Digitally sign documents via software certificates #4129
+158
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Document signing needs to store keys as richdocuments settings. This involves the signing key, certificate and the matching CA chain. As a first step, add code to the personal settings to be able to set a CA chain that issues the signing key / certificate. Setting and getting the setting is possible after this; the setting is not yet exposed in the WOPI CheckFileInfo response. <CollaboraOnline/online#9992 (comment)> has instructions on how to generate self-signed certificates for document signing for development purposes. Related to nextcloud#4123 Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
…FileInfo This setting was already possible to read and write from the personal settings UI, but was not available towards Collabora Online. Other private user settings like the Zotero API key are exposed in the WOPI CheckFileInfo reply. Do the same here: if the feature is enabled in general and this is not a public share, then include the signature CA setting in the CheckFileInfo response. The same still needs doing for the signature cert/key. Related to nextcloud#4123 Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
…, too (fixes nextcloud#4123) The CA chain for the document signing was already a user setting & it was exposed in the WOPI CheckFileInfo, but the actual signing certificate & key was missing, so signing was not possible. These are typically in a similar PEM format using just ASCII characters, so providing a textarea where the user can paste them sounds like a good fit. Add the read/write of this setting and also expose it as part of the private user info in WOPI CheckFileInfo. With this, once all 3 are configured, it's possible to sign a document in Nextcloud Office, using the Signature button on the Home tab of the notebookbar. Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
| @@ -17,6 +17,16 @@ import { showError } from '@nextcloud/dialogs' | |||
| this.zoteroAPIKeySaveButton = document.getElementById('zoteroAPIKeySave') | |||
| this.zoteroAPIKeyRemoveButton = document.getElementById('zoteroAPIKeyRemove') | |||
|
|
|||
| this.documentSigningCertInput = document.getElementById('documentSigningCertField') | |||
There was a problem hiding this comment.
It would be great if we can rather add this to the vue.js based frontend, but maybe that is something where @elzody can help moving that over
There was a problem hiding this comment.
Oh, I was just tracing how the zotero API key setting does this, and this way seemed to be the way it works. Maybe move the zotero API key handling to the vue.js based frontend, and then I'm happy to do the same for these settings as well? Thanks.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This implements step 1 of digital signature signing, where the keystore is in richdocuments and the signing is performed in Collabora Online, not via some external signing service. This supports ODF, OOXML and PDF formats.
Checklist
npm run stylelintpassesHow to test
Make sure to have a new enough COOL snapshot, so its /hosting/capabilities reports hasDocumentSigningSupport=true. This is true for online.git master as of >= 2024-11-09.
Go to /settings/user/richdocuments
Fill in the 3 new signing settings. For testing, you can generate the certificates with a script described at Digitally sign documents CollaboraOnline/online#9992 (comment) or just use these:
Let me know if you would like any tweaks. Thanks.