[EgorKhaklin]

Enrol projects/polaris-id

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To sign the CLA, post a comment on this pull request that contains only this line: I have read the CLA Document and I hereby sign the CLA

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

I built this Dockerfile with docker build at polaris-id 5c3bc9f4, with .dockerignore removed as tools/check does, and ran the tests in the image with the network off.

Context: this answers the question on #1196, how widely Polaris is used; GitHub does not let me re-open that pull request.

Polaris is an open-source identity token system: an authority issues a credential signed with ML-DSA-65, the person holds it, and anyone can check it offline against published keys. Its verifier, polaris-oid4vp, checks untrusted input from the network: the presentations wallets send, with their signatures, selective disclosures and X.509 certificate chains. It is built for the digital identity credentials every EU member state must offer its citizens in a wallet by December 2026.

The field is narrow, and within it Polaris is used and listed:

• IDFoundry/OID4VCgo tests against Polaris's verifier every day and on each release, and runs Polaris's SD-JWT VC and mso_mdoc test corpora in its CI, pinned by hash.
• web-token/jwt-framework and vouchkit run Polaris's negative test vectors in their test suites.
• The FIDES community lists polaris-oid4vp in its relying-party catalog and Khaklin Technologies in its organization directory.
• Germany's EUDI Wallet sandbox accepted Polaris's use case, a verifier that asks for the PID with minimal disclosure (such as "18 or over" only); onboarding starts with a kick-off call this month.
• Version 1.0.0rc7 of polaris-oid4vp is OpenID Certified™ by Egor Khaklin to the OpenID4VP 1.0 + HAIP 1.0 Verifier profile: a self-certification, not an endorsement or an independent verification. On 28 September, Biometric Update named me among those certified, for the Verifier role.
• Hardening Polaris found a vulnerability in liboqs-python, fixed by Open Quantum Safe in 0.16.0.2 (GHSA-w696-4vrr-x6x3).

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/polaris-id

Repository: EgorKhaklin/polaris-id at main · opened by EgorKhaklin

	Check	Result
⚠️	Repository	under 6 months old (created 5 months ago, last push today)
⚠️	Stars / forks	no forks and no watchers: little sign that others use it (5 stars · 0 forks · 0 watching)
⚠️	Outside participants	none: the last 57 issues and pull requests were all opened by the project's own people or by bots
⚠️	Criticality score	0.39 on the OpenSSF scale of 0 to 1: low, and the project has under 100 stars signals created_since 5, updated_since 0, contributor_count 5, org_count 1, commit_frequency 58.3, recent_releases_count 15, closed_issues_count 494, updated_issues_count 494, comment_frequency 0.5, dependents_count 7
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm or the top 1,000 on crates.io
✅	License	Apache-2.0
✅	Opened by an active maintainer	owns the repository; 100+ commits in the last 12 months; #2 contributor
✅	Contact in SECURITY.md	PolarisID@protonmail.com is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
ℹ️	.oss-scanner/ in the repository	not present; the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
⚠️	Checklist	2 of 8 not ticked: I confirm that I believe my project meets the inclusion criteria and is an estab…; 'tools/check <name>' builds the project, and its tests run in the shell that fol…

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}