(VB.NET) Validate a .pkpass Archive

Opens a .pkpass archive (which is just a .zip renamed to .pkpass) and validates the contents. The hashes in the manifest are compared with the computed hash values for each individual file. If all computed hash values match, then the signature is verified.

Chilkat .NET Downloads Chilkat .NET Framework Chilkat for .NET Core

' This example assumes the Chilkat API to have been previously unlocked.
' See Global Unlock Sample for sample code.

Dim crypt As New Chilkat.Crypt2
Dim zip As New Chilkat.Zip

Dim success As Boolean = zip.OpenZip("qa_data/pkpass/invalid.pkpass")
If (success = False) Then
    Debug.WriteLine(zip.LastErrorText)
    Exit Sub
End If


' Get the contents of the manifest.json file, which contains something like this:

' {
'   "icon.png" : "0296b01347b3173e98438a003b0e88986340b2d8",
'   "logo.png" : "25de09e2d3b01ce1fe00c2ca9a90a2be1aaa05cf",
'   "icon@2x.png" : "5afd9585b08c65fdf105a90c8bd643407cba2787",
'   "pass.json" : "145ea5a5db784fff485126c77ecf7a1fc2a88ee7",
'   "strip@2x.png" : "468fa7bc93e6b55342b56fda09bdce7c829d7d46",
'   "strip.png" : "736d01f84cb73d06e8a9932e43076d68f19461ff"
' }

Dim ent As Chilkat.ZipEntry = zip.GetEntryByName("manifest.json")
If (zip.LastMethodSuccess = False) Then
    Debug.WriteLine("manifest.json entry not found.")
    Exit Sub
End If


' Get the exact content of the manifest.json for later signature verification.
Dim bdManifest As New Chilkat.BinData
success = ent.UnzipToBd(bdManifest)

Dim json As New Chilkat.JsonObject
json.EmitCompact = False
json.Load(ent.UnzipToString(0,"utf-8"))
Debug.WriteLine(json.Emit())



' For each file in the JSON, get the filename and hex hash value.
crypt.EncodingMode = "hexlower"
crypt.HashAlgorithm = "sha1"

Dim someHashesFailed As Boolean = False
Dim filename As String
Dim sbHashHex As New Chilkat.StringBuilder
Dim bdFileData As New Chilkat.BinData
Dim numMembers As Integer = json.Size
Dim i As Integer = 0
While i < numMembers
    filename = json.NameAt(i)
    sbHashHex.Clear()
    sbHashHex.Append(json.StringAt(i))

    ent = zip.GetEntryByName(filename)
    If (zip.LastMethodSuccess = False) Then
        Debug.WriteLine(filename & " not found in the pkpass file.")
        Exit Sub
    End If


    ' Get the data for this file.
    bdFileData.Clear()
    success = ent.UnzipToBd(bdFileData)

    Dim computedHashHex As String = crypt.HashBdENC(bdFileData)
    If (sbHashHex.ContentsEqual(computedHashHex,False) = False) Then
        Debug.WriteLine("Computed hash does not match stored hash for " & filename)
        Debug.WriteLine("  computed: " & computedHashHex)
        Debug.WriteLine("  stored:   " & sbHashHex.GetAsString())
        someHashesFailed = True
    Else
        Debug.WriteLine("hash verified for " & filename & "(" & computedHashHex & ")")
    End If




    i = i + 1
End While

If (someHashesFailed = True) Then
    Debug.WriteLine("Some hashes failed.")
    Exit Sub
End If


' Let's verify the signature..
' First get the signature.
ent = zip.GetEntryByName("signature")
If (zip.LastMethodSuccess = False) Then
    Debug.WriteLine("signature not found in the pkpass file.")
    Exit Sub
End If


Dim bdSignature As New Chilkat.BinData
success = ent.UnzipToBd(bdSignature)


' Show the contents of the signature in base64 encoding.
Debug.WriteLine("Signature:")
Debug.WriteLine(bdSignature.GetEncoded("base64_mime"))
Debug.WriteLine("----")

' Verify the signature against the manifest.json
crypt.EncodingMode = "base64"
Dim verified As Boolean = crypt.VerifyBdENC(bdManifest,bdSignature.GetEncoded("base64"))
If (verified = False) Then
    Debug.WriteLine(crypt.LastErrorText)
End If

Debug.WriteLine("signature verified = " & verified)