billylo1/covidpass

Web app for adding Ontario vaccination records to Apple Wallet (forked from covidpass in EU)

Grassroots

This web-based tool allows you to add your Ontario Vaccination Receipt as a pass into your Apple Wallet on iOS in a privacy-respecting way. It achieves this without sending your data to a server and instead uses a hashed representation for the signing step.

Here is a demo

Quick start

• Go to https://grassroots.vaccine-ontario.ca
• Click Ontario Health to download your vaccination receipt onto your iPhone (local storage)
• Select File, Browse, your-vaccine-receipt.pdf
• Add to the wallet

Debug the web app

yarn install
yarn dev

Run the Docker container

docker build . -t covidpass -t gcr.io/broadcast2patients/covidpass
docker run --rm -t -i -p 3000:3000 covidpass

Integration with other repos required

setup.md has the details on how to bring the components together.

FAQ

I do not want to trust a third party with my vaccination data, does this tool respect my privacy?

Processing of your data happens entirely in your browser and only a hashed representation is sent to the server for the signing step. For more details of this, please see https://toronto.ctvnews.ca/video?clipId=2294461

How do I make sure that nobody can access my vaccination pass from the lock screen (iOS)?

Navigate to the "TouchID & Code" or "FaceID & Code" or just "Code" section in the Settings and switch the toggle to off for Wallet in the section "Allow access from the lock screen". Also see this official guide from Apple.

Using your own Apple Developer Certificate (if you would like to fork this project and run it yourself)

Get your certificate

• Sign into your Apple Developer Account

• Go to Certificates, Identifiers and Profiles

• Register a new Pass Type Identifier under the Identifiers tab

• Create a new Pass Type ID Certificate under the Certificates tab

• Select your previously created Pass Type Identifier in the process

• Move your new certificate to the My Certificates tab in the keychain

• Export your certificate as a .p12 file

• Install node.js and download the passkit-keys script

• Create a keys folder and put the .p12 file inside

• Run ./passkit-keys <path to your keys folder>

• You may have to type in the passphrase you defined during the export step

Run the API locally

A description of how you can use your certificate locally with the API will be provided in the readme of the CovidPass API. To connect the web app to your local server, you have to set the API_BASE_URL environment variable accordingly.

Explanation of the process

The whole process of generating the pass file happens locally in your browser. For the signing step, a hashed representation of your data is sent to the server.

First, the following steps happen locally in your browser:

• Validating the digital signature on the receipt from Ontario Health to ensure it's authentic
• Decoding your vaccination event data from the PDF file (e.g. date, type of vaccine, dose #, organization who administered it
• Assembling a pkpass file out of your data
• Sending the serial number and vaccination event data for verification when the QR code is scanned.
• Generating a file containing hashes of the data stored in the pass file
• Sending only the file containing the hashes to the server

Second, the following steps happen on the server:

• Receiving and checking the hashes which were generated locally
• Signing the file containing the hashes
• Sending the signature back

Finally, the following steps happen locally in your browser:

• Assembling the signed pass file out of the incomplete file generated locally and the signature
• Saving the file on your device

Logging

• Sentry.io is used. Please put your DSN into your environment variable SENTRY_DSN at runtime to activate it.

Credits

The idea for this web app originated from the solution of an Austrian web developer, which only works for Austrian certificates at the moment.

The main codebase is forked from covidpass and added Ontario specifcs.

Contribute

Contributions to this project is welcome. Feel free to leave your suggestions, issues or pull requests.

covidpass's Issues

Generating GPay passes does not work in dev

As the title states. I found https://github.com/billylo1/grassroots-gpay/blob/main/functions/start2.sh but it uses hardcoded paths and the such. Maybe the docs should be updated?

