There is nothing specified for exactly which bytes are hashed - either for an individu

see note about each resource having its HEADER+BODY signed in : <a href="https://githu

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="20

Details of exactly what is hashed (both for individual entries and the package itself) are missing about webpackage HOT 6 CLOSED

wicg commented on June 1, 2024

Details of exactly what is hashed (both for individual entries and the package itself) are missing

from webpackage.

Comments (6)

bmeck commented on June 1, 2024

see note about each resource having its HEADER+BODY signed in : https://github.com/dimich-g/webpackage/blame/master/README.md#L308

My PR rephrased in a few places to make more explicit in #23

It might be prudent however to change the phrasing of https://github.com/dimich-g/webpackage/blame/master/README.md#L312 to state that nested packages as signed as opaque entities as it sounds currently like nested packages are not something that the root package can verify as being correct currently.

from webpackage.

bmeck commented on June 1, 2024

Just noticed, the certificates are not signed in the Content-Index examples; unsure if this is intentional, but seems like just an accident.

from webpackage.

bmeck commented on June 1, 2024

@lrosenthol if certificates are signed is the rest covered?

from webpackage.

lrosenthol commented on June 1, 2024

You can't sign a certificate with itself - but you could sign the certificates from a nested package with the certs from the parent - that would be perfectly fine.

…

On Thu, Jan 12, 2017 at 10:32 PM, Bradley Meck ***@***.***> wrote: @lrosenthol <https://github.com/lrosenthol> if certificates are signed is the rest covered? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#12 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AE1vNZL62PntQ79dK3bnPVwpddgBWyLFks5rRvBYgaJpZM4K1say> .

from webpackage.

jyasskin commented on June 1, 2024

Arguably, these details can go in the draft specification rather than the explainer, but it's probably time to start that specification and add these details, so we can iterate on them.

from webpackage.

jyasskin commented on June 1, 2024

#36 now specifies exactly which bytes are hashed and signed, so I believe this is fixed.

from webpackage.

Recommend Projects