Bob, Dennis,

On 06.01.09 13:54, Bob Jolliffe wrote:

I agree. The question is whether we use the URI that was used to retrieve the package as base URI, or that URI with "/META-INF" appended. So, we indeed could take everything we say in 17.5, but only adapt the base URI that is used.

Well, independent of what is implemented, I think there could be reasons to use the URI that was used to retrieve the package as base URI, although the files are in the META-INF folder. The signature files like the manifest.xml are information that make up the package. That they are stored in a folder META-INF can be considered to be an implementation detail of the package. We could have stored this information in some other place (which is not a folder in the zip files) if zip files would allow us to do so. I would not prefer this actually, because having the package related information in a META-INF folder makes that information accessible and is consistent with JAR files. I'm only mentioning this to point out how the signature information differs from let's say information in content.xml.

So, what I actually could imagine is that we modify 17.5 by adding that these rules also apply to files in the META-INF folder (in general, and not only for digital signature files), except that the base URI to use there is the one that was used to retrieve the package.

Best regards

Sitz der Gesellschaft: Sun Microsystems GmbH, Sonnenallee 1, D-85551 Kirchheim-Heimstetten Amtsgericht Muenchen: HRB 161028 Geschaeftsfuehrer: Thomas Schroeder, Wolfgang Engels, Dr. Roland Boemer Vorsitzender des Aufsichtsrates: Martin Haering