From 629bbc155bd42a72a4a1ff0f7540efa8a37cd6fd Mon Sep 17 00:00:00 2001
From: Benjamin Dauvergne <bdauvergne@entrouvert.com>
Date: Tue, 7 Jun 2022 17:20:13 +0200
Subject: [PATCH] qrcode_certificate: prototype

---
 qrcode-certificate/v0/certificate.png         | Bin 0 -> 1829 bytes
 .../v0/check_qrcode_certificate.py            |  24 +++++
 .../v0/make_qrcode_certificate.py             |  49 ++++++++++
 .../v0/qrcode-reader/index.html               |  89 ++++++++++++++++++
 4 files changed, 162 insertions(+)
 create mode 100644 qrcode-certificate/v0/certificate.png
 create mode 100644 qrcode-certificate/v0/check_qrcode_certificate.py
 create mode 100644 qrcode-certificate/v0/make_qrcode_certificate.py
 create mode 100644 qrcode-certificate/v0/qrcode-reader/index.html

diff --git a/qrcode-certificate/v0/certificate.png b/qrcode-certificate/v0/certificate.png
new file mode 100644
index 0000000000000000000000000000000000000000..518072065bec61ccf8ce430711821dc56745b9bc
GIT binary patch
literal 1829
zcmV+=2io|FP)<h;3K|Lk000e1NJLTq00N2t00N2u00000k`G5A000K;Nkl<Zc%1E>
zQEKEm5Jhi28}cc`EFep<cQ8u|S<>4<dnvtu0sFJTrrw82rBYAeF(l1&(Dg^sPOA@Y
z$fcyKs*)(a_*(z@Y9c@+kwg+nB#}fCNhFa(68TxA*fj#Hh{&>!0Co|(#VJ^2ge(9=
zrc>$#?B(V1*rz0t$frcks;asH^0onbNe4tG07$A>Wdx9JqVF<7F90xagX$$605GVk
zs<y}nJSCAtJ{1!A|9;+Jg2-2vhAK=N2UIs8i^;|vSx2hdkjG^WUcSc{Cz8l7N6NB`
z$dV3VzK&4Un}|$94lJry5v;EVay**#_$yCIB$3aE)c03aeHRg|uQw5q7sY&)BBA6H
zGz==sUwTR+iF^j+Xup#J*a4ZZ0?b(=gUWn41;B6s`y`nEouJqSn72uQ{f7mm$37*I
zL_RTc6%n%uFetE(khkjyV1LQVkOj89sjtc#XK~*i{FFoz`Bcapdur%V;3kUw6kT6$
zg7C&}?_!-$-be>5ZawrVi6rtFkqBOMHr`aT6RnqQqnWh^U{HINw0LgG2d5*W=(!Qu
z4Kk?5{`oPOW9^<a=DQ)q$~Mm}*~jQu6WJHiHG>jjYS`J3_ki-i8k8*TlvfqN*h6Gj
zNR;hSz=BA!ozWbHE&$5%<|v=oTw8kN2_It*ksTt7dP;^tSm?|fEW@BC7pNXtGbR6^
zO!F>DsU9LbLpJL1RZN)8C66vC4nbV^9R4oVLu5zDFmto1TAiS|8HX^N157<-HfM?g
z*F8k`hHPVxTWecc%E0aD3*Z*DhKU?q10s7xmK<yK-098I*}^i&Z31%_ik%P#E7v_l
z_J)j}+npQW5hwd=UaL^c6u9movTLNrp2PNbq7yx6GvtFk(o_q7m}@{}Z^)Qy5dF2I
zF%gnlHi6fXM$u_3Fr|8k>;~B;-&7O93rAHo#F;84uQx4eJzVz?*&DK%mX$6A#gi^x
zTK!>CJ3>k+^W2E+6&Z3v>up{96i>kogT^{2I&yE0>LIcxWSF^`7K#k+ntw!JAeAK#
zYC`q~F!m7H7t&WYo=uS4u?FyQ;!ce-b#NW`J-#@RM1KAX>mGB^{PLJ$+oRsLEi80u
zx(?MtWN*m0&;fw3-&4x2T|%Dc2H3mxV~(PFi0lR#Jn8D7Syqm(fNXhFKXH^^qQz+g
zyCD+UFETf-9&-;w0E6ZhJL_cGZL+|mCNd4G7o1`-Y9E1lJH;Z?_xj>Q68TA_s@|kl
zkJ{g^rV5eCQm$peDFEzmc3Wn6vOM-Fi6rv5kRiDsU)eR-0EC=2_^r>^054+5ALD)x
zk-Z_~x~EMVuo~@DcY{n;p<h)1Fwc$1?vQOiH;*o^4|lPPlhACVy4!6TZ&VMFJt2Sh
z+-fTI*5+L|8$7tHRZ!n6qI!tz1sNt@P4y@|e=SC)+V!9)3JBSxj6Fnlg=|u8v{d!j
zj!um|b#JE>^vphoyEK^yR1cBeAe&CS8@v>|3Zf>17BSVn1{cI82viS|eIY+cn=U#E
zJq&8YgPPdpa#8oVx$YsdL!`WIKt8L-D-Y~;J0-tb<wa%LN9bjLQCZS0pR%3zP3`QT
zhdw2dL_QZXv}3Eu(lywG*b^2+wQQ~iCC=Q4>=v0+Rj(stfhDYoh-K>J5%YG6ojspJ
zkqFjlu=D8G*W(`ffTtvq$Y(+}9jQWyaT9t&>;j*=hqy&uYvSs~*h6G5$Pb$6cyGhn
