(Visual Basic 6.0) Validate a .pkpass Archive

Opens a .pkpass archive (which is just a .zip renamed to .pkpass) and validates the contents. The hashes in the manifest are compared with the computed hash values for each individual file. If all computed hash values match, then the signature is verified.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

' This example assumes the Chilkat API to have been previously unlocked.
' See Global Unlock Sample for sample code.

Dim crypt As New ChilkatCrypt2
Dim zip As New ChilkatZip

Dim success As Long
success = zip.OpenZip("qa_data/pkpass/invalid.pkpass")
If (success = 0) Then
    Debug.Print zip.LastErrorText
    Exit Sub
End If

' Get the contents of the manifest.json file, which contains something like this:

' {
'   "icon.png" : "0296b01347b3173e98438a003b0e88986340b2d8",
'   "logo.png" : "25de09e2d3b01ce1fe00c2ca9a90a2be1aaa05cf",
'   "icon@2x.png" : "5afd9585b08c65fdf105a90c8bd643407cba2787",
'   "pass.json" : "145ea5a5db784fff485126c77ecf7a1fc2a88ee7",
'   "strip@2x.png" : "468fa7bc93e6b55342b56fda09bdce7c829d7d46",
'   "strip.png" : "736d01f84cb73d06e8a9932e43076d68f19461ff"
' }

Dim ent As ChilkatZipEntry
Set ent = zip.GetEntryByName("manifest.json")
If (zip.LastMethodSuccess = 0) Then
    Debug.Print "manifest.json entry not found."
    Exit Sub
End If

' Get the exact content of the manifest.json for later signature verification.
Dim bdManifest As New ChilkatBinData
success = ent.UnzipToBd(bdManifest)

Dim json As New ChilkatJsonObject
json.EmitCompact = 0
success = json.Load(ent.UnzipToString(0,"utf-8"))
Debug.Print json.Emit()

' For each file in the JSON, get the filename and hex hash value.
crypt.EncodingMode = "hexlower"
crypt.HashAlgorithm = "sha1"

Dim someHashesFailed As Long
someHashesFailed = 0
Dim filename As String
Dim sbHashHex As New ChilkatStringBuilder
Dim bdFileData As New ChilkatBinData
Dim numMembers As Long
numMembers = json.Size
Dim i As Long
i = 0
Do While i < numMembers
    filename = json.NameAt(i)
    sbHashHex.Clear 
    success = sbHashHex.Append(json.StringAt(i))

    Set ent = zip.GetEntryByName(filename)
    If (zip.LastMethodSuccess = 0) Then
        Debug.Print filename & " not found in the pkpass file."
        Exit Sub
    End If

    ' Get the data for this file.
    success = bdFileData.Clear()
    success = ent.UnzipToBd(bdFileData)

    Dim computedHashHex As String
    computedHashHex = crypt.HashBdENC(bdFileData)
    If (sbHashHex.ContentsEqual(computedHashHex,0) = 0) Then
        Debug.Print "Computed hash does not match stored hash for " & filename
        Debug.Print "  computed: " & computedHashHex
        Debug.Print "  stored:   " & sbHashHex.GetAsString()
        someHashesFailed = 1
    Else
        Debug.Print "hash verified for " & filename & "(" & computedHashHex & ")"
    End If

    i = i + 1
Loop

If (someHashesFailed = 1) Then
    Debug.Print "Some hashes failed."
    Exit Sub
End If

' Let's verify the signature..
' First get the signature.
Set ent = zip.GetEntryByName("signature")
If (zip.LastMethodSuccess = 0) Then
    Debug.Print "signature not found in the pkpass file."
    Exit Sub
End If

Dim bdSignature As New ChilkatBinData
success = ent.UnzipToBd(bdSignature)

' Show the contents of the signature in base64 encoding.
Debug.Print "Signature:"
Debug.Print bdSignature.GetEncoded("base64_mime")
Debug.Print "----"

' Verify the signature against the manifest.json
crypt.EncodingMode = "base64"
Dim verified As Long
verified = crypt.VerifyBdENC(bdManifest,bdSignature.GetEncoded("base64"))
If (verified = 0) Then
    Debug.Print crypt.LastErrorText
End If

Debug.Print "signature verified = " & verified