[FELIX-3603] Resources in META-INF/xxx/ fodlers in a signed bundle should be checked

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: framework.security-2.2.0
• Component/s: Framework Security
• Assignee: Karl Pauls
• Reporter: Guillaume Nodet
• Created: 21/Jul/12 11:39
• Updated: 27/Jul/12 09:24
• Resolved: 27/Jul/12 09:24

Description

See section 2.3.2 of the OSGi Core spec,

Bundles do not support partially signed bundles. The manifest must contain name sections for all resources but should not have entries for resources in the META-INF directory. Signed entries in the META-INF directory must be verified. Sub directories of META-INF must be treated like any other JAR directory.