On 07.02.20 20:13, Steve Martin wrote:
Document signatures shall be stored in a file called META-INF/documentsignatures.xml in the package as described in section 3.5 of the OpenDocument specification part 3. Document signatures shall contain a <ds:Reference> element for each file within the package, with the exception that <ds:Reference> elements for the META-INF/documentsignatures.xml file containing the signature, and any files contained in the package whose relative path starts with "external-data/" should be omitted.
interesting, i hadn't noticed that... apparently it was added with https://issues.oasis-open.org/browse/OFFICE-3028
I understand it in that way: If I create a directory with the name "external-data" and put files into that directory, these files remain unaffected by the signature check (unlike my file "Thumbnails/meta.xml"). Is this correct? Or are these files just not a part of the signature while generating the signature value?*I repeated my test scenario and adjusted the manifest.xml file accordingly:<manifest:file-entry manifest:full-path="external-data/meta.xml" manifest:media-type="text/xml"/>If I now copy the meta.xml file into the "external-data" folder after creating the signature, I still get the message that the signature is invalid. None of the URI attributes of the <Reference> elements contain the value "external-data/meta.xml".
git grep "external-data" indicates that this feature remains unimplemented in LO.