Signature process in LibreOffice 6.3

[Michael Stahl]

On 07.02.20 20:13, Steve Martin wrote:
> 
>> Document signatures shall be stored in a file called 
>> META-INF/documentsignatures.xml in the package as described in section 
>> 3.5 of the OpenDocument specification part 3. Document signatures 
>> shall contain a <ds:Reference> element for each file within the 
>> package, with the exception that <ds:Reference> elements for the 
>> META-INF/documentsignatures.xml file containing the signature, and any 
>> files contained in the package whose relative path starts with 
>> "external-data/" should be omitted.

interesting, i hadn't noticed that... apparently it was added with 
https://issues.oasis-open.org/browse/OFFICE-3028

> I understand it in that way: If I create a directory with the name 
> "external-data" and put files into that directory, these files remain 
> unaffected by the signature check (unlike my file 
> "Thumbnails/meta.xml"). Is this correct? Or are these files just not a 
> part of the signature while generating the signature value?*
> 
> I repeated my test scenario and adjusted the manifest.xml file accordingly:
> 
> <manifest:file-entry manifest:full-path="external-data/meta.xml" 
> manifest:media-type="text/xml"/>
> 
> If I now copy the meta.xml file into the "external-data" folder after 
> creating the signature, I still get the message that the signature is 
> invalid. None of the URI attributes of the <Reference> elements contain 
> the value "external-data/meta.xml".

git grep "external-data" indicates that this feature remains 
unimplemented in LO.