Mailing-List: contact dev-help@corinthia.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@corinthia.incubator.apache.org
Received-SPF: softfail (nike.apache.org: transitioning domain of
 dennis.hamilton@acm.org does not designate 216.234.124.51 as permitted
 sender)
Reply-To: <dennis.hamilton@acm.org>
From: "Dennis E. Hamilton" <dennis.hamilton@acm.org>
To: <dev@corinthia.incubator.apache.org>
Subject: MiniZip Dependency Consideration
Date: Mon, 22 Dec 2014 08:56:57 -0800
Organization: NuovoDoc
Message-ID: <004c01d01e08$4ce43420$e6ac9c60$@acm.org>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AdAeBxa0N3eu+TopQuKnV9JqzEtMAw==
Content-Language: en-us
Received-SPF: softfail (supercp.com: domain of transitioning
 dennis.hamilton@acm.org does not designate 97.113.57.118 as permitted sender)

There has been previous discussion on replacing the external dependency =
on MiniZip.

One thing to be careful about is the fact that these "simple" =
implementations, and simpler replacements, can be too simple.  We'll =
need to be vigilant about exposures to crafted exploits and also to how =
detected errors are handled in a resilient fashion.

This is a timely reminder: =
<http://www.ocert.org/advisories/ocert-2014-011.html>.

I think, in the long run, it should be possible to slide in an =
implementation of DCF, the ISO Document Container Profile of the PKWARE =
Zip specification.  This is oriented specifically to the use of Zip as a =
document container in cross-platform interchange (rather than a way of =
moving archives of file sets from one computer to another).  This should =
accomodate for OPC (in OOXML and elsewhere), ODF, and ePUB without =
difficulty. =20

I'm not clear, at this point, when DCF will appear and how available it =
will be.

 - Dennis