Mastodawn

Fabio Manganiello

Lately I have noticed that when you purchase a ticket you don’t get a static PDF/PNG anymore.

Increasingly often, you get a .pkpass file, which is supposed to be opened in wallet apps (like Google Wallet or any 3rd-party wallet app).

Since I don’t like to share information about the events I attend with strangers on the Internet, I have decided to take a closer look at these .pkpass files.

They are just zip files that contain a background image, an icon and a pass.json with the actual information about the ticket. Nothing that can’t be handled by a script rather than a 3rd-party 100 MB mobile app.

I have thus put together a simple #shell script that does exactly that.

Dependencies:

jq
zint
magick
unzip
curl or wget

https://gist.manganiello.tech/fabio/pkpass2png

Usage:

pkpass2png https://domain.tld/myticket.pkpass ticket.png

pkpass2png - Opengist

@fabio thank you, I can finally cross one of my old side project TODO items off my list 💖

I used to travel a ton in the before times and were always pissed at the corpos pushing you into downloading their apps (or any app, really) when this could be a 1, PNG or 2, a PWA that unpacks the pkpass and displays it with the metadata for you (gating the interactive features that use an external API behind a mail client-style "load external data" confirm dialog)

(ehhem, @thunderbird if you are listening ☝️

awkward_look_monkey

)

Thunderbird: Free Your Inbox Jan 5

@flaki@/flaki.social Oooh! The best place to get started on this would probably be Mozilla Connect, our site for suggestions and ideas! (https://connect.mozilla.org ) Our community can upvote/support and our developers can take a look at implementation details in more detail.

Mozilla Connect

Share product feedback, submit ideas for new features, and help shape future releases.

@flaki @fabio hey flaki, do you want me to make a @thunderbird webextension to handle pkpass? <3 I can do it in probably a day...

@flaki @fabio @thunderbird

I got very far today. Can already render pkpass as inline attachements. Unfortunately, I'm having trouble finding sample pkpass files to test this out.

Thunderbird: Free Your Inbox Jan 9

@soapdog This is great progress! Thanks so much for sharing it. 🎉

@thunderbird @flaki @soapdog @fabio I should have a heap of airline and train files. - Let me see if I can dig them out.

@abeorch @thunderbird @flaki @fabio thank you, I couldn't find a single airline one to test.

@soapdog @flaki @fabio @thunderbird I have a tiny few for unit tests: https://github.com/CatimaLoyalty/Android/tree/main/app/src/test/res/protect/card_locker/pkpass. Hope that helps.

Do note the ones with fake in the name are manually modified for testing and all are slightly modified for privacy so the signatures will likely not match

Android/app/src/test/res/protect/card_locker/pkpass at main · CatimaLoyalty/Android

Catima, a Loyalty Card & Ticket Manager for Android - CatimaLoyalty/Android

GitHub

Andrej Shadura Dec 24

@fabio, PassAndroid can view these on Android without sending them anywhere. It’s not really maintained well, but it works. Available at F-Droid as well.

https://github.com/ligi/PassAndroid

Andrej Shadura Dec 24

@fabio, also looks like Catima can now open pkpass too:

https://github.com/CatimaLoyalty/Android

GitHub - CatimaLoyalty/Android: Catima, a Loyalty Card & Ticket Manager for Android

Catima, a Loyalty Card & Ticket Manager for Android - CatimaLoyalty/Android

GitHub

Kai Klostermann Dec 24

@andrew_shadura @fabio maybe you want to check out: https://f-droid.org/packages/nz.eloque.foss_wallet

FossWallet | F-Droid – Freies und quelloffenes Android-App-Repository

MD3-App zur Passverwaltung von "Apple Passbook (.pkpass)"-Dateien

QuadRadical Dec 24

@OddDev @andrew_shadura @fabio You can also do the same on Linux with Gnome Wallet!

Andrej Shadura Dec 24

@OddDev, oh, thanks!

@OddDev @andrew_shadura @fabio
Can comfirm that it works well, gets frequent @fdroid store updates, is fully foss (GPL3) and is just 7 MB, instead of 100MB

https://github.com/SeineEloquenz/fosswallet

D Ingram Dec 24

@andrew_shadura @fabio And FossWallet too. Something that looks like a wallet is more likely to get past security though.
https://f-droid.org/packages/nz.eloque.foss_wallet

Nice to know it is just a ZIP though, and something to explore for fun.

@andrew_shadura
What's the maintenance on that which we could ask @ligi to take care of? I guess PassAndroid is just feature-complete and doesn't need to change?
@fabio

Andrej Shadura Dec 25

@yala, sorry to be blunt, but there’s a bug tracker full of work items. Most importantly, it fell out of Google Play (I suspect API changes).

