Re: [office] DSIG proposal - definition of URL case

[Michael Brauer - Sun Germany - ham02 - Hamburg <Michael.Brauer@Sun.COM>]

Dennis, Bob,

here are couple of thoughts from my side regarding this topic.

1. First of all, I think that the discussion what the base URI is for 
<ds:Reference> elements and whether external files can be referenced is 
unrelated to Bob's and Jomar's proposal. That means, I think we can vote 
on this today even though maybe further clarifications are required.

2. The digital signature proposal was initially made by the OOo team. 
The idea was that files within a package may get signed, but that 
references to external files are not permitted.

3. The initial proposal have been agreed already. What we state there 
was "Files within a package may have a digital signature applied. 
Digital signatures are stored in one or more files within the META-INF 
folder." This language does not explicitly state that digital signature 
files must not contain referenced to files outside the package, but it 
does so indirectly by stating that files within a package may get signed.

4. Regardless whether the package root or the META-INF folder would be 
considered to the base of relative URIs within the digital signature 
streams, it would technically be possible to reference files outside the 
package or the package itself. However, I would recommend to not permit 
this for ODF 1.2.

Best regards

Michael



On 01/12/09 03:42, Dennis E. Hamilton wrote:
> Thanks Bob,
> 
> Just for the record, is there any decision on exactly how the restriction on
> <ds:Reference> URI is to be stated and where it will be stated?
> 
>  - Dennis 
> 
> -----Original Message-----
> From: Bob Jolliffe [mailto:bobjolliffe@gmail.com] 
> Sent: Sunday, January 11, 2009 14:49
> To: dennis.hamilton@acm.org
> Cc: office TC; Jomar Silva; Michael Brauer
> Subject: Re: [office] DSIG proposal - external-sigining use case
> 
> Hi Dennis
> 
> It's an interesting use case.  There are perhaps even others.  
> [ ... ]
> 


-- 
Michael Brauer, Technical Architect Software Engineering
StarOffice/OpenOffice.org
Sun Microsystems GmbH             Nagelsweg 55
D-20097 Hamburg, Germany          michael.brauer@sun.com
http://sun.com/staroffice         +49 40 23646 500
http://blogs.sun.com/GullFOSS

Sitz der Gesellschaft: Sun Microsystems GmbH, Sonnenallee 1,
	   D-85551 Kirchheim-Heimstetten
Amtsgericht Muenchen: HRB 161028
Geschaeftsfuehrer: Thomas Schroeder, Wolfgang Engels, Dr. Roland Boemer
Vorsitzender des Aufsichtsrates: Martin Haering