Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Digitally sign documents via software certificates. #4123

Closed
vmiklos opened this issue Oct 14, 2024 · 1 comment · Fixed by #4129
Closed

Digitally sign documents via software certificates. #4123

vmiklos opened this issue Oct 14, 2024 · 1 comment · Fixed by #4129
Labels
2. developing Work in progress enhancement New feature or request

Comments

@vmiklos
Copy link
Contributor

vmiklos commented Oct 14, 2024

Is your feature request related to a problem? Please describe.

Collabora Online is adding digital signature support, see CollaboraOnline/online#9992 for the details. This is something that richdocuments could use.

Describe the solution you'd like

The solution is meant to provide signing support for ODF (e.g. ODT), OOXML (e.g. DOCX) and PDF files.

We discussed this with @juliushaertl about a month ago, but back then the Collabora Online side was far from ready. The suggested plan is:

  • Step 1: Exposing signing via software certificates
    • Key store in richdocuments
    • Signing can happen in Collabora Online
    • One key per user (in PEM format, this means a key, a certificate and optionally a CA chain)
    • this issue.
  • Step 2: build electronic signature support on top of this, via some external provider
    • this is interesting, but let's get back to this once step 1 is done.

Describe alternatives you've considered

It's always possible to export as PDF and sign that PDF outside Collabora Online, if you don't mind the export / download, sign, upload steps, which is a bit complicated.

Additional context

I intend to work on this, just creating the issue to track the richdocuments progress at a single place.
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 14, 2024
@vmiklos
feat: add personal setting to specify the CA chain for document signing
dccf70c 
Document signing needs to store keys as richdocuments settings. This
involves the signing key, certificate and the matching CA chain.

As a first step, add code to the personal settings to be able to set a
CA chain that issues the signing key / certificate.

Setting and getting the setting is possible after this; the setting is
not yet exposed in the WOPI CheckFileInfo response.

<CollaboraOnline/online#9992 (comment)>
has instructions on how to generate self-signed certificates for
document signing for development purposes. Related to nextcloud#4123
@vmiklos
Copy link
Contributor Author

vmiklos commented Oct 14, 2024

I started on this here: https://github.com/vmiklos/nextcloud-richdocuments/commits/sign

I'll create a PR once this works for me locally.

@joshtrichards joshtrichards added the enhancement New feature or request label Oct 14, 2024
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 15, 2024
@vmiklos
feat: expose the documentSigningCa personal setting in the WOPI Check…
b781fe6 
…FileInfo

This setting was already possible to read and write from the personal
settings UI, but was not available towards Collabora Online.

Other private user settings like the Zotero API key are exposed in the
WOPI CheckFileInfo reply.

Do the same here: if the feature is enabled in general and this is not a
public share, then include the signature CA setting in the CheckFileInfo
response.

The same still needs doing for the signature cert/key. Related to nextcloud#4123
@juliusknorr juliusknorr added the 2. developing Work in progress label Oct 15, 2024
@jancborchardt jancborchardt moved this to 🏗️ At engineering in 🖍 Design team Oct 15, 2024
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 16, 2024
@vmiklos
feat: add personal setting to specify the CA chain for document signing
ec1bb5a 
Document signing needs to store keys as richdocuments settings. This
involves the signing key, certificate and the matching CA chain.

As a first step, add code to the personal settings to be able to set a
CA chain that issues the signing key / certificate.

Setting and getting the setting is possible after this; the setting is
not yet exposed in the WOPI CheckFileInfo response.

<CollaboraOnline/online#9992 (comment)>
has instructions on how to generate self-signed certificates for
document signing for development purposes. Related to nextcloud#4123
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 16, 2024
@vmiklos
feat: expose the documentSigningCa personal setting in the WOPI Check…
6351252 
…FileInfo

This setting was already possible to read and write from the personal
settings UI, but was not available towards Collabora Online.

Other private user settings like the Zotero API key are exposed in the
WOPI CheckFileInfo reply.

Do the same here: if the feature is enabled in general and this is not a
public share, then include the signature CA setting in the CheckFileInfo
response.

The same still needs doing for the signature cert/key. Related to nextcloud#4123
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 16, 2024
@vmiklos
feat: document signing, add setting for the signing certificate & key…
66dc749 
…, too (fixes nextcloud#4123)

The CA chain for the document signing was already a user setting & it
was exposed in the WOPI CheckFileInfo, but the actual signing
certificate & key was missing, so signing was not possible.

These are typically in a similar PEM format using just ASCII characters,
so providing a textarea where the user can paste them sounds like a good
fit.

