Postulo/postulo
Postulo/postulo
Watch
3
0
Fork
You've already forked postulo
 0
Code Issues 83 Pull requests Projects Releases 4 Packages 1 Wiki Activity Actions

Europass: find out what the platform exports today, and read it #244

New issue
Closed
opened 2026-09-16 11:59:23 +00:00 by tiagoagueda · 1 comment
tiagoagueda commented 2026-09-16 11:59:23 +00:00
Owner

Split out of #235, whose last bullet was a research task rather than a fix. #235 did the
three concrete things (levels left unset, record_language from the file's locale,
translated group labels) and deliberately left this one alone, because half-building a
reader against a format nobody here has seen is worse than not having one.

What we actually know

  • reader.read sniffs on the first non-whitespace byte: < is XML, { is JSON, anything
    else is refused with a message naming the two formats.
  • read_xml refuses anything with no LearnerInfo element; read_json accepts
    SkillsPassport.LearnerInfo or a bare LearnerInfo.
  • Both fixtures in tests/data/ are SkillsPassport. Neither came from europass.europa.eu
    this year.
  • A PDF is refused outright, because it starts with %.

What is plausible and unverified

The audit's claim is that today's Europass editor exports HR-Open Candidate XML, or a
PDF with the XML embedded, rather than SkillsPassport. Nobody has checked. If it is true,
"import your Europass CV" is a promise Postulo does not keep for anybody who made their CV
this year, and the refusal message tells them their own export is not a Europass file.

What to do first, before writing any code

Make a Europass CV on europass.europa.eu and download it in every format the Download
menu offers. Commit each as a fixture with the personal details replaced, the way
tests/data/europass.xml already is, and say in the file's comment what produced it and
when — that comment is the thing that stops the next person guessing again.

Then, depending on what came back

  • Still SkillsPassport-shaped. Nothing to build. Say so in the fixture comment and on
    Your career record, and close this.
  • HR-Open Candidate. A third reader behind the same importing.Record, which is what
    the Record shape exists for (#129). It cannot sniff on the first byte, since it is XML
    too, so read_xml grows a look at the root element's local name and dispatches; the
    refusal message then has to name three formats rather than two.
  • A PDF carrying the XML. This is the one that needs a decision rather than a patch.
    An embedded file lives in /Names /EmbeddedFiles and reaching it means parsing PDF
    structure, which Postulo has no dependency for today (WeasyPrint writes and never reads).
    Adding one is a supply-chain decision, and it is an untrusted-input decision besides: the
    uploaded file is a stranger's, so whatever is added has to be held to the same rules as
    the rest of the importer kind — the size cap before parsing, no object-stream bomb, and
    refuse_unreadable on what comes out of the attachment as well as on what went in,
    because the payload is a second file.

Also worth settling while looking

Whether the editor's PDF has any machine-readable payload at all any more. If it does not,
the upload form should say which file to choose rather than leaving somebody to find out by
being refused; accept=".xml,.json,…" on the input already hints at it, and the sentence
above it does not.