zLDWkU)YB2Xr%r6KL-i2Z6SC<7pXy<8N9?4Nf4E4zJiE~rcT0)v4H;^xQBNkdtb;*o
z?wbwX;Kkcba|2Tp)k9=|$Xo>HCL1s)*69>|f4vEiZssH`=>XR06cH&$(Z5|^^aJDr
zo{~r+p9&e%rY~N>qgz|1kcY-0^%&E7(kW+dMD~SjDimtJg5)N`hO)u4)gwoacD3V&
zlu$iH_JnNDEd}6}2gN_ovX_cDxr<${0mQy<-{XrDN#y6RyWN_Y^SL2T+B^!Cr4fQx
zP}^ElJw$ecY~n}lDwS#psrqUMAzdd-<jj%dx`)W#kZpB!i8x_fr<e#asd@vNgR`5{
zOQ;?qdqFmbCTwkU-R&+iHS3;GumF_l8`VQ(-^l$X#}tuQRRE{dOaxhc*eWl%FJe~S
zDq~qBeb+BeB$0o5{T_R2BZIp<&?8iymQMiXBp-TiMD~Up?RQcDyWJ@EABO<L0qjz4
z(=P}B=sH2LPQxKc#|YpY75i8wao^*M6G`N!FH_H&i+BdWlwwklSplp+4`{CH`T1)U
zqzwR0(NzEiP5|kb=)<0pNFtvRDf<6o{_I-6#}_A(NFs?Ol1L(nB$7xXyFva34YbXk
T;gF%D00000NkvXXu0mjfBMVZN

literal 0
HcmV?d00001

diff --git a/qrcode-certificate/v0/check_qrcode_certificate.py b/qrcode-certificate/v0/check_qrcode_certificate.py
new file mode 100644
index 0000000..571b513
--- /dev/null
+++ b/qrcode-certificate/v0/check_qrcode_certificate.py
@@ -0,0 +1,24 @@
+import base64
+import binascii
+
+import nacl.signing
+
+
+def base64url_decode(raw):
+    rem = len(raw) % 4
+    if rem > 0:
+        raw += b'=' * (4 - rem)
+    return base64.urlsafe_b64decode(raw)
+
+
+hex_verify_key = '79a441b73a99ead8c4446aa36c973dd23787d459122fe2169232a07a181e37a9'
+
+verify_key = nacl.signing.VerifyKey(binascii.unhexlify(hex_verify_key))
+
+message = 'eyJ0eXBlIjogImNlcnRpZmljYXQtemZlIiwgImltbWF0cmljdWxhdGlvbiI6ICJBWi0xMjM0LUJFIiwgIm5vbSI6ICJKZWFuIE1hcmMgRHVwb25kIiwgImRhdGVfZW1pc3Npb24iOiAiMjAyMi0wNi0wNyJ9.Nno9aCyay5sxducJtpmuBDP8VBoRdwe4rfw3ohBP1bSBnmFJf17sXQdMDGDXt6eN6bzyfeI3mDrmpTnVDf81DQ'
+
+parts = message.encode().split(b'.')
+payload = base64url_decode(parts[0])
+signature = base64url_decode(parts[1])
+
+assert verify_key.verify(payload, signature)
diff --git a/qrcode-certificate/v0/make_qrcode_certificate.py b/qrcode-certificate/v0/make_qrcode_certificate.py
new file mode 100644
index 0000000..335a44d
--- /dev/null
+++ b/qrcode-certificate/v0/make_qrcode_certificate.py
@@ -0,0 +1,49 @@
+import base64
+import binascii
+import json
+
+import nacl.signing
+import qrcode
+import qrcode.constants
+import qrcode.image.svg
+
+
+def base64url_decode(raw):
+    rem = len(raw) % 4
+    if rem > 0:
+        raw += b'=' * (4 - rem)
+    return base64.urlsafe_b64decode(raw)
+
+
+def base64url_encode(raw):
+    return base64.urlsafe_b64encode(raw).rstrip(b'=')
+
+
+key = nacl.signing.SigningKey(seed=b'1234' * 8)
+print('Hex verify key:', binascii.hexlify(key.verify_key.encode()).decode())
+doc = {
+    'type': 'certificat-zfe',
+    'immatriculation': 'AZ-1234-BE',
+    'nom': 'Jean Marc Dupond',
+    'date_emission': '2022-06-07',
+}
+
+payload = json.dumps(doc).encode()
+signed = key.sign(payload)
+certificate = b'%s.%s' % (base64url_encode(payload), base64url_encode(signed.signature))
+
+# verify
+b64_payload, b64_signature = certificate.split(b'.')
