{"id":18352556,"url":"https://github.com/felleslosninger/efm-asic","last_synced_at":"2026-02-28T23:31:21.012Z","repository":{"id":34195570,"uuid":"38050087","full_name":"felleslosninger/efm-asic","owner":"felleslosninger","description":"Generic implementation of ASiC-E archives in accordance with ETSI 102 918 v1.3.1.","archived":false,"fork":false,"pushed_at":"2025-10-08T08:09:06.000Z","size":2551,"stargazers_count":30,"open_issues_count":13,"forks_count":27,"subscribers_count":19,"default_branch":"main","last_synced_at":"2025-10-08T08:18:57.757Z","etag":null,"topics":["eformidling","java","library","spring-boot","team-eformidling"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/felleslosninger.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2015-06-25T13:13:20.000Z","updated_at":"2025-10-08T06:12:33.000Z","dependencies_parsed_at":"2024-03-02T09:15:10.917Z","dependency_job_id":"85c7803b-e0fc-4d58-9a37-44d085fa097d","html_url":"https://github.com/felleslosninger/efm-asic","commit_stats":null,"previous_names":["felleslosninger/efm-asic","difi/asic"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/felleslosninger/efm-asic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felleslosninger%2Fefm-asic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felleslosninger%2Fefm-asic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felleslosninger%2Fefm-asic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felleslosninger%2Fefm-asic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/felleslosninger","download_url":"https://codeload.github.com/felleslosninger/efm-asic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felleslosninger%2Fefm-asic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29954955,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-28T22:53:01.873Z","status":"ssl_error","status_checked_at":"2026-02-28T22:52:50.699Z","response_time":90,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["eformidling","java","library","spring-boot","team-eformidling"],"created_at":"2024-11-05T21:36:25.028Z","updated_at":"2026-02-28T23:31:20.970Z","avatar_url":"https://github.com/felleslosninger.png","language":"Java","funding_links":[],"categories":["Interoperability and Digital Infrastructure"],"sub_categories":[],"readme":"\u003e [!WARNING]\n\u003e Please note that this project is in maintenance mode.\n\u003e \n\u003e It is currently being maintained for the purpose of eFormidlings use of the advanced signature container (ASiC) format.\n\u003e\n\u003e Bugs will be fixed and dependencies kept up to date, but no new features will be added.\n\u003e\n\u003e eFormidling is looking into alternatives and might archive the project in the future.\n\u003e\n\u003e Alternatives to this project include:\n\u003e\n\u003e - KS FIKS is maintaining a fork of this libarary at https://github.com/ks-no/asic (also for .NET at https://github.com/ks-no/fiks-asice-dotnet)\n\u003e - The Digital Signature Service (part of the Digital Europe eSignature building block) is maintaining a set of libraries for building and validating ASiC (and more) at https://github.com/esig/dss\n\n# Associated Signature Container (ASiC)\n\nAn ASiC file is simply a ZIP archive created according to some rules set forth in the specifications. \n\nThe benefits of using containers for message transfer are:\n* all files are kept together as a single collection.\n* very efficient with regards to space.\n* due to the compressed format, communication bandwith is utilized better\n* message integrity is provided, using message digests and signatures.\n* confidentiality is provied by encryption using AES-256 in GCM mode\n\nThis component provides an easy-to-use factory for creating ASiC-E containers.\n\nConformance is claimed according to 7.2.1 (TBA) and 7.2.2 in\n[ETSI TS 102 918 V1.3.1](http://webapp.etsi.org/workprogram/Report_WorkItem.asp?WKI_ID=42455).