Changes for publishing 'final' revision of VP (#654)

As per discussion on yesterday's WG call, changes to prepare the 'final' version ready for publication now that the vote has passed.

* Changes for final publication

Remove document history

Update title

"Status: Final" also needs to be added into the document header but this
has to be done manually in the html.

* Add section explaining the two different urls for the final spec

* Apply MikeJ's suggestion

Co-authored-by: Michael B. Jones <[email protected]>

Author: jogu

openid-4-verifiable-presentations-1_0.md

@@ -1,5 +1,5 @@
 %%%
-title = "OpenID for Verifiable Presentations - Editor's draft"
+title = "OpenID for Verifiable Presentations"
 abbrev = "openid-4-vp"
 ipr = "none"
 workgroup = "OpenID Digital Credentials Protocols"
@@ -73,6 +73,10 @@ Additionally, it defines how to use OpenID4VP in conjunction with the Digital Cr
 * Tobias Looker (MATTR)
 * Adam Lemmon (MATTR)
 
+## Errata revisions
+
+The latest revision of this specification, incorporating any errata updates, is published at [openid-4-verifiable-presentations-1_0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html). The text of the final specification as approved will always be available at [openid-4-verifiable-presentations-1_0-final](https://openid.net/specs/openid-4-verifiable-presentations-1_0-final.html). When referring to this specification from other documents, it is recommended to reference [openid-4-verifiable-presentations-1_0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html).
+
 ## Requirements Notation and Conventions
 
 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [@!RFC2119] [@!RFC8174] when, and only when, they appear in all capitals, as shown here.
@@ -3555,245 +3559,3 @@ Copyright (c) 2025 The OpenID Foundation.
 The OpenID Foundation (OIDF) grants to any Contributor, developer, implementer, or other interested party a non-exclusive, royalty free, worldwide copyright license to reproduce, prepare derivative works from, distribute, perform and display, this Implementers Draft, Final Specification, or Final Specification Incorporating Errata Corrections solely for the purposes of (i) developing specifications, and (ii) implementing Implementers Drafts, Final Specifications, and Final Specification Incorporating Errata Corrections based on such documents, provided that attribution be made to the OIDF as the source of the material, but that such attribution does not indicate an endorsement by the OIDF.
 
