You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openoffice.apache.org by Dave Fisher <wa...@apache.org> on 2021/09/28 22:35:30 UTC
Future - Digital Signatures
Hi Pedro,
I think that AOO42X and Trunk need to improve in three ways.
(1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
Setup may need to be improved.
(2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
(3) We need to properly display whatever signatures are on the document.
What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
Regards,
Dave
> On Sep 18, 2021, at 5:06 AM, Pedro Lino <pe...@mailbox.org.INVALID> wrote:
>
> Hi Dave
>
> I can't sign any document.
> I have my own Certificate (from my European ID Card)
> It shows up on the Windows certmgr.msc under Personal but does not show up on AOO 4.1.11 (AOO4111m1(Build:9808) - Rev. 8167b394bd) built by Matthias
> I also have a personal SSH key in Linux which AOO 4.1.11 can not use...
>
> Any ideas?
>
> Regards,
> Pedro
>
>> On 09/17/2021 6:49 PM Dave Fisher <wa...@apache.org> wrote:
>>
>>
>> Hi Pedro,
>>
>>> On Sep 17, 2021, at 9:29 AM, Pedro Lino <pe...@mailbox.org.INVALID> wrote:
>>>
>>> Thanks!
>>>
>>> AOO4111m1(Build:9808) - Rev. 8167b394bd
>>> 2021-09-17 13:41 - Linux x86_64
>>>
>>> Compiled successfully, installed and is working without any hitches
>>
>> Try signing a document and then reopening.
>>
>> Regards,
>> Dave
>>
>>>
>>> Regards,
>>> Pedro
>>>
>>>> On 09/17/2021 10:27 AM Dave Fisher <wa...@apache.org> wrote:
>>>>
>>>>
>>>> Yes
>>>>
>>>> Sent from my iPhone
>>>>
>>>>> On Sep 17, 2021, at 2:09 AM, Pedro Lino <pe...@mailbox.org.invalid> wrote:
>>>>>
>>>>> Hi Matthias
>>>>>
>>>>>>> On 09/16/2021 10:35 PM Matthias Seidel <ma...@hamburg.de> wrote:
>>>>>>
>>>>>> Apparently we needed another fix...
>>>>>>
>>>>>> I am doing a Test Build for Windows right now and will upload it to my
>>>>>> Apache home directory tomorrow.
>>>>>
>>>>> If I compile now from branch AOO41X will it include all these fixes?
>>>>>
>>>>> Regards,
>>>>> Pedro
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>>>>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>>>>
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>>>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Dave Fisher <wa...@comcast.net>.
> On Sep 29, 2021, at 5:01 PM, Dave Fisher <wa...@comcast.net> wrote:
>
>
>
> Sent from my iPhone
>
>> On Sep 29, 2021, at 4:42 PM, Regina Henschel <rb...@t-online.de> wrote:
>>
>> Hi Dave,
>>
>> Dave Fisher schrieb am 30.09.2021 um 00:11:
>>> This document was not signed using the ODF 1.2 or 1.3 specification. Instead LO implements its own extension.
>>> PGPData xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0”
>>
>> Which version of LibreOffice? For ODF 1.3 you need LibreOffice 7.0, some additions are in 7.1 and 7.2.
>
> Pedro used LO 6.4.7.
>
> I need to inspect an LO 7.2 PGP signed odt.
Pedro sent me a LO 7.2.1 PGP signed odt and it also uses the loext xmlns.
It would be good to understand how xmlns extensions fit into the ODF specifications.
>>
>>> This replaces X509Data when PGP signing is done in LO. I wonder if we can implement this without looking at their code.
>>
>> I don't know whether signatures use the same as OpenPGP encryption. But Thorsten Behrens told me, that LibreOffice uses the gpgme library and that it needs to be included in the distribution at least on Windows and Mac. But gpgme has LGPLv2+ license. So I think, use of LibreOffice's solution is not possible for Apache OpenOffice.
>
> That approach would require an extension provided by a 3rd party or an exception to Apache Release Policy.
>
> BouncyCastle/Java could be an alternative as well.
>
> Regards,
> Dave
>
>
>>
>> Kind regards
>> Regina
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Dave Fisher <wa...@comcast.net>.
Sent from my iPhone
> On Sep 29, 2021, at 4:42 PM, Regina Henschel <rb...@t-online.de> wrote:
>
> Hi Dave,
>
> Dave Fisher schrieb am 30.09.2021 um 00:11:
>> This document was not signed using the ODF 1.2 or 1.3 specification. Instead LO implements its own extension.