README build instruction error

Please see the attached stacktrace.
I followed the instruction by doing

yarn install
yarn dev

Both of the command ran without issue.
When I attempt to connect to http://localhost:3000/ the follow error occurred.

bash-mini: covidpass$ yarn install && yarn dev
yarn install v1.17.3
warning package-lock.json found. Your project contains lock files generated by tools other than Yarn. It is advised not to mix package managers in order to avoid resolution inconsistencies caused by unsynchronized lock files. To clear this warning, remove package-lock.json.
[1/4] 🔍  Resolving packages...
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
[4/4] 🔨  Building fresh packages...
success Saved lockfile.
✨  Done in 6.09s.
yarn run v1.17.3
$ next dev
ready - started server on 0.0.0.0:3000, url: http://localhost:3000
info  - Using webpack 5. Reason: Enabled by default https://nextjs.org/docs/messages/webpack5

warn - You have enabled the JIT engine which is currently in preview.
warn - Preview features are not covered by semver, may introduce breaking changes, and can change at any time.
event - compiled successfully
event - build page: /
wait  - compiling...
event - compiled successfully
sentry initialized
event - build page: /next/dist/pages/_error
wait  - compiling...
event - compiled successfully
sentry initialized
/Users/user/Code/covidpass/node_modules/pdfjs-dist/build/pdf.js:2164
    if (arguments[0]?.annotationStorage !== undefined) {
                     ^

SyntaxError: Unexpected token '.'
    at Module._compile (internal/modules/cjs/loader.js:891:18)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:991:10)
    at Module.load (internal/modules/cjs/loader.js:811:32)
    at Function.Module._load (internal/modules/cjs/loader.js:723:14)
    at Module.require (internal/modules/cjs/loader.js:848:19)
    at require (internal/modules/cjs/helpers.js:74:18)
    at Object.pdfjs-dist (/Users/user/Code/covidpass/.next/server/pages/index.js:579:18)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at eval (webpack-internal:///./src/process.ts:6:68)
    at Object../src/process.ts (/Users/user/Code/covidpass/.next/server/pages/index.js:382:1)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at eval (webpack-internal:///./components/Form.tsx:17:70)
    at Object../components/Form.tsx (/Users/user/Code/covidpass/.next/server/pages/index.js:85:1)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at eval (webpack-internal:///./pages/index.tsx:13:74)
    at Object../pages/index.tsx (/Users/user/Code/covidpass/.next/server/pages/index.js:316:1)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at __webpack_exec__ (/Users/user/Code/covidpass/.next/server/pages/index.js:643:52)
    at /Users/user/Code/covidpass/.next/server/pages/index.js:644:28
    at Object.<anonymous> (/Users/user/Code/covidpass/.next/server/pages/index.js:647:3)
    at Module._compile (internal/modules/cjs/loader.js:955:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:991:10)
    at Module.load (internal/modules/cjs/loader.js:811:32)
    at Function.Module._load (internal/modules/cjs/loader.js:723:14)
    at Module.require (internal/modules/cjs/loader.js:848:19)
    at require (internal/modules/cjs/helpers.js:74:18)
    at requirePage (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/require.js:1:1519)
    at loadComponents (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/load-components.js:1:1442)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:94:5)
    at async DevServer.findPageComponents (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:77:257)
    at async DevServer.renderToHTML (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:138:542)
    at async DevServer.renderToHTML (/Users/user/Code/covidpass/node_modules/next/dist/server/next-dev-server.js:36:578)
    at async DevServer.render (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:75:160)
    at async Object.fn (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:58:672)
    at async Router.execute (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/router.js:25:67)
    at async DevServer.run (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:68:1042)
    at async DevServer.handleRequest (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:32:504)
/Users/user/Code/covidpass/node_modules/pdfjs-dist/build/pdf.js:2164
    if (arguments[0]?.annotationStorage !== undefined) {
                     ^