 The technology described in this specification was made available from contributions from various sources, including members of the OpenID Foundation and others. Although the OpenID Foundation has taken steps to help ensure that the technology is available for distribution, it takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this specification or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any independent effort to identify any such rights. The OpenID Foundation and the contributors to this specification make no (and hereby expressly disclaim any) warranties (express, implied, or otherwise), including implied warranties of merchantability, non-infringement, fitness for a particular purpose, or title, related to this specification, and the entire risk as to implementing this specification is assumed by the implementer. The OpenID Intellectual Property Rights policy (found at openid.net) requires contributors to offer a patent promise not to assert certain patent claims against other contributors and against implementers. OpenID invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology that may be required to practice this specification.
-
-# Document History
-
-   [[ To be removed from the final specification ]]
-
-   -30
-
-   * TBC
-
-   -29
-
-   * define mdoc session transcript for redirect-based oid4vp flow
-   * rename `verifier_attestations` parameter name to `verifier_info`
-   * make the `meta` parameter mandatory in DCQL query
-   * explicitly state that various arrays need to be non-empty
-   * clarify text about how encryption keys are obtained
-   * clarify how hashing works in transaction_data_hashes
-   * rework & expand privacy considerations section
-   * capitalize use of defined terms more consistently
-   * relax language in some cases that required wallets to always perform signature verification
-   * fix language implying `verifier_attestations` was mandatory
-   * try to make it clearer that direct_post.jwt builds on top of direct_post
-   * update pre-final specs section
-   * add IANA considerations for `encrypted_response_enc_values_supported`
-   * remove now unused reference to JARM
-   * move `verifier_attestations` IANA consideration to correct section
-   * fix title in 23220-2 ref
-   * add example of response encryption
-   * remove reference to CBOR encoding the OpenID4VPDCAPIHandoverInfo thumbprint
-   * fixed reference for DC API single/multi sign requests and made it clear what the protocol identifier is
-   * fix type_values example in W3C Verifiable Credential section
-   * fix an example that used now removed jwt_vp and ldp_vp
-   * fix description of invalid_request error
-   * add note that cross-device flow diagram doesn't show all parameters
-   * additions to & typo fixed in acknowledgements
-
-   -28
-
-   * rename `issuer_signed_alg_values` and `device_signed_alg_values` and add support for HMAC variants 
-   * Replace the JARM `authorization_encrypted_response_enc` with a new `encrypted_response_enc_values_supported` that allows the client to specify an array of acceptable `enc` values for the JWE
-
-   -27
-
-   * rename `vp_formats` to `vp_formats_supported` in Verifier Metadata
-   * update the `vp_formats_supported` metadata to always be format specific, and explicitly define the structure for `mso_mdoc`, `jwt_vc_json` and `ldp_vc`.
-   * require fully-specified COSE and JOSE algorithms for `mso_mdoc` and `dc+sd-jwt` formats in `vp_formats_supported` metadata
-   * remove AnonCreds for now as we're lacking implementation experience
-   * clarify that client identifier prefix specific parameters go in the header in multi RP DC API requests
-   * wallets must verify `expected_origins` in signed requested over the Digital Credentials API
-   * add "SD-JWT VCLD" section to SD-JWT VC Credential Format appendix
-   * clarify rules around rejecting presentations that fail checks
-   * remove references to ISO 18013-7 due it referencing an older version of the VP specification
-   * specify value matching for mdocs via a reference to cbor-to-json
-
-   -26
-
-   * add SD-JWT VCDM (now called SD-JWT VC LD)
-   * add `verifier_attestations` to list of authorization parameters
-   * renamed "Client ID Scheme" to "Client Identifier Prefix", and updated metadata (`client_id_prefixes_supported`) and an example `error_description` to match
-   * add note that `iss` must be ignored if present in the request object
-   * added security considerations for value matching in DCQL
-   * require `kid` in JWE response header if present in client_metadata `jwks`
-   * added some more (non-exhaustive) privacy considerations with pointers to SD-JWT and OpenID4VCI
-   * add implementation consideration about pre-final specs
-   * remove DIF Presentation Exchange as a query language option
-   * Changes in the DCQL query parameters specific to W3C VCs and AnonCreds
-   * Introduce ability to present without key binding, including a new parameter `require_cryptographic_holder_binding` in the Credential Query
-   * Adapt usage of "Verifiable Presentation" to only refer to Presentations with Holder Binding and "Presentation" to refer to all types of credential presentations
-   * change the identifier for the ETSI trusted list `trusted_authorities` entry from `openid_fed` to `openid_federation`
-   * change openid_fed to openid_federation for Trusted Authorities Query
-   * remove JARM and response signing, using JWT directly for unsigned, encrypted responses, including changes to allow the client to indicate a set of acceptable `alg` values for the JWE using the `alg` value in the JWKS instead of the JARM `authorization_encrypted_response_alg`
-   * make consistent the use of prefixes in the client_id prefixing, defining new `openid_federation:` and `decentralized_identifier:` prefixes
-   * fix nonce computation for AnonCreds
-   * For w3c vc, DCQL `type_values` now matches against expanded type values
-   * For ISO mdoc, `doctype_value` is now mandatory in DCQL query `meta` parameter
-   * For SD-JWT VC, `vct_values` is now mandatory in DCQL query `meta` parameter
-   * For W3C VC, `type_values` is now mandatory in DCQL query `meta` parameter
-   * `purpose` element removed from DCQL `credential_sets`
