Difference between revisions of "Security/Document Integrity"

Revision as of 10:34, 10 July 2009

The best way to ensure document integrity is to digitally sign the documents.

But most people won't do it, or even don't have the infrastructure for this, so there should be some light weight mechanism for checking the document integrity

ODF conformance clause

The ODF specification should have some conformance clause, that all files, except package meta data in META-INF folder (signature streams for example) and the mimetype stream, must be registered in manifest.xml.

When this is defined, an ODF application should not load any files which are not registered in manifest, or show a warning to the user.

Make sure OOo 3.2 would adhere to the ODF conformance clause

Independently from whether or not the conformance clause above will make it into the ODF specification, OpenOffice.org should create documents adhering to the definition above. (isse #XXXXX)

Check ODF integrity in OOo 3.2

Assuming that the conformance clause above will be added to the ODF specification, OOo should warn when loading documents containing streams not registered in manifest.xml.(issue #XXXXX)

This shouldn't be a problem for older documents (written with OOo), because OOo is already registering all files in manifest.xml

Maybe the check should only be done for ODF 1.2 (and newer) documents, to avoid interop problems with documents written by other applications.