Hi David,
I totally agree, and like mentioned before, every *file* (including the 0-length current.xml) has been signed
in the example :-)
If there's another *file* that should have been signed (but isn't), can you please give an example ? That's
probably something we've missed and then we'll correct it in our application. Thanks.
So that leaves us with zip entries like "Configurations/menubar/", if they are to be signed, then it should
IMHO be reflected in the spec (I wouldn't call this "a file", and the spec only says "shall contain a
<ds:Reference> element for each *file*" - 1.2cd05 part 1, but perhaps I'm misinterpreting "file" in this
context)
Regarding files not affecting content or appearance, I think it's not possible to be sure that a file does not
ever change content or appearance (might be implementation-specific), and signing applications may not
even have the slightest idea how ODF could be rendered (like our eID component: it parses some XML
and adds signatures, that's it)
Best regards,
Bart
________________________________________
From: David LeBlanc []
Sent: Saturday, September 25, 2010 10:29 PM
To: ; Hanssens Bart;
Cc: Cornelis Frank
Subject: RE: [office] RE: XAdES support in ODF
Right, but the current spec (which I did not change) says that everything should be signed. This would include 0-length files because if they got something in them, this would be a change.
If there are files that do not affect content or appearance, then we may not sign these, and should document them as such.
Sent from my phone, but I might be verbose - I have a keyboard...
-----Original Message-----
From: Dennis E. Hamilton <>
Sent: Friday, September 24, 2010 10:07 PM
To: David LeBlanc <>; 'Hanssens Bart' <>; <>
Cc: 'Cornelis Frank' <>
Subject: RE: [office] RE: XAdES support in ODF
You're right, the Configurations2\accelerator\current.xml should have been
signed, and it was. Oddly, they used the default transformation, but I
guess that is tolerable considering it is a 0-length file.
So I don't think they missed any that they weren't supposed to. They even
signed the mimetype, Thumbnails/thumbnail.png, manifest.rdf and
META-INF/manifest.xml. It looks like everything was signed that could be.
- Dennis
