Certificate Cannot Be Validated for Switzerland

ckujau commented 3 years ago

Avoid duplicates

[x] Bug is not mentioned in the FAQ
[ ] Bug is specific for Android only, for general issues / questions that apply to iOS and Android please raise them in the documentation repository -- unknown, I don't have iOS to verify.
[x] Bug is not already reported in another issue

Technical details

Device name: Google Pixel 4a
Android version: 11 (September 2021 update)
App version: 2.9.0

Describe the bug

Similarly what was described in corona-warn-app/cwa-documentation#671 for Netherlands, the same happens when I try to validate my DCC against Switzerland. But, contrary to this comment from the mentioned issue the app does not report "There are currently no entry rules for the selected country" (as it does for other countries), it reports "The following rules could not be checked" and lists several rules below with question marks.

Steps to reproduce the issue

Add a DCC
Check for the validity in Switzerland
Certificate Cannot Be Validated -- Screenshot

Expected behaviour

The application should be able to validate the certificate.

Possible Fix

The error message is a bit confusing as it lists all (?) rules but doesn't clearly show which rule was violated, and what to do to remediate this.
Can the validation errors made selectable? That way one could report the validation errors more easily. The hardest part filling out this issue template was to learn how to stitch together screenshots :-)

Additional context

The DCC was issued on August 12, 2021 in Berlin. I don't know the schema version though.
The CovPass (v1.138.6) application also shows the same validation errors for Switzerland for the same DCC.

Internal Tracking ID: EXPOSUREAPP-9648

Ein-Tim commented 3 years ago

Confirm same behavior under iOS. Tested against schema version 1 as well as schema version 1.3. Result is always the same as shown in the screenshot shared by @ckujau.

dsarkar commented 3 years ago

Internal Tracking ID: EXPOSUREAPP-9648

Ein-Tim commented 3 years ago

@dsarkar Please move to documentation repo as this affects both, iOS and Android.

dsarkar commented 3 years ago

Switzerland had been informed already.

ckujau commented 3 years ago

Thanks for handling this, but...moving to cwa-documentation...is this really "just" a documentation issue? A mere user could be really worried if a proper vaccination certificate would not validate in country xyz. But the "Switzerland had been informed already" comment above lead me to believe that the actual validation error is being worked on, great! (Although to me, the uninitiated, it sounds like someone called up the Swiss Embassy and they are now taking care of things ;-))

Ein-Tim commented 3 years ago

@ckujau

The documentation repository here is not only used for issued with the documents published here but also for bugs in the application itself when these bugs affect both, iOS & Android. And this is the case here.

More infos on this can be found in this issue: https://github.com/corona-warn-app/cwa-documentation/issues/707

vaubaehn commented 3 years ago

@dsarkar @thomasaugsten @mlenkeit Do you know, if the Swiss business rules team received concrete information about where the errors in their business rules are? If not, they may have a look at two suspects:

At all rules that contain "var":"external.validationClockAtStartOfDay". As to my best knowledge, validationClockAtStartOfDay is not valid syntax and not implemented into CertLogic. It should be "var":"external.validationClock".
At other rules that return status "open" accidentally: They probably have an invalid if-then-else-structure when validating the presence of >1 fields: E.g., VR-CH-0003 is
```
  "Logic":{
     "if":[
        {
           "var":"payload.v.0"
        },
        {
           "var":"payload.v.0.dt"
        },
        true
     ]
  },
```

And probably needs to be

      "Logic":{
         "if":[
            {
               "var":"payload.v.0"
            },
            {
             "if":[
                {
                   "var":"payload.v.0.dt"
                },
                true
                ]
            },
            true
         ]
      },

Could you kindly check whether my findings are correct and ping the swiss team accordingly? Thanks in advance and cheers, v.

thomasaugsten commented 3 years ago

We informed the swiss team immediately after they upload the rule

vaubaehn commented 3 years ago

Hi @thomasaugsten , thanks for your reply. My question was, if you gave concrete information to them, what to fix? They changed some rules in the past 1 or 2 weeks, but the 2 issues that I described above are still open. If you could check if my proposal is correct, they maybe could fix their rules a bit faster?

Ein-Tim commented 3 years ago

Meanwhile a check no longer shows that the certificate couldn't be checked but a valid certificate is faulty shown as invalid:

vaubaehn commented 3 years ago

Hi @Ein-Tim , that's interesting... I'm still on CWA Android 2.6, but here a completed vaccination certificate is still validated (more or less correctly) as status "open" for Switzerland in VR-CH-0004 and VR-CH-0006... Are you perceiving a separate iOS issue for the latest CWA release (=> "open" results in/displayed as "failed")?

thomasaugsten commented 3 years ago

Your proposal is correct they will fix this as soon as possible

vaubaehn commented 3 years ago

@thomasaugsten Thanks for your feedback, happy to hear!

Ein-Tim commented 3 years ago

@vaubaehn

Hi @Ein-Tim , that's interesting... I'm still on CWA Android 2.6, but here a completed vaccination certificate is still validated (more or less correctly) as status "open" for Switzerland in VR-CH-0004 and VR-CH-0006...

Just checked under Android (CWA 2.10), same, a certificate is shown as "Open" and not as invalid. I will open an issue for this in the iOS repo.

thomasaugsten commented 3 years ago

Please create the ticke in the correct repo https://github.com/eu-digital-green-certificates/dgc-certlogic-ios

MikeMcC399 commented 3 years ago

@thomasaugsten

Please create the ticke in the correct repo https://github.com/eu-digital-green-certificates/dgc-certlogic-ios

It would be good to record this link somewhere more central. Maybe in the README or the bug template?

vaubaehn commented 3 years ago

@MikeMcC399 We should be careful with this link, not to drive users always to that repo. For these kind of issues, it first needs a pre-sorting, whether it's CWA related (CWA handles CertLogic return value wrong) or CertLogic related (CertLogic returns a wrong value). Thomas obviously made the pre-sorting here and sent Tim already to the right repo... In case a similar issue pops up in the future, I would have less worries if it's reported in a CWA repo first, and if it's clearly CertLogic related, moved to their repos after - not to miss anything important. Just my 2 🪙

Ein-Tim commented 3 years ago

I opened https://github.com/eu-digital-green-certificates/dgc-certlogic-ios/issues/49.

MikeMcC399 commented 3 years ago

@vaubaehn Well maybe any description should come with some advice. I guess first of all it would be about validity checks. Then if the same problem is happening on CovPass and on CWA it would be reasonable to start by assuming that the problem lies with the certificate logic and not with CWA.

vaubaehn commented 3 years ago

@MikeMcC399 In general I'm agreeing, but I still would feel better to leave it to the pros (Thomas or Maximilian) to do the first evaluation whether the issue can stay in one CWA repo or should be moved to the CertLogic repos. But if @thomasaugsten or @mlenkeit decide that it would be a good idea to integrate some information to README or bug template, like you suggested, I'd be happy to help out to reviewing the text enhancements.

By the way, @Ein-Tim

Then if the same problem is happening on CovPass and on CWA it would be reasonable to start by assuming that the problem lies with the certificate logic and not with CWA.

What do you see when you validate a DCC against Swiss rules with CovPass? That'll be interesting...

Ein-Tim commented 3 years ago

What do you see when you validate a DCC against Swiss rules with CovPass? That'll be interesting...

Also a fail under iOS & open under Android.

vaubaehn commented 3 years ago

@Ein-Tim CovPass Android leads to "open". However, the sorting of results is a bit different: it's sorted by DCC field, and all "open" (=invalid) rules are summarized per affected DCC field (while CWA shows each "open" rule as single/separate instance).

So, we have a clear iOS related CertLogic problem (additionally to the invalid Swiss rules) 🎉 How lucky that we can catch two flies with one clap!

vaubaehn commented 3 years ago

Looks like corrected Swiss rules are already in PROD and will be effective from 18.10.2021 12:00 UTC on. 🎉

Ein-Tim commented 3 years ago

@ckujau

Can you recheck, please? I can confirm that this has been fixed for me (iPhone XR, iOS 15.0.2, CWA 2.11.1).

ckujau commented 3 years ago

Yes, now the certificate validates for Switzerland on Android (tested both with 2.9.0 and 2.11.2). Thanks for your help here!

dsarkar commented 3 years ago

Good morning @ckujau @Ein-Tim @vaubaehn @MikeMcC399 and community.

Thanks for contributing and the feedback! Best, DS

Corona-Warn-App Open Source Team

corona-warn-app / cwa-documentation