>> PGPData xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0”
>
> Which version of LibreOffice? For ODF 1.3 you need LibreOffice 7.0, some additions are in 7.1 and 7.2.
Pedro used LO 6.4.7.
I need to inspect an LO 7.2 PGP signed odt.
>
>> This replaces X509Data when PGP signing is done in LO. I wonder if we can implement this without looking at their code.
>
> I don't know whether signatures use the same as OpenPGP encryption. But Thorsten Behrens told me, that LibreOffice uses the gpgme library and that it needs to be included in the distribution at least on Windows and Mac. But gpgme has LGPLv2+ license. So I think, use of LibreOffice's solution is not possible for Apache OpenOffice.
That approach would require an extension provided by a 3rd party or an exception to Apache Release Policy.
BouncyCastle/Java could be an alternative as well.
Regards,
Dave
>
> Kind regards
> Regina
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Regina Henschel <rb...@t-online.de>.
Hi Dave,
Dave Fisher schrieb am 30.09.2021 um 00:11:
> This document was not signed using the ODF 1.2 or 1.3 specification. Instead LO implements its own extension.
>
> PGPData xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0”
Which version of LibreOffice? For ODF 1.3 you need LibreOffice 7.0, some
additions are in 7.1 and 7.2.
>
> This replaces X509Data when PGP signing is done in LO. I wonder if we can implement this without looking at their code.
I don't know whether signatures use the same as OpenPGP encryption. But
Thorsten Behrens told me, that LibreOffice uses the gpgme library and
that it needs to be included in the distribution at least on Windows and
Mac. But gpgme has LGPLv2+ license. So I think, use of LibreOffice's
solution is not possible for Apache OpenOffice.
Kind regards
Regina
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Dave Fisher <wa...@apache.org>.
> On Sep 29, 2021, at 9:10 AM, Dave Fisher <wa...@apache.org> wrote:
>
>
>
>> On Sep 29, 2021, at 8:59 AM, Pedro Lino <pe...@mailbox.org.INVALID> wrote:
>>
>> Hi Dave
>>
>>> On 09/28/2021 11:35 PM Dave Fisher <wa...@apache.org> wrote:
>>
>>> I think that AOO42X and Trunk need to improve in three ways.
>>>
>>> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
>>> Setup may need to be improved.
>>> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
>>> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
>>> (3) We need to properly display whatever signatures are on the document.
>>
>> I agree. It is good news that ODF 1.2 supports signatures (although it would be ideal for AOO to move on to ODF 1.3)
>
> To be clear ODF 1.3 has the same spec as 1.2 for digital signatures.
>
>>
>>> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
>>
>> Document signed with OpenPGP using LO 6.4.7 in Ubuntu 18.04 x64
>> - opening with AOO 4.1.11 on the same Ubuntu 18.04 x64 the message is "Digital Signature: The document signature does not match the document content. We strongly recommend you to not trust this document."
>> - opening with 4.1.11 on Windows 7 Pro x64 the message is the same but there is a popup window when the document is opened with a serious warning
>> https://i.imgur.com/8CloLVl.png
Thanks for sharing the files.
This document was not signed using the ODF 1.2 or 1.3 specification. Instead LO implements its own extension.
PGPData xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0”
This replaces X509Data when PGP signing is done in LO. I wonder if we can implement this without looking at their code.
Regards,
Dave
>>
>> Document signed with OpenPGP using AOO 4.1.11 in Win7 Pro x64
>> - opening with AOO 4.1.11 on Ubuntu 18.04 x64 the message is "Digital Signature: The document signature is OK, but the certificates could not be validated."
>>
>> Document signed with EU card
>> - opening with AOO 4.1.11 on Ubuntu 18.04 x64 the message is "Digital Signature: The document signature is OK, but the certificates could not be validated."
>> - opening with AOO 4.1.11 on Windows 7 Pro x64 (where I have installed the Root certificate for my ID card), the message is "The document signature is OK". If another ID card is used to sign (and the Root certificate for that card is not imported) then the message is the same as under Ubuntu.
>>
>> I can share the documents with you by personal email if that helps.
>
> Sure, I’d like to unzip them and inspect the signature xml.
>
> Regards,
> Dave
>
>>
>> Regards,
>> Pedro
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Dave Fisher <wa...@apache.org>.
