Question about ANSSI certification for Apple App Store

[plubius]

Hi everyone,

I remember Sophie Gautier mentioning the process that TDF went through to get an encryption certificate for LibreOffice for ANSSI:

https://www.mail-archive.com/board-discuss@documentfoundation.org/msg06408.html

I just found out that new requirement has rolled out globally and downstream open source projects like NeoOffice, Collabora Office, etc. also have to apply for an encryption certificate from ANSSI.

Apparently, I had released the last NeoOffice version only days before Apple added this new requirement so I was initially confused why TDF needed a certificate from the French government.

Anyway, I know that preparing the application for this certicate was not an easy task, but would TDF be willing to publicly share their application (or at least any technical answers) with the community?

Obviously, NeoOffice, Collabora, and whoever must prepare and submit their own application, but using LibreOffice's application as a template will hopefully ensure that downstream projects don't submit data that conflicts with LibreOffice.

I understand if TDF's bylaws prevent making the application public, but I thought I would ask.

Regards,

Patrick

[caolan]

FWIW: the ANSSI cert was mentioned in today's ESC. Minutes:
https://lists.freedesktop.org/archives/libreoffice/2023-February/089958.html
"
   + question from Patrick
   + had no time to look into that yet (Cloph)
   + will share info once TDF filed its papers
"

[plubius]

Thank you and the ESC for discussing my request.

Do I understand correctly that TDF hasn't submitted anything to ANSSI yet? If yes, I am happy to help research and/or draft text to spread the work around.

I may be wrong, but so far I think that the only non-system encryption that triggers the requirement to file a submission with ANSSI is that LibreOffice includes the following third-party packages on macOS and iOS:

- Mozilla's Network Security Services (NSS) (both macOS and iOS)
- OpenSSL (macOS only)

Did I miss any?

Patrick

[plubius]

I started looking at the form and found that it wasn't fillable. Fortunately, ANSSI was very responsive and sent me fillable versions of the form.

Unfortunately, the fillable PDF is 2.2 M in size. I am planning on posting rough drafts as I work on this for NeoOffice. Is git or the LibreOffice wiki a better place to handle sharing such a large file?

Patrick

[floeff]

Hello,

Do I understand correctly that TDF hasn't submitted anything to ANSSI yet? If yes, I am happy to help research and/or draft text to spread the work around.

thanks a lot!
I am not 100% sure, so let me copy Sophie and Christian on this.

I started looking at the form and found that it wasn't fillable. Fortunately, ANSSI was very responsive and sent me fillable versions of the form.

Unfortunately, the fillable PDF is 2.2 M in size. I am planning on posting rough drafts as I work on this for NeoOffice. Is git or the LibreOffice wiki a better place to handle sharing such a large file?

Thanks a lot for this!
Sophie, can you create a Nextcloud upload folder and share with Patrick offlist? That seems the best way to share the file(s).

Thanks
Florian

[sophi]

Hi all,

Hello,

Do I understand correctly that TDF hasn't submitted anything to ANSSI yet? If yes, I am happy to help research and/or draft text to spread the work around.

thanks a lot!
I am not 100% sure, so let me copy Sophie and Christian on this.

Yes, Cloph didn't sent the form back yet

I started looking at the form and found that it wasn't fillable. Fortunately, ANSSI was very responsive and sent me fillable versions of the form.

Unfortunately, the fillable PDF is 2.2 M in size. I am planning on posting rough drafts as I work on this for NeoOffice. Is git or the LibreOffice wiki a better place to handle sharing such a large file?

Thanks a lot for this!
Sophie, can you create a Nextcloud upload folder and share with Patrick offlist? That seems the best way to share the file(s).

Done, also shared with Cloph
Cheers
Sophie

[plubius]

Hi everyone,

I have uploaded the files to the following NextCloud folder (thanks Sophi for setting this up!):

   https://nextcloud.documentfoundation.org/s/PrACjSQfTZ5cYcA

Curently, the folder contains the following two empty files:

   ANNEXE-I v2.pdf: this is the fillable PDF that we will eventually submit to ANSSI
   ANNEXE I_FR-EN.doc: this ANSSI's unofficial working copy but you can't submit this document
   ANNEXE I_FR-EN.odt: this is the .doc file resaved as .odt

In ANNEXE I_FR-EN.odt, I have started filling some of the text fields.

I should be able to post to an e-mail to the LibreOffice developer's mailing list today or tomorrow with a rough list of "todos" remaining.

Patrick