[java-opensaml] branch main updated: OSJ-457: Improve efficiency of SignatureTrustEngine implementations

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-opensaml.

View the commit online:
https://codeberg.org/Shibboleth/java-opensaml/commit/a9d2aaea1ff045cba5bf3a8edb996373e4b684bb

The following commit(s) were added to refs/heads/main by this push:
     new a9d2aaea1 OSJ-457: Improve efficiency of SignatureTrustEngine implementations
a9d2aaea1 is described below

commit a9d2aaea1ff045cba5bf3a8edb996373e4b684bb
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Aug 6 14:43:01 2026 -0400

    OSJ-457: Improve efficiency of SignatureTrustEngine implementations
---
 .../signature/support/impl/BaseSignatureTrustEngine.java    | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
index da6a6f1cc..9e4898666 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
@@ -195,13 +195,16 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
             try {
                 for (final Credential kiCred : getKeyInfoResolver().resolve(keyInfoCriteriaSet)) {
                     assert kiCred != null;
-                    if (verifySignature(signature, kiCred)) {
-                        log.debug("Successfully verified signature using KeyInfo-derived credential");
-                        log.debug("Attempting to establish trust of KeyInfo-derived credential");
-                        if (evaluateTrust(kiCred, trustBasis)) {
-                            log.debug("Successfully established trust of KeyInfo-derived credential");
+                    if (evaluateTrust(kiCred, trustBasis)) {
+                        log.debug("Successfully established trust of KeyInfo-derived credential");
+                        log.debug("Attempting to verify signature using trusted KeyInfo-derived credential");
+                        if (verifySignature(signature, kiCred)) {
+                            log.debug("Successfully verified signature using trusted KeyInfo-derived credential");
                             return true;
+                        } else {
+                            log.debug("Signature verification failed using trusted KeyInfo-derived credential");
                         }
+                    } else {
                         log.debug("Failed to establish trust of KeyInfo-derived credential");
                     }
                 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.