Split out of #235, whose last bullet was a research task rather than a fix. #235 did the three concrete things (levels left unset, `record_language` from the file's locale, translated group labels) and deliberately left this one alone, because half-building a reader against a format nobody here has seen is worse than not having one. ## What we actually know - `reader.read` sniffs on the first non-whitespace byte: `<` is XML, `{` is JSON, anything else is refused with a message naming the two formats. - `read_xml` refuses anything with no `LearnerInfo` element; `read_json` accepts `SkillsPassport.LearnerInfo` or a bare `LearnerInfo`. - Both fixtures in `tests/data/` are SkillsPassport. Neither came from europass.europa.eu this year. - A PDF is refused outright, because it starts with `%`. ## What is plausible and unverified The audit's claim is that today's Europass editor exports HR-Open **Candidate** XML, or a PDF with the XML embedded, rather than SkillsPassport. Nobody has checked. If it is true, "import your Europass CV" is a promise Postulo does not keep for anybody who made their CV this year, and the refusal message tells them their own export is not a Europass file. ## What to do first, before writing any code Make a Europass CV on europass.europa.eu and download it in **every** format the Download menu offers. Commit each as a fixture with the personal details replaced, the way `tests/data/europass.xml` already is, and say in the file's comment what produced it and when — that comment is the thing that stops the next person guessing again. ## Then, depending on what came back - **Still SkillsPassport-shaped.** Nothing to build. Say so in the fixture comment and on *Your career record*, and close this. - **HR-Open Candidate.** A third reader behind the same `importing.Record`, which is what the `Record` shape exists for (#129). It cannot sniff on the first byte, since it is XML too, so `read_xml` grows a look at the root element's local name and dispatches; the refusal message then has to name three formats rather than two. - **A PDF carrying the XML.** This is the one that needs a decision rather than a patch. An embedded file lives in `/Names /EmbeddedFiles` and reaching it means parsing PDF structure, which Postulo has no dependency for today (WeasyPrint writes and never reads). Adding one is a supply-chain decision, and it is an untrusted-input decision besides: the uploaded file is a stranger's, so whatever is added has to be held to the same rules as the rest of the importer kind — the size cap before parsing, no object-stream bomb, and `refuse_unreadable` on what comes *out* of the attachment as well as on what went in, because the payload is a second file. ## Also worth settling while looking Whether the editor's PDF has any machine-readable payload at all any more. If it does not, the upload form should say which file to choose rather than leaving somebody to find out by being refused; `accept=".xml,.json,…"` on the input already hints at it, and the sentence above it does not.
tiagoagueda added this to the 0.4.0 milestone 2026-09-16 11:59:23 +00:00
tiagoagueda modified the milestone from 0.4.0 to 0.5.0 2026-09-19 10:31:12 +00:00
tiagoagueda commented 2026-09-29 13:22:08 +00:00
Author
Owner

What europass.europa.eu exports today: the research for #244

Done on 2026-09-29 from public sources only: no account was created, nothing was signed into, and no personal data was sent anywhere. Every page below was fetched that day. Nobody here has downloaded a CV from the platform, so the issue's first step (a person making a CV and downloading it) has still not been done; it is #318 now, with the steps.

Summary

Claim Confidence Sources
The editor's only download is a PDF. It offers no XML and no JSON. High 1, 12
The PDF carries the CV as an attached XML file, and the editor imports that PDF again. High 3, 1, 12, 13, 14
The attachment is called attachment.xml. Medium-high 12, 13. Postulo does not depend on the name.
It is Flate-packed in a /Type /EmbeddedFile stream written by pdf-lib, with /AF on the catalogue, and the PDF is not encrypted. Medium 13 only. The reader also takes an uncompressed stream and refuses anything else with the reason.
The XML's root is Candidate in http://www.europass.eu/1.0, beside hr: (http://www.hr-xml.org/3), oa: (http://www.openapplications.org/oagis/9) and eures: (http://www.europass_eures.eu/1.0). It is HR Open Standards 3.2 (majorVersionID="3" minorVersionID="2"). High 4, 5, 6, 12, 13
The published schema is "Europass XML schema definition v4.0.1". Its Candidate.xsd reads "Europass2 1.0.1, 02 June 2020", and the documentation is v3.0.0 of 17/02/2020. High 3, 4, 5
Exports do not follow that schema to the letter: they carry RenderingInformation, a Skills block and CourseCertifications, none of which it defines, and put children in a different order. Medium 12 shows Candidate.RenderingInformation; 13 shows the rest. The examples in 13 fail validation against the official XSD at exactly those places (checked with lxml).
Nothing produces the old SkillsPassport XML any more; it came from Cedefop's editor, replaced in July 2020. High 2, 7, 11
The old SkillsPassport JSON was never a download from any Europass editor. Cedefop's REST API wrote it (/v1/document/to/json), and that host now fails TLS with a revoked certificate. High that it was never a download; medium that nothing produces it 10, 11
What Postulo said until now, that the JSON is "what europass.europa.eu exports today", was wrong. High All of the above

