On 07.02.20 20:13, Steve Martin wrote:
Document signatures shall be stored in a file called
META-INF/documentsignatures.xml in the package as described in section
3.5 of the OpenDocument specification part 3. Document signatures
shall contain a <ds:Reference> element for each file within the
package, with the exception that <ds:Reference> elements for the
META-INF/documentsignatures.xml file containing the signature, and any
files contained in the package whose relative path starts with
"external-data/" should be omitted.
interesting, i hadn't noticed that... apparently it was added with
https://issues.oasis-open.org/browse/OFFICE-3028
I understand it in that way: If I create a directory with the name
"external-data" and put files into that directory, these files remain
unaffected by the signature check (unlike my file
"Thumbnails/meta.xml"). Is this correct? Or are these files just not a
part of the signature while generating the signature value?*
I repeated my test scenario and adjusted the manifest.xml file accordingly:
<manifest:file-entry manifest:full-path="external-data/meta.xml"
manifest:media-type="text/xml"/>
If I now copy the meta.xml file into the "external-data" folder after
creating the signature, I still get the message that the signature is
invalid. None of the URI attributes of the <Reference> elements contain
the value "external-data/meta.xml".
git grep "external-data" indicates that this feature remains
unimplemented in LO.
_______________________________________________
LibreOffice mailing list
LibreOffice@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/libreoffice
