Re: [png-mng-implement] dSIG

[Greg R. <ne...@po...>]

Mar...@di... wrote:

> I wanted to help out providing PNG dSIG support, so I started
> looking for C libraries able to process DER encodings. Most
> of them claimed to still have several issues, so I picked
> libtomcrypt in the end because of its detailed documentation
> and nicely structured source code. I started experimenting with
> it and it is not yet fully functional regarding the purposes of
> parsing CMS DER structures, but I think with some effort I'll be
> able to adjust the DER part of the library according to our needs.

> What would I have to do in order to contribute?

Assuming Glenn hasn't contacted you offlist, the best approach may be to
post some information here about the kinds of changes to libpng you're
proposing to do, get some feedback (hopefully), and then start hacking.

For the moment, I see two main concerns:  (1) if you add a dependency on
another library, it probably needs to be optional (and perhaps ifdef'd
out by default, or at least runtime-loadable--e.g., dlopen/dlsym or app
callbacks); and (2) the license should be compatible with the libpng/zlib
license (i.e., minimally restrictive).  

Anything beyond those is likely to depend on the implementation details.
Note that libpng still doesn't include iTXt support due to backward-
compatibility concerns, so any dSIG support is similarly likely to appear
only in 1.4.x.

Greg