[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
|
Re: [ease-dev] [EASE-dev] Introduction
|
Hi Varun,
you are on the right track regarding signing. But I would prefer to keep
signature and code in the same file. Eg we could think of appending the
signature in a comment block at the end of the file. It would be easier
to host and things that belong together would stick together. Basically
its very similar to signing emails. You are right that we need some
API/UI to sign scripts so users can do that in a comfortable way. An
interactive UI would be great, possibly bound to the context menu of
resources. Another option would be to provide a builder (similar to a
compiler) that reacts on file changes on script files. With a predefined
certificate we could automatically sign scripts on every file save.
Further a builder could check those certificates on scripts and add an
overlay icon to the files (valid/broken/no signature).
To write these comments we have an API that can detect the target script
language of a file and provide correct tokens for block and line comments.
cheers
Christian
On 03/16/2016 02:20 PM, Varun Raval wrote:
Hi Christian,
Some basic requirements are data(in our case: script) and signature
must be in different files as per my knowledge so far about key
generation. We can merge certificate and sign in a single file by
making our custom format since both are binary files.
So, what we can do is, when we encounter scripts from server, we can
check if there is a signature file with same name on server in same
directory or not. If it's not there then we can warn user about
dangers of that script. If it's there then we can import certificate
and verify signature.
For this, we need to tell signing user beforehand, that if they are
interested in uploading scripts they must prefer to sign those scripts
and upload signature file. User than will have option to upload
signature and certificate combined in a file that we have generated(by
providing some kind of functionality like plugin) or by generating
signature in user's own way. In second case user will have to upload
certificate separately so that we can verify before executing scripts.
For verifying, as I mentioned earlier, we can check whether signature
and certificate are there on server and respond accordingly.
Hope this helps!!