@andrew_shadura @yala @fabio
The problem with google play is that they want data from me that I do not want to give them. I need to make some sort of shell organisation for that. Google really became evil here ..

Andrej Shadura Dec 26

@ligi I've bitten the bullet and gave in (unless I'm misunderstanding what sort of data you mean). If you want me to, I can upload to Google Play for you. (I was considering re-uploading under a different package id anyway.)

andreaskem Dec 24

@fabio Honorable mention: KDE Itinerary (works on Android)
https://apps.kde.org/itinerary/

KDE Itinerary

Digital travel assistant

KDE Applications

Kai Klostermann Dec 24

@fabio But you know that there are actually ethical apps being able to read those files? E.g. https://f-droid.org/packages/nz.eloque.foss_wallet

FossWallet | F-Droid – Freies und quelloffenes Android-App-Repository

MD3-App zur Passverwaltung von "Apple Passbook (.pkpass)"-Dateien

Fabio Manganiello Dec 24

@OddDev I know, but what disturbs me the most is the idea of purchasing a ticket from my desktop just to hop through my phone to open it, and then maybe screenshot or export it back to store it to my cloud as an image.

It’s great that there are FOSS apps for it, but for a process so simple that could easily rely on static images so far it’s also good to have an alternative that requires no app at all.

@fabio BTW: PassAndroid available via f-droid.org has an APK size of 3.7 MB.

https://f-droid.org/en/packages/org.ligi.passandroid/

PassAndroid | F-Droid - Free and Open Source Android App Repository

View Passbook files

Charo del Genio Dec 24

@fabio it hasn't happened to me yet, but I wonder, will the people who check the tickets require the file to be opened in an approved app?

Fabio Manganiello Dec 24

@paraw luckily there are many FOSS apps that also open pkpass files (if you’re lucky and the actual pkpass files is directly exposed to you, rather than an “Add to Google Wallet” button). So if you install one of those you’ll probably be prompted to open the file with them on mobile. But still, it’s the whole idea of “needing a mobile app to generate the image of a barcode given a background and some metadata” that disturbs me 😆

@fabio - I like your coding. very clean. The scary thing I would have is opening a .pkpass file and get my computer hijacked. Unless the source is legit.

αxel simon ↙︎↙︎↙︎Dec 24

@fabio for completeness, on Android the FOSS Catima also deals with them. But this feels like a superior long-term option

Charles P.Dec 24

@fabio there are some open-source application to open pkpasses too :
- on Android there's fWallet (FDroid) : https://f-droid.org/packages/business.braid.f_wallet/
- for GNOME there's Passes : https://github.com/pablo-s/passes
- for KDE or Android, there's KDE Itinerary (only for transportation) : https://apps.kde.org/fr/itinerary/

fWallet | F-Droid - Free and Open Source Android App Repository

A beautiful cross-platform wallet application for your transport tickets, discou

🇺🇦🇪🇺 cweickhmann Dec 24

@fabio For convenience on a phone, try PassAndroid, 14MB*, fully FOSS, available on F-Droid. https://github.com/ligi/PassAndroid

TBH, for an Apple-conceived format it's surprisingly open and straight forward, pkpass that is.

*) Yeah, I know that's insane but it's probably as good as it gets with an apk.

GitHub - ligi/PassAndroid: Android App to view passes

Android App to view passes. Contribute to ligi/PassAndroid development by creating an account on GitHub.

GitHub

Leela Torres Dec 24

@cweickhmann @fabio
https://f-droid.org/packages/org.ligi.passandroid

PassAndroid | F-Droid - Free and Open Source Android App Repository

View Passbook files

サムエルはコーヒーをたくさんのみます。Dec 24

@fabio my absolutely legendary man, thank you

@fabio I looked at this format as well. There is also a signature. The only implementation I found that verifies those: Apple. Yes, generating those files is also gated by Apple.

Fabio Manganiello Dec 24

@waldi generation shouldn’t be too hard (at least the manifest.json and pass.json). Good point on the signature. I also noticed it, but didn’t know how it’s calculated, nor how it’s verified against the original issuer at scan time, since it’s nowhere reported in the barcode.

Daniel González Dec 24

@fabio I see a problem with pkpasses that updates info from the net. I've seen boarding passes that update gate info and also Real Madrid tickets that changes barcode/qr on matchday to prevent ticket "sharing"

Fabio Manganiello Dec 24

@daniel_gonzalez yup, that’s indeed going to be the next step. These URLs can be saved in a Tasker profile, hooked to the right MIME type, then whenever the user opens the file or URL the script is invoked 🙂

pixelOwotanBlush

@fabio pkpass are nice, but some crap send you a google wallet exclusive crap

@fabio thank you, next time I check in from a holiday hotel, I'll find your post, find a Linux computer and do these things.

