Some status errors are not being reported.

[ottonomy]

We got an obscure status error due to clock skew. This was reported as statusResult.error.cause.message: The current date time (2025-11-25T22:59:26.684Z) is before \"validFrom\" (2025-11-25T22:59:26.753Z).

However due to this restriction, it got skipped from the reported results, so the credential appeared valid except for not being in an issuer registry. It was actually revoked, but there should be a status error reported for some other cases.

https://github.com/digitalcredentials/verifier-core/blob/main/src/Verify.ts#L179

if (statusResult?.error?.cause?.message?.startsWith(NOT_FOUND_ERROR)) {

[jchartrand]

Thanks @ottonomy

So I should be able to re-create this error using a VC whose credentialStatus.statusListCredential property points at a status list whose VC has a validFrom date in the future?

Okay, I think I now understand what you are saying - that 'if' statement that you pointed at needs an 'else' that returns a statusStep containing any other error - correct?

[ottonomy]

Yes, you should be able to reproduce this in unit tests.

Another error message that is real and valid "Status list credential type must include \"BitstringStatusListCredential\"."

What I'm saying is that there are a whole bunch of different errors that can come out of the "checkStatus" function in the verification result, and the verifier-core response normalization is blowing away almost all of them, producing false negatives for many different reasons. Basically any time the statusResult has a "verified": false", there is an error message that is useful information. Like the below, basically that the verifier didn't understand the status list used. Or the previous message related to a bit of clock skew.

{
  verified: false,
  error: {
    message: "Status list credential type must include \"BitstringStatusListCredential\"."
  },
}

(Aside on the clock skew issue, digital bazaar has done some work in @digitalbazaar/vc to enable you to pass in some allowable amount of skew, or a fake "now time" that you would test against so that you can customize the clock skew allowable for instance. In the implementation that produced the original error in this thread, we adjusted it to produce a validFrom time one minute in the past from the time when the credential is requested)

[jchartrand]

Yes, handling that single status error, and ignoring the rest, is definitely an oversight/bug - thank you for pointing it out.

…

On Nov 26, 2025, at 12:26 PM, Nate Otto ***@***.***> wrote: ottonomy left a comment (digitalcredentials/verifier-core#23) <#23 (comment)> Yes, you should be able to reproduce this in unit tests. Another error message that is real and valid "Status list credential type must include \"BitstringStatusListCredential\"." What I'm saying is that there are a whole bunch of different errors that can come out of the "checkStatus" function in the verification result, and the verifier-core response normalization is blowing away almost all of them, producing false negatives for many different reasons. Basically any time the statusResult has a "verified": false", there is an error message that is useful information. Like the below, basically that the verifier didn't understand the status list used. Or the previous message related to a bit of clock skew. { verified: false, error: { message: "Status list credential type must include \"BitstringStatusListCredential\"." }, } (Aside on the clock skew issue, digital bazaar has done some work in @digitalbazaar/vc to enable you to pass in some allowable amount of skew, or a fake "now time" that you would test against so that you can customize the clock skew allowable for instance. In the implementation that produced the original error in this thread, we adjusted it to produce a validFrom time one minute in the past from the time when the credential is requested) — Reply to this email directly, view it on GitHub <#23 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEFSXJR6UEHZTMXBWHK6L336XPEJAVCNFSM6AAAAACNGJPZXCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKOBSGQZTCMBRHA>. You are receiving this because you commented.