RE: [office] RE: XAdES support in ODF

["Dennis E. Hamilton" <dennis.hamilton@acm.org>]

So, please capture the output of the unzip -l helloword-signed.odt and send
me the text file, since I can't duplicate that on my equipment.  

Oh wait, I got it.  There are [bogus?] entries in the global directory at
the end of the file that have no files in the Zip package itself.  They all
happen to have names ending in "\" according to WinZip, which I find passing
strange since I thought the separator in Zip is "/" so I am not sure how
much is literally the case or I have been using the wrong character all of
this time.

I've included a PNG of what WinZip says is in the file, in the order in
which the content appears in the file.

If I perform the Winzip integrity test on the file, here is the report I
get:

No errors detected in compressed data of
\\Whs\Users\orcmid\docs\associazione\standards\OASIS\ODF\Development\hellowo
rld-signed.odt.
Testing ...
testing: mimetype                 OK
testing: content.xml              OK
testing: manifest.rdf             OK
testing: styles.xml               OK
testing: meta.xml                 OK
testing: Thumbnails\thumbnail.png   OK
testing: Configurations2\accelerator\current.xml   OK
testing: Configurations2\progressbar\   OK
testing: Configurations2\floater\   OK
testing: Configurations2\popupmenu\   OK
testing: Configurations2\menubar\   OK
testing: Configurations2\toolbar\   OK
testing: Configurations2\images\Bitmaps\   OK
testing: Configurations2\statusbar\   OK
testing: settings.xml             OK
testing: META-INF\manifest.xml    OK
testing: META-INF\documentsignatures.xml   OK

I need to dig up a decent hex editor and see what is really going on in this
file.  I'll follow-up after I have done that.

-----Original Message-----
From: Hanssens Bart [mailto:Bart.Hanssens@fedict.be] 
Sent: Sunday, September 26, 2010 02:30
To: dennis.hamilton@acm.org; 'David LeBlanc'; office@lists.oasis-open.org
Cc: Cornelis Frank
Subject: RE: [office] RE: XAdES support in ODF

Dennis,

I use command line unzip 6.0 (ubuntu) which is based upon info-zip's code.
(unzip -l hello.. just lists the entries in the packages, without unzipping
to the file system)

Or, use hexdump and look at the end of the zip :-)

Which makes sense, because one can also zip (outside ODF context)
empty directories, and they get stored as well (probably with some flag that
says "this might be a directory", then we must check if it is allowed to do
so
within ODF, because the ODF packaging is more restrictive about this)

Bart

________________________________________
From: Dennis E. Hamilton [dennis.hamilton@acm.org]
Sent: Sunday, September 26, 2010 4:44 AM
To: Hanssens Bart; 'David LeBlanc'; office@lists.oasis-open.org
Cc: Cornelis Frank
Subject: RE: [office] RE: XAdES support in ODF

I don't believe there is such a Zip entry.  What tool are you using to look
at the Zip file?  (Do not use the built-in Windows shell that simulates
folders, or any Linux equivalent.  They may make a folder where there is
none in the Zip itself if there is a Zipped file that has that path as part
of its name.)

 - Dennis

-----Original Message-----
From: Hanssens Bart [mailto:Bart.Hanssens@fedict.be]
Sent: Saturday, September 25, 2010 16:26
To: dennis.hamilton@acm.org; 'David LeBlanc'; office@lists.oasis-open.org
Cc: Cornelis Frank
Subject: RE: [office] RE: XAdES support in ODF

Dennis,


uhm, perhaps I'm missing something here.

I'm not looking at the manifest at all, only at the zip.

There *is* a zip entry called "Configurations/menubar/".

Unzipping the .odt would map it to empty directories, but directories are
actually
also files (probably this is what you meant, David  ?), so indeed they
should also
be signed.


Best regards,

Bart


________________________________________
From: Dennis E. Hamilton [dennis.hamilton@acm.org]
Sent: Sunday, September 26, 2010 12:08 AM
To: Hanssens Bart; 'David LeBlanc'; office@lists.oasis-open.org
Cc: Cornelis Frank
Subject: RE: [office] RE: XAdES support in ODF

Bart, there is no Zip entry like "Configurations/menubar/".  The only way
for there to be a Zip entry is for there to be a Zip directory entry with
that name, and that means there would have to be a file in the package that
had that name.

There might be such a META-INF/manifest.xml <manifest:file-entry>, just as
there is for "/", but that isn't relevant to the signature procedure so long
as it isn't for a file in the Zip.

What am I missing?

 - Dennis

-----Original Message-----
From: Hanssens Bart [mailto:Bart.Hanssens@fedict.be]
Sent: Saturday, September 25, 2010 14:32
To: David LeBlanc; dennis.hamilton@acm.org; office@lists.oasis-open.org
Cc: Cornelis Frank
Subject: RE: [office] RE: XAdES support in ODF

[ ... ]

So that leaves us with zip entries like "Configurations/menubar/", if they
are to be signed, then it should
IMHO be reflected in the spec (I wouldn't call this "a file", and the spec
only says "shall contain a
<ds:Reference> element for each *file*" - 1.2cd05 part 1, but perhaps I'm
misinterpreting "file" in this
context)

[ ... ]


---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

F10xy59-2010-09-26-1109-WinZipSigFiles.png