Add the read/write of this setting and also expose it as part of the
private user info in WOPI CheckFileInfo.

With this, once all 3 are configured, it's possible to sign a document
in Nextcloud Office, using the Signature button on the Home tab of the
notebookbar.
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 16, 2024
@vmiklos
feat: add personal setting to specify the CA chain for document signing
20ca5fd 
Document signing needs to store keys as richdocuments settings. This
involves the signing key, certificate and the matching CA chain.

As a first step, add code to the personal settings to be able to set a
CA chain that issues the signing key / certificate.

Setting and getting the setting is possible after this; the setting is
not yet exposed in the WOPI CheckFileInfo response.

<CollaboraOnline/online#9992 (comment)>
has instructions on how to generate self-signed certificates for
document signing for development purposes. Related to nextcloud#4123

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 16, 2024
@vmiklos
feat: expose the documentSigningCa personal setting in the WOPI Check…
6ca8071 
…FileInfo

This setting was already possible to read and write from the personal
settings UI, but was not available towards Collabora Online.

Other private user settings like the Zotero API key are exposed in the
WOPI CheckFileInfo reply.

Do the same here: if the feature is enabled in general and this is not a
public share, then include the signature CA setting in the CheckFileInfo
response.

The same still needs doing for the signature cert/key. Related to nextcloud#4123

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 16, 2024
@vmiklos
feat: document signing, add setting for the signing certificate & key…
25acd1d 
…, too (fixes nextcloud#4123)

The CA chain for the document signing was already a user setting & it
was exposed in the WOPI CheckFileInfo, but the actual signing
certificate & key was missing, so signing was not possible.

These are typically in a similar PEM format using just ASCII characters,
so providing a textarea where the user can paste them sounds like a good
fit.

Add the read/write of this setting and also expose it as part of the
private user info in WOPI CheckFileInfo.

With this, once all 3 are configured, it's possible to sign a document
in Nextcloud Office, using the Signature button on the Home tab of the
notebookbar.

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
@vmiklos vmiklos mentioned this issue Oct 16, 2024
Merged
3 tasks
@elzody elzody closed this as completed in adfb905 Oct 21, 2024
@github-project-automation github-project-automation bot moved this from 🏗️ At engineering to 🎉 Done in 🖍 Design team Oct 21, 2024
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 22, 2024
@vmiklos
feat: add personal setting to specify the CA chain for document signing
18a8d7a 
Document signing needs to store keys as richdocuments settings. This
involves the signing key, certificate and the matching CA chain.

As a first step, add code to the personal settings to be able to set a
CA chain that issues the signing key / certificate.

Setting and getting the setting is possible after this; the setting is
not yet exposed in the WOPI CheckFileInfo response.

<CollaboraOnline/online#9992 (comment)>
has instructions on how to generate self-signed certificates for
document signing for development purposes. Related to nextcloud#4123

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 20ca5fd)
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 22, 2024
@vmiklos
feat: expose the documentSigningCa personal setting in the WOPI Check…
af6bcc8 
…FileInfo

This setting was already possible to read and write from the personal
settings UI, but was not available towards Collabora Online.

Other private user settings like the Zotero API key are exposed in the
WOPI CheckFileInfo reply.

Do the same here: if the feature is enabled in general and this is not a
public share, then include the signature CA setting in the CheckFileInfo
response.

The same still needs doing for the signature cert/key. Related to nextcloud#4123

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 6ca8071)
vmiklos added a commit to vmiklos/nextcloud-richdocuments that referenced this issue Oct 22, 2024
@vmiklos
feat: document signing, add setting for the signing certificate & key…
c3f1bb3 
…, too (fixes nextcloud#4123)

The CA chain for the document signing was already a user setting & it
was exposed in the WOPI CheckFileInfo, but the actual signing
certificate & key was missing, so signing was not possible.

These are typically in a similar PEM format using just ASCII characters,
so providing a textarea where the user can paste them sounds like a good
fit.

Add the read/write of this setting and also expose it as part of the
private user info in WOPI CheckFileInfo.

With this, once all 3 are configured, it's possible to sign a document
in Nextcloud Office, using the Signature button on the Home tab of the
notebookbar.

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit adfb905)
@vmiklos vmiklos mentioned this issue Oct 22, 2024
Merged
@vmiklos vmiklos mentioned this issue Dec 6, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2. developing Work in progress enhancement New feature or request
Projects
🖍 Design team
Status: 🎉 Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Digitally sign documents via software certificates vmiklos/nextcloud-richdocuments
3 participants
@vmiklos @joshtrichards @juliusknorr