Documentation of signature check

[rriemann]

Dear @timokoenig ,

this is awesome. I will recommend it to some EU public sector bodies.

Can you please tell me how the verification of signatures is realised and where the certificates come from? I think it would be useful to cover this aspect in the readme.

Have a nice day!

[timokoenig]

@rriemann thank you, I really appreciate it!

I will add more in-depth information to the readme shortly

[timokoenig]

@rriemann I added a bit more documentation on where the data comes from and which library is being used

[rriemann]

Thanks! Very helpful.

CovidValidation uses a Github Action to fetch the newest DSC list once a day from the following API.

So the app server (or the app in the browser) then downloads the data from Github? What's the advantage? Why doesn't the app downloads directly from de.dscg.ubirch.com?

[timokoenig]

When I built iOS CovPass last year, I came across a few problems that I want to avoid with this WebApp. First things are firewalls and mobile device managements. These are not easy to handle and could cause major problems with update algorithms because they block traffic to third party APIs. Second thing are potential outages of these APIs. It is easier to control the own web servers than others. Also to make it easy the WebApp and the data like DSCs are hosted on the same server.

Github plays in this whole DSC topic only the part of a cron job. The Github Action runs once a day to download the DSCs and eu entry rules (which are 300+ requests) and saves them in two json files.

[timokoenig]

Small side node: I added a flag to the environment variables to use the DEMO certificates in a local build. This makes it possible to test certificates from https://github.com/eu-digital-green-certificates/dcc-quality-assurance.

https://github.com/timokoenig/covid-validator/tree/v1.1.0#test-data