RE: ACTION-543: Make proposals for the last two points noted in ISSUE-43 comments

I have added the Scott's text to the Signature 2.0 spec.  this should close my ACTION-587.
See http://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-20/  document date - June 7th 2010 

But I haven't yet updated the schema.  I think we should have a changed schema (non-normative) for 1.x also, not just 2.0.

Pratik

-----Original Message-----
From: Pratik Datta 
Sent: Wednesday, June 02, 2010 9:06 AM
To: Scott Cantor; public-xmlsec@w3.org
Subject: RE: ACTION-543: Make proposals for the last two points noted in ISSUE-43 comments

It is probably ok to change the schema.

I was thinking that some implementations might have this issue if we change the schema - maybe they don't. (Our implementation is not affected)

JAXB (or some other xml binding technology)  generates java files from xml schema files.  It is possible that particular implementation is set up in such a way that every time that implementation is built, it fetches the official schema from the W3C site, and then generates java files from it, and then compiles the rest of code against these generated java files. If the official schema changes, then the generated java files will also change and the compilation may fail. This problem will happen even if IssuerSerial is not even used. I agree that this is not really a good way to set up a build, so maybe this is just a hypothetical problem after all.

But it will be good to have the modified version of the schema with all the known problems fixed. New implementations or major revisions of existing implementations can then start off this fixed version.


Pratik


-----Original Message-----
From: Scott Cantor [mailto:cantor.2@osu.edu] 
Sent: Tuesday, June 01, 2010 11:44 AM
To: Pratik Datta; public-xmlsec@w3.org
Subject: RE: ACTION-543: Make proposals for the last two points noted in ISSUE-43 comments

> Adding these warnings is fine.
> But changing the datatype in the schema may have some unintended
> consequences.  In XML binding APIs, e.g. like JAXB which takes an XML
schema
> and creates Java classes from it, changing the xml schema from int to
string
> creates an incompatible change in the java class.

Why would that be a problem unless somebody creates an instance that carries
a non-integer serial number? That's supposed to be invalid anyway, so all I
can see it doing is changing the error you get.

> So I would suggest that
> we do not modify the normative version of the schema,  but we can make an
> unofficial errata-merged version available. New Dsig implementations can
> start with modified version.

That's fine with me, but I wanted to represent the opinion that I've heard
from various other communities that leaving schemas broken in the interest
of stability makes us look "stupid" (their words, not mine).

-- Scott

Received on Monday, 7 June 2010 15:29:31 UTC