> On Sep 29, 2021, at 8:59 AM, Pedro Lino <pe...@mailbox.org.INVALID> wrote:
>
> Hi Dave
>
>> On 09/28/2021 11:35 PM Dave Fisher <wa...@apache.org> wrote:
>
>> I think that AOO42X and Trunk need to improve in three ways.
>>
>> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
>> Setup may need to be improved.
>> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
>> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
>> (3) We need to properly display whatever signatures are on the document.
>
> I agree. It is good news that ODF 1.2 supports signatures (although it would be ideal for AOO to move on to ODF 1.3)
To be clear ODF 1.3 has the same spec as 1.2 for digital signatures.
>
>> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
>
> Document signed with OpenPGP using LO 6.4.7 in Ubuntu 18.04 x64
> - opening with AOO 4.1.11 on the same Ubuntu 18.04 x64 the message is "Digital Signature: The document signature does not match the document content. We strongly recommend you to not trust this document."
> - opening with 4.1.11 on Windows 7 Pro x64 the message is the same but there is a popup window when the document is opened with a serious warning
> https://i.imgur.com/8CloLVl.png
>
> Document signed with OpenPGP using AOO 4.1.11 in Win7 Pro x64
> - opening with AOO 4.1.11 on Ubuntu 18.04 x64 the message is "Digital Signature: The document signature is OK, but the certificates could not be validated."
>
> Document signed with EU card
> - opening with AOO 4.1.11 on Ubuntu 18.04 x64 the message is "Digital Signature: The document signature is OK, but the certificates could not be validated."
> - opening with AOO 4.1.11 on Windows 7 Pro x64 (where I have installed the Root certificate for my ID card), the message is "The document signature is OK". If another ID card is used to sign (and the Root certificate for that card is not imported) then the message is the same as under Ubuntu.
>
> I can share the documents with you by personal email if that helps.
Sure, I’d like to unzip them and inspect the signature xml.
Regards,
Dave
>
> Regards,
> Pedro
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Pedro Lino <pe...@mailbox.org.INVALID>.
Hi Dave
> On 09/28/2021 11:35 PM Dave Fisher <wa...@apache.org> wrote:
> I think that AOO42X and Trunk need to improve in three ways.
>
> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
> Setup may need to be improved.
> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
> (3) We need to properly display whatever signatures are on the document.
I agree. It is good news that ODF 1.2 supports signatures (although it would be ideal for AOO to move on to ODF 1.3)
> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
Document signed with OpenPGP using LO 6.4.7 in Ubuntu 18.04 x64
- opening with AOO 4.1.11 on the same Ubuntu 18.04 x64 the message is "Digital Signature: The document signature does not match the document content. We strongly recommend you to not trust this document."
- opening with 4.1.11 on Windows 7 Pro x64 the message is the same but there is a popup window when the document is opened with a serious warning
https://i.imgur.com/8CloLVl.png
Document signed with OpenPGP using AOO 4.1.11 in Win7 Pro x64
- opening with AOO 4.1.11 on Ubuntu 18.04 x64 the message is "Digital Signature: The document signature is OK, but the certificates could not be validated."
Document signed with EU card
- opening with AOO 4.1.11 on Ubuntu 18.04 x64 the message is "Digital Signature: The document signature is OK, but the certificates could not be validated."
- opening with AOO 4.1.11 on Windows 7 Pro x64 (where I have installed the Root certificate for my ID card), the message is "The document signature is OK". If another ID card is used to sign (and the Root certificate for that card is not imported) then the message is the same as under Ubuntu.
I can share the documents with you by personal email if that helps.
Regards,
Pedro
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Arrigo Marchiori <ar...@yahoo.it.INVALID>.
Hello,
On Thu, Sep 30, 2021 at 02:14:54PM -0400, Jim Jagielski wrote:
> > On Sep 29, 2021, at 4:25 PM, Dave Fisher <wa...@apache.org> wrote:
> >
> >
> >
> >> On Sep 29, 2021, at 1:05 PM, Arrigo Marchiori <ar...@yahoo.it.INVALID> wrote:
> >>
> >> Hello Dave, All,
> >>
> >> On Tue, Sep 28, 2021 at 03:35:30PM -0700, Dave Fisher wrote:
> >>
> >>> Hi Pedro,
> >>>
> >>> I think that AOO42X and Trunk need to improve in three ways.
> >>>
> >>> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
> >>> Setup may need to be improved.
