{"action":"created","issue":{"url":"https://api.github.com/repos/adlnet/xAPI-Spec/issues/634","labels_url":"https://api.github.com/repos/adlnet/xAPI-Spec/issues/634/labels{/name}","comments_url":"https://api.github.com/repos/adlnet/xAPI-Spec/issues/634/comments","events_url":"https://api.github.com/repos/adlnet/xAPI-Spec/issues/634/events","html_url":"https://github.com/adlnet/xAPI-Spec/issues/634","id":58764525,"number":634,"title":"Are attachments included in signatures? Does order matter?","user":{"login":"garemoko","id":1363163,"avatar_url":"https://avatars.githubusercontent.com/u/1363163?v=3","gravatar_id":"","url":"https://api.github.com/users/garemoko","html_url":"https://github.com/garemoko","followers_url":"https://api.github.com/users/garemoko/followers","following_url":"https://api.github.com/users/garemoko/following{/other_user}","gists_url":"https://api.github.com/users/garemoko/gists{/gist_id}","starred_url":"https://api.github.com/users/garemoko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garemoko/subscriptions","organizations_url":"https://api.github.com/users/garemoko/orgs","repos_url":"https://api.github.com/users/garemoko/repos","events_url":"https://api.github.com/users/garemoko/events{/privacy}","received_events_url":"https://api.github.com/users/garemoko/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-24T16:36:30Z","updated_at":"2015-02-24T19:38:07Z","closed_at":null,"body":"The spec says: ``` The JWS signature MUST have a payload of a valid JSON serialization of the Statement generated before the signature was added. ```\r\n\r\nDoes this logically imply that the signature MUST be the last attachment to be added, and indeed the last property of the statement to be populated by the AP? (So signing the statement and then adding some more context is not allowed). \r\n\r\nI think it does and that we should make this explicit. "},"comment":{"url":"https://api.github.com/repos/adlnet/xAPI-Spec/issues/comments/75829329","html_url":"https://github.com/adlnet/xAPI-Spec/issues/634#issuecomment-75829329","issue_url":"https://api.github.com/repos/adlnet/xAPI-Spec/issues/634","id":75829329,"user":{"login":"garemoko","id":1363163,"avatar_url":"https://avatars.githubusercontent.com/u/1363163?v=3","gravatar_id":"","url":"https://api.github.com/users/garemoko","html_url":"https://github.com/garemoko","followers_url":"https://api.github.com/users/garemoko/followers","following_url":"https://api.github.com/users/garemoko/following{/other_user}","gists_url":"https://api.github.com/users/garemoko/gists{/gist_id}","starred_url":"https://api.github.com/users/garemoko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garemoko/subscriptions","organizations_url":"https://api.github.com/users/garemoko/orgs","repos_url":"https://api.github.com/users/garemoko/repos","events_url":"https://api.github.com/users/garemoko/events{/privacy}","received_events_url":"https://api.github.com/users/garemoko/received_events","type":"User","site_admin":false},"created_at":"2015-02-24T19:38:07Z","updated_at":"2015-02-24T19:38:07Z","body":"\"the statement in the signature must be equivalent to the statement outside the signature minus the signature\" - obviously this must be true and what the requirement I quoted is trying to say, but it'd be nice to explicitly state this. This is what I was getting at in my issue, but ironically failed to explicitly say!"}}