pjfanning opened a new pull request, #1476: URL: https://github.com/apache/poi/pull/1476
Builds on #1475; that commit appears here too until it's merged. When a signature is verified, `SignaturePart.validate()` now also compares the package's relationships with the ones the signature covers. In each relationships part, a relationship that isn't covered must not have the same type as one that is. If it does, `verifySignature()` returns false and the relationship is logged. Signers don't all cover the same relationship types. For example, Office leaves out `customXml`, and some signers leave out `presProps`. Types that a signer leaves out entirely are therefore not checked, and all signed samples in test-data still verify. New test: `testAddedRelationshipIsNotSigned`. `TestSignatureInfo` and the other `dsig` tests pass locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
