Migrating from 6.x to 7.0

This guide covers breaking changes introduced in EUDIPLO v7.0 and the required migration steps from any 6.x version.

Back up before upgrading

Always back up your database and your assets/config directory before performing a major version upgrade.

Summary of Breaking Changes

Area	Change	Impact
Trust-list verification material	walletProviderTrustLists no longer accepts string URLs. Each entry must define verifier material (verifierKey or verifierX509Der).	High
Trust-list JWT integrity	Unsigned trust-list JWT acceptance is removed. If verifier material is missing, trust-list validation now fails instead of falling back to TOFU behavior.	High
DCQL trusted authorities	In dcql_query.credentials[].trusted_authorities, etsi_tl.values is now object-based (url + verifier material) or managed (trustListId) instead of plain URL strings.	High
Presentation config webhooks	Presentation configs no longer accept the deprecated webhook JSON payload. Use webhookEndpointId and the webhook endpoint relationship instead.	Medium

---

1. walletProviderTrustLists Format Is Strict in v7

What Changed

In v6.x, this was accepted:

• walletProviderTrustLists: ["https://trust.example/wallet-providers.jwt"]

In v7, this is rejected.

Each entry must be an object with:

• url (required)
• one verifier method (required):
  • verifierKey (JWK), or
  • verifierX509Der (base64 DER-encoded X.509 certificate)

Before (6.x)

{
    "walletProviderTrustLists": ["https://trust.example/wallet-providers.jwt"]
}

After (7.0)

{
    "walletProviderTrustLists": [
        {
            "url": "https://trust.example/wallet-providers.jwt",
            "verifierKey": {
                "kty": "EC",
                "crv": "P-256",
                "x": "...",
                "y": "...",
                "alg": "ES256"
            }
        }
    ]
}

Alternative using certificate verifier material:

{
    "walletProviderTrustLists": [
        {
            "url": "https://trust.example/wallet-providers.jwt",
            "verifierX509Der": "MIIB..."
        }
    ]
}

---

2. Trust-list JWT Integrity Is Now Enforced

What Changed

v6.x allowed trust-list JWT retrieval without signature verification if no verifier material was configured.

v7 removes that behavior for walletProviderTrustLists entries:

• missing verifier material is a configuration error
• trust-list JWT validation fails closed for that entry

Migration Steps

1. Inventory all issuance configs containing walletProviderTrustLists.
2. Replace string entries with object entries.
3. Add verifier material (verifierKey or verifierX509Der) for every entry.
4. Re-test:
   • wallet attestation flows (walletAttestationRequired)
   • OID4VCI attestation proof flows using wallet-provider trust lists

---

3. DCQL trusted_authorities Format Changed

What Changed

For presentation configs, dcql_query.credentials[].trusted_authorities changed for ETSI trust lists:

• v6.x accepted etsi_tl.values as an array of URL strings
• v7 requires etsi_tl.values to be an array of objects

Each ETSI value object must be one of:

• external trust list reference:
  • url (required)
  • plus verifierKey or verifierX509Der (required)
• managed local trust list pointer:
  • trustListId (required)
  • verifier material is resolved server-side from the trust-list key chain

openid_federation.values remains an array of string entity IDs.

Before (6.x)

{
    "dcql_query": {
        "credentials": [
            {
                "id": "pid",
                "format": "mso_mdoc",
                "trusted_authorities": [
                    {
                        "type": "etsi_tl",
                        "values": ["https://example.com/trust-list/pid-provider.jwt"]
                    }
                ]
            }
        ]
    }
}

After (7.0) - External Trust List

{
    "dcql_query": {
        "credentials": [
            {
                "id": "pid",
                "format": "mso_mdoc",
                "trusted_authorities": [
                    {
                        "type": "etsi_tl",
                        "values": [
                            {
                                "url": "https://example.com/trust-list/pid-provider.jwt",
                                "verifierX509Der": "MIIB..."
                            }
                        ]
                    }
                ]
            }
        ]
    }
}

After (7.0) - Managed Local Trust List

{
    "dcql_query": {
        "credentials": [
            {
                "id": "pid",
                "format": "mso_mdoc",
                "trusted_authorities": [
                    {
                        "type": "etsi_tl",
                        "values": [
                            {
                                "trustListId": "local-pid-trust-list"
                            }
                        ]
                    }
                ]
            }
        ]
    }
}

Migration Steps

1. Find all presentation configs that set dcql_query.credentials[].trusted_authorities with type: "etsi_tl".
2. Replace string URL entries in values with object entries.
3. For external URLs, add verifier material (verifierKey or verifierX509Der).
4. Optionally replace external URLs with managed pointers (trustListId) when using EUDIPLO-managed trust lists.
5. Re-test OID4VP and ISO 18013-7 presentation verification flows.

---

4. Presentation Configs Now Use webhookEndpointId Only

What Changed

In v6.x, presentation configs could still carry a deprecated webhook JSON payload.

In v7, that payload is removed. Presentation configs must reference a reusable webhook endpoint by webhookEndpointId instead.

Migration Steps

1. Find any saved presentation configs that still contain a webhook JSON payload.
2. Create or reuse a webhook endpoint under the tenant.
3. Set webhookEndpointId on the presentation config and remove the old webhook payload.
4. Re-test presentation request generation and notification delivery.