Cardano Updates

Disable doctest to unblock `master`

feat: add EDR-021: code annotations (NOTE, TODO and FIXME)

The SDK sent MediationKeysUpdateList to the mediator but did not process
the response, so per-recipient failures reported by the mediator went
unnoticed.

Register a handler for the keylist-update-response protocol message.
Each entry in body.updated is inspected; results other than success or
no_change are logged as warnings with the recipient DID and action.
Confirmed against the Identus mediator (MediatorCoordinationExecuter.scala)
which returns this response with tuples of (recipient_did, action, result).

Closes #391

Signed-off-by: Seydi Charyyev <[email protected]>

JWT.verify did not validate the nbf (not before) claim, so JWTs with nbf in the future were incorrectly considered valid. This is a security issue per RFC 7519 Section 4.1.5.

Added an explicit nbf check after JWT decode: if nbf is present and the current time is before it, verify() returns false. JWTs without an nbf claim keep the previous behavior (no nbf enforced).

This is a sister fix to #489/#550 (which addressed the exp claim).

Closes #551

Signed-off-by: Seydi Charyyev <[email protected]>

This is consistent with the naiive N^2 diffusion of votes early sketch
that is implemented.

This is now possible because of de-duplication of the vote notification mechanism

JWT.verify did not validate the exp (expiration) claim, so expired JWTs were incorrectly considered valid. This is a security issue per RFC 7519 Section 4.1.4.

Added an explicit exp check after JWT decode: if exp is present and the current time is at or past it, verify() returns false. JWTs without an exp claim keep the previous behavior (no expiration enforced).

Closes #489

Signed-off-by: Seydi Charyyev <[email protected]>

Remove Buffer setup code for testing environment.

Signed-off-by: Abhayraj Jaiswal <[email protected]>

This results in votes being forwarded already. However, this is
obviously not safe to do this way in adversarial settings.

This is obviously a dirty hack, but works to drive the development right
now and side-steps key registration, while already exploring how to pass
the voting key into the right consensus components.

Pure additions for consumers that need to look up packages by
plan-id rather than canonical name.

* `package.identifier.unit-id` (modules/package.nix): a new
  optional field carrying plan.json's per-entry `id` (defaults to
  null when not derived from a plan entry).
* `modules/install-plan/planned.nix`: when constructing the
  per-plan-id package entries, populate `package.identifier`
  with `name` / `version` / `unit-id`.  Without this,
  reading `package.identifier.{name,version}` on a plan-id-keyed
  entry threw — the canonical-name-keyed entry already gets a
  real identifier via `load-cabal-plan.nix`, but the per-plan-id
  ones (used when one canonical name has multiple plan instances)
  did not.
* `package-ids-by-name` (modules/plan.nix +
  install-plan/override-package-by-name.nix): a name → [id]
  index over `plan-json.install-plan`.  A canonical pkg-name can
  appear under several plan ids (per-instance UnitIDs that differ
  only in their dep UnitIDs, or a multi-component package split
  across per-component entries); consumers can now iterate the
  ids unambiguously instead of name-matching against
  `config.packages`.