Uploaded image for project: 'Wookie'
  1. Wookie
  2. WOOKIE-139

Implement the W3C XML Digital Signatures for Widgets specification in Wookie

    Details

    • Type: New Feature
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 0.12.0
    • Component/s: None
    • Labels:

      Description

      W3C XML Digital Signatures for Widgets specifies how both authors and distributors of widgets can digitally sign a Widget package:

      The spec is here: http://dev.w3.org/2006/waf/widgets-digsig/

      This means that an organisation can choose to automatically install and update widgets that carry recognised signatures - for example from a reputable online widget store (distributor) or from an approved widget author rather than require admin intervention to approve them.

      For Wookie this means implementing the mechanism for locating and verifying W3C signature.xml files in Widgets, and providing signature management options.

      For example, we may want to have a configuration property set for requiring signatures be checked, and a file where trusted signatories are listed for checking against when a new widget is uploaded, or a new version is detected online using Widget Updates.

      We may also want to look at how Wookie can delegate upwards decisions based on signature verification, for example to let an Apache Rave admin choose to allow automatic publishing of signed widgets from trusted sources provided that Wookie has verified the signature and returned this information to Rave. This could be handled in the response to uploading a widget to Wookie using the REST API, e.g. adding <signature verified="true" type="author"/> to the metadata returned in the response body.

        Attachments

        1. verifying_digital_signatures_v2.patch
          46 kB
          Pushpalanka Jayawardhana
        2. wookie-digsig-v1.patch
          14 kB
          Paul Sharples
        3. Wookie_Widget_Signer_Guide
          2 kB
          Pushpalanka Jayawardhana
        4. logo.png
          6 kB
          Pushpalanka Jayawardhana
        5. Signer_W3C_widget_digisg.patch
          59 kB
          Pushpalanka Jayawardhana

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              scottbw Scott Wilson
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: