(Objective-C) Validate a .pkpass Archive

Opens a .pkpass archive (which is just a .zip renamed to .pkpass) and validates the contents. The hashes in the manifest are compared with the computed hash values for each individual file. If all computed hash values match, then the signature is verified.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoCrypt2.h>
#import <CkoZip.h>
#import <CkoZipEntry.h>
#import <CkoBinData.h>
#import <CkoJsonObject.h>
#import <NSString.h>
#import <CkoStringBuilder.h>

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

CkoCrypt2 *crypt = [[CkoCrypt2 alloc] init];
CkoZip *zip = [[CkoZip alloc] init];

BOOL success = [zip OpenZip: @"qa_data/pkpass/invalid.pkpass"];
if (success == NO) {
    NSLog(@"%@",zip.LastErrorText);
    return;
}

// Get the contents of the manifest.json file, which contains something like this:

// {
//   "icon.png" : "0296b01347b3173e98438a003b0e88986340b2d8",
//   "logo.png" : "25de09e2d3b01ce1fe00c2ca9a90a2be1aaa05cf",
//   "icon@2x.png" : "5afd9585b08c65fdf105a90c8bd643407cba2787",
//   "pass.json" : "145ea5a5db784fff485126c77ecf7a1fc2a88ee7",
//   "strip@2x.png" : "468fa7bc93e6b55342b56fda09bdce7c829d7d46",
//   "strip.png" : "736d01f84cb73d06e8a9932e43076d68f19461ff"
// }

CkoZipEntry *ent = [zip GetEntryByName: @"manifest.json"];
if (zip.LastMethodSuccess == NO) {
    NSLog(@"%@",@"manifest.json entry not found.");
    return;
}

// Get the exact content of the manifest.json for later signature verification.
CkoBinData *bdManifest = [[CkoBinData alloc] init];
success = [ent UnzipToBd: bdManifest];

CkoJsonObject *json = [[CkoJsonObject alloc] init];
json.EmitCompact = NO;
[json Load: [ent UnzipToString: [NSNumber numberWithInt: 0] srcCharset: @"utf-8"]];
NSLog(@"%@",[json Emit]);

// For each file in the JSON, get the filename and hex hash value.
crypt.EncodingMode = @"hexlower";
crypt.HashAlgorithm = @"sha1";

BOOL someHashesFailed = NO;
NSString *filename = 0;
CkoStringBuilder *sbHashHex = [[CkoStringBuilder alloc] init];
CkoBinData *bdFileData = [[CkoBinData alloc] init];
int numMembers = [json.Size intValue];
int i = 0;
while (i < numMembers) {
    filename = [json NameAt: [NSNumber numberWithInt: i]];
    [sbHashHex Clear];
    [sbHashHex Append: [json StringAt: [NSNumber numberWithInt: i]]];

    ent = [zip GetEntryByName: filename];
    if (zip.LastMethodSuccess == NO) {
        NSLog(@"%@%@",filename,@" not found in the pkpass file.");
        return;
    }

    // Get the data for this file.
    [bdFileData Clear];
    success = [ent UnzipToBd: bdFileData];

    NSString *computedHashHex = [crypt HashBdENC: bdFileData];
    if ([sbHashHex ContentsEqual: computedHashHex caseSensitive: NO] == NO) {
        NSLog(@"%@%@",@"Computed hash does not match stored hash for ",filename);
        NSLog(@"%@%@",@"  computed: ",computedHashHex);
        NSLog(@"%@%@",@"  stored:   ",[sbHashHex GetAsString]);
        someHashesFailed = YES;
    }
    else {
        NSLog(@"%@%@%@%@%@",@"hash verified for ",filename,@"(",computedHashHex,@")");
    }

    i = i + 1;
}

if (someHashesFailed == YES) {
    NSLog(@"%@",@"Some hashes failed.");
    return;
}

// Let's verify the signature..
// First get the signature.
ent = [zip GetEntryByName: @"signature"];
if (zip.LastMethodSuccess == NO) {
    NSLog(@"%@",@"signature not found in the pkpass file.");
    return;
}

CkoBinData *bdSignature = [[CkoBinData alloc] init];
success = [ent UnzipToBd: bdSignature];

// Show the contents of the signature in base64 encoding.
NSLog(@"%@",@"Signature:");
NSLog(@"%@",[bdSignature GetEncoded: @"base64_mime"]);
NSLog(@"%@",@"----");

// Verify the signature against the manifest.json
crypt.EncodingMode = @"base64";
BOOL verified = [crypt VerifyBdENC: bdManifest encodedSig: [bdSignature GetEncoded: @"base64"]];
if (verified == NO) {
    NSLog(@"%@",crypt.LastErrorText);
}

NSLog(@"%@%d",@"signature verified = ",verified);