search

corona-warn-app / cwa-app-ios

Native iOS app using the exposure notification framework from Apple. The CWA development ends on May 31, 2023. You still can warn other users until April 30, 2023. More information:
https://coronawarn.app/en/faq/#ramp_down
Apache License 2.0
1.68k stars 286 forks source link

Simulator: Choosing "fake" HC1/HC2 leads to invalid signature error #3631

Closed Ein-Tim closed 2 years ago

Ein-Tim commented 2 years ago

Avoid duplicates

Technical details

Describe the bug

Selecting the universal QR code scanner on a simulator and then selecting either "HC1" oder "HC2" in the pop-up "Select a QRCode you want to fake" leads to an invalid signature error.

Steps to reproduce the issue

  1. Open the Corona-Warn-App on your Simulator branched from release/2.12.x
  2. Click on the tab in the middle (the QR code icon)
  3. Select either "HC1" or "HC2" from the pop up
  4. See the invalid signature error.

Expected behaviour

It should be possible to import certificates without a valid signature to a Simulator.

Possible Fix

Disable signature check for Simulators, maybe via the "Override App Features" option in the Developer Menu?

Additional information

This can be tracked in an internal ticket with #3632.

Internal Tracking-ID: EXPOSUREAPP-9765

ndegendogo commented 2 years ago

@Ein-Tim Actually, the "fake" certificates indeed have an invalid signature. So the behaviour to reject them is correct (we want to be able to debug even the cryptographic operations like signature verification on the simulator).

If I understand your wish correctly, you want a variant where the signature verification of these fake certificates is "mocked" so that they are accepted and can be stored, and that you can use them to test the behaviour of the app with certificates present.

Please try "Whiskey's debugging trick" if it fulfils your wish.

Note: meanwhile the fake certificates are outdated. So you can scan and store them, but still they are shown as invalid.

Ein-Tim commented 2 years ago

I meanwhile consider this as intentional. Thus closing this issue.

Ein-Tim commented 2 years ago