/s

Fabio Manganiello Dec 24

@bonkers or automate it with Tasker and Termux 🙂

@fabio I actually do take a Linux laptop on holidays :)

Last time I had a ticket like that, I received a pdf copy and a file to add into Google wallet, so I had the choice.

@fabio Thanks Fabio, buon Natale!

LukefromDC Dec 24

@fabio Nobody should be using shit like Google Waller. I do not attend advance ticketed events but this will help a lot of people who do not have "Google certified" phones connected to a Google account and to their bank account or a credit card.

@fabio Another vote for Catima! The dev is on masto too: @SylvieLorxu

@fabio ah, nice! Except, down at the end... that's MATH 🫠

@fabio
Funny I was just looking at #FossWallet just before seeing this post. Didn't try it, but nice to see there are #FOSS solutions

https://f-droid.org/packages/nz.eloque.foss_wallet

FossWallet | F-Droid – Freies und quelloffenes Android-App-Repository

MD3-App zur Passverwaltung von "Apple Passbook (.pkpass)"-Dateien

@fabio As someone who had to figure out how to generate .pkpass files in my store, yes, these are stupidly complicated, and dealing with Apple's cert infrastructure *sucks*. Why can't I just stuff a PNG into Wallet.app directly??

But! They do have some cool features:

• When you are near the venue, the pass pops up on the lock screen, without needing to unlock first.
• If any details (name, time, etc) the pass updates via push notifications.
• When that happens, the pass indicates the changes.

@fabio Last I checked Apple has really good documentation on pkpass files. Sometimes the bar codes and QR codes are encoded in the JSON file instead of image files so you may want a barcode/QR code generator in your next iteration of the script.

(I was using the documentation to take other barcodes in my life and try to make my own pkpass files, but I believe I can trust Apple Wallet.)

Miss Lolo🍉🌹Dec 25

@fabio
Dear fabio
We are facing very difficult
circumstances with my five children. Any donation will be greatly appreciated.🙏

Microblog Castellano Dec 25

@fabio
Thank you. In my android phone I used Fosswallet, available at F-Droid --- but that one still weights 10 Mb.

@microblogc @fabio
Catima is only 4.5 MiB

Has support for .pkpass files since
v2.34.0 - 142 (2024-12-10)

https://f-droid.org/packages/me.hackerchick.catima/

Catima — Loyalty Card Wallet | F-Droid - Free and Open Source Android App Repository

For your barcodes, memberships, loyalty programs, coupons and tickets.

@dec23k I have Catima installed for my various (shared) loyalty cards, I had no idea it could handle these weird wallet files as well, that's great!

@fabio By coincidence I stumbled upon this app on Fdroid that might be useful as well: https://f-droid.org/packages/nz.eloque.foss_wallet

FossWallet | F-Droid – Freies und quelloffenes Android-App-Repository

MD3-App zur Passverwaltung von "Apple Passbook (.pkpass)"-Dateien

@fabio
I wonder if KDE Itinerary can handle this file format:

https://apps.kde.org/itinerary/

KDE Itinerary

Digital travel assistant

KDE Applications

@fabio Pretty sure you can use #catima from #fdroid to open them. Its a great programme. I store all my loyalty card details in it. f-droid.org/packages/me.hacker…

Catima — Loyalty Card Wallet | F-Droid - Free and Open Source Android App Repository

For your barcodes, memberships, loyalty programs, coupons and tickets.

Thejesh GN ⏚ ತೇಜೇಶ್ ಜಿ ಎನ್Dec 26

@fabio thank you. It looks good. I will use.

i use PassAndroid, a FOSS viewer on android it would be great to have a privacy friendly PWA.

@fabio
I use the Catima App for this and it is pretty convenient.

Jeff Fortin T. (風の庭園のNekohayo)Dec 28

@fabio
For those it may interest: let it be known that we also have a #GNOME application (called "Passes") for handling #PKPass or #esPass tickets, for #LinuxMobile travelers and partygoers in abandoned warehouses kitted up for a rave.

I would be happy to see someone contribute some sort of inter-app integration between "Passes" and GNOME Calendar someday: https://gitlab.gnome.org/GNOME/gnome-calendar/-/issues/1127

#GNOMECalendar #travelling #travel

Fascinating. I grabbed a .pkpass file from an airline and extracted it to see what was there. No background.png or stripe.png, but icon.png, footer.png, and logo.png.

Irenes (many)Jan 16

@fabio oh very nice! thank you!

Shirogane Ryu Jan 16

@fabio interesante, me imaginaba que ese formato sería algo parecido a lo que ha comentado.
También en la F-droid store hay alguna app que sirve para usar dicho formatos por si no se quiere usar una app privativa y conectada a saber que servidores