Signing Change Notices (draft)
Goal: Know what changed in signing in each release, so you can stay validated.
NOTE
Draft
OpenX ships often. Each release that changes signing gets a notice here. This page is a draft: its first notice describes the change being built now, not one that has shipped.
What each notice says
| Part | What it holds |
|---|---|
| Release | The OpenX release, and the @o-industrial/common version that carries the shared signing code |
| Date | When it reached production |
| What changed | Each signing change, in plain words |
| Does it change behaviour for a caller? | Yes or no, and for which callers |
| Look again at | The IQ or OQ steps and clauses it touches |
| Tests and test-plan rows | The tests added or changed, and the test-plan rows a tester walks |
Notice 1: Signing tied to the record (in progress)
Release: not shipped. Date: to be set when each step ships.
What changes
Each signature will rest on a login from your login system, made for that record and meaning, and used once. It rolls out in steps, so an app that signs today keeps working until it has moved.
| Step | What changes | Changes behaviour for a caller? | Look again at |
|---|---|---|---|
| Now | One same-person rule across sign-ins; the nonce function published; the calling app and an optional comment kept on each signature; every refused signing recorded; signature events over HTTP; the verify tool; this pack and the builder's guide as drafts | No | §11.10(e), §11.300(d); OQ-10, OQ-18 to OQ-20 |
| Wave 1 | OpenX accepts the tied proofs (Nonce, Challenge, Batch) beside today's path; the "may this person sign now?" check; each login signs once; the refusal table; the printed name and login evidence on every tied signature; the certificate; the reference signing kit for apps | No: a new path is added, the old one still works | §11.50, §11.70, §11.200; OQ-3 to OQ-9, OQ-17 |
| Wave 2 | Sample Management moves its signing onto the tied proofs | For Sample Management users: signing asks for a fresh login made for the record | Your Sample Management validation |
| Wave 3 | OpenX refuses a signature with no tied proof; refuses jobs, apps, AI calls and swapped tokens by name; refuses a token your app made | Yes: an app still on the old path is refused | §11.100(a), §11.200; OQ-21 |
| Final | This pack and the builder's guide in final form; a test path for builders | No | The whole pack |
Removed at wave 3
- The connected-app path that signs without its own login proof.
- Today's sign-in-again grant for signatures. The challenge stays, but only as the tie for one signature or one batch.
Tests and test-plan rows
Listed when each step ships. The planned tests are in the trace.
Next steps
- What to run again -> IQ and OQ outline
- How to move your app -> Sign records from your app