<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
    #email-body { min-width: 30em !important; }
    #email-page { padding: 8px !important; }
    #email-banner { padding: 8px 8px 0 8px !important; }
    #email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
    #email-fields { padding: 0 8px 8px 8px !important; }
    #email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
    <tr valign="top">
        <td id="email-page" style="padding:16px !important;">
            <table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
                <tr valign="top">
                    <td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
                </tr><tr valign="top">
    <td id="email-banner" style="padding:32px 32px 0 32px;">

                
        
        
            <table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
    <tr valign="top">
        <td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
                                        <img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?ownerId=ian%40iay.org.uk&avatarId=10125" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
                        <div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
                                    <a class="user-hover" rel="ian@iay.org.uk" id="email_ian@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=ian%40iay.org.uk" style="color:#326ca6;">Ian Young</a>
     updated <img src="https://issues.shibboleth.net/jira/images/icons/bug.gif" height="16" width="16" border="0" align="absmiddle" alt="Bug"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/MDA-87'>MDA-87</a>
            </div>
                        <div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
                <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/MDA-87'><strong>signature problems after assembling an EntitiesDescriptor</strong></a>
            </div>
                    </td>
    </tr>
</table>
        
    </td>
</tr>
<tr valign="top">
    <td id="email-fields" style="padding:0 32px 32px 32px;">
        <table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
            <tr valign="top">
                <td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
                <td>
                    <table border="0" cellpadding="0" cellspacing="0" width="100%">
                                                    <tr valign="top">
        <td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
            <strong style="font-weight:normal;color:#505050;">Change By:</strong>
        </td>
        <td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
                                                <a class="user-hover" rel="ian@iay.org.uk" id="email_ian@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=ian%40iay.org.uk" style="color:#326ca6;">Ian Young</a>
                            (09/Apr/13 10:55 AM)
        </td>
    </tr>
            <tr valign="top">
        <td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
            <strong style="font-weight:normal;color:#505050;">Description:</strong>
        </td>
        <td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
                                    <span class="diffcontext">If&nbsp;you&nbsp;use&nbsp;the&nbsp;EntitiesDescriptorAssemblerStage&nbsp;to&nbsp;assemble&nbsp;an&nbsp;aggregate,&nbsp;then&nbsp;sign&nbsp;using&nbsp;a&nbsp;XMLSignatureSigningStage,&nbsp;the&nbsp;resulting&nbsp;signature&nbsp;validates&nbsp;if&nbsp;you&nbsp;do&nbsp;so&nbsp;immediately&nbsp;but&nbsp;not&nbsp;if&nbsp;you&nbsp;serialise&nbsp;the&nbsp;document&nbsp;to&nbsp;a&nbsp;file&nbsp;and&nbsp;re-read&nbsp;it,&nbsp;or&nbsp;use&nbsp;a&nbsp;tool&nbsp;like&nbsp;xmlsectool&nbsp;to&nbsp;validate.<br><br>Even&nbsp;more&nbsp;curiously,&nbsp;if&nbsp;you&nbsp;serialise&nbsp;the&nbsp;unsigned&nbsp;metadata&nbsp;to&nbsp;a&nbsp;file&nbsp;and&nbsp;re-read&nbsp;*that*,&nbsp;then&nbsp;the&nbsp;resulting&nbsp;signature&nbsp;(when&nbsp;serialised&nbsp;to&nbsp;a&nbsp;new&nbsp;file)&nbsp;appears&nbsp;to&nbsp;be&nbsp;correct,&nbsp;both&nbsp;to&nbsp;the&nbsp;MDA&nbsp;validator&nbsp;and&nbsp;the&nbsp;one&nbsp;in&nbsp;xmlsectool.<br><br>This&nbsp;tends&nbsp;to&nbsp;point&nbsp;to&nbsp;an&nbsp;error&nbsp;in&nbsp;the&nbsp;way&nbsp;the&nbsp;EntitiesDescriptor&nbsp;has&nbsp;been&nbsp;constructed.<br><br>One&nbsp;workround&nbsp;would&nbsp;probably&nbsp;be&nbsp;to&nbsp;serialise&nbsp;the&nbsp;document&nbsp;to&nbsp;disk,&nbsp;clear&nbsp;the&nbsp;collection&nbsp;and&nbsp;reload&nbsp;the&nbsp;document&nbsp;before&nbsp;signing.<br><br>Another&nbsp;workround&nbsp;is&nbsp;to&nbsp;perform&nbsp;an&nbsp;identity&nbsp;transform&nbsp;on&nbsp;the&nbsp;item&nbsp;using&nbsp;XSLTransformationStage&nbsp;before&nbsp;performing&nbsp;the&nbsp;signature.&nbsp;&nbsp;This&nbsp;probably&nbsp;works&nbsp;because&nbsp;the&nbsp;document&nbsp;is&nbsp;being&nbsp;normalised&nbsp;when&nbsp;the&nbsp;transform&#39;s&nbsp;result&nbsp;is&nbsp;being&nbsp;created,&nbsp;as&nbsp;the&nbsp;output&nbsp;is&nbsp;a&nbsp;new</span>
<span class="diffaddedchars" style="background-color:#ddfade;">&nbsp;DOM</span>
<span class="diffcontext">&nbsp;document.&nbsp;&nbsp;This&nbsp;also&nbsp;probably&nbsp;explains&nbsp;why&nbsp;we&nbsp;haven&#39;t&nbsp;seen&nbsp;this&nbsp;issue&nbsp;before,&nbsp;as&nbsp;in&nbsp;many&nbsp;cases&nbsp;there&nbsp;is&nbsp;some&nbsp;kind&nbsp;of&nbsp;XSLT&nbsp;going&nbsp;on&nbsp;after&nbsp;the&nbsp;raw&nbsp;aggregate&nbsp;is&nbsp;constructed&nbsp;but&nbsp;before&nbsp;signature.<br><br>Here&#39;s&nbsp;a&nbsp;bean&nbsp;definition&nbsp;for&nbsp;such&nbsp;a&nbsp;transform:<br><br>{code}<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;bean&nbsp;id=&quot;tweak&quot;&nbsp;class=&quot;net.shibboleth.metadata.dom.XSLTransformationStage&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;init-method=&quot;initialize&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;p:id=&quot;tweak&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;property&nbsp;name=&quot;xslResource&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;bean&nbsp;class=&quot;net.shibboleth.utilities.java.support.resource.FilesystemResource&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;init-method=&quot;initialize&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;constructor-arg&nbsp;value=&quot;#{&nbsp;aggregatorBase&nbsp;+&nbsp;&#39;/tweak.xsl&#39;&nbsp;}&quot;/&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/bean&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/property&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/bean&gt;<br>{code}<br><br>I&#39;ve&nbsp;attached&nbsp;an&nbsp;XSLT&nbsp;transform&nbsp;file&nbsp;corresponding&nbsp;to&nbsp;this.</span>

        </td>
    </tr>
                            </table>
                </td>
            </tr>
        </table>
    </td>
</tr>













            </table>
        </td><!-- End #email-page -->
    </tr>
    <tr valign="top">
        <td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
            This message is automatically generated by JIRA.<br />
            If you think it was sent incorrectly, please contact your JIRA administrators<br />
            For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
        </td>
    </tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->