<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Jerome Alet wrote:
<blockquote cite="mid:20080609190127.GA10233@mail.librelogiciel.com"
type="cite">
<pre wrap="">Hi,
On Mon, Jun 09, 2008 at 02:12:26PM -0400, Walter Tautz wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi, I was wondering if it would be possible to have print jobs
be signed with a pgp key. I suppose this boils down to some
kind of prefilter in cups? Perhaps it would be easier to to
Pykota? Thoughts? Admittedly this notion doesn't really have
anything directly to do with quota but, instead, with authorization
but it would be neat to have such a feature somewhere within the bowels
of the print infrastructure of cups+pykota.
</pre>
</blockquote>
<pre wrap=""><!---->
The problem is : where do you want the job to be signed, and where
do you want the signature to be checked.
</pre>
</blockquote>
Signed: on the client (could be difficult on non-unix platforms)<br>
Checked: on the cups server by querying key server<br>
<br>
<blockquote cite="mid:20080609190127.GA10233@mail.librelogiciel.com"
type="cite">
<pre wrap="">
I don't know much about digital signatures but I think the only
place to sign a print job is on the client.
Unfortunately, usually CUPS will modify the datas it receives from the
client (unless you print in raw mode), so the client's signature is
useless.
</pre>
</blockquote>
Cups would have to modified presumably. Probably a Hash of<br>
the print data would be signed rather than the data itself. Similar<br>
to mail signed with gpg? I am not an expert either. Perhaps Michael
Sweet<br>
would have some ideas. I have cc'ed the cups mail list.<br>
<blockquote cite="mid:20080609190127.GA10233@mail.librelogiciel.com"
type="cite">
<pre wrap="">
Then CUPS will send these modified datas to a printer, but how
do you expect the printer to validate the signature, even if
a way existed to preserve it from the client to the printer ?
</pre>
</blockquote>
The printer wouldn't as noted above. Obviously we have to assume that
the connection<br>
to the printer from the cups server is "secure".<br>
<blockquote cite="mid:20080609190127.GA10233@mail.librelogiciel.com"
type="cite">
<pre wrap="">
I don't see how to implement such signed print jobs, from what I
understand, it's not possible, unless (maybe) the final printer is
not a real printer but a virtual one (i.e. an application like Tea4CUPS
or similar).
</pre>
</blockquote>
Could be.<br>
<blockquote cite="mid:20080609190127.GA10233@mail.librelogiciel.com"
type="cite">
<pre wrap="">
What can be done though, is to add printed watermarks on each print
job passing through CUPS. To do this you'll need the alternate pstops
filter available from Helge Blischke (search for it on <a class="moz-txt-link-abbreviated" href="http://www.cups.org">www.cups.org</a>).
But this visual watermarking is only done on the print server, and
has to be verified by an human being looking at the printed paper.
</pre>
</blockquote>
Not needed, it has to be software automated.<br>
<br>
Walter<br>
</body>
</html>