Sources

The European Commission's own

  1. Europass FAQ, second page: https://europass.europa.eu/en/faq?page=1
    • "In which format can I save my Europass CV? Currently, you can save your Europass CV in a Europass PDF version."
    • "If you are a guest user, you can import your Europass CV to the Online Editor and make any changes you need and download the CV again."
  2. Europass FAQ, third page: https://europass.europa.eu/en/faq?page=2
    • "The new Europass was launched in July 2020."
    • "Your old Europass CVs and Cover letters downloaded as PDF or XML formats can be imported to the new Europass when you: Create your Europass profile. Create or update your Europass CV or cover letter using the online editor."
    • "You will not be able to import your old Europass CVs or cover letters if you have them in formats such as Word, ODF or PDF documents created from the offline editable formats."
  3. ePortfolio | Interoperability: https://europa.eu/europass/en/eportfolio-interoperability
    • Live, it now answers 403 ("You are not authorized to access this page").
    • The Internet Archive's copies of 2020-12-29 and 2021-08-24 (https://web.archive.org/web/20210824203909/https://europa.eu/europass/en/eportfolio-interoperability) say:
      • "The Europass XML is based on the HR-Open Standards and EURES specifications."
      • "Individuals, who use the Europass Online Editors to produce their Europass Curriculum Vitae, have the option to receive the document in PDF format with the XML attached."
      • "The latest Europass XML Schema is version 4.0.1 … currently supported by the following Europass services: e-Profile, CV online editor."
      • "the new CV online editor is backward compatible: it is possible to upload an XML or PDF+XML document that is based on Europass XML schema version 4.0.1."
    • The page linked the schema zip, the documentation and a sample, and listed v3.4.0 as "only kept for backward compatibility purposes and historical reasons".
  4. The schema: https://europass.europa.eu/system/files/2020-07/ECV_DLV_20200714_4.0.1.zip
    • 5,078,205 bytes, SHA-256 14591a994ddd66111d6e0ef3c64086a4680102047c280a946091f8b78ebeee9f.
    • ECV_XSD/org_europass/1.0.1/Developer/Nouns/Candidate.xsd has root Candidate and target namespace http://www.europass.eu/1.0.
    • The zip also holds the EURES, HR Open 3.2 and OAGIS schemas; Schematron rules; a crosswalk, Legacy Europass XML to Europass2 v2.0.xlsx; a draft JSON serialisation (ECV_JsonSchema_v4.1_S0.7.json, root key Candidate), which nothing shows being produced for people; and the sample below.
  5. "EUROPASS2 CV XML Schema Documentation" v3.0.0 (DG EMPL, 160 pages): https://europass.europa.eu/system/files/2020-08/ECV_Schema_Documentation_v3.0.0_20200602.pdf
    • It gives the root, the four namespaces, and "Compulsory use of the version 3.2 of HR-OS".
    • It covers "the Europass Curriculum Vitae (ECV) for the new release of the Europass portal".
    • Its sentence about receiving the CV "in Europass XML format or PDF format with the XML attached" is copied word for word from the v3.4.0 documentation (7), so on its own it is weak evidence about the new editor. That is why 3 and 1 matter.
  6. The Commission's sample: https://europass.europa.eu/system/files/2020-07/CandidateSample1%28based%20on%20EURES_Conformant_mandatory_v1.3%29_0.xml
    • 7,208 bytes, SHA-256 24674c0e7507fc838c0794b619d5590b5f486f284ac280049ba348a8ab1347b4.
    • It validates against 4, holds placeholder data, and is committed as tests/data/europass-candidate-sample.xml.
  7. Europass XML Schema V3.4.0 documentation (Cedefop): https://europass.europa.eu/system/files/2020-07/europass-xml-schema-doc-v3.4.0_0.pdf
    • The old format: root SkillsPassport, namespace http://europass.cedefop.europa.eu/Europass, last changed October 2019, with a RESTful API.
  8. The old schema archive: https://europass.europa.eu/system/files/2020-07/XML%20Archived.zip (downloaded, not needed further).
  9. Pages that no longer link the CV schema:

Cedefop's old platform

  1. The old hosts: https://europass.cedefop.europa.eu/ (the editor and /rest) and https://interop.europass.cedefop.europa.eu/ both failed the TLS handshake with "certificate is revoked". That shows they cannot be used, not that they are switched off.
  2. Cedefop's editor source, EWA: https://github.com/europass/ewa-cedefop, last commit fee3b9758c of 2020-06-11.
    • ExportInfo.js lists the download formats as PDF (default, uploadable), Word, ODT and XML, and no JSON.
    • Constants.java names the attachment Europass-XML-Attachment.xml.
    • https://github.com/europass/rest-examples-java lists /v1/document/to/json: the JSON belonged to the API, not the editor.