-   * Add new DC API `openid4vp-v1-multisigned` protocol identifier for requests with JWS JSON Serialization
-   * Remove incorrect requirement for automatic registration when using OpenID Federation
-   * Change DCQL processing rules to allow the same credential to fulfil different queries
-   * Update specification to make DC API consistent with the rest of the specification
-
-   -25
-
-   * clarify value matching in DCQL
-   * clarify why requests using redirect_uri scheme cannot be signed
-   * add `trusted_authorities` to DCQL
-   * add note introducing cbor and cddl
-   * clarify DCQL case of `claims` and `claim_sets` being absent
-   * add language on client ID and nonce binding for ISO mdocs and W3C VCs
-   * for DC API, always use Origin for binding the response (e.g. in Key Binding JWT `aud` and sessionTranscript in mdoc)
-   * clarify the behavior is not to sign when authorization_signed_response_alg is omitted
-   * add a note on the use of apu/apv in the JWE header of encrypted responses
-   * add x509_hash client identifier scheme
-   * remove x509_san_uri client identifier scheme
-   * clarify that `dcql_query` and `presentation_definition` are passed as JSON objects (not strings) in request objects
-   * support returning multiple presentations for a single dcql credential query when requested using `multiple`
-   * Added support for multiple Client Identifiers and corresponding Request Signature to the DC API profile
-
-   -24
-
-   * add mdoc specific `intent_to_retain` mechanism, using the definition from 18013-5
-   * require `typ` value in request object to be `oauth-authz-req+jwt`
-   * add `SessionTranscript` requirements 
-   * use claims path pointer for mdoc based credentials
-
-   -23
-
-   * fixed percent-encoding of URI examples
-   * fixed an example that used 'client' where 'wallet' is more appropriate
-   * make SIOP example request/response consistent with each other
-   * make example request and example SD-JWT key binding JWT consistent
-   * add note that there are a choice of encryption JWE algorithms available, including the HPKE draft
-   * add `transaction_data` & `dcql_query` to list of allowed parameters in W3C Digital Credentials API appendix
-   * change Credential Format Identifier `vc+sd-jwt` to `dc+sd-jwt` to align with the media type in draft -06 of [@I-D.ietf-oauth-sd-jwt-vc] and update `typ` accordingly in examples
-   * remove references to the openid4vci credential format section
-   * clarified what profiling OID4VP means
-   * moved credential format specific DCQL parameters to the annex
-   * generalized W3C Digital Credentials API references
-   * changed response mode value for the OID4VP over the DC API
-   * updated to PE ver 2.1.1 (used to be 2.0.0)
-
-   -22
-
-   * Introduced the Digital Credentials Query Language
-   * add transaction data mechanism
-   * remove `client_id_scheme` and turn it into a prefix of the `client_id`; this addresses a security issue with the previous solution
-   * Clarified what can go in the `client_metadata` parameter
-   * Fixed #227: Enabled non-breaking extensibility.
-   * Fixed #383: Completed IANA Considerations section.
-
-   -21
-
-   * removed `client_metadata_uri` authorization parameter
-   * added how OpenID4VP request/response can be used over the browser API
-   * remove path_nested description from Response Parameters section and move it into W3C VC Annex
-   * fix indentation of examples
-   * added references to ISO/IEC 23220 and 18013 documents 
-   * added `post` request method for Request URI
-   * Added IETF SD-JWT VC profile
-   * Added `wallet_unavailable` error
-
-   -20
-
-   * added "verifier_attestation" client id scheme value
- 
-   -19
-
-   * added "x509_san_uri" and "x509_san_dns" client id scheme value
-
-   -18
-
-   * editorial update based on the 45 days review period prior to the Vote for proposed Second Implementer’s Draft
-
-   -17
-
-   * direct_post response mode uses state to identify response 
-   * Added sequence diagrams for same and cross device flows to overview section
-
-   -16
-
-   * Added `client_id_scheme` parameter
-   * Defined that single VP Tokens must not use the array syntax for single Verifiable Presentations
-
-   -15
-
-   * Added definition of VP Token 
-   * Editorial improvements for better readability (restructured request and response section, consistent terminology, and casing)
-
-   -14
-
-   * added support for signed and encrypted authorization responses based on JARM
-   * clarified response encoding for authorization responses
-   * moved invocation/just-in-time client metadata exchange/AS Discovery sections from siopv2 to openid4vp
-
-   -13
-
-   * added scope support
-
-   -12
-
-   * add Cross-Device flow (using SIOP v2 text)
-   * Added Client Metadata Section (based on SIOP v2 text)
-
-   -11
-
-   * changed base protocol to OAuth 2.0
-   * consolidated the examples
-  
-   -10
-
-   * Added AnonCreds example
-   * Added ISO mobile Driving License (mDL) example
-
-   -09
-
-   * added support for passing presentation_definition by reference
-   * added description how to request credential issued by a member of a federation
-
-   -08
-
-   * reflected editorial comments received during pre-implementer's draft review period
-
-   -07
-
-   * added text on other credential formats
-   * fixed inconsistency in security consideration regarding nonce
-
-   -06
-
-   * added additional security considerations
-   * removed support for embedding Verifiable Presentations in ID Token or UserInfo response
-   * migrated to Presentation Exchange 2.0
-
-   -05
-
-   * moved presentation submission parameters outside of Verifiable Presentations (ID Token or UserInfo)
-
-   -04
-
-   * added presentation submission support
-   * cleaned up examples to use `nonce` & `client_id` instead of `vp_hash` for replay detection
-   * fixed further nits in examples
-   * added and reworked references to other specifications
-
-   -03
-
-   * aligned with SIOP v2 spec
-
-   -02
-
-   * added `presentation_definition` as sub parameter of `verifiable_presentation` and VP Token
-
-   -01
-
-   * adopted DIF Presentation Exchange request syntax
-   * added security considerations regarding replay detection for Verifiable Credentials
-
-   -00 
-
-   *  initial revision