On Thu, Aug 9, 2012 at 1:52 PM, Scott Wilson <[email protected]
> wrote:
> On 8 Aug 2012, at 21:33, Pushpalanka Jayawardhana wrote:
>
> > Hi devs,
> >
> > I am trying to verify a widget signed using the Wookie digsig-client
> which is as attached.
> > I have also attached the code used to verify the unzipped .wgt directory
> once the path is given. It uses apache-santuario library which is present
> as a dependency for Wookie.
> >
> > I can correctly verify the widget that I have manually extracted.
> > But when I try to verify the widget that is deployed in the server,
> giving the unzipped path of the widget inside the server, it get failed.
> > With these observations, I feel there is some changes happening when the
> widget is unzipped at the server.
> >
> > Can anyone give some inputs to solve this?
>
> I think I figured it out - the widget signature is being verified AFTER
> the start file is modified by injecting additional JavaScript references.
>
> To test it I modified Wookie to use an IStartPageProcessor implementation
> that doesn't do anything; verification then succeeded.
>
> So, the verification step must take place before
> IStartPageProcessor.processStartFile() is called.
>
Thanks a lot Scott.
I commented
org.apache.wookie.util.html.StartPageProcessor.processStartFile(...,...){}
method content and could get the verification succeeded. So I placed the
widget validation, just after unzipping it as follows, inside
W3CWidgetFactory.java.
WidgetPackageUtils.unpackZip(zip, unzippedWidgetDirectory);
//checks for validity of widget using digital signatures
* if (digitalSignatureParser != null) {*
* isValid = digitalSignatureParser*
* .processDigitalSignatures(unzippedWidgetDirectory*
* .getAbsolutePath());*
* }*
// Iterate over all start files and update paths
for (IContent content: widgetModel.getContentList()){
// now update the js links in the start page
File startFile = new File(unzippedWidgetDirectory.getCanonicalPath() +
File.separator + content.getSrc());
String relativestartUrl = (WidgetPackageUtils.getURLForWidget(localPath,
manifestIdentifier, content.getSrc()));
content.setSrc(relativestartUrl);
*if(startFile.exists() && startPageProcessor != null){ *
* startPageProcessor.processStartFile(startFile, widgetModel, content);*
* }*
*
*
But still the same error exists as before. Wonder how can that happen.
Am I missing anything?
>
> -S
>
>
> >
> >
> > Thanks and Best Regards,
> > --
> > Pushpalanka Jayawardhana | Undergraduate | Computer Science and
> Engineering
> > University of Moratuwa
> > +94779716248 | http://pushpalankajaya.blogspot.com
> > Twitter: http://twitter.com/Pushpalanka | Slideshare:
> http://www.slideshare.net/Pushpalanka
> >
> >
> > <verification.zip>
>
>
--
Pushpalanka Jayawardhana | Undergraduate | Computer Science and Engineering
University of Moratuwa
+94779716248 | http://pushpalankajaya.blogspot.com
Twitter: http://twitter.com/Pushpalanka | Slideshare:
http://www.slideshare.net/Pushpalanka
