Mailing-List: contact security-dev-help@xml.apache.org; run by ezmlm
Precedence: bulk
Reply-To: security-dev@xml.apache.org
Received-SPF: pass (hermes.apache.org: local policy)
Message-ID: <42213271.7070906@wingsofhermes.org>
Date: Sun, 27 Feb 2005 13:37:37 +1100
From: Berin Lautenbach <berin@wingsofhermes.org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.7.3) Gecko/20040910
MIME-Version: 1.0
To: security-dev@xml.apache.org
Subject: Base64 question + Preparing for a 1.2 C++ release
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Peoples,

I've been doing some work to clean up for a 1.2 release.  In particular, 
I have just :

1.  Started going through and cleaning up the various bugs that haven't 
yet been fixed
2.  Stripped out all requirements for RTTI
3.  Stripped out requirement for MFC in debug build
4.  Now builds against OpenSSL 0.9.8 as well as 0.9.7 and 0.9.6, and 
supports SHA 224/256/384/512 if they are supported by the version of 
OpenSSL.

Before we do a 1.2 however, I'm wondering if we can do something about 
the base64 and validation problems.

Scott - you are the person with the most experience in schema validation 
and signatures.  Is it worthwhile adding some form of switch to tell the 
library to output base64 data in normalised form?  (I.e. no line feeds 
etc.)  That way normalisation won't touch the data and schema validation 
should work a bit better?  Or am I missing something fundamental somewhere?

Open to thoughts on that one - it means using the internal base64 class 
rather than that provided by OpenSSL.

Cheers,
	Berin