LGTM Sorry for delay.
BR, Mikhail ________________________________________ From: Crosswalk-dev [[email protected]] on behalf of Zhang, Xu U [[email protected]] Sent: Monday, June 23, 2014 2:41 PM To: [email protected] Subject: [Crosswalk-dev] Intent to Implement - Tizen Widget Signature Description: Tizen requires the WRT(crosswalk) MUST support widget signature processing as defined in the W3C XML Digital Signatures for Widgets. We’d like to check whether the web application is signed with a valid Tizen distributor signature. Also according to signature checking result, WRT decides whether to install the application and privilege level of the web application. Spec: http://www.w3.org/TR/widgets-digsig/ http://www.w3.org/TR/xmldsig-core Affected Components xwalk installer, xwalk application database Related feature https://crosswalk-project.org/jira/browse/XWALK-1171 https://crosswalk-project.org/jira/browse/XWALK-1507 https://crosswalk-project.org/jira/browse/XWALK-1508 https://crosswalk-project.org/jira/browse/XWALK-1509 https://crosswalk-project.org/jira/browse/XWALK-1510 Target release Crosswalk9 Implementation details To implement this feature, it includes below subtasks: 1. Locate signature files in the widget package 2. Verify whether the signature XML file is a valid XML document according to signature.xsd 3. Reference validation 4. Signature validation 5. Signature Property validation 6. System security policy parser. Installer need compare footprint in the signature with system policy to decide privilege level. 7. Certificate and CRL/OCSP verification (optional). Certificate chain validation and certificate revocation processing using CRLs [RFC5280]<http://www.w3.org/TR/widgets-digsig/> or OCSP [RFC2560]<http://www.w3.org/TR/widgets-digsig/> is a big task and should be another new security feature. So I suggest we don’t implement this check currently. When system provides certificate checking API, we can call related API to do this work. --------------------------------------------------------------------- Intel Finland Oy Registered Address: PL 281, 00181 Helsinki Business Identity Code: 0357606 - 4 Domiciled in Helsinki This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies. _______________________________________________ Crosswalk-dev mailing list [email protected] https://lists.crosswalk-project.org/mailman/listinfo/crosswalk-dev
