WIP did-plc controller by MichaelMure · Pull Request #47 · MetaMask/go-did-it

MichaelMure · 2026-06-26T13:33:49Z

Note

High Risk
New code paths create and mutate DIDs via rotation-key signing and replay chain rules; mistakes or gaps in validation could allow trusting a hostile registry or signing unauthorized state.

Overview
Adds didplcctl (controller/did-plc), a full did:plc controller on top of the existing verifier: Registry talks to plc.directory (or a custom URL), Create registers genesis operations, and Controller supports Head, Update, Recover, Tombstone, and Audit.

Operations are built through a codec that validates write-time limits, encodes DAG-CBOR (via new internal/dagcbor), signs with low-S ECDSA, and parses plc_operation, plc_tombstone, and legacy create genesis ops. chain.validate replays the audit log to enforce genesis DID binding, prev/signature authority, recovery ranking, the 72h window, and agreement with registry nullified flags; optional WithFullChainVerification uses that replay for Head instead of trusting /log/last.

Coverage includes a fake registry, golden logs from the live directory, and upstream interop audit vectors. Readme marks did:plc as controller-supported; did-key helpers now return didkey.DidKey with doc comments only.

^{Reviewed by Cursor Bugbot for commit b5cb3d0. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-06-26T13:34:06Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/multiformats/go-multicodec@v0.10.0
	github.com/multiformats/go-multibase@v0.2.0 ⏵ v0.3.0	⁺¹
	github.com/mr-tron/base58@v1.1.0 ⏵ v1.3.0	⁺¹
	github.com/multiformats/go-multihash@v0.2.3
	github.com/ipfs/go-cid@v0.6.1
	github.com/multiformats/go-varint@v0.0.7 ⏵ v0.1.0

View full report

socket-security · 2026-06-26T13:34:08Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Network access: golang `github.com/klauspost/cpuid/v2` Location: Package overview From: `?` → `golang/github.com/multiformats/go-multihash@v0.2.3` → `golang/github.com/klauspost/cpuid/v2@v2.0.9` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/klauspost/cpuid/v2@v2.0.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e9ae33f. Configure here.}

The base branch was changed.

Copilot

Pull request overview

Adds full did:plc controller support, including signed operations, registry access, recovery, and chain verification.

Changes:

Implements create, update, recovery, tombstone, head, and audit workflows.
Adds DAG-CBOR encoding, CID derivation, key policies, and legacy operation support.
Adds live fixtures, hostile-history tests, documentation, and concrete did:key return types.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`Readme.md`	Marks `did:plc` controller support.
`go.mod`	Adds CID and multiformat dependencies.
`go.sum`	Records dependency checksums.
`controller/did-key/key.go`	Returns concrete `DidKey` values.
`verifiers/did-key/key.go`	Exposes concrete `DidKey` constructors.
`controller/did-plc/controller.go`	Implements controller operations.
`controller/did-plc/registry.go`	Implements registry HTTP access.
`controller/did-plc/options.go`	Adds registry configuration options.
`controller/did-plc/state.go`	Defines and validates document state.
`controller/did-plc/spec.go`	Defines protocol constants and DID derivation.
`controller/did-plc/operation.go`	Implements operation signing and verification.
`controller/did-plc/key.go`	Handles rotation keys and signer authorization.
`controller/did-plc/codec.go`	Encodes and parses current operations.
`controller/did-plc/codec_legacy.go`	Normalizes legacy genesis operations.
`controller/did-plc/chain.go`	Replays and validates operation histories.
`controller/did-plc/errors.go`	Defines controller sentinel errors.
`controller/did-plc/doc.go`	Documents architecture and protocol behavior.
`controller/did-plc/example_test.go`	Demonstrates controller workflows.
`controller/did-plc/fake_test.go`	Provides a rule-enforcing fake registry.
`controller/did-plc/roundtrip_test.go`	Tests registry and controller workflows.
`controller/did-plc/chain_test.go`	Tests valid and hostile histories.
`controller/did-plc/internal/dagcbor/dagcbor.go`	Implements DAG-CBOR and CID utilities.
`controller/did-plc/internal/dagcbor/dagcbor_test.go`	Tests encoding and CID validation.
`controller/did-plc/testdata/README.md`	Documents captured fixtures.
`controller/did-plc/testdata/audit_atproto.json`	Adds current-format audit fixture.
`controller/did-plc/testdata/audit_legacy.json`	Adds legacy audit fixture.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+	rawSig, err := base64.RawURLEncoding.DecodeString(sig)
+	if err != nil {
+		return -1, fmt.Errorf("%w: decoding signature: %w", ErrInvalidChain, err)
+	}


+// The timestamps this relies on are the registry's own and are not signed, so the window
+// and ordering checks hold the registry to its account of events rather than proving
+// anything on their own.
+func (c chain) validate(didStr string) error {


+	nullified := make(map[string]bool, len(c))
+
+	for i := range c {
+		e := &c[i]


+	rotKeys, err := c.rotationKeysFromWire(raw.RotationKeys)
+	if err != nil {
+		return nil, err
+	}
+	vms, err := c.verificationMethodsFromWire(raw.VerificationMethods)


+func appendString(buf []byte, s string) []byte {
+	buf = appendHead(buf, majorString, uint64(len(s)))
+	return append(buf, s...)
+}


+	assert.Equal(t, "AtprotoPersonalDataServer", entries[0].State.Services["atproto_pds"].Type)
+}
+
+// Every key handed out in an State must be one the same package would accept back, so that


cursor Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread controller/did-plc/audit.go Outdated

Comment thread controller/did-plc/controller.go Outdated

dovydas55 previously approved these changes Jun 26, 2026

View reviewed changes

MichaelMure force-pushed the plc-controller branch from 82270b1 to e9ae33f Compare June 29, 2026 12:44

cursor Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread controller/did-plc/controller.go

MichaelMure force-pushed the crypto-selection branch 5 times, most recently from 478ec68 to d41b7e8 Compare August 27, 2026 21:43

Base automatically changed from crypto-selection to master August 31, 2026 10:22

MichaelMure and others added 4 commits August 31, 2026 12:23

WIP did-plc controller

6681d2d

WIP

3639ca7

wip

b20f87c

wip

29c0603

MichaelMure force-pushed the plc-controller branch from e9ae33f to 29c0603 Compare August 31, 2026 10:23

MichaelMure requested a balanced review from Copilot August 31, 2026 10:25

Copilot started reviewing on behalf of MichaelMure August 31, 2026 10:25 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

wip

b5cb3d0

Navigation Menu

Uh oh!

WIP did-plc controller - #47

WIP did-plc controller#47
MichaelMure wants to merge 5 commits into
masterfrom
plc-controller

MichaelMure commented Jun 26, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Jun 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

MichaelMure commented Jun 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MichaelMure commented Jun 26, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Jun 26, 2026 •

edited

Loading

socket-security Bot commented Jun 26, 2026 •

edited

Loading