Support normative ETSI trust lists

Author: philpotisk

waltid-libraries/credentials/waltid-trust-registry/README.md

@@ -4,9 +4,26 @@ Kotlin/JVM library for loading trust lists and resolving certificates, certifica
 
 Supported inputs:
 
-- ETSI TS 119 612 Trust List XML
-- Provisional LoTE JSON and XML used by current EUDI pilots
-- LoTE JSON in a compact-JWS envelope
+- ETSI TS 119 612 Trust List and List of Trusted Lists XML
+- ETSI TS 119 602 V1.1.1 JSON, validated against the ETSI Annex A.1 schema
+- ETSI TS 119 602 V1.1.1 XML, validated against the ETSI Annex A.2.1 XSD
+- TS 119 602 JSON in a compact-JWS envelope
+
+Other JSON/XML shapes are rejected.
+
+## Standards status
+
+| Area | Status |
+|---|---|
+| TS 119 602 Annex A.1 JSON syntax | ETSI JSON Schema validation and normalization implemented |
+| TS 119 602 Annex A.2.1 XML syntax | Offline ETSI XSD validation and normalization implemented |
+| TS 119 602 Annex A.2.2 / TS 119 612 XML | Ingestion implemented |
+| RFC 7515 compact JWS integrity | Implemented for embedded ECDSA payloads |
+| TS 119 602 profile rules, annexes D–I | Conformance test expansion required |
+| JAdES Baseline B / XAdES-B-B profile validation | Not complete; cryptographic signature validation alone is not a conformance claim |
+
+The library must not be described as fully ETSI-conformant until the remaining profile rules and AdES validation are
+implemented and verified against an independent conformance suite.
 
 ## Security model
 
@@ -96,13 +113,23 @@ check(result.assurance?.authenticityState == AuthenticityState.INTEGRITY_VERIFIE
 
 For `AUTHENTICATED`, use `REQUIRE_AUTHENTICATED` and configure independently trusted TSL signer certificates.
 
+The parser distinguishes a national trust list from the EU List of Trusted Lists (LoTL):
+
+```kotlin
+check(result.format == TrustListFormat.ETSI_TS_119_612_TRUST_LIST_XML)
+```
+
+For the EU LoTL, `result.format` is `ETSI_TS_119_612_LIST_OF_TRUST_LISTS_XML` and
+`result.pointersLoaded` reports the number of `OtherTSLPointer` entries. The library does not automatically fetch the
+member-state lists referenced by those pointers; register and load each required national list explicitly.
+
 ### Explicitly allow an unsigned list
 
 Unsigned LoTE inputs require an explicit policy:
 
 ```kotlin
 val result = registry.loadSourceFromContent(
-    sourceId = "pilot-lote",
+    sourceId = "wallet-providers",
     content = loteJson,
     options = SourceLoadOptions(
         acceptancePolicy = SourceAcceptancePolicy.ALLOW_UNSIGNED
@@ -143,10 +170,15 @@ Failed refreshes do not replace the active source snapshot. `RefreshResult` prov
 
 - Boolean `validateSignature` loading methods remain temporarily available but are deprecated. New integrations should use `SourceLoadOptions`.
 - Persisted sources created before the assurance model must be refreshed or migrated; missing assurance is treated as not admitted.
-- The LoTE JSON/XML shapes are provisional pilot formats, not claims of final ETSI schema conformance.
 - Compact JWS support validates embedded payloads and pinned X.509 signers; it is not full JAdES support.
 - `InMemoryTrustStore` is thread-safe but not persistent. Production deployments should provide a persistent `TrustStore` implementation.
 
+Useful public test sources:
+
+- Austria TSL: `https://www.signatur.rtr.at/vertrauensliste.xml`
+- Italy TSL: `https://eidas.agid.gov.it/TL/TSL-IT.xml`
+- EU LoTL: `https://ec.europa.eu/tools/lotl/eu-lotl.xml`
+
 ## Tests
 
