[Accepted] SE-0291 Amendment: Package Collection Signing

[xwu (Xiaodi Wu)]

During the discussion, the following point was brought up regarding signing:

@yim_lee

@mattt

If the signature is appended to the package collection payload, how exactly are the contents of that payload validated? I ask this because I suspect that things like insignificant whitespace and key reordering may be problematic for verification.

This is an excellent point and thanks for the link. The signing tool (that we will provide) will definitely apply those rules. i.e., it will not just use the collection JSON file/string "as-is" for the signature.

I notice that it’s not part of the amendment text: is this part of the approved design?