Postulo/postulo
Postulo/postulo
Watch
3
0
Fork
You've already forked postulo
 0
Code Issues 83 Pull requests Projects Releases 4 Packages 1 Wiki Activity Actions

Check the Europass reader against a CV downloaded from europass.europa.eu today #318

New issue
Open
opened 2026-09-29 13:10:43 +00:00 by tiagoagueda · 1 comment
tiagoagueda commented 2026-09-29 13:10:43 +00:00
Owner

#244 is closed by ac2696504: Postulo reads the PDF europass.europa.eu gives out, through the Candidate XML attached inside it, and the older SkillsPassport XML, PDF and JSON as before. What it reads was worked out from the Commission's published schema (v4.0.1), its sample file, and two published accounts of real downloads (2025 and 2026). The research, with every source, is the comment on #244.

Nobody has yet downloaded a CV from the platform and tried it. That is the step this issue is for, and only a person can take it: making a CV there means using the site, and the check must be done with invented details.

What is not confirmed

  • Whether a PDF downloaded today carries its attachment as a stream marked /Type /EmbeddedFile and packed with Flate. The one account that looked says so; the PDF specification makes /Type optional, and without it the reader would say the PDF has nothing attached.
  • Which sections a download holds today. One account shows a Skills block (digital skills, as PersonCompetency with TaxonomyID Digital_Skill) that the published schema does not define. The reader names it on the review page as not read rather than guessing.

The steps

  1. On europass.europa.eu, as a guest or signed in, make a CV with invented details and no photo, in English:
    • two jobs, one current, with bulleted descriptions;
    • an education entry with a final grade and an EQF level;
    • a mother tongue, and a foreign language with all five levels;
    • digital skills, some loose and some in a named group;
    • a project and a custom section;
    • a website and an ORCID address.
  2. Open Download, note every entry it offers (the sources say PDF only), and download each.
  3. Look inside the PDF: pdfinfo europass.pdf (encryption), pdfdetach -list europass.pdf (the attachment's name), pdfdetach -save 1 -o attachment.xml europass.pdf.
  4. Read the XML for anything real before committing it. Signed in, CandidateSupplier/PersonContact may hold the account's email: replace it with alex@example.org. Then commit tests/data/europass-download-YYYY-MM-DD.pdf unchanged and tests/data/europass-download-YYYY-MM-DD.xml with a first comment saying where and when it was downloaded, that its details are invented, and what was replaced.
  5. uv run python manage.py import_europass tests/data/europass-download-YYYY-MM-DD.pdf --user <you> --dry-run, then upload the PDF at Documents → Your career → Import and compare with what was typed, especially the line "Some sections of the file have nowhere to go…".
  6. Add test_a_real_download_reads to tests/test_europass_candidate.py over the committed PDF, asserting the counts, source == "pdf-candidate" and record.skipped. That is the test that means something. If the review page names Skills, map Skills/PersonCompetency and SkillsGroup/Title onto skill groups; the note then goes away by itself.