Independent accounts of real downloads

  1. Lucio Benfante, "Generating a Resume from Europass", 21 March 2025: https://www.benfante.com/en/blog/generating-resume-from-europass/
    • "you can … download the resume in PDF format".
    • "For a time, it seemed possible to download your resume data in XML format … but this no longer appears to be an option".
    • "Within the PDF, there is an attachment … containing the resume in XML format".
    • He extracts it with pdfdetach -savefile attachment.xml, reads Candidate.RenderingInformation[0].ClosingStatement[0].Date[0]['hr:FormattedDateTime'], and links 5 as the documentation.
  2. europass-cv (Stefano Zeppieri), CC BY 4.0, created 2026-09-18, commit 2478b3497d: https://github.com/J0ker98/europass-cv
    • "from real exports" (two, July 2026), from the editor's code and from its importer.
    • attachment.xml, text/xml, made with pdf-lib, with /Desc, /UF and /AF, packed with FlateDecode.
    • RenderingInformation/SectionsOrder; a Skills block of PersonCompetency entries with TaxonomyID Digital_Skill; three-letter language codes; lower-case country codes.
    • It says the importer rejects SkillsPassport v3 as an old format, which contradicts 2; this is not resolved.
    • It says the Commission publishes no schema, which 4 contradicts.
  3. php-europass, MIT, created 2026-09-25: https://github.com/diogogithub/php-europass
    • It embeds Candidate XML as attachment.xml in LaTeX PDFs.
    • "Full-CV imports were checked in both the Europass CV editor and profile wizard." That corroborates the import side.
  4. gmazzamuto/europasscv issue #33 (2018): https://github.com/gmazzamuto/europasscv/issues/33. The old platform's PDFs carried Europass-XML-Attachment.xml, made with iText. History only.

What was built on it (ac2696504)

  • A third reader, plugins/europass/candidate.py, behind the same importing.Record.
    • read_xml dispatches on the root element's name and namespace. A Candidate from another namespace is refused with a message naming both XML formats.
    • Elements are matched by local name; neither order nor presence is relied on.
    • Fields are mapped as the Commission's crosswalk maps them.
    • Language codes are named in the CV's language; a code that cannot be named is kept as the code.
    • HTML in the long fields becomes text.
    • A profile section with content and nowhere to go is named on the review page.
  • The PDF, plugins/europass/pdf.py, needs no new dependency.
    • It finds /Type /EmbeddedFile streams, which works however much else is compressed.
    • It inflates Flate under a hard 5 MB cap on the output, then hands the result to the same readers as a second file, so the size cap and the DOCTYPE refusal apply again.
    • It refuses, with the reason and what to upload instead: encryption, other filters, damage, a bomb, nothing attached, or no Europass attachment.
    • Old Cedefop PDFs read the same way.
    • At most 8 attachments and 32 markers are examined.
  • The words: the upload page, the plugin description, the refusals and the review page's line saying which format was read.
  • Fixtures: tests/data/europass-candidate.xml, written by hand from the schema and validated against it; tests/data/europass-candidate-sample.xml, the Commission's sample; test PDFs built in the test module. None is a real download.
  • Not built: a reader for the Skills block, since only 13 describes it; a reader for the draft Candidate JSON; country names, since the format gives codes.

What is still unverified

Whether a PDF downloaded today marks its attachment /Type /EmbeddedFile and packs it with Flate, which sections it holds, and whether digital skills now live in the Skills block. The step that settles all three can only be taken by a person, and it is #318.

