||||
**State**: closed
|
||||
**Labels**: type:editorial, type:process
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2302
|
||||
|
||||
## #2345: 16.2. ES256 Credential with No Attestation test vector misses extraData content
|
||||
|
||||
**State**: closed
|
||||
**Labels**: type:editorial
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2345
|
||||
|
||||
## #2350: Consider RP ID migration use cases
|
||||
|
||||
**State**: open
|
||||
**Labels**: stat:Discuss, subtype:FeatureProposal
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2350
|
||||
|
||||
## #2336: WebAuthn requestUserInfo -- easier account creation
|
||||
|
||||
**State**: open
|
||||
**Labels**: stat:Discuss, type:technical, subtype:FeatureProposal, TPAC 2025
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2336
|
||||
|
||||
## #2320: document and mitigate fingerprinting and disclosure risk of capabilities and extensions
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:technical, privacy-needs-resolution
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2320
|
||||
|
||||
## #2321: privacy implications of cross-origin iframe
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:technical, privacy-needs-resolution
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2321
|
||||
|
||||
## #2323: user verification discouraged should consider privacy impact or UA advice
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:editorial, privacy-tracker
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2323
|
||||
|
||||
## #2355: [L3 CR] Transition Request Draft
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:process
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2355
|
||||
|
||||
## #2338: Add Credential Manager Trust Group Key (CMTG) extension
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:technical, subtype:FeatureProposal, TPAC 2025
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2338
|
||||
|
||||
## #2352: Re-Open "confirmation" discussion (see PR#2020)
|
||||
|
||||
**State**: open
|
||||
**Labels**: stat:Discuss, subtype:FeatureProposal
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2352
|
||||
|
||||
## #2349: Feature: Allow RP to opt out of certain transports
|
||||
|
||||
**State**: open
|
||||
**Labels**: stat:Discuss, type:technical, subtype:FeatureProposal
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2349
|
||||
|
||||
## #2225: Prepare for CR
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:process
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2225
|
||||
|
||||
## #2244: [L3 CR] Horizontal Review: Security & Privacy
|
||||
|
||||
**State**: closed
|
||||
**Labels**: type:process
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2244
|
||||
|
||||
## #2228: Allow immediate mediation
|
||||
|
||||
**State**: open
|
||||
**Labels**: stat:Discuss, type:technical
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2228
|
||||
|
||||
## #2351: Spec doesn't build with bikeshed 5.0.3 or higher
|
||||
|
||||
**State**: closed
|
||||
**Labels**: type:editorial
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2351
|
||||
|
||||
## #2342: WebAuthn requirePlatformBackupEligibleCredential
|
||||
|
||||
**State**: closed
|
||||
**Labels**: type:technical
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2342
|
||||
|
||||
## #2347: thalinda
|
||||
|
||||
**State**: closed
|
||||
**Labels**: stat:Discuss, subtype:FeatureProposal
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2347
|
||||
|
||||
## #2297: Explainer for Level 4
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:explainer, TPAC 2025
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2297
|
||||
|
||||
## #2257: Update Credential Record to suggest storing RP ID as well for better Related Origins support
|
||||
|
||||
**State**: open
|
||||
**Labels**: type:editorial, TPAC 2025
|
||||
**URL**: https://github.com/w3c/webauthn/issues/2257
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
# Releases
|
||||
|
||||
## PR-00-20190116: Web Authentication Proposed Recommendation (PR-00)
|
||||
|
||||
**Published**: 2019-01-23
|
||||
|
||||
This tags the commit used as the basis for the published Proposed Recommendation version of WebAuthn Level 1: https://www.w3.org/TR/2019/PR-webauthn-20190117/
|
||||
|
||||
Note that the milestones associated with the Proposed Rec effort use "PropRec" in their identifiers rather than "PR" in order to try to reduce confusion with PRs (git pull requests) when referring to them (i.e., the PropRec milestones).
|
||||
|
||||
Diffs, change summary, etc. TBD.