 ```bash
@@ -155,3 +187,10 @@ Failed refreshes do not replace the active source snapshot. `RefreshResult` prov
 ```
 
 Network tests are disabled by default. Enable them explicitly with `RUN_NETWORK_TESTS=true`.
+
+Normative references:
+
+- ETSI TS 119 602 V1.1.1: <https://www.etsi.org/deliver/etsi_ts/119600_119699/119602/01.01.01_60/ts_119602v010101p.pdf>
+- ETSI schemas, pinned in the implementation to commit `e84f427f0cde99513b574ef4b5a155ac4a38eab6`:
+  <https://forge.etsi.org/rep/esi/x19_60201_lists_of_trusted_entities>
+- ETSI TS 119 612 V2.4.1: <https://www.etsi.org/deliver/etsi_ts/119600_119699/119612/02.04.01_60/ts_119612v020401p.pdf>

waltid-libraries/credentials/waltid-trust-registry/THIRD_PARTY_NOTICES/ETSI-TS-119-602-SCHEMAS.txt

@@ -0,0 +1,27 @@
+The embedded ETSI TS 119 602 JSON schema is derived from:
+https://forge.etsi.org/rep/esi/x19_60201_lists_of_trusted_entities
+commit e84f427f0cde99513b574ef4b5a155ac4a38eab6
+
+Copyright 2025 ETSI
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.

waltid-libraries/credentials/waltid-trust-registry/build.gradle.kts

@@ -13,6 +13,7 @@ kotlin {
             implementation(identityLibs.kotlinx.serialization.json)
             implementation(identityLibs.kotlinx.datetime)
             implementation(identityLibs.kotlinx.coroutines.core)
+            implementation(identityLibs.optimumcode.jsonschemavalidator)
 
             // HTTP fetching (KMP Ktor client core)
             implementation(identityLibs.bundles.waltid.ktor.client)

waltid-libraries/credentials/waltid-trust-registry/src/commonMain/kotlin/id/walt/trust/model/TrustModel.kt

@@ -8,7 +8,20 @@ import kotlin.time.Instant
 // ---------------------------------------------------------------------------
 
 @Serializable
-enum class SourceFamily { TSL, LOTE, PILOT }
+enum class SourceFamily {
+    TSL,
+    LOTE
+}
+
+/** Concrete syntax and role of an ingested trust-list artifact. */
+@Serializable
+enum class TrustListFormat {
+    ETSI_TS_119_612_TRUST_LIST_XML,
+    ETSI_TS_119_612_LIST_OF_TRUST_LISTS_XML,
+    ETSI_TS_119_602_JSON,
+    ETSI_TS_119_602_XML,
+    UNKNOWN
+}
 
 // ---------------------------------------------------------------------------
 // Source assurance / freshness state
@@ -78,6 +91,7 @@ data class TrustSource(
     val sourceId: String,
     val sourceFamily: SourceFamily,
     val displayName: String,
+    val format: TrustListFormat = TrustListFormat.UNKNOWN,
     val sourceUrl: String? = null,
     val territory: String? = null,
     val issueDate: Instant? = null,
@@ -211,6 +225,7 @@ data class TrustSourceHealth(
     val sourceId: String,
     val displayName: String,
     val sourceFamily: SourceFamily,
+    val format: TrustListFormat = TrustListFormat.UNKNOWN,
     val freshnessState: FreshnessState,
     val assurance: SourceAssurance,
     val nextUpdate: Instant? = null,
@@ -229,6 +244,7 @@ data class RefreshResult(
     val entitiesLoaded: Int = 0,
     val servicesLoaded: Int = 0,
     val identitiesLoaded: Int = 0,
+    val pointersLoaded: Int = 0,
     val error: String? = null,
     val errorCode: SourceLoadErrorCode? = null,
     val assurance: SourceAssurance? = null