SyntaxError: Unexpected token '.'
    at Module._compile (internal/modules/cjs/loader.js:891:18)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:991:10)
    at Module.load (internal/modules/cjs/loader.js:811:32)
    at Function.Module._load (internal/modules/cjs/loader.js:723:14)
    at Module.require (internal/modules/cjs/loader.js:848:19)
    at require (internal/modules/cjs/helpers.js:74:18)
    at Object.pdfjs-dist (/Users/user/Code/covidpass/.next/server/pages/index.js:579:18)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at eval (webpack-internal:///./src/process.ts:6:68)
    at Object../src/process.ts (/Users/user/Code/covidpass/.next/server/pages/index.js:382:1)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at eval (webpack-internal:///./components/Form.tsx:17:70)
    at Object../components/Form.tsx (/Users/user/Code/covidpass/.next/server/pages/index.js:85:1)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at eval (webpack-internal:///./pages/index.tsx:13:74)
    at Object../pages/index.tsx (/Users/user/Code/covidpass/.next/server/pages/index.js:316:1)
    at __webpack_require__ (/Users/user/Code/covidpass/.next/server/webpack-runtime.js:33:42)
    at __webpack_exec__ (/Users/user/Code/covidpass/.next/server/pages/index.js:643:52)
    at /Users/user/Code/covidpass/.next/server/pages/index.js:644:28
    at Object.<anonymous> (/Users/user/Code/covidpass/.next/server/pages/index.js:647:3)
    at Module._compile (internal/modules/cjs/loader.js:955:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:991:10)
    at Module.load (internal/modules/cjs/loader.js:811:32)
    at Function.Module._load (internal/modules/cjs/loader.js:723:14)
    at Module.require (internal/modules/cjs/loader.js:848:19)
    at require (internal/modules/cjs/helpers.js:74:18)
    at requirePage (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/require.js:1:1519)
    at loadComponents (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/load-components.js:1:1442)
    at async DevServer.findPageComponents (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:77:257)
    at async DevServer.renderToHTML (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:138:542)
    at async DevServer.renderToHTML (/Users/user/Code/covidpass/node_modules/next/dist/server/next-dev-server.js:36:578)
    at async DevServer.render (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:75:160)
    at async Object.fn (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:58:672)
    at async Router.execute (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/router.js:25:67)
    at async DevServer.run (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:68:1042)
    at async DevServer.handleRequest (/Users/user/Code/covidpass/node_modules/next/dist/next-server/server/next-server.js:32:504)

Text file version: stack.txt

Certificate validity is not checked

The vaccination receipt PDF downloaded from the Ministry of Health is signed with a certificate, but this certificate doesn't seem to be checked in the process. This means that anyone can create a certificate with the same organization name and common name, and sign a forged vaccination receipt which will be accepted. See

covidpass/src/process.ts

Lines 45 to 46 in b38540a

	const issuedByEntrust = (result.issuedBy.organizationName == 'Entrust, Inc.');
	const issuedToOntarioHealth = (result.issuedTo.commonName == 'covid19signer.ontariohealth.ca');

The initial attempt at using the library function to verify the PDF likely failed because the certificate used by the govt of Ontario does not have a chain of trust to a root CA (there is no chain at all). You can see this when you open up the PDF in Adobe Reader and it says the signature has issues. However, since each receipt is signed by the same certificate, you can still make sure that the proper certificate is used by checking for a specific certificate instead of just the common name and organization name.

There might be a method in node-forge you can use on this certificate.

Doesn’t detect 4th shot on page 2

QR code in apple wallet is too small on ios 14

I'm on ios 14 and i created the vaccine pass however the QR code is extremely small and trying to scan it with the verifier app doesn't work unless the qr code is bigger. Can you please make it a bit more bigger?

t.arrayBuffer is not a function

A few users reported this. Not sure how to reproduce the error yet. Need to log more info.

Adding the dosage number would be ideal

Adding the dosage number on the pass would be ideal.

500 Vaccine code - Unknown

Decoding my qr code gives me the 500 Vaccine code, which for me was

Product / Produit : Moderna Spikevax Bivalent BA.1 COVID-19

{
  "fullUrl": "resource:1",
  "resource": {
    "resourceType": "Immunization",
    "meta": {
      "security": [
        {
          "system": "https://smarthealth.cards/ial",
          "code": "IAL1.4"
        }
      ]
    },
    "status": "completed",
    "manufacturer": {
      "identifier": {
        "system": "http://hl7.org/fhir/sid/mvx",
        "value": "MOD"
      }
    },
    "vaccineCode": {
      "coding": [
        {
          "system": "http://hl7.org/fhir/sid/cvx",
          "code": "500"
        },
        {
          "system": "http://snomed.info/sct",
          "code": "snip"
        }
      ]
    },
    "occurrenceDateTime": "snip",
    "lotNumber": "016F22A",
    "patient": {
      "reference": "resource:0"
    },
    "performer": [
      {
        "actor": {
          "display": "snip"
        }
      }
    ]
  }
},

