Hello,
my name is Steve Martin and I am an enrolled student at the Ruhr
University Bochum. I have a question regarding the implementation of the
signature process in LibreOffice.
I use a self-created X.509 certificate for signing my ODT documents.
As soon as I sign my ODT document, the file "documentsignatures.xml" is
created in the META-INF folder in the OpenDocument package. Before I
signed my ODT document, I had decompressed the ODT document and added an
additional file entry in META-INF/manifest.xml:
<manifest:file-entry manifest:full-path="Thumbnails/meta.xml"
manifest:media-type="text/xml"/>
Then I saved the manifest.xml file and compressed all the files back
into a ZIP package. I can now open this file with LibreOffice and sign
it with my X.509 certificate.
After I signed the document, I decompressed it again and copied the
meta.xml file into the Thumbnails directory. Thanks to the previously
added file entry in the manifest.xml file, I can now compress all the
partial files back into a ZIP archive and open the document with
LibreOffice as normal, without being shown the message that the file is
corrupted.
However, I don't understand why do I get now the message that the
signature is not valid? I decompressed the ODT document with the invalid
signature and compared the documentsignatures.xml file contained in the
META-INF folder with the documentsignatures.xml file that was created
immediately after the signature was created. Both files are exactly the
same and neither contain the value "Thumbnails/meta.xml" in the URI
attribute in the <Reference> elements.
Since none of the files that are listed in the documentsignatures.xml
were manipulated, the signature should be valid? Or is there another
signature somewhere besides the XML signature about the file structure
of the ODT document?
Thanks many for your help
Steve
_______________________________________________
LibreOffice mailing list
LibreOffice@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/libreoffice
