Hi all,

I realized you accept/verify any signed SHC on the interface, even those we create for demos and other non-production environments. Those should not be a "Trusted Party" or a valid certificate in the real world.

Do you have any plan to add and maintain a Trust Registry with only the keys that have been verified to issue Proof of Vaccinations that effectively happened?

You can use ours to start if you wish: https://github.com/Path-Check/trust-registry

We use it on our app and it's working great to filter production keys for all the trash that is out there.

Happy to help in any way I can.

Best,

Isolated issue to the call to the PNG library to that defines imageData.

PNG fails to read the image and throws error "unrecognised content at end of stream"

La validation ne fonctionne pas et retourne 404.
Est-ce que https://covid19.quebec.ca/PreuveVaccinaleApi/issuer/.well-known/jwks.json devrait exister?

Pour reproduire:

1. docker run -v $(pwd):/usr/node/app -w /usr/node/app -it --rm node shc.js 'vaccin-qr.png'
2. Le JSON avec le contenu du code QR est extrait et sauvegardé dans out.
3. Mais l'erreur est afficher au terminal et "trustable": false

Error: Request failed with status code 404
at createError (/usr/node/app/node_modules/axios/lib/core/createError.js:16:15)
at settle (/usr/node/app/node_modules/axios/lib/core/settle.js:17:12)
at IncomingMessage.handleStreamEnd (/usr/node/app/node_modules/axios/lib/adapters/http.js:260:11)
at IncomingMessage.emit (node:events:377:35)
at endReadableNT (node:internal/streams/readable:1312:12)
at processTicksAndRejections (node:internal/process/task_queues:83:21) {
config: {
url: 'https://covid19.quebec.ca/PreuveVaccinaleApi/issuer/.well-known/jwks.json',
method: 'get',
headers: {
Accept: 'application/json, text/plain, /',
'User-Agent': 'axios/0.21.1'
},
transformRequest: [ [Function: transformRequest] ],
transformResponse: [ [Function: transformResponse] ],
timeout: 0,
adapter: [Function: httpAdapter],
xsrfCookieName: 'XSRF-TOKEN',
xsrfHeaderName: 'X-XSRF-TOKEN',
maxContentLength: -1,
maxBodyLength: -1,
validateStatus: [Function: validateStatus],
data: undefined
...

Nice work/beau travail!

I am getting a "trustable": false when extracting data. I guess this part requires communication with covid19.quebec.ca ?

Tried with a QR that was produced on July 28.

out/ contents.

"payload": { "iss": "https://covid19.quebec.ca/PreuveVaccinaleApi/issuer"

"verifications": { "trustable": false }

curl -i https://covid19.quebec.ca/PreuveVaccinaleApi/issuer
HTTP/1.1 404 Not Found
Request-Context: appId=cid-v1:83d2d660-f9fc-4bf4-8f8d-c14090c51237
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Cache: CONFIG_NOCACHE
X-Azure-Ref: 0EO0CYQAAAAB7H9RvofX1TJ6Tt3IXqjSyWU1RMDFFREdFMDkxMgA5YTcwM2E4NS1mYTQ1LTQyNWYtYTE0NC00NDQ3ZTZhMDc0ZGY=
Date: Thu, 29 Jul 2021 18:01:51 GMT
Content-Length: 0

Hi, I'm getting this error when I run node shc.js 'sample.png', where sample.png is the QR Code sample included with the package. I tried using another qr code png but still get the same error. I'm new so I'm sure it's user error but I'd appreciate anyone's input/help.

Thanks!