Where my tweet about testing in production gained me knowledge about the Covid QR code systems
Posted by jpluimers on 2021/07/06
Even though RIVM twitter-care did not respond at all on my raised issue that the production environment leaded an acceptation environment URL, it did gain me some knowledge on their systems and the (then upcoming) European QR code systems.
[Archive.is] Jeroen Wiert Pluimers on Twitter: “Onhandig op de #CoronaCheck site van het @rivm de link hier (1) wijst nog naar de acceptatie omgeving en daar heb je authorisatie voor nodig. Zonder “.acc” werkt het ook niet: (2) Dit werkt wel: (3) CC @locuta… “
The problem digging into it was that it only reproduces when inside the [Archive.is] Coronacheck Print Portaal after you have logged on via DigiD, so you cannot save it in the WayBack machine nor Archive.is.
This print portal isn’t a straightforward hierarchy of web-pages, but an actual Vue.js app that injects itself into [Wayback/Archive.is] nl-covid19-coronacheck-website/index.html at main · minvws/nl-covid19-coronacheck-website and dynamically changes the URL depending on the application state.
It also means that you cannot archive pages like coronacheck.nl/nl/print/vaccinatie-ophalen or coronacheck.nl/nl/print/keuze-papieren-bewijs as the Vue.js app will not understand state from those sub-URLs and go back to coronacheck.nl/nl/print/
The only other results of [Wayback] “acc.coronacheck.nl” – Google Search were:
Acceptance URLs in production
I had a hunch the CoronaCheck code would be open source, though finding it through the most obvious [Wayback] open source coronacheck app – Google Search failed. Since the web-site and app look very similar to the CoronaMelder web-site and app, I tried [Wayback] open source coronamelder app – Google Search and found the page with links: [Wayback] Colophon – Stop the spread of the coronavirus, download CoronaMelder.
Note that [Wayback] Open-Source Project Corona-Warn-App is a different beast. Though internationally available and released way earlier than the Dutch apps, the Dutch government has a huge ego (maybe even abbreviatable to Hugo) resulting in severe “not invented here” syndrome despite having had to be bailed out when “code black” happened in hospitals.
One thing that I learned is that there is one version of the code behind coronacheck.nl/nl/print/print-vaccinatie in the main branch of github.com/minvws/nl-covid19-coronacheck-website that has only acceptance URLs. They are in these locations:
- [Wayback/Archive.is] nl-covid19-coronacheck-website/config.js at main · minvws/nl-covid19-coronacheck-website
- [Wayback/Archive.is] nl-covid19-coronacheck-website/en.js at main · minvws/nl-covid19-coronacheck-website
- [Wayback/Archive.is] nl-covid19-coronacheck-website/nl.js at main · minvws/nl-covid19-coronacheck-website
Apparently, replacing these with production URLs is done during deployment, but I could not find the code that does it in the main repositories at [Wayback] github.com/minvws
European Corona/COVID-19 Green Pass QR certificate
One answer to my tweet was [Archive.is] Joel Haasnoot on Twitter: “gir.st/blog/greenpass.html… “ which provides more information on the European
These are the links I thought were interesting:
- [Wayback] gir.st – What’s Inside the EU Green Pass QR Code? (describes the QR contains a Base45-encoded, compressed, signed binary data structure, points to documentation and has a Python decoder for it)
- Green Pass QR Decoder: [Wayback] greenpass.py
- [Archive.is] GreenCheck Austrian Checking site
- European [Wayback] docs/covid-certificate_json_specification_en.pdf
- [Wayback/Archive.is] hcert-spec/README.md at main · ehn-dcc-development/hcert-spec
- [Wayback/Archive.is] European eHealth network – digital covid certificate coordination (formerly github.com/ehn-digital-green-development)
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a Reply