Skip to content

fix: add security notes for test cryptographic keys and wallets #122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RishabhS7 merged 1 commit into from
Nov 14, 2025
Merged

fix: add security notes for test cryptographic keys and wallets #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/__tests__/core/documentBuilder.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,13 @@ import {
VerificationType,
} from '@trustvc/w3c-issuer';

// -----------------------------
// Note: Dummy/test cryptographic key pairs for local development and CI/CD.
// Used for signing/verifying credentials only. Not for production. Do not control funds.
// -----------------------------

const BBS2020testPrivateKey: PrivateKeyPair = {
// test key for BBS 2020 signing
id: 'did:web:trustvc.github.io:did:1#keys-1',
controller: 'did:web:trustvc.github.io:did:1',
type: VerificationType.Bls12381G2Key2020,
Expand All @@ -17,6 +23,7 @@ const BBS2020testPrivateKey: PrivateKeyPair = {
};

const ECDSAtestPrivateKey: PrivateKeyPair = {
// test key for ECDSA signing
'@context': 'https://w3id.org/security/multikey/v1',
id: 'did:web:trustvc.github.io:did:1#multikey-1',
type: VerificationType.Multikey,
Expand All @@ -26,6 +33,7 @@ const ECDSAtestPrivateKey: PrivateKeyPair = {
};

