LGTM
On Mon, Jun 23, 2014 at 1:41 PM, Zhang, Xu U <[email protected]> wrote: > *Descript**ion:* > Tizen requires the WRT(crosswalk) MUST support widget signature processing > as defined in the W3C XML Digital Signatures for Widgets. We’d like to > check whether the web application is signed with a valid Tizen distributor > signature. Also according to signature checking result, WRT decides whether > to install the application and privilege level of the web application. > > *Spec**:* > *http://www.w3.org/TR/widgets-digsig/* > <http://www.w3.org/TR/widgets-digsig/> > *http://www.w3.org/TR/xmldsig-core* <http://www.w3.org/TR/xmldsig-core> > > *Affected Components* > xwalk installer, xwalk application database > > *Related feature* > *https://crosswalk-project.org/jira/browse/XWALK-1171* > <https://crosswalk-project.org/jira/browse/XWALK-1171> > *https://crosswalk-project.org/jira/browse/XWALK-1507* > <https://crosswalk-project.org/jira/browse/XWALK-1507> > *https://crosswalk-project.org/jira/browse/XWALK-1508* > <https://crosswalk-project.org/jira/browse/XWALK-1508> > *https://crosswalk-project.org/jira/browse/XWALK-1509* > <https://crosswalk-project.org/jira/browse/XWALK-1509> > *https://crosswalk-project.org/jira/browse/XWALK-1510* > <https://crosswalk-project.org/jira/browse/XWALK-1510> > > *Target release* > Crosswalk9 > > *Implementation details* > To implement this feature, it includes below subtasks: > > 1. Locate signature files in the widget package > 2. Verify whether the signature XML file is a valid XML document > according to signature.xsd > 3. Reference validation > 4. Signature validation > 5. Signature Property validation > 6. System security policy parser. Installer need compare footprint in > the signature with system policy to decide privilege level. > 7. Certificate and CRL/OCSP verification (optional). Certificate chain > validation and certificate revocation processing using CRLs [RFC5280] > <http://www.w3.org/TR/widgets-digsig/> or OCSP [RFC2560] > <http://www.w3.org/TR/widgets-digsig/> is a big task and should be > another new security feature. So I suggest we don’t implement this check > currently. When system provides certificate checking API, we can call > related API to do this work. > > > > > > _______________________________________________ > Crosswalk-dev mailing list > [email protected] > https://lists.crosswalk-project.org/mailman/listinfo/crosswalk-dev > > -- Kenneth Rohde Christiansen Web Platform Architect, Intel Corporation. Phone +45 4294 9458 ﹆﹆﹆
_______________________________________________ Crosswalk-dev mailing list [email protected] https://lists.crosswalk-project.org/mailman/listinfo/crosswalk-dev