## What europass.europa.eu exports today: the research for #244 Done on 2026-09-29 from public sources only: no account was created, nothing was signed into, and no personal data was sent anywhere. Every page below was fetched that day. Nobody here has downloaded a CV from the platform, so the issue's first step (a person making a CV and downloading it) has still not been done; it is #318 now, with the steps. ### Summary | Claim | Confidence | Sources | | --- | --- | --- | | The editor's only download is a PDF. It offers no XML and no JSON. | High | 1, 12 | | The PDF carries the CV as an attached XML file, and the editor imports that PDF again. | High | 3, 1, 12, 13, 14 | | The attachment is called `attachment.xml`. | Medium-high | 12, 13. Postulo does not depend on the name. | | It is Flate-packed in a `/Type /EmbeddedFile` stream written by pdf-lib, with `/AF` on the catalogue, and the PDF is not encrypted. | Medium | 13 only. The reader also takes an uncompressed stream and refuses anything else with the reason. | | The XML's root is `Candidate` in `http://www.europass.eu/1.0`, beside `hr:` (`http://www.hr-xml.org/3`), `oa:` (`http://www.openapplications.org/oagis/9`) and `eures:` (`http://www.europass_eures.eu/1.0`). It is HR Open Standards 3.2 (`majorVersionID="3" minorVersionID="2"`). | High | 4, 5, 6, 12, 13 | | The published schema is "Europass XML schema definition v4.0.1". Its `Candidate.xsd` reads "Europass2 1.0.1, 02 June 2020", and the documentation is v3.0.0 of 17/02/2020. | High | 3, 4, 5 | | Exports do not follow that schema to the letter: they carry `RenderingInformation`, a `Skills` block and `CourseCertifications`, none of which it defines, and put children in a different order. | Medium | 12 shows `Candidate.RenderingInformation`; 13 shows the rest. The examples in 13 fail validation against the official XSD at exactly those places (checked with lxml). | | Nothing produces the old SkillsPassport XML any more; it came from Cedefop's editor, replaced in July 2020. | High | 2, 7, 11 | | The old SkillsPassport JSON was never a download from any Europass editor. Cedefop's REST API wrote it (`/v1/document/to/json`), and that host now fails TLS with a revoked certificate. | High that it was never a download; medium that nothing produces it | 10, 11 | | What Postulo said until now, that the JSON is "what europass.europa.eu exports today", was wrong. | High | All of the above | ### Sources **The European Commission's own** 1. **Europass FAQ, second page:** https://europass.europa.eu/en/faq?page=1 - "In which format can I save my Europass CV? Currently, you can save your Europass CV in a Europass PDF version." - "If you are a guest user, you can import your Europass CV to the Online Editor and make any changes you need and download the CV again." 2. **Europass FAQ, third page:** https://europass.europa.eu/en/faq?page=2 - "The new Europass was launched in July 2020." - "Your old Europass CVs and Cover letters downloaded as PDF or XML formats can be imported to the new Europass when you: Create your Europass profile. Create or update your Europass CV or cover letter using the online editor." - "You will not be able to import your old Europass CVs or cover letters if you have them in formats such as Word, ODF or PDF documents created from the offline editable formats." 3. **ePortfolio | Interoperability:** https://europa.eu/europass/en/eportfolio-interoperability - Live, it now answers 403 ("You are not authorized to access this page"). - The Internet Archive's copies of 2020-12-29 and 2021-08-24 (https://web.archive.org/web/20210824203909/https://europa.eu/europass/en/eportfolio-interoperability) say: - "The Europass XML is based on the HR-Open Standards and EURES specifications." - "Individuals, who use the Europass Online Editors to produce their Europass Curriculum Vitae, have the option to receive the document in PDF format with the XML attached." - "The latest Europass XML Schema is version 4.0.1 … currently supported by the following Europass services: e-Profile, CV online editor." - "the new CV online editor is backward compatible: it is possible to upload an XML or PDF+XML document that is based on Europass XML schema version 4.0.1." - The page linked the schema zip, the documentation and a sample, and listed v3.4.0 as "only kept for backward compatibility purposes and historical reasons". 