Link to directly add to Apple Health in iOS 15 (with official Apple Wallet support in 15.1 beta)

Just a suggestion, but if browsing using iOS 15, you can click this link to load a QR code directly into Apple Health:

Link

As you can see in the link URL, the magic part of the link is just the numeric part of the SHC code, without the "shc:/" at the front. Typing it directly into a browser won't work, it has to be clicked on as a link to popup correctly.

Note that unlike pkpass files, this does not require Safari and can work in Firefox or other browsers as well. And the QR code generated by Apple Health and within the Apple Wallet app is much larger and easier to scan than the current pkpass approach.

QR Code does not generate correct link (URL encoding error)

Organization I received vaccination from has spaces in the name (e.g. organization=Some Pharmacy) which breaks the URL generated by the QR Code. If I manually add the "%20" (e.g. organization=Some%20Pharmacy) the link works and validates the pass correctly. Tested several QR Scanners, all with the same result.

519 and 312 unknown code for Ontario vaccine certificate

Based on my own Ontario issued Covid vaccine certificate

519 is
Date : 26 SEP / SEPT 2022
Product / Produit : Moderna Spikevax Bivalent BA.1 COVID-19
Lot : 017F22A

312 is
Date : 23 OCT / OCT 2023
Product / Produit : Moderna Spikevax XBB.1.5 COVID-19
Lot : 020G23A

Province changed proof-of-vaccination receipt format; 2nd dose card gen broken

Overnight, the province pushed a change to their proof-of-vaccination system which now combines all of the dose receipts into a single PDF, whereas previously every dose receipt was a separate PDF. This has (unsurprisingly) broken our card generation, and right now only dose 1 cards are being detected and generated.

A fix for this is in progress.

QR Code with new ontario QR form is too small

Would it be possible to enlarge the new QR code displayed in the apple wallet?

The passbook button works on Firefox and Edge (Windows 10) but is disabled

After removing disabled=true from the submit button using dev tools, the pkpass file was still created and I was able to load it onto my phone successfully.

I would recommend not arbitrarily restricting browsers since these passes work on several apps for android as well, and not everyone uses or wants to use chrome. I was able to find this workaround and still get my pass on my android phone (no chrome installed), but if possible I would suggest the button not be disabled unless there is a functional reason not to enable it.

Restricted to Android 8

Official Google docs say this should be supported for Android 5+, why is the site restricted to 8.1?

https://support.google.com/googlepay/answer/10890261?hl=en#zippy=%2Ccant-add-your-covid-card

Native solution for iOS 15 users

Just wanted to throw this in here as well, I’m not sure if this is limited right now to only iOS 15 users as I don’t have another device not running beta, but simply long-pressing and choosing to open the QR card in Apple Health will store your immunization records, QR code and signature verifications in health.

Multi-language support?

Support for BC Vaccine Cards

Would be great if you could add support for BC vaccine cards through BC Health Gateway. They come as a PNG file with the vaccinated person's name and a QR.

More samples here:
https://www2.gov.bc.ca/gov/content/covid-19/vaccine/proof

A BC Vaccine Card verifier app is available at https://apps.apple.com/ca/app/bc-vaccine-card-verifier/id1583114791

Add to Wallet disabled

Add to Wallet seem to be disabled. BTW, am on iOS 15

Some people only have an email receipt (no OHIP, red/white cards, passport as ID, etc.)

Need to offer an option to handle these cases.

Call to /valid.html is not validated

A valid request to https://verifier.vaccine-ontario.ca/verify returns a 302 redirect to /valid.html and shows the green checkmark and Verified message.

As there is no validation on the GET request for /valid.html anyone could make a QR code that simply links to /valid.html

Would it be possible for the request to /verify to return the contents of what's already invalid.html or notfound.html rather than issuing a redirect?