Upgrade Internet Identity Backend Canister to 8d3e876b0

Backend Canister Upgrade

A passkey or recovery phrase that already belongs to one identity can no longer be used to register another identity, including through the legacy registration method. Users who sign in with Apple can now share their verified email with apps, except Apple’s private relay addresses, which apps can’t send mail to.

What's Changed

_Since proposal-backend-144354_

• fix(be): enforce cross-anchor device uniqueness in legacy register (#4459)
• feat(be,fe): verified emails from Apple, except private relay addresses (#4427)

Full release notes

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull  # to ensure you have the latest changes.
git checkout 8d3e876b074a5a93e167cb09a550a3c20f4c3ed8
./scripts/verify-hash --ii-hash b09b4ddac9db91b78a931edf340db93621ee4634e1b96645dc2f1c3f41610d6a

Backend Argument Verification

Run the following command to verify the backend upgrade argument hash:

didc encode -d ./src/internet_identity/internet_identity.did -t '(opt InternetIdentityInit)' '(opt record {
openid_configs = opt vec {
    record {
        auth_uri = "https://accounts.google.com/o/oauth2/v2/auth";
        jwks_uri = "https://www.googleapis.com/oauth2/v3/certs";
        logo = "<svg viewBox=\"0 0 24 24\"><clipPath id=\"__google-logo-path\"><path d=\"M12 10v4.5h6.47c-.5 2.7-3 4.74-6.47 4.74-3.9 0-7.1-3.3-7.1-7.25S8.1 4.75 12 4.75c1.8 0 3.35.6 4.6 1.8l3.4-3.4C18 1.2 15.24 0 12 0 5.4 0 0 5.4 0 12s5.4 12 12 12c7 0 11.5-4.9 11.5-11.7 0-.8-.1-1.54-.2-2.3H12z\"></path></clipPath><g style=\"clip-path:url(#__google-logo-path); transform: scale(0.75); transform-origin: center center;\"><foreignObject height=\"28\" transform=\"translate(-2,-2)\" width=\"28\"><div style=\"width:100%;height:100%;background:conic-gradient(#FF4641,#FD5061 40deg,#FD5061 60deg,#3186FF 85deg,#3186FF 117deg,#00A5B7 142deg,#0EBC5F 167deg,#0EBC5F 200deg,#6CC500 226deg,#FFCC00 253deg,#FFD314 268deg,#FFCC00 292deg,#FF4641 327deg)\"></div></foreignObject><rect fill=\"#3186FF\" height=\"8\" width=\"16\" x=\"11\" y=\"8\"></rect></g></svg>";
        name = "Google";
        fedcm_uri = opt "";
        email_verification = opt variant { Google };
        issuer = "https://accounts.google.com";
        auth_scope = vec { "openid"; "profile"; "email" };
        client_id = "775077467414-rgoesk3egruq26c61s6ta8bpjetjqvgo.apps.googleusercontent.com";
    };
    record {
        auth_uri = "https://appleid.apple.com/auth/authorize";
        jwks_uri = "https://appleid.apple.com/auth/keys";
        logo = "<svg viewBox=\"0 0 24 24\"><path d=\"M14.8 3.2c1-1.2 1.2-2.7 1-3.2-1 0-2.2.7-2.9 1.5-.9 1.2-1.1 2.6-.9 3 .6.2 2-.3 2.8-1.3ZM9.2 20c1.2 0 1.6-.8 3.2-.8 1.5 0 1.8.8 3.1.8s2.3-1.2 3-2.5c1-1.4 1.3-2.8 1.4-2.8 0 0-2.6-1.2-2.6-4.1 0-2.5 2-3.7 2.1-3.8a4.5 4.5 0 0 0-3.9-2c-1.4 0-2.6.8-3.4.8-.8 0-1.9-.8-3.2-.8-2.3 0-4.8 2-4.8 6 0 2.3 1 4.8 2 6.5 1 1.5 1.9 2.7 3 2.7Z\" style=\"fill: currentColor;\"></path></svg>";
        name = "Apple";
        fedcm_uri = opt "";
        email_verification = opt variant { Apple };
        issuer = "https://appleid.apple.com";
        auth_scope = vec { "openid"; "email"; "name" };
        client_id = "ai.id.auth";
    };
    record {
        auth_uri = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
        jwks_uri = "https://login.microsoftonline.com/common/discovery/v2.0/keys";
        logo = "<svg viewBox=\"0 0 24 24\"><path fill=\"#f25124\" d=\"M2.5 2.5h9v9h-9z\"/><path fill=\"#7eba02\" d=\"M12.5 2.5h9v9h-9z\"/><path fill=\"#01a3ee\" d=\"M2.5 12.5h9v9h-9z\"/><path fill=\"#feba01\" d=\"M12.5 12.5h9v9h-9z\"/></svg>";
        name = "Microsoft";
        fedcm_uri = opt "";
        email_verification = opt variant { Microsoft };
        issuer = "https://login.microsoftonline.com/{tid}/v2.0";
        auth_scope = vec { "openid"; "profile"; "email" };
        client_id = "80d5203e-9ba2-4acf-97a1-88d926a0bbbf";
    };
};
})' | xxd -r -p | sha256sum

The output should match the argument hash.