+assert key.verify_key.verify(base64url_decode(b64_payload), base64url_decode(b64_signature))
+
+print(f'Certificate({len(certificate)} bytes):', certificate)
+
+qr = qrcode.QRCode(
+    error_correction=qrcode.constants.ERROR_CORRECT_L,
+    #    image_factory=qrcode.image.svg.SvgPathImage,
+)
+qr.add_data(certificate)
+qr.make(fit=True)
+img = qr.make_image(fill_color='black', back_color='white')
+with open('certificate.png', 'wb') as fd:
+    img.save(fd)
diff --git a/qrcode-certificate/v0/qrcode-reader/index.html b/qrcode-certificate/v0/qrcode-reader/index.html
new file mode 100644
index 0000000..18069b1
--- /dev/null
+++ b/qrcode-certificate/v0/qrcode-reader/index.html
@@ -0,0 +1,89 @@
+<html>
+    <head>
+        <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/js-nacl/1.4.0/nacl_factory.min.js"></script>
+        <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/Base64/1.1.0/base64.min.js"></script>
+        <script type="text/javascript" src="https://unpkg.com/html5-qrcode"></script>
+        <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
+    </head>
+    <body>
+        <div class="container">
+                <label>SCAN QR CODE</label>
+                <div id="reader" style="width: 70vmin"></div>
+                <label>RESULT</label>
+                <pre id="text" style="font-size: 2rem; white-space: pre-wrap;"></pre>
+            </div>
+        </div>
+
+        <script>
+           var base64url_to_base64 = function(input) {
+               // Replace non-url compatible chars with base64 standard chars
+               input = input
+                   .replace(/-/g, '+')
+                   .replace(/_/g, '/');
+
+               // Pad out with standard base64 required padding characters
+               var pad = input.length % 4;
+               if(pad) {
+                 if(pad === 1) {
+                   throw new Error('InvalidLengthError: Input base64url string is the wrong length to determine padding');
+                 }
+                 input += new Array(5-pad).join('=');
+               }
+
+               return input;
+           }
+           function b64urldecode(base64url) {
+               var binary_string = window.atob(base64url_to_base64(base64url));
+               console.log('binary string', binary_string)
+               var len = binary_string.length;
+               var bytes = new Uint8Array(len);
+               for (var i = 0; i < len; i++) {
+                   bytes[i] = binary_string.charCodeAt(i);
+               }
+               return bytes;
+           }
+           nacl_factory.instantiate(function (nacl) {
+               let key = '79a441b73a99ead8c4446aa36c973dd23787d459122fe2169232a07a181e37a9';
+               let uint8_key = nacl.from_hex(key);
+
+                function onScanSuccess(c, decodedResult) {
+                  // handle the scanned code as you like, for example:
+                   let pre = document.getElementById('text');
+                   pre.textContent = 'Decoding "' + c + '"\n';
+                   console.log('1');
+                   let parts = c.split('.');
+                   console.log('2');
+                   if (parts.length != 2) {
+                       pre.textContent += "ERROR wrong length";
+                       return true;
+                   }
+                   try {
+                       let b64_payload = parts[0];
+                       let b64_signature = parts[1];
+                       let payload = b64urldecode(b64_payload);
+                       let signature = b64urldecode(b64_signature);
+                       let decoder = new TextDecoder('utf-8');
+                       const jsonString = decoder.decode(payload);
+                       const signatureString = decoder.decode(signature);
+                       const data = JSON.parse(jsonString)
+                       console.log(signature);
+                       console.log(nacl.to_hex(signature));
+                   } catch (e) {
+                       pre.textContent += 'ERROR ' + e;
+                   }
+                   if (! nacl.crypto_sign_verify_detached(signature, payload, uint8_key)) {
+                       pre.textContent += "ERROR wrong signature";
+                       return true;
+                   }
+
+                   pre.textContent = "signature OK\n" + JSON.stringify(data, null, " ");
+                   return true;
+                }
+
+
+                let scanner = new Html5Qrcode("reader");
+                scanner.start({ facingMode: "environment" }, { fps: 10, qrbox: {width: 500, height: 500} }, onScanSuccess);
+           });
+        </script>
+    </body>
+</html>