|
An
XAV
analysis consists of the messages generated by the tests in the
Test Suite for a given application type. The messages are then organized
into various summaries from general to more detailed.
The Application Result Summary is the default section of the report
and describes the overall result for the application.
There is one row for each error category.
Contained in the result summary is a score is a number that is a function of
the count of the severity of the messages. Scores are calculated as follows:
-
5 - Pass with no Warnings or errors of any type.
-
4 - Pass with only Warnings.
-
3 - Fail with only 1 Error (may also have warnings).
-
2 - Fail with 1 or more Errors (may also have warnings).
-
1 - Fail with Fatal Errors (may also have warnings).
-
0 - No score. No testable resources.
Secure Application Validation Record
XAV creates a Secure Application Validation Record (SAVR)
each time an analysis run is performed. Within the SAVR the score values are
stored, along with an application resource manifest, digital signature used
to sign the SAVR, a digest used to verify the integrity of the application
resource manifest and a number of other useful fields.
If the SAVR is included with application resources in the object (or data)
carousel when the application is distributed or transmitted, the network
or receiver can use the contents of the SAVR to implement a security policy
prior to transmission or execution of the application. Examples:
-
Applications with a low score could be rejected because they may not
be interoperable or use resources inefficiently.
-
Reject any applications that have a manifest digest that does not equal the
calculated digest at the point of reception. It is likely such applications
have been tampered with during transmission.
-
Reject applications that have an invalid signature.
SAVR is particularly useful for ETV applications since
there are very few security features available in the EBIF standard.
|