Done when

  • A real download is committed, with its provenance, and read by a test.
  • The wiki's Not yet checked against a real download section in Your career record is removed or narrowed to what is still unknown.
#244 is closed by `ac2696504`: Postulo reads the PDF europass.europa.eu gives out, through the Candidate XML attached inside it, and the older SkillsPassport XML, PDF and JSON as before. What it reads was worked out from the Commission's published schema (v4.0.1), its sample file, and two published accounts of real downloads (2025 and 2026). The research, with every source, is the comment on #244. **Nobody has yet downloaded a CV from the platform and tried it.** That is the step this issue is for, and only a person can take it: making a CV there means using the site, and the check must be done with invented details. ## What is not confirmed - Whether a PDF downloaded today carries its attachment as a stream marked `/Type /EmbeddedFile` and packed with Flate. The one account that looked says so; the PDF specification makes `/Type` optional, and without it the reader would say the PDF has nothing attached. - Which sections a download holds today. One account shows a `Skills` block (digital skills, as `PersonCompetency` with `TaxonomyID` `Digital_Skill`) that the published schema does not define. The reader names it on the review page as not read rather than guessing. ## The steps 1. On europass.europa.eu, as a guest or signed in, make a CV with **invented details** and no photo, in English: - two jobs, one current, with bulleted descriptions; - an education entry with a final grade and an EQF level; - a mother tongue, and a foreign language with all five levels; - digital skills, some loose and some in a named group; - a project and a custom section; - a website and an ORCID address. 2. Open **Download**, note every entry it offers (the sources say PDF only), and download each. 3. Look inside the PDF: `pdfinfo europass.pdf` (encryption), `pdfdetach -list europass.pdf` (the attachment's name), `pdfdetach -save 1 -o attachment.xml europass.pdf`. 4. Read the XML for anything real before committing it. Signed in, `CandidateSupplier/PersonContact` may hold the account's email: replace it with `alex@example.org`. Then commit `tests/data/europass-download-YYYY-MM-DD.pdf` unchanged and `tests/data/europass-download-YYYY-MM-DD.xml` with a first comment saying where and when it was downloaded, that its details are invented, and what was replaced. 5. `uv run python manage.py import_europass tests/data/europass-download-YYYY-MM-DD.pdf --user <you> --dry-run`, then upload the PDF at *Documents → Your career → Import* and compare with what was typed, especially the line "Some sections of the file have nowhere to go…". 6. Add `test_a_real_download_reads` to `tests/test_europass_candidate.py` over the committed PDF, asserting the counts, `source == "pdf-candidate"` and `record.skipped`. That is the test that means something. If the review page names `Skills`, map `Skills/PersonCompetency` and `SkillsGroup/Title` onto skill groups; the note then goes away by itself. ## Done when - A real download is committed, with its provenance, and read by a test. - The wiki's *Not yet checked against a real download* section in *Your career record* is removed or narrowed to what is still unknown.
tiagoagueda added this to the 0.5.0 milestone 2026-09-29 18:38:04 +00:00
tiagoagueda modified the milestone from 0.5.0 to 0.6.0 2026-10-31 15:55:19 +00:00
tiagoagueda commented 2026-10-31 15:55:19 +00:00
Author
Owner

Moved to 0.6.0 at the maintainer's word (2026-10-31), to release 0.5.0 today. PR #1183 (0.5.0) makes the reader find an attachment however the PDF names or lists it, and commits a real current-editor Candidate XML (MIT, invented data). What is left is the issue's 'done when': a CV downloaded from the editor itself, which needs an EU Login account, so the maintainer's own download.

Moved to 0.6.0 at the maintainer's word (2026-10-31), to release 0.5.0 today. PR #1183 (0.5.0) makes the reader find an attachment however the PDF names or lists it, and commits a real current-editor Candidate XML (MIT, invented data). What is left is the issue's 'done when': a CV downloaded from the editor itself, which needs an EU Login account, so the maintainer's own download.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
weblate
b9-1165
f-1101
f-1100
f-1102
0.5.0
0.3.0
v0.5.0
v0.4.0
v0.3.0
v0.2.1
v0.2.0
v0.1.0
Labels
Clear labels   
accessibility
Usable by everyone, including people with disabilities: one of the project's stated missions

  
authentication
Signing in, and proving who you are

  
breaking change
Changes behaviour or data in a way operators must act on

  
bug
Something does not do what it says it does

  
documentation
The wiki, the docs, or the words in the interface

  
enhancement
An improvement or a new capability

  
interface
The shape of the pages: what is where, and how it reads

  
internationalisation
Languages, regions, and the formats and symbols that go with them

  
observability
What an operator can see about a running instance: metrics, logs, health

  
performance
Uses fewer resources, or is more reliable, with no loss of features or accessibility

  
security
Keeping the code and the data secure: one of the project's stated missions

  
tier
1
 Easy: small, self-contained, no prerequisites

  
tier
2
 High-severity security: account access, personal data, the boundaries

  
tier
3
 Foundations: prerequisite work that unblocks other issues

  
tier/4
Later: large features and long-horizon work

No labels
accessibility
authentication
breaking change
bug
documentation
enhancement
interface
internationalisation
observability
performance
security
tier
1
tier
2
tier
3
tier/4
Milestone
Clear milestone
No items
No milestone
0.6.0
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Postulo/postulo#318
No description provided.