OASIS Open Document Format for Office Applications (OpenDocument) TC

On 27 September 2010 22:11, Dennis E. Hamilton 

There isn't really a way to sign a directory entry without making up a transform. If you did that, then you'd have to specify the transform in the standard. I can think of several ways to make a transform, but it would be a nuisance to implement and express in normative language.

IMHO, that's really overkill. I think we want to drop back to "What You See Is What You Sign." If an empty directory has no effect on either the content or appearance of the document, and I cannot imagine a scenario in which it would, then we should ignore it for the purpose of signatures. If a file turned up later in that directory, then the presence of a new file would then violate the requirement that all of the files be signed, and you're dealing with either an invalid or partial signature, depending on how an implementer wanted to treat that particular error.

In OOXML signatures, there are provisions for certain parts of the archive not being signed, so there's some tolerance for metadata to get updated without invalidating the signature. This is part of why I wrote the proposal to say that "all files must be signed in order for the signature to be a full document signature" - I wanted to provide for the possibility in the future of signing something less.

Given the time constraints, I'd propose doing the following:

1) Ignore empty directories.
2) Do not make a transform that captures the directory structure of the archive, because it does not affect the appearance or content of the document.
3) In vNext, we should work on defining what must be signed in a more refined manner, paying attention to what affects content and/or appearance and what does not.



                                                

					
                                                    

        
                                                
				
                                                

                                                    
                                                        
                                                        Original Message
                                                
                                                Original Message-----
From: Bob Jolliffe [mailto:bobjolliffe@gmail.com] 
Sent: Monday, September 27, 2010 3:19 PM
To: dennis.hamilton@acm.org
Cc: Hanssens Bart; Svante Schubert; ODF TC List
Subject: Re: [office] RE: Directories in Zip packages

On 27 September 2010 22:11, Dennis E. Hamilton 

+1 on the recommendation.  

I think we have the framework of an agreement about this.  Needs an issue
for Part 3.

 - Dennis



                                                

					
                                                    

        
                                                
				
                                                

                                                    
                                                        
                                                        Original Message
                                                
                                                Original Message-----
From: David LeBlanc [mailto:dleblanc@exchange.microsoft.com] 
Sent: Monday, September 27, 2010 15:55
To: Bob Jolliffe; dennis.hamilton@acm.org
Cc: Hanssens Bart; Svante Schubert; ODF TC List
Subject: RE: [office] RE: Directories in Zip packages

[ ... ]

Given the time constraints, I'd propose doing the following:

1) Ignore empty directories.
2) Do not make a transform that captures the directory structure of the
archive, because it does not affect the appearance or content of the
document.
3) In vNext, we should work on defining what must be signed in a more
refined manner, paying attention to what affects content and/or appearance
and what does not.

[ ... ] 

+1 on your conclusion.

 - Dennis

More amusement:

Yes, but an uncompressed file of length 0 both compressed and uncompressed
length of 0, just like those "faux" directory entries.  Normally, a Zipper
doesn't compress a file when the uncompressed form is shorter, the exception
in ODF being that any file that is encrypted (!) is always compressed.

Oh yes, encryption of (empty) directories.  Perish the thought.



                                                

					
                                                    

        
                                                
				
                                                

                                                    
                                                        
                                                        Original Message
                                                
                                                Original Message-----
From: Bob Jolliffe [mailto:bobjolliffe@gmail.com] 
Sent: Monday, September 27, 2010 15:19
To: dennis.hamilton@acm.org
Cc: Hanssens Bart; Svante Schubert; ODF TC List
Subject: Re: [office] RE: Directories in Zip packages

On 27 September 2010 22:11, Dennis E. Hamilton 

It should also be noted that there are two ways two store A/B/C in a ZIP, 
where C is a file:

Some ZIP apps store this as three entries:

A/
A/B/
A/B/C

And some ZIP apps store it as a single entry:

A/B/C and then rely on unzipping logic to know to create the appropriate 
parent directories.

Both are legal and you'll see both. 

-Rob

Bob Jolliffe 

On 28/09/2010 01:43, robert_weir@us.ibm.com wrote:
> It should also be noted that there are two ways two store A/B/C in a ZIP, 
> where C is a file:
> 
> Some ZIP apps store this as three entries:
> 
> A/
> A/B/
> A/B/C
> 
> And some ZIP apps store it as a single entry:
> 
> A/B/C and then rely on unzipping logic to know to create the appropriate 
> parent directories.
> 
> Both are legal and you'll see both. 
> 
> -Rob

one reason why a ZIP producer would create entries for directories is to
store things like UID/GID and such using various platform specific extensions.
AFAIK Info-Zip can do this.

of course for an ODF package that kind of thing is completely unnecessary.
But on the other hand using some generic ZIP implementation to modify ODF
packages can be very convenient at times, and if such a generic ZIP
implementation happens to create entires for directories then IMHO that
shouldn't make the ODF package invalid or non-conformant.

[the extra platform specific stuff shouldn't be in a conformant package of
course, IIRC that is what the conformance clauses say.]

reagards,
 michael

-- 
ORACLE          | 

Michael Stahl 

Rob asked:

>But what about A/B/D/ ?  It contains only the empty subdirectory A/B/C/E/.
>So it is not empty, but it only contains empty things.  So is it signed?

No, unless the presence of emtpy directories has some impact on the content or appearance of the document. The principle is "What You See Is What You Sign". So if changing or removing the directory makes no difference in what is seen, it doesn't matter if you sign it.

The container for the files should really be an independent thing, and what we're signing are the files themselves.

That's for document signing. If we're trying to sign something to ensure that it hasn't been tampered with, then we'd just sign the whole archive as a blob, and the signature would then be external to the archive - could be that both of them are stored in another archive. I think there's less customer need for this mode, and when we get back to encryption, we can provide for this.

+1



                                                

					
                                                    

        
                                                
				
                                                

                                                    
                                                        
                                                        Original Message
                                                
                                                Original Message-----
From: David LeBlanc [mailto:dleblanc@exchange.microsoft.com] 
Sent: Tuesday, September 28, 2010 10:43
To: robert_weir@us.ibm.com; Michael Stahl
Cc: ODF TC List
Subject: RE: [office] RE: Directories in Zip packages

Rob asked:

>But what about A/B/D/ ?  It contains only the empty subdirectory A/B/C/E/.
>So it is not empty, but it only contains empty things.  So is it signed?

No, unless the presence of emtpy directories has some impact on the content
or appearance of the document. The principle is "What You See Is What You
Sign". So if changing or removing the directory makes no difference in what
is seen, it doesn't matter if you sign it.

The container for the files should really be an independent thing, and what
we're signing are the files themselves.

That's for document signing. If we're trying to sign something to ensure
that it hasn't been tampered with, then we'd just sign the whole archive as
a blob, and the signature would then be external to the archive - could be
that both of them are stored in another archive. I think there's less
customer need for this mode, and when we get back to encryption, we can
provide for this.
---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php 

On 28 September 2010 13:24, Michael Stahl