4. **The schema:** https://europass.europa.eu/system/files/2020-07/ECV_DLV_20200714_4.0.1.zip - 5,078,205 bytes, SHA-256 `14591a994ddd66111d6e0ef3c64086a4680102047c280a946091f8b78ebeee9f`. - `ECV_XSD/org_europass/1.0.1/Developer/Nouns/Candidate.xsd` has root `Candidate` and target namespace `http://www.europass.eu/1.0`. - The zip also holds the EURES, HR Open 3.2 and OAGIS schemas; Schematron rules; a crosswalk, `Legacy Europass XML to Europass2 v2.0.xlsx`; a draft JSON serialisation (`ECV_JsonSchema_v4.1_S0.7.json`, root key `Candidate`), which nothing shows being produced for people; and the sample below. 5. **"EUROPASS2 CV XML Schema Documentation" v3.0.0** (DG EMPL, 160 pages): https://europass.europa.eu/system/files/2020-08/ECV_Schema_Documentation_v3.0.0_20200602.pdf - It gives the root, the four namespaces, and "Compulsory use of the version 3.2 of HR-OS". - It covers "the Europass Curriculum Vitae (ECV) for the new release of the Europass portal". - Its sentence about receiving the CV "in Europass XML format or PDF format with the XML attached" is copied word for word from the v3.4.0 documentation (7), so on its own it is weak evidence about the new editor. That is why 3 and 1 matter. 6. **The Commission's sample:** https://europass.europa.eu/system/files/2020-07/CandidateSample1%28based%20on%20EURES_Conformant_mandatory_v1.3%29_0.xml - 7,208 bytes, SHA-256 `24674c0e7507fc838c0794b619d5590b5f486f284ac280049ba348a8ab1347b4`. - It validates against 4, holds placeholder data, and is committed as `tests/data/europass-candidate-sample.xml`. 7. **Europass XML Schema V3.4.0 documentation (Cedefop):** https://europass.europa.eu/system/files/2020-07/europass-xml-schema-doc-v3.4.0_0.pdf - The old format: root `SkillsPassport`, namespace `http://europass.cedefop.europa.eu/Europass`, last changed October 2019, with a RESTful API. 8. **The old schema archive:** https://europass.europa.eu/system/files/2020-07/XML%20Archived.zip (downloaded, not needed further). 9. **Pages that no longer link the CV schema:** - https://europass.europa.eu/en/information-developers (digital credentials and the European Learning Model only); - https://europass.europa.eu/en/stakeholders/interoperability-europass; - https://europass.europa.eu/en/europass-profile-and-interoperability. **Cedefop's old platform** 10. **The old hosts:** https://europass.cedefop.europa.eu/ (the editor and `/rest`) and https://interop.europass.cedefop.europa.eu/ both failed the TLS handshake with "certificate is revoked". That shows they cannot be used, not that they are switched off. 11. **Cedefop's editor source, EWA:** https://github.com/europass/ewa-cedefop, last commit `fee3b9758c` of 2020-06-11. - `ExportInfo.js` lists the download formats as PDF (default, uploadable), Word, ODT and XML, and no JSON. - `Constants.java` names the attachment `Europass-XML-Attachment.xml`. - https://github.com/europass/rest-examples-java lists `/v1/document/to/json`: the JSON belonged to the API, not the editor. **Independent accounts of real downloads** 12. **Lucio Benfante, "Generating a Resume from Europass"**, 21 March 2025: https://www.benfante.com/en/blog/generating-resume-from-europass/ - "you can … download the resume in PDF format". - "For a time, it seemed possible to download your resume data in XML format … but this no longer appears to be an option". - "Within the PDF, there is an attachment … containing the resume in XML format". - He extracts it with `pdfdetach -savefile attachment.xml`, reads `Candidate.RenderingInformation[0].ClosingStatement[0].Date[0]['hr:FormattedDateTime']`, and links 5 as the documentation. 13. **europass-cv (Stefano Zeppieri)**, CC BY 4.0, created 2026-09-18, commit `2478b3497d`: https://github.com/J0ker98/europass-cv - "from real exports" (two, July 2026), from the editor's code and from its importer. - `attachment.xml`, `text/xml`, made with pdf-lib, with `/Desc`, `/UF` and `/AF`, packed with FlateDecode. - `RenderingInformation/SectionsOrder`; a `Skills` block of `PersonCompetency` entries with `TaxonomyID` `Digital_Skill`; three-letter language codes; lower-case country codes. - It says the importer rejects SkillsPassport v3 as an old format, which contradicts 2; this is not resolved. - It says the Commission publishes no schema, which 4 contradicts. 