\n\n## To build from source\nBuild with Java 21 and a recent Maven 3 version like this :\n```\nmvn clean install\n\n# For reference - these were my Java and Maven versions\n\njava -version\n# openjdk version \"21.0.5\" 2024-10-15 LTS\n# OpenJDK Runtime Environment Temurin-21.0.5+11 (build 21.0.5+11-LTS)\n# OpenJDK 64-Bit Server VM Temurin-21.0.5+11 (build 21.0.5+11-LTS, mixed mode, sharing)\n\nmvn -version\n# Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)\n```\n\n## Maven Releases\nLatest `1.x.y` series is for Java 21+, while the older series based on Java 8 ended with version `0.12.0` release on `19 Oct 2023`.\n\n\u003ctable\u003e\n\u003ctr\u003e\n\u003cth\u003e1.x.y for Java 21 (in maintenance mode)\u003c/th\u003e\n\u003cth\u003e0.x.y for Java 8 (no longer maintained)\u003c/th\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\n\n```xml\n\u003cdependency\u003e\n    \u003cgroupId\u003eno.difi.commons\u003c/groupId\u003e\n    \u003cartifactId\u003ecommons-asic\u003c/artifactId\u003e\n    \u003cversion\u003e1.0.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\n\u003c/td\u003e\n\u003ctd\u003e\n\n```xml\n\u003cdependency\u003e\n    \u003cgroupId\u003eno.difi.commons\u003c/groupId\u003e\n    \u003cartifactId\u003ecommons-asic\u003c/artifactId\u003e\n    \u003cversion\u003e0.12.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/table\u003e\n\n## Important Note about ZipBomb prevention\nStarting with version 1.0.0 we have added simple protection against [ZipBomb](https://github.com/felleslosninger/efm-asic/security/advisories/GHSA-rc4q-523c-3qmm).\n\nThis has been implemented with a custom `ByteArrayOutputStream` that limits decoding of files in `META-INF` to 1 MiB (see [MaxSizeProtectedOutputStream](src/main/java/no/difi/asic/zipbomb/MaxSizeProtectedOutputStream.java)).\n\nThe only use of `MaxSizeProtectedOutputStream` is in the `handleMetadataEntry()` method in [AbstractAsicReader](src/main/java/no/difi/asic/AbstractAsicReader.java).\n\nTo change the 1 MiB limit we can specify a more exact limit in `handleMetadataEntry()` or set another default inside the `MaxSizeProtectedOutputStream` implementation.\n\n## What does it look like?\n\nIn general the archive looks something like depicted below \n\n```\nasic-container.asice: \n   |\n   +-- mimetype\n   |\n   +-- bii-envelope.xml\n   |\n   +-- bii-document.xml\n   |\n   +-- META-INF/\n          |\n          + asicmanifest.xml\n          |\n          + signature.p7s   \n   \n```\n\nConsult the [AsicCadesContainerWriterTest](src/test/java/no/difi/asic/AsicWriterTest.java) for sample usage.\nHere is a rough sketch on how to do it:\n```java\n// Creates an ASiC archive after which every entry is read back from the archive.\n\n// Name of the file to hold the the ASiC archive\nFile archiveOutputFile = new File(System.getProperty(\"java.io.tmpdir\"), \"asic-sample-default.zip\");\n\n// Creates an AsicWriterFactory with default signature method\nAsicWriterFactory asicWriterFactory = AsicWriterFactory.newFactory();\n\n// Creates the actual container with all the data objects (files) and signs it.\nAsicWriter asicWriter = asicWriterFactory.newContainer(archiveOutputFile)\n        // Adds an ordinary file, using the file name as the entry name\n        .add(biiEnvelopeFile)\n                // Adds another file, explicitly naming the entry and specifying the MIME type\n        .add(biiMessageFile, BII_MESSAGE_XML, MimeType.forString(\"application/xml\"))\n                // Signing the contents of the archive, closes it for further changes.\n        .sign(keystoreFile, TestUtil.keyStorePassword(), TestUtil.privateKeyPassword());\n\n// Opens the generated archive and reads each entry\nAsicReader asicReader = AsicReaderFactory.newFactory().open(archiveOutputFile);\n\nString entryName;\n\n// Iterates over each entry and writes the contents into a file having same name as the entry\nwhile ((entryName = asicReader.getNextFile()) != null) {\n    log.debug(\"Read entry \" + entryName);\n    \n    // Creates file with same name as entry\n    File file = new File(entryName);\n    // Ensures we don't overwrite anything\n    if (file.exists()) {\n        throw new IllegalStateException(\"File already exists\");\n    }\n    asicReader.writeFile(file);\n    \n    // Removes file immediately, since this is just a test \n    file.delete();  \n}\nasicReader.close(); \n```\n\n## Security\n\nThis library validate signatures, but does not validate the certificate. It's up to the implementer using the library\nto choose if and how to validate certificates. Certificate(s) used for validation is exposed by the library.