const bbs2023KeyPair: Bbs2023PrivateKeyPair = {
// test key for BBS 2023 signing
'@context': 'https://w3id.org/security/multikey/v1',
id: 'did:web:trustvc.github.io:did:1#multikey-2',
type: VerificationType.Multikey,
Expand Down
67 changes: 1 addition & 66 deletions src/__tests__/fixtures/fixtures.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1351,72 +1351,7 @@ export const W3C_TRANSFERABLE_RECORD = freezeObject({
verificationMethod: 'did:web:trustvc.github.io:did:1#keys-1',
},
} as SignedVerifiableCredential);
// export const ECDSA_W3C_VERIFIABLE_DOCUMENT_V2_0 = freezeObject({
// '@context': [
// 'https://www.w3.org/ns/credentials/v2',
// 'https://w3id.org/security/data-integrity/v2',
// 'https://w3id.org/vc/status-list/2021/v1',
// 'https://trustvc.io/context/transferable-records-context.json',
// 'https://trustvc.io/context/attachments-context.json',
// 'https://trustvc.io/context/qrcode-context.json',
// 'https://trustvc.io/context/bill-of-lading.json',
// ],
// qrCode: { type: 'TrustVCQRCode', uri: 'https://localhost:3000/qrcode' },
// credentialStatus: {
// type: 'TransferableRecords',
// tokenNetwork: { chain: 'MATIC', chainId: '80001' },
// tokenRegistry: '0xE0a94770B8e969B5D9179d6dA8730B01e19279e2',
// tokenId: '96435d29f3b0ce55e452d699fd09a85efdb7200493c5e77f09cbe0b63b2e3d88',
// },
// credentialSubject: {
// billOfLadingName: 'TrustVC Bill of Lading',
// scac: 'SGPU',
// blNumber: 'SGCNM21566325',
// vessel: 'vessel',
// voyageNo: 'voyageNo',
// portOfLoading: 'Singapore',
// portOfDischarge: 'Paris',
// carrierName: 'A.P. Moller',
// placeOfReceipt: 'Beijing',
// placeOfDelivery: 'Singapore',
// packages: [
// { packagesDescription: 'package 1', packagesWeight: '10', packagesMeasurement: '20' },
// { packagesDescription: 'package 2', packagesWeight: '10', packagesMeasurement: '20' },
// ],
// shipperName: 'Shipper Name',
// shipperAddressStreet: '101 ORCHARD ROAD',
// shipperAddressCountry: 'SINGAPORE',
// consigneeName: 'Consignee name',
// notifyPartyName: 'Notify Party Name',
// links: 'https://localhost:3000/url',
// attachments: [
// { data: 'BASE64_ENCODED_FILE', filename: 'sample1.pdf', mimeType: 'application/pdf' },
// { data: 'BASE64_ENCODED_FILE', filename: 'sample2.pdf', mimeType: 'application/pdf' },
// ],
// type: ['BillOfLading'],
// },
// renderMethod: [
// {
// id: 'https://localhost:3000/renderer',
// type: 'EMBEDDED_RENDERER',
// templateName: 'BILL_OF_LADING',
// },
// ],
// validUntil: '2029-12-03T12:19:52Z',
// issuer: 'did:web:trustvc.github.io:did:1',
// type: ['VerifiableCredential'],
// validFrom: '2024-04-01T12:19:52Z',
// id: 'urn:uuid:0198a36a-e37b-7aa6-a715-cf85b6019301',
// proof: {
// type: 'DataIntegrityProof',
// created: '2025-08-13T12:32:28Z',
// verificationMethod: 'did:web:trustvc.github.io:did:1#multikey-1',
// cryptosuite: 'ecdsa-sd-2023',
// proofPurpose: 'assertionMethod',
// proofValue:
// 'u2V0AhVhAX3jgXNIsqyCUgAexhykylzIFcd3e5IYSZUcENyh5-dGj9dofOMWl_KZF4evDJdzgUAmeDLnqcR9CpqAZbRTKVFgjgCQDmbT57c_Tgi3whdpjj8xECa73XTJlKIQPCA3BTPGDFutYIHx-Rew_DEy5XIdKQc9Am37-2GSGk3kox8dhKgoOflS-mC5YQAZy5CHM6vKL77ZGtfv3wE1iVxz9Qq0h71Gw6aACtn-wdUbYhF3toi8Nd5RkXxBqKRkzWnS_GbRF4cSdj9wN8udYQKowz5C8RzQM8NuLYTPH-3bujsmzoqYYMNZDI32v1wE3-mxWu11cAJ5l6w2_Jd81ElbdDMSkjIeeltEWRfvsIAFYQEJU3m9S4reGE6Ki6OUkP2G9zW3xe8Wc0E6Uimf1oqttFKE6SSMXvKRokcOQ09HDtVRgp5Zed8lmLl3M38xyentYQD8o--_SpwEOWgGn-uZfMPjDaGjaOMSeE7t1Y10lFpswjgx-2oX_6DxTTfcq784R9Jc-b5giwzfhTFIQT7avDkpYQEB9Ewgc6J8Pr_NP9gz4kiIGfHVJZT16ENhp-4QA7MhdksJuxU3UK4aCail5rcM4nGg9KQQiVNMKObVqbdNe2lZYQLNUXVA7ld_LYfGo1RLNTyXpIqYQAPhNdswJWuHO5aU6R0wYJ2obBvSTmY