[Accepted] SE-0291 Amendment: Package Collection Signing

[tomerd]

The review of SE-0291 Package Collection Signing amendment has concluded.

The feedback from the discussion thread and review has been largely informational and the amendment has been accepted.

Thank you to everyone who participated in the review!

Tom Doron,
Review Manager

[xwu (Xiaodi Wu)]

During the discussion, the following point was brought up regarding signing:

@yim_lee

@mattt

If the signature is appended to the package collection payload, how exactly are the contents of that payload validated? I ask this because I suspect that things like insignificant whitespace and key reordering may be problematic for verification.

This is an excellent point and thanks for the link. The signing tool (that we will provide) will definitely apply those rules. i.e., it will not just use the collection JSON file/string "as-is" for the signature.

I notice that it’s not part of the amendment text: is this part of the approved design?

[yim_lee]

The signature check compares package collection instances instead of raw JSON/bytes so we don't need to worry about key ordering, whitespaces, etc.