|
||||
|
||||
## CR-00-20180320: Web Authentication Candidate Recommendation (CR-00)
|
||||
|
||||
**Published**: 2018-03-20
|
||||
|
||||
**Web Authentication Candidate Recommendation (CR-00) is officially published here: <a href="https://www.w3.org/TR/2018/CR-webauthn-20180320/">https://www.w3.org/TR/2018/CR-webauthn-20180320/<a>**
|
||||
|
||||
NOTE: the latest official WebAuthn spec release is always available here: <a href="https://www.w3.org/TR/webauthn/">https://www.w3.org/TR/webauthn/</a> (thus the latter presently yields CR-00)
|
||||
|
||||
|
||||
**<a href="https://www.w3.org/TR/2018/CR-webauthn-20180320/">WebAuthn CR-00</a> _features a number of
|
||||
|
||||
## WD-09-20180315: Web Authentication Working Draft rev 9 (WD-09)
|
||||
|
||||
**Published**: 2018-03-20
|
||||
|
||||
**Web Authentication Working Draft rev 9 (WD-09) is officially published here: <a href="https://www.w3.org/TR/2018/WD-webauthn-20180315/">https://www.w3.org/TR/2018/WD-webauthn-20180315/</a>**
|
||||
|
||||
NOTE: WebAuthn WD-09 (20180315) morphed into [CR-00](https://github.com/w3c/webauthn/releases/tag/CR-00-20180320) on 20180320 -- **_there are no differences between the latter and the former other than the maturity level designations_**.
|
||||
|
||||
The latest official WebAuthn spec release is always available
|
||||
|
||||
## WD-08-20180306: Web Authentication Working Draft rev 8 (WD-08)
|
||||
|
||||
**Published**: 2018-03-20
|
||||
|
||||
**Web Authentication Working Draft rev 8 (WD-08) is officially published here: <a href="https://www.w3.org/TR/2018/WD-webauthn-20180306/">https://www.w3.org/TR/2018/WD-webauthn-20180306/</a>**
|
||||
|
||||
NOTE: There are substantial differences between WD-08 and WD-07 -- see [CR-00](https://github.com/w3c/webauthn/releases/tag/CR-00-20180320) for relevant details and diffs, because:
|
||||
|
||||
There is only [one minor normative difference](https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F20
|
||||
|
||||
## WD-07-20171205: Web Authentication Working Draft rev 7 (WD-07)
|
||||
|
||||
**Published**: 2017-12-05
|
||||
|
||||
**Web Authentication Working Draft rev 7 (WD-07) is officially published here: <a href="https://www.w3.org/TR/2017/WD-webauthn-20171205/">https://www.w3.org/TR/2017/WD-webauthn-20171205/</a>**
|
||||
|
||||
NOTE: the latest official WebAuthn spec release is always available here: <a href="https://www.w3.org/TR/webauthn/">https://www.w3.org/TR/webauthn/</a> (so this presently yields WD-07)
|
||||
|
||||
**Please also note that this spec is a _Working DRAFT_ and will change, possibly in "breaking" ways.**
|
||||
|
||||
**<a href=
|
||||
|
||||
## WD-06-20170811: Web Authentication Working Draft rev 6 (WD-06)
|
||||
|
||||
**Published**: 2017-08-17
|
||||
|
||||
Web Authentication Working Draft rev 6 (WD-06) is officially published here: <a href="https://www.w3.org/TR/2017/WD-webauthn-20170811/">https://www.w3.org/TR/2017/WD-webauthn-20170811/</a>
|
||||
|
||||
NOTE: the latest official WebAuthn spec release is always available here: <a href="https://www.w3.org/TR/webauthn/">https://www.w3.org/TR/webauthn/</a> (so this presently yields WD-06)
|
||||
|
||||
Please also note that this spec is a _Working DRAFT_ and will change, possibly in "breaking" ways.
|
||||
|
||||
<a href="https://
|
||||
|
||||
## WD-05-20170505: Web Authentication Working Draft rev 5 (WD-05)
|
||||
|
||||
**Published**: 2017-05-07
|
||||
|
||||
Web Authentication Working Draft rev 5 (WD-05) is officially published here: https://www.w3.org/TR/2017/WD-webauthn-20170505/
|
||||
|
||||
The latest official WebAuthn spec release is always available here: https://www.w3.org/TR/webauthn/
|
||||
|
||||
Please note that this spec is only a Working DRAFT and will change, possibly in "breaking" ways. While not a candidate recommendation, this version is informally intended by the working group to be an Implementer’s Draft, which will be used for experimenting with imp
|
||||
|
||||
Reference in new issue
Block a user