7XgB9uBl5ytBecxai2OQF6Bt2khqRYQLRL8DMQwhMWXUUgahHlSOI87-zltHXHwvQbhK-73t-n9L4sFUHfRtRNEhRfx1SvYZtRhg-v3djuADHpcdOBk6BYQOpBNFhO9O6dd50fvWJUJetEnbbWg8NTmO30gzPcDpa4MMeJjHL83OI81ZROav8ol8OOS2qeXbSTmUJT6kdycCBYQDiAv_rwDe6tVtjjazQzxOccOIWvkdVkUUXKUCT1gLoGsbUH5uuSs98y7PEUDFOmtXVxlSTTrxd-9d7mJzyr_4lYQKkeAtOratchWur9oLQs9vT6RnjPeg_mDJxXd9cqa6FPDPss3R4Cg9T2FSG6u86J62XfQGVgnWmJcfFfLoMsL05YQJjtbnO3OdGjQ3ZT12uMHcat0RJXxSery6nsuPNN-6k5Cn0H053P7jlfdDdXiNajK6kpnepESUKpo_0zeGU643dYQL2Eg6aYFBqWLc_qvEv5RX_GXuIGgOzCm2N9wBLp3pWBwzpQ3kWQu9-EPfKN4UM3QdlSnEePsoa44c-7ynyL71JYQBI7F__JL6LXWWzvaW3a-DNheFPfApcCb0dCHpsSGR_9l4f0gTxqZZH5tS57W0v62h6IzVpz76qmk7SjtPOYQcBYQDKYI8xN4Qk-gdF08uf774Qay3k3f94szWTWtrl-O9p_1XMltqxqrguWp-CoMA9aHJd-TL0PTJSbQ1KctYvu-WFYQFhH4WxSreYkUtcxqPKhfefyI5DIl8xoZVZoZswySmcxmIC2eI-_4JfLobkdo9-N_vhlyTu5K1ZfAp2SE2SlUUhYQF9pEhyultl8EBpQdXUtb3kfD3UVNjiOhLmzr2cEBpN8OLX5JCO-NLRswp7ytaqgFEX33aYYDIT-w-pVOI3zAftYQNDtlcfBBi5Qd8GCjqTVGm6qg7urCXkrzBFiHzqOIYCfaA0ip0-l2HY50YdxYd1MNmTQFszcTZDuEQpFuRgPX2VYQBvdqItd15wfxfA70BwgCCguTU7RH0Zabwy_vxndDLyLSw2Xsfy-IhhUyVmbcCyY7uIqPNnPLd-Lprbt2pgbM6xYQE-ozaFo3mS_0LAhBJ4bR7SRg3GQLwH80UEpQxuWDdMfBAS255aUok1Nv-MtG_z_fJOJx4X0D-W8ARFUq2VMo0tYQBIse9iDOZQ96Yzk9u4a1sAslF7muc453oaJiP9AreMO5GD614b1FNyjVB70DDhCAjJR_hODqYO-QzhiyzNzwm9YQMNjdjqv5XN5uBzyxMLFN8pXSEI3wMVNNN7XA6px0n0SHmse94klMa7EQejBW5xjD-C08KrcxZ3n8zL4XUi96kVYQJH2kIvVdh9XUuOLSFrqQppm8kyHuM4BJFJsUmdBT-OxX9-FHCtIgGArcIlxX_kVuok-6sv9fvO6-bvnjRXq8JdYQDsM7f6WjhmbDPlsZTFcfZ06qQ3tKEsqVPPpmpDM6WqRwlIzDevcqauzHfUvlfcLehR777izO0sKYMSbESL_WH9YQBUuJleMjPotYsrazAjp3NOy6OCXloec6jehqVlGR7c8s4gukJPCy9O7IBjER0_yyGESF2pZM-cEPVhmxLNwoUNYQOn_PRW9xsRKLmV7TsDQwvQnBQbYYmT1nWhEdACBf9mBVNkbrsBQAwZ1aUUb55hk5-EXUHoKLE8HP9y25Et0aFlYQESxH6MpwVXehGEA8kuM8muhyBHXCzVPMXPO0CTNguRlcL9WevE_L_Y7ldJUbvBRsEnTaOZ3S4RJnQokr0jIGoZYQI6kxmtR5hVtBcStCzHFdqLD0tYodQv0jT9JIqYJtiPRk5IW9JcIJt5IT3Kkd10k0WBp4yn_5T5oqWw4bXlGe9dYQHNCnsqLYLwu98vQkxI18SAjwN8meF_tPf4yk1y5X_slJuLjHAI2g2yq8wHddmam4wGKxCOg8ZeGe1MZoEl0DfZYQGPGZWTd6DV66I-VvLFORw4UfnAi7rP_MJqjejdk604ByQrwPvDZlRnjKdVf2EGGpqKrbcwdOXSEoSZ1W_XdSLZYQK7qYaSzOnqDBx6n9qMYpQfRae_DM2krRWv59NcNtSjly-kjkhd-pytTuEsgJOQbQkfBaNcqh745bfkdUUNgGtRYQEBR3peXmp1Q1pmutQ66iw24zMsIIiFdzO8EfJZNFmX69pqshet068jMktoFWtmCAGmRcV5p9jI2XCotD3yVFuBYQP8AxwRqfef3CaPihqx4F8OxUhhySQmaYOZGYVGOmSfC99pUrN-tsNbmHOB3Yr3HY9YvqWXe3IqzuOMbbRf8I4xYQCAbs7MBJGjVgZEE6GOrqub_glf2AslIrPSZLTYW0n2E2Kcg_y09uC4wC5UaOWgMQRVNgs645mAu6KayeQN7k_1YQHKArZtvjaBNyijHj24qDQRDhQNr6GAmCDDmsKsHaHAfDWWA301CLWFYw_0OmMeF2OBBdymPbghNImt2l_AUQ35YQOdAMei-zIX-uWw8ii5d0r3OSj9IXKzAj__Fd7Jo6oSWk2H_XR88b_nVNUeHlVpJjnwXuMeCjAPfIchAR4XIldJYQGn78Irvp9aBYMOCwulF8_GhpzUdT3AV2c213VA87jZ0dfPfb3tkbS44OoF50P5UTCLD2Y-MYx9jHrWJaJDWxWdYQLVSTwmnliLV4heL9lv1pa5vE8hGhRz35TEG4gHrkWB-O3Z4x9PPTPXn5O9tE4MjLzkkRPv0M7_zQ0ge6Z7x9eFYQHpKtwDNfm8UN6jpouUInO-tyJrxMnQN7SrKvlv4Drj6LWE_9bIfDGrZl9UJTMf1EBp1_wiV6bYMEkIhz_kfPmRYQPkY6DkpKGIBy4SWSZrIHj1UuG9UMMdkCOClQjPGqcXYCiwlC8uuW2C6Jrr_28PJvwnAS-0le25TP-TALuXSCGhYQLhFn1rEv2NJ_6N1jFZLCoeDvHMFWJ9aIlj9huCQuJJcnOONp_8qbAbP4db_rKyxUclacddLeX6MLnI29om_rYBYQMg1y6VkfsnfA8nZ7TeksPU48eyOBy3PRMkIdPB7QWWy_c-90CdTbPZD3C_Bw4w82w-uyDtC3vZr3aaii524sf1YQG8ZcfLuVfWxwpNzi9W6u2rg0b17lI86XGDCBpfv_4nMaEgGlVWmn-nn63NbsquKHPkCCNq9_ejEwjiwdNHNuPxYQAAXhoenzuHU6T5C5_Y6dYRNwR9V08ABjrwfUn-OsEm7zx7CORGcNBJ-zN3svFJfOrhCAof6jxWc5WXnJuj93SRYQEmfQSDgxPkWiD64pLJwBk4kJjJe_rdmJO9zL-rPb7O9sL-0Af8tgiUnREE7Qn8y2l7PoY2ytC4b3h_TJ0NDlM5YQD_NiL6Ojj7D0EVEJ3d0cZBQ0X8nE1CscGfrV_NbFQhYAxHHIjnTSLEN_oF76conYHts6xpgnYx4a6ttRbLwQKpYQNzuO2DpnS1bg9ZMoNgeBHJETxIbHm6Grk3vLb8KTk5koyY2jhjHDdp1uTezCG5nXbP_gVLAcowSotH_c5G9XLiCZy9pc3N1ZXJqL3ZhbGlkRnJvbQ',
// },
// });