> >>> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
> >>> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
> >>> (3) We need to properly display whatever signatures are on the document.
> >>>
> >>> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
> >>
> >> Please let us bear in mind that we have an open pull request [1] about
> >> upgrading the nss library. It is currently waiting for review, and it
> >> is stuck on macOS.
> >
> > We need to know from Jim how a build goes with the PR incorporated in AOO42X.
> >
> >>
> >> Before we begin editing our code, I suggest we merge that pull request
> >> first.
> >>
> >> 1: https://github.com/apache/openoffice/pull/100 <https://github.com/apache/openoffice/pull/100>
> >
> > Maybe merge there and see how the next dev build goes?
>
> +1.
+1 for me too.
I had to apply some additional patches, in order to compile under
Catalina. They are here:
home.apache.org/~ardovm/openoffice/catalina/catalina_nss.patch
It's ok for me if we do not want to merge them together with the PR; I
will merge them into the "catalina" branch instead. I suggest we keep
them at hand in case the Mac builds fail.
Best regards,
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Jim Jagielski <ji...@jaguNET.com>.
> On Sep 29, 2021, at 4:25 PM, Dave Fisher <wa...@apache.org> wrote:
>
>
>
>> On Sep 29, 2021, at 1:05 PM, Arrigo Marchiori <ar...@yahoo.it.INVALID> wrote:
>>
>> Hello Dave, All,
>>
>> On Tue, Sep 28, 2021 at 03:35:30PM -0700, Dave Fisher wrote:
>>
>>> Hi Pedro,
>>>
>>> I think that AOO42X and Trunk need to improve in three ways.
>>>
>>> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
>>> Setup may need to be improved.
>>> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
>>> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
>>> (3) We need to properly display whatever signatures are on the document.
>>>
>>> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
>>
>> Please let us bear in mind that we have an open pull request [1] about
>> upgrading the nss library. It is currently waiting for review, and it
>> is stuck on macOS.
>
> We need to know from Jim how a build goes with the PR incorporated in AOO42X.
>
>>
>> Before we begin editing our code, I suggest we merge that pull request
>> first.
>>
>> 1: https://github.com/apache/openoffice/pull/100 <https://github.com/apache/openoffice/pull/100>
>
> Maybe merge there and see how the next dev build goes?
+1.
Re: Future - Digital Signatures
Posted by Dave Fisher <wa...@apache.org>.
> On Sep 29, 2021, at 1:05 PM, Arrigo Marchiori <ar...@yahoo.it.INVALID> wrote:
>
> Hello Dave, All,
>
> On Tue, Sep 28, 2021 at 03:35:30PM -0700, Dave Fisher wrote:
>
>> Hi Pedro,
>>
>> I think that AOO42X and Trunk need to improve in three ways.
>>
>> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
>> Setup may need to be improved.
>> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
>> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
>> (3) We need to properly display whatever signatures are on the document.
>>
>> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
>
> Please let us bear in mind that we have an open pull request [1] about
> upgrading the nss library. It is currently waiting for review, and it
> is stuck on macOS.
We need to know from Jim how a build goes with the PR incorporated in AOO42X.
>
> Before we begin editing our code, I suggest we merge that pull request
> first.
>
> 1: https://github.com/apache/openoffice/pull/100
Maybe merge there and see how the next dev build goes?
Regards,
Dave
>
> Best regards,
> --
> Arrigo
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Future - Digital Signatures
Posted by Arrigo Marchiori <ar...@yahoo.it.INVALID>.
Hello Dave, All,
On Tue, Sep 28, 2021 at 03:35:30PM -0700, Dave Fisher wrote:
> Hi Pedro,
>
> I think that AOO42X and Trunk need to improve in three ways.
>
> (1) We need to make sure that we hook to the systems native key store and/or a Mozilla keystone.
> Setup may need to be improved.
> (2) We need to allow a PGP and EU card key to be selected and converted to X509 internally while signing.
> It looks like ODF 1.3 spec makes no changes to ODF 1.2 in terms of digital signatures.
> (3) We need to properly display whatever signatures are on the document.
>
> What happens when you inspect the digital signatures of a file signed in LO with PGP and EU card in AOO 4.1.11 RC?
Please let us bear in mind that we have an open pull request [1] about
upgrading the nss library. It is currently waiting for review, and it
is stuck on macOS.
Before we begin editing our code, I suggest we merge that pull request
first.
1: https://github.com/apache/openoffice/pull/100
Best regards,
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org