A simple tool to dump the European Union's COVID passports (Digital Green Certificates)

Digital-Green-Certificate-Dump.py

#!/usr/bin/env python3

# install dependencies:
# pip install base45 cbor2 (cwt - not used here)

import sys
import zlib

from base45 import b45decode
from cbor2 import loads
from datetime import datetime
from json import dumps
from pprint import pprint

def pretty_print(data):
    print(dumps(data, sort_keys=True, indent=4))

def decode_data(data):
    bytes = b45decode(str(data))
    dec = zlib.decompress(bytes)
    return dec

def read_data(file):
    with open(file, "r") as myfile:
        data=myfile.read()
    return data

def write_binfile(filename, dec):
    with open(filename, 'wb') as myfile:
        myfile.write(dec)

def get_kid(value):
    try:
        # 'kid': {4: b'{\x89G\xe8\x8e"0\x83'}
        # convert it to be printable
        kid = value[4].hex()
    except:
        kid = str(value[4])
    return kid

def convert_timestamp(s):
    try:
        return datetime.utcfromtimestamp(int(s)).strftime('%Y-%m-%d %H:%M:%S')
    except Exception as e:
        return s

def get_dgc(cbor):
    data = loads(cbor)
    # replace meaningless unix timestamps with readable timestamps
    data[4] = convert_timestamp(data[4])
    data[6] = convert_timestamp(data[6])
    return data

data = read_data("qr-code.txt")
if data[0:4] != 'HC1:':
    print('Unsupported format in the input file.')
    sys.exit(1)
dec = decode_data(data[4:])
cbortag = loads(dec)

dgc = {
    'tag': cbortag.tag,
    'alg': loads(cbortag.value[0]),
    'kid': get_kid(cbortag.value[1]),
    'dgc': get_dgc(cbortag.value[2]),
    'signature': cbortag.value[3].hex(),
}
pretty_print(dgc)

# write_binfile('result-after-dezlib.bin', dec)

# further reading:
# - https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_v3_en.pdf
# - https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_v1_en.pdf
# - https://ec.europa.eu/health/sites/default/files/ehealth/docs/digital-green-certificates_dt-specifications_en.pdf

# give credits, send bugreports to https://twitter.com/tcpj_cz and https://twitter.com/zajdee

Data from QR is prefixed by 4 chars e.g. "HC1:" and these 4 bytes should be skipped before decoding base45.

@gimli2: thanks, this was mentioned in the previous version of the gist as a manual job before one runs the data through the script. I will add the stripping to the code.

HC1: stripping added; only HC1: certs are supported at the moment, so if the prefix doesn't match, the script bails out.