strepsirrhini/office-gobmx
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
office-gobmx/xmlsecurity
History
Miklos Vajna 8ce222753a Update libxmlsec to 1.3.3 
Extend external/xmlsec/old-nss.patch.1, our bundled NSS in debug builds
has some assert failure in relatively new xmlsec code, just disable it
for now till it's clarified with upstream how to sort that out properly.

E.g. CppunitTest_filter_svg fails like this:

	#1  0x00007ffff77503e5 in abort () at /lib64/libc.so.6
	#2  0x00007ffff679ca90 in PR_Assert (s=0x7ffff44fbfe5 "oidmechhash != NULL", file=0x7ffff44fbfb6 "secoid.c", ln=2140) at ../../../../pr/src/io/prlog.c:571
	#3  0x00007ffff44eaae0 in SECOID_FindOIDByMechanism (mechanism=307) at secoid.c:2140
	#4  0x00007ffff6660c65 in PK11_MechanismToAlgtag (type=307) at pk11mech.c:1745
	#5  0x00007fffe874e4ea in xmlSecNssCryptoCheckMechanism (type=307) at crypto.c:68
	#6  0x00007fffe874ec44 in xmlSecNssUpdateAvailableCryptoTransforms (functions=0x7fffe87ffbc0 <functions>) at crypto.c:401
	#7  0x00007fffe874f13d in xmlSecNssInit () at crypto.c:552
	#8  0x00007fffe86b2c36 in initXmlSec() () at /home/vmiklos/git/libreoffice/core/xmlsecurity/source/xmlsec/xmlsec_init.cxx:42
	#9  0x00007fffdf3c54f2 in DocumentSignatureManager::init() (this=0x7fffffff3970) at /home/vmiklos/git/libreoffice/core/xmlsecurity/source/helper/documentsignaturemanager.cxx:79
	#10 0x00007fffdf43e3da in (anonymous namespace)::DocumentDigitalSignatures::ImplVerifySignatures(com::sun:⭐:uno::Reference<com::sun:⭐:embed::XStorage> const&, com::sun:⭐:uno::Reference<com::sun:⭐:io::XInputStream> const&, DocumentSignatureMode)
	     (this=0x1c07ac0, rxStorage=uno::Reference to (OStorage *) 0x1944e18, xSignStream=empty uno::Reference, eMode=DocumentSignatureMode::Macros)
	    at /home/vmiklos/git/libreoffice/core/xmlsecurity/source/component/documentdigitalsignatures.cxx:486
	#11 0x00007fffdf43da17 in (anonymous namespace)::DocumentDigitalSignatures::verifyScriptingContentSignatures(com::sun:⭐:uno::Reference<com::sun:⭐:embed::XStorage> const&, com::sun:⭐:uno::Reference<com::sun:⭐:io::XInputStream> const&) (this=0x1c07ac0, rxStorage=uno::Reference to (OStorage *) 0x1944e18, xSignInStream=empty uno::Reference)
	    at /home/vmiklos/git/libreoffice/core/xmlsecurity/source/component/documentdigitalsignatures.cxx:373
	#12 0x00007fffe6fa06df in SfxObjectShell::GetDocumentSignatureInformation(bool, com::sun:⭐:uno::Reference<com::sun:⭐:security::XDocumentDigitalSignatures> const&)
	     (this=0x188c280, bScriptingContent=true, xSigner=empty uno::Reference) at /home/vmiklos/git/libreoffice/core/sfx2/source/doc/objserv.cxx:1847

Change-Id: I36dee0d2b128a6931875572aa4acc9df940ab623
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161951
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2024-01-15 08:09:21 +01:00
..
doc XMLSecurity Module Documentation Update 2023-08-26 01:01:40 +02:00
inc xmlsecurity: remove "AdES-compliant signature" checkbox 2023-12-15 10:52:04 +01:00
qa Fix typo 2024-01-11 21:18:49 +01:00
source upgrade libxml2, libxslt & liblangtag 2024-01-05 11:05:36 +01:00
test_docs
uiconfig/ui xmlsecurity: remove "AdES-compliant signature" checkbox 2023-12-15 10:52:04 +01:00
util
workben
AllLangMoTarget_xsc.mk
CppunitTest_qa_certext.mk
CppunitTest_xmlsecurity_dialogs_test.mk
CppunitTest_xmlsecurity_pdfsigning.mk
CppunitTest_xmlsecurity_signing.mk CppunitTest_xmlsecurity_signing2: inherit from UnoApiXmlTest 2022-12-01 16:45:45 +01:00
CppunitTest_xmlsecurity_signing2.mk CppunitTest_xmlsecurity_signing2: inherit from UnoApiXmlTest 2022-12-01 16:45:45 +01:00
Executable_pdfverify.mk
IwyuFilter_xmlsecurity.yaml Remove some unused includes 2022-11-24 08:09:53 +01:00
Library_xmlsecurity.mk
Library_xsec_xmlsec.mk Update libxmlsec to 1.3.3 2024-01-15 08:09:21 +01:00
Makefile
Module_xmlsecurity.mk Allow selecting a custom certificate manager 2023-07-11 16:30:59 +02:00
README.md Fix typo 2023-08-27 18:46:24 +02:00
UIConfig_xmlsec.mk

README.md

Document Signing

Introduction

This code provides dialogs, and infrastructure wrapping libxmlsec and gpgme that implements document signing.

For signing a document, a personal key pair is used, which consists of a private key and a public key, which is added to the document in addition to the digital signature of the document, when signing it.

The document signing can be done both for the source ODF/OOXML files and the exported PDF files. It is also possible to sign existing PDF files.

Module Contents

  • doc: OpenDocument workflow legacy information with some illustrations to have an idea of the workflow, for starters check doc/OpenDocumentSignatures-Workflow.odt.
  • inc: Headers to a subset of source files inside the module, parts like source/framework have headers inside the folder.
  • qa: Unit tests for signing and shell scripts for certificates creation for testing.
  • test_docs: Documents & certificates used for testing.
  • source: More on that below.
  • uiconfig: User interface configuration for different dialogs, it is recommended to navigate from relevant source file to the .ui file linked in the class which will be under uiconfig/ui.
  • util: UNO passive registration config for GPG/ NSS.

Source Primary Contents

  • component: Main implementation of DocumentDigitalSignatures where the interaction with security environment and certificates occur.
  • dialogs: Certificate & Signatures management dialogs.
    • certificatechooser: Dialog that allows you to find and choose certificates or signatures for encryption.
    • certificateviewer: More detailed information about each certificate.
    • digitalsignaturesdialog: Main window for signatures of the documents and the start point of signing document.
  • framework: Various elements for verifying signatures and running security engine.
  • gpg: The implementation of encrypting with GPG and security environment initialization.
  • helper: Some helper classes that include signatures manager and the helpers for PDF signing, UriBinding, and XML signatures. It also include helper tools for XSecurityEnvironment.
  • xmlsec: XML, NSS, MSCrypt encryption/ signing tools, more on the low-level side of actual implementation of algorithms.

PDF Testing

To test the signed PDFs, one can use the pdfverify in this way:

./bin/run pdfverify $PWD/xmlsecurity/qa/unit/pdfsigning/data/2good.pdf

The file parameter should be an absolute path.

This is the output of pdfverify for 2good.pdf:

verifying signatures
found 2 signatures
signature #0: digest match? 1
signature #0: partial? 0
signature #1: digest match? 1
signature #1: partial? 0

References