export const ECDSA_W3C_VERIFIABLE_DOCUMENT_V2_0 = freezeObject({
'@context': [
'https://www.w3.org/ns/credentials/v2',
Expand Down
4 changes: 3 additions & 1 deletion src/__tests__/token-registry-functions/fixtures.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,9 @@ export const mockV4TradeTrustTokenContract = {
ownerOf: vi.fn(() => Promise.resolve(MOCK_OWNER_ADDRESS)),
};

export const PRIVATE_KEY = '0x59c6995e998f97a5a004497e5f1ebce0c16828d44b3f8d0bfa3a89d271d5b6b9'; // random local key
// Note: Dummy test wallets — private keys for local development and CI/CD only.
// These wallets are not for production and hold no funds or value on any network.
export const PRIVATE_KEY = '0x59c6995e998f97a5a004497e5f1ebce0c16828d44b3f8d0bfa3a89d271d5b6b9';

export const providerV5 = new ethersV5.providers.JsonRpcProvider();
export const providerV6 = new JsonRpcProviderV6();
6 changes: 6 additions & 0 deletions src/__tests__/w3c/sign.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ describe('W3C sign', () => {
// eslint-disable-next-line @typescript-eslint/no-unused-vars
const { proof, id, ...documentWithoutProof } = W3C_VERIFIABLE_DOCUMENT;

// Note: Dummy/test cryptographic BBS 2020 key pairs for local development and CI/CD.
// Used for signing/verifying credentials only. Not for production. Do not control funds.
const signingResult = await signW3C(
documentWithoutProof,
{
Expand Down Expand Up @@ -79,6 +81,8 @@ describe('W3C sign', () => {
...documentWithoutProof
} = ECDSA_W3C_VERIFIABLE_DOCUMENT_V2_0;

// Note: Dummy/test cryptographic ECDSA key pairs for local development and CI/CD.
// Used for signing/verifying credentials only. Not for production. Do not control funds.
const signingResult = await signW3C(
{ ...documentWithoutProof, credentialStatus: restCredentialStatus },
{
Expand Down Expand Up @@ -111,6 +115,8 @@ describe('W3C sign', () => {
...documentWithoutProof
} = BBS2023_W3C_VERIFIABLE_DOCUMENT_V2_0;

// Note: Dummy/test cryptographic BBS 2023 key pairs for local development and CI/CD.
// Used for signing/verifying credentials only. Not for production. Do not control funds.
const signingResult = await signW3C(
{ ...documentWithoutProof, credentialStatus: restCredentialStatus },
{
Expand Down
Loading