\n\n\n## Creating an ASiC-E container manually\n\nThis is how you create an ASiC container manually:\n\n1. Create empty directory named `asic-sample`\n1. Copy the files `bii-envelope.xml`and `bii-trns081.xml` into `asic-sample`\n1. Create the directory `META-INF`:\n1. Compute the SHA-256 digest value for the files and save them:\n```\nopenssl dgst -sha256 -binary bii-envelope |base64\nopenssl dgst -sha256 -binary bii-message |base64\n\n```\n1. Create the file `META-INF/asicmanifest.xml`, add an entry for each file and\npaste the SHA-256 values computed in the previous step. The file should look something like this:\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\n\u003cASiCManifest xmlns=\"http://uri.etsi.org/02918/v1.2.1#\" xmlns:ns2=\"http://www.w3.org/2000/09/xmldsig#\"\u003e\n    \u003cSigReference URI=\"META-INF/signature.p7s\" MimeType=\"application/x-pkcs7-signature\"/\u003e\n    \u003cDataObjectReference URI=\"bii-trns081.xml\" MimeType=\"application/xml\"\u003e\n        \u003cns2:DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"/\u003e\n        \u003cns2:DigestValue\u003emorANIlh3TGxMUsJWKfICly7YXoduG7LCohAKc2Sip8=\u003c/ns2:DigestValue\u003e\n    \u003c/DataObjectReference\u003e\n    \u003cDataObjectReference URI=\"bii-envelope.xml\" MimeType=\"application/xml\"\u003e\n        \u003cns2:DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"/\u003e\n        \u003cns2:DigestValue\u003eIZ9yiwKHsTWMcyFebi7csqOOIHohy2gPd02VSfbyUCI=\u003c/ns2:DigestValue\u003e\n    \u003c/DataObjectReference\u003e\n\u003c/ASiCManifest\u003e\n```\n1. Create the signature, which should be placed into `signature.p7s`. The file `comodo.pem` should\nbe replaced with the PEM-file holding your private key for the signature, and the certificate to prove it.\n```\nopenssl cms -sign -in META-INF/asicmanifest.xml -binary -outform der -out META-INF/signature.p7s -signer comodo.pem\n```\n\n1. Verify the signature:\n```\nopenssl cms -verify -in META-INF/signature.p7s -inform der -content META-INF/asicmanifest.xml -noverify\n```\nNote! The `-noverify` option omits verifying the certificate chain of trust and should only be used to verify that the files were created properly\n\n1. Create the ZIP-archive using your favourite tool :-)\n\n**Disclaimer:** The procedure liste above works on a Mac or Linux machine with the various tools pre-installed. If you are running on a windows machine\nyou need to download and install the *openssl* and *base64* tool and adapt the procedure according to your liking.\n\n\n## Verifying the contents using *openssl*\n\nHere is how to verify the signature using the *openssl(1)* command line tool:\n\n```\nopenssl cms -verify -in META-INF/signature.p7s -inform der -content META-INF/asicmanifest.xml -noverify\n```\n\nThe `-noverify` option will allow self signed certificates, and should normally be omitted :-).\n\n## Release\nSee documentation for the [maven-release-plugin](https://maven.apache.org/maven-release/maven-release-plugin/) and [guide for maven-release-plugin](https://maven.apache.org/guides/mini/guide-releasing.html).\n\n```bash\n# local repo must be in sync with origin/GitHub\ngit push\n\nmvn release:prepare\n# answer three questions (set the tag equal to the release version)\n# What is the release version for \"Associated Signature Container (ASiC)\"? (commons-asic) 1.0: : 1.0.0\n# What is SCM release tag or label for \"Associated Signature Container (ASiC)\"? (commons-asic) 1.0.0: :\n# What is the new development version for \"Associated Signature Container (ASiC)\"? (commons-asic) 1.0.1-SNAPSHOT: :\n\nmvn release:perform\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffelleslosninger%2Fefm-asic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffelleslosninger%2Fefm-asic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffelleslosninger%2Fefm-asic/lists"}