superuser-digital-identity-wallet

Developer wallet for testing digital identity credential retrieval and presentation flows.

This project is intentionally a DEV wallet, not a production wallet. It is built to test holder-side protocol behavior (especially OID4VCI + OID4VP with SD-JWT VC), inspect credentials, and debug interoperability quickly.

What it does

• Receive credentials from OID4VCI credential offers.
• Store credentials locally in a simple JSON wallet store.
• Decode and inspect SD-JWT VC credentials (including disclosures and key binding details).
• Match credentials against OID4VP requests and submit presentations.
• Browse credential details in a curses terminal UI
  • switch panel with TAB, c copies current panel content, e opens the content in $VISUAL/$EDITOR

Quick start

python -m venv .env
source .env/bin/activate
pip install -e .
python src/superuser_digital_identity_wallet_cli.py --help

Wallet storage location:

• Default: ${XDG_CONFIG_HOME:-~/.config}/superuser-digital-identity-wallet/wallet.json
• Override: SUPERUSER_DIGITAL_IDENTITY_WALLET_STORE=/path/to/wallet.json

Wallet config file:

• Default: ${XDG_CONFIG_HOME:-~/.config}/superuser-digital-identity-wallet/config.json
• Override: SUPERUSER_DIGITAL_IDENTITY_WALLET_CONFIG_FILE=/path/config.json
• Example template: wallet.config.example.json

Config keys (JSON):

• store: wallet store path
• log.x5c: enable x5c trace logs (true/false)
• trust.pins: local root pin PEM paths (array or comma-separated string)
• trust.tsl_url / trust.tsl_file: ETSI TSL source
• trust.tsl_signer_pins: pinned TSL signer PEM paths
• trust.allow_system_store: allow optional system trust store fallback

Trust configuration via env vars (these override config file):

• Local pinned roots: SUPERUSER_DIGITAL_IDENTITY_WALLET_TRUSTED_ROOT_CA_FILE=/path/root-a.pem,/path/root-b.pem
• Signed trust list (ETSI XML TSL):
  • SUPERUSER_DIGITAL_IDENTITY_WALLET_TRUST_LIST_TSL_URL=https://tl.bundesnetzagentur.de/TL-DE.xml or SUPERUSER_DIGITAL_IDENTITY_WALLET_TRUST_LIST_TSL_FILE=/path/TL-DE.xml
  • SUPERUSER_DIGITAL_IDENTITY_WALLET_TRUST_LIST_SIGNER_CERT_FILE=/path/tsl-signer-pin.pem (comma-separated PEM files supported)
• Optional fallback: SUPERUSER_DIGITAL_IDENTITY_WALLET_ALLOW_SYSTEM_TRUST_STORE=1

Dev note

Private keys are stored with credentials for local testing convenience. Treat the wallet store as sensitive test data.