ESciDoc Component Checksum Calculation

Checksum calculation of eSciDoc component is important from several aspects:
 * Long-term preservation aspects
 * to ensure that users will get exactly the content that is stored in a eSciDoc repository instance

eSciDoc Object manager core service must make sure that the checksum is calculated for each internally managed content of an eSciDoc component.

Scenarios

 * A checksum is always calculated for the newly created files
 * A checksum is always calculated when file content is newly uploaded thus replacing previous content

Post-condition

 * The internally managed content checksum and the algorithm used is delivered with the component properties, or within the content properties

eSciDoc and Fedora checksum built-in functionality
Fedora enables calculation of the checksum for each Fedora datastream in the repository. The default configuration of Fedora does not perform the checksum calculation of Fedora object datastreams.

For more details see Fedora checksum calculation

However, there are two options:


 * overwrite default Fedora checksum operation (as described in Fedora documentation)
 * provide separate checksum operation from within internal logic of the Object manager component

Successfully tested to enable checksum calculation for content datastream in Fedora. It should be discussed how the checksum is delivered inside the component. If the checksum method (e.g. MD5, SHA-1) is delivered inside the component it is easy to implement setting the method creating an object; it may be possible to change the method with every content update. Frank 13:26, 12 March 2009 (UTC)

Checksum and method come with eSciDoc Infrastructure for Component Content and will be displayed with two additional elements inside Component Properties:

...  ...   ed7d42ce826da388e64e3cdbf62ae1f1 md5 ...  ...

Checksum Algorithms

 * see Checksum@Wikipedia
 * see Hash functions overview
 * see MD5 algorithm

Questions

 * Some systems create checksums calculated by several different algorithms at the same time. Is it important also for eSciDoc Repository?
 * see Example: Ant Apache download


 * Is checksum also needed to prevent malicious manipulation? If so, signatures over these checksums are needed assuming someone who is able to change content in the storage backend may be also able to change FOXML in the storage backend. Frank 13:12, 12 March 2009 (UTC)
 * no requirement so far --Natasa 10:41, 30 March 2009 (UTC)