The .clicinsitu file format

A template shared from the app, or delivered by MVT Conseil, travels in a .clicinsitu file. That file is encoded and signed, not encrypted: you can read it without us.

What the file contains

1. A single line of UTF-8 text: CLICINSITU_PACK_V1:<content>[.<signature>]. Extension .clicinsitu, type application/vnd.clicinsitu.
2. The content: the templates as JSON, compressed (gzip) then written as unpadded base64url — exactly the encoding of template QR codes.
3. The JSON: a list of templates, or an object {"schema": "clicinsitu/pack/v1", "meta": {…}, "models": […]}. Template names, the details they ask for, their recipients and their email texts are all readable as plain text.
4. The signature, optional: ECDSA P-256 (SHA256withECDSA) over the content bytes, with MVT Conseil's key. Valid: the app shows “ClicInSitu certified template”. Missing: “Template shared by a user”. Present but wrong: the file is refused.
5. The limits: 512 KB per file, 2 MB of JSON, 100 templates, and the same checks as a QR code. A file doesn't turn on configuration locking and doesn't contain a PIN.

Reading a file

You don't need the app to read it — three lines of Python are enough:

import base64, gzip, json
content = open("modele.clicinsitu", encoding="utf-8").read().strip().split(":", 1)[1].split(".")[0]
print(json.dumps(json.loads(gzip.decompress(base64.urlsafe_b64decode(content + "=="))), indent=2, ensure_ascii=False))

Public key used to check signatures (X.509, base64):

MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErIab062yMtMF0y1xXYI3OVA6Nsl6Ec3FW3nFWlgm9wuOlNo9HJdOjp+4YNpkctfFt443k5gstoMw1/ljh8W/uw==

Back to Security & privacy.