14. **php-europass**, MIT, created 2026-09-25: https://github.com/diogogithub/php-europass - It embeds Candidate XML as `attachment.xml` in LaTeX PDFs. - "Full-CV imports were checked in both the Europass CV editor and profile wizard." That corroborates the import side. 15. **gmazzamuto/europasscv issue #33** (2018): https://github.com/gmazzamuto/europasscv/issues/33. The old platform's PDFs carried `Europass-XML-Attachment.xml`, made with iText. History only. ### What was built on it (`ac2696504`) - **A third reader**, `plugins/europass/candidate.py`, behind the same `importing.Record`. - `read_xml` dispatches on the root element's name and namespace. A `Candidate` from another namespace is refused with a message naming both XML formats. - Elements are matched by local name; neither order nor presence is relied on. - Fields are mapped as the Commission's crosswalk maps them. - Language codes are named in the CV's language; a code that cannot be named is kept as the code. - HTML in the long fields becomes text. - A profile section with content and nowhere to go is named on the review page. - **The PDF**, `plugins/europass/pdf.py`, needs no new dependency. - It finds `/Type /EmbeddedFile` streams, which works however much else is compressed. - It inflates Flate under a hard 5 MB cap on the output, then hands the result to the same readers as a second file, so the size cap and the DOCTYPE refusal apply again. - It refuses, with the reason and what to upload instead: encryption, other filters, damage, a bomb, nothing attached, or no Europass attachment. - Old Cedefop PDFs read the same way. - At most 8 attachments and 32 markers are examined. - **The words:** the upload page, the plugin description, the refusals and the review page's line saying which format was read. - **Fixtures:** `tests/data/europass-candidate.xml`, written by hand from the schema and validated against it; `tests/data/europass-candidate-sample.xml`, the Commission's sample; test PDFs built in the test module. None is a real download. - **Not built:** a reader for the `Skills` block, since only 13 describes it; a reader for the draft Candidate JSON; country names, since the format gives codes. ### What is still unverified Whether a PDF downloaded today marks its attachment `/Type /EmbeddedFile` and packs it with Flate, which sections it holds, and whether digital skills now live in the `Skills` block. The step that settles all three can only be taken by a person, and it is #318.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
weblate
b9-1165
f-1101
f-1100
f-1102
0.5.0
0.3.0
v0.5.0
v0.4.0
v0.3.0
v0.2.1
v0.2.0
v0.1.0
Labels
Clear labels   
accessibility
Usable by everyone, including people with disabilities: one of the project's stated missions

  
authentication
Signing in, and proving who you are

  
breaking change
Changes behaviour or data in a way operators must act on

  
bug
Something does not do what it says it does

  
documentation
The wiki, the docs, or the words in the interface

  
enhancement
An improvement or a new capability

  
interface
The shape of the pages: what is where, and how it reads

  
internationalisation
Languages, regions, and the formats and symbols that go with them

  
observability
What an operator can see about a running instance: metrics, logs, health

  
performance
Uses fewer resources, or is more reliable, with no loss of features or accessibility

  
security
Keeping the code and the data secure: one of the project's stated missions

  
tier
1
 Easy: small, self-contained, no prerequisites

  
tier
2
 High-severity security: account access, personal data, the boundaries

  
tier
3
 Foundations: prerequisite work that unblocks other issues

  
tier/4
Later: large features and long-horizon work

No labels
accessibility
authentication
breaking change
bug
documentation
enhancement
interface
internationalisation
observability
performance
security
tier
1
tier
2
tier
3
tier/4
Milestone
Clear milestone
No items
No milestone
0.5.0
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Postulo/postulo#244
No description provided.