Uploaded image for project: 'OASIS Open Document Format for Office Applications (OpenDocument) TC'
  1. OASIS Open Document Format for Office Applications (OpenDocument) TC
  2. OFFICE-2686

ODF 1.2 Part 1 3.16 Macro Signature Meaningless and Inappropriate

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Applied
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: ODF 1.2 CD 05
    • Fix Version/s: ODF 1.2 CD 06
    • Component/s: General, Part 2 (Packages) [1.2: 3], Part 3 (Schema) [1.2: 1], Security
    • Labels:
      None
    • Environment:

      This defect applies in ODF 1.2 Part 1 CD04 and in the revisions leading up to CD05. The specific text discussed is that in OpenDocument-v1.2-part1-cd04-rev05.odt

    • Proposal:
      Hide

      1. In section 3.16, Delete all text starting with the first mention of macro signatures and extending to the end of the section:

      ... "A macro signature is a digital signature that is applied to macro code and other executable code that may be contained in a package. Macro signatures are stored in a file called META-INF/macrosignatures.xml in the package as described in section 2.4 of the OpenDocument specification part 3. Since macro code and executable code is implementation specific, this specification does not define to the files to which a macro signature applies.

      "A document may have document and macro signatures applied simultaneously, and may have further implementation specific signatures applied to its package. "

      2. In Part 3, adopt a decentralized mechanism for implementaiton-defined introduction of META-INF/signature.xml files that avoid name collisions and conflicting use of the same name.

      Show
      1. In section 3.16, Delete all text starting with the first mention of macro signatures and extending to the end of the section: ... "A macro signature is a digital signature that is applied to macro code and other executable code that may be contained in a package. Macro signatures are stored in a file called META-INF/macrosignatures.xml in the package as described in section 2.4 of the OpenDocument specification part 3. Since macro code and executable code is implementation specific, this specification does not define to the files to which a macro signature applies. "A document may have document and macro signatures applied simultaneously, and may have further implementation specific signatures applied to its package. " 2. In Part 3, adopt a decentralized mechanism for implementaiton-defined introduction of META-INF/ signature .xml files that avoid name collisions and conflicting use of the same name.
    • Resolution:
      Hide

      1. In section 3.16, Delete all text starting with the first mention of macro signatures and extending to the end of the section:

      ... "A macro signature is a digital signature that is applied to macro code and other executable code that may be contained in a package. Macro signatures are stored in a file called META-INF/macrosignatures.xml in the package as described in section 2.4 of the OpenDocument specification part 3. Since macro code and executable code is implementation specific, this specification does not define to the files to which a macro signature applies.

      "A document may have document and macro signatures applied simultaneously, and may have further implementation specific signatures applied to its package. "

      Show
      1. In section 3.16, Delete all text starting with the first mention of macro signatures and extending to the end of the section: ... "A macro signature is a digital signature that is applied to macro code and other executable code that may be contained in a package. Macro signatures are stored in a file called META-INF/macrosignatures.xml in the package as described in section 2.4 of the OpenDocument specification part 3. Since macro code and executable code is implementation specific, this specification does not define to the files to which a macro signature applies. "A document may have document and macro signatures applied simultaneously, and may have further implementation specific signatures applied to its package. "

      Description

      Section 3.16 essentially restates provisions already provided in ODF 1.2 Part 3. Most of the restatement is unnecessary and is somewhat self-contradictory. There is a tiny amount of new material concerning META-INF/documentsignatures.xml.

      MACRO SIGNATURE DIFFICULTIES

      The vague treatment of macro signatures is uninformative and only serves to reserve the name META-INF/macrosignatures.xml for an unspecified purpose and significance. In all material respects, its occurrence is already provided for in Part 3 and the absence of an actionable provision here adds no value.

      This non sequiter is not helpful:

      "Since macro code and executable code is implementation specific, this specification does not define to the files to which a macro signature applies."

      In addition, there is no indication what the signing of macros (and scripts?) signifies and how that is meaningful if document and such macro signatures can be applied simultaneously.

      If there is a problem with naming provisions for digital-signature files in the META-INF/signature.xml family, it seems inappropriate that the solution be incorporation of reserved names for some unidentified party's implementaiton-specific purpose in the ODF 1.2 specification itself. This problem needs to be dealt with in a generally-useful manner.

        Attachments

          Activity

            People

            • Assignee:
              orcmid Dennis Hamilton (Inactive)
              Reporter:
              orcmid Dennis Hamilton (Inactive)
            • Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: