Re: [office] DSIG proposal - URI vs.

[Michael Brauer - Sun Germany - ham02 - Hamburg <Michael.Brauer@Sun.COM>]

Bob, Dennis,

On 06.01.09 13:54, Bob Jolliffe wrote:
> Hi Dennis
> 
> 2009/1/5 Dennis E. Hamilton <dennis.hamilton@acm.org>:

>> 3. SUGGESTION: In this case I would recommend using the definition of 17.5
>> (which is in the package section for ODF 1.1 and which still needs to be
>> cleaned up to resolve some defect-report concerns) with the modification
>> that "/" is the root of the package and not of the directory containing the
>> package.  (It is important not to have to know the filename of the package
>> in order to refer to it.)
> 
> Current implementations use the following convention for the
> <ds:Reference> URL attribute:
>  <Reference URI="content.xml">
>  <Reference URI="Thumbnails/thumbnails.png">
> 
> The discussion is about the Base URI to be used rather than the root.

I agree. The question is whether we use the URI that was used to 
retrieve the package as base URI, or that URI with "/META-INF" appended. 
So, we indeed could take everything we say in 17.5, but only adapt the 
base URI that is used.


> If there were no existing implementations, then I would have suggested
> the same as you.  But there are and it doesn't make sense to make a

Well, independent of what is implemented, I think there could be reasons 
to use the URI that was used to retrieve the package as base URI, 
although the files are in the META-INF folder. The signature files like 
the manifest.xml are information that make up the package. That they are 
stored in a folder META-INF can be considered to be an implementation 
detail of the package. We could have stored this information in some 
other place (which is not a folder in the zip files) if zip files would 
allow us to do so. I would not prefer this actually, because having the 
package related information in a META-INF folder makes that information 
accessible and is consistent with JAR files. I'm only mentioning this to 
point out how the signature information differs from let's say 
information in content.xml.

So, what I actually could imagine is that we modify 17.5 by adding that 
these rules also apply to files in the META-INF folder (in general, and 
not only for digital signature files), except that the base URI to use 
there is the one that was used to retrieve the package.

Best regards

Michael


-- 
Michael Brauer, Technical Architect Software Engineering
StarOffice/OpenOffice.org
Sun Microsystems GmbH             Nagelsweg 55
D-20097 Hamburg, Germany          michael.brauer@sun.com
http://sun.com/staroffice         +49 40 23646 500
http://blogs.sun.com/GullFOSS

Sitz der Gesellschaft: Sun Microsystems GmbH, Sonnenallee 1,
	   D-85551 Kirchheim-Heimstetten
Amtsgericht Muenchen: HRB 161028
Geschaeftsfuehrer: Thomas Schroeder, Wolfgang Engels, Dr. Roland Boemer
Vorsitzender des Aufsichtsrates: Martin Haering