[BULK] upcoming release of xmlsectool 1.2.0

[Krug, Jeff]

I took a look at it today, and I do have some questions regarding the "blacklist" related options, as it feels a little bit unclear how this was intended to work.  It seems like the option "--blacklistDigest" option can be used in a signature verification to cause said verification to potentially fail.  I get how this works, but the context for the list is just this single invocation of the tool, correct?  At least this seems to be the functionality I see.  

This makes the other two options a bit unclear to me.  Executing the listBlacklist shows md5 algorithms that are blacklisted internally to the tool (note this is technically an action command, which is odd context wise regarding the content of the current help which says the action commands are sign/verify/validate).  Finally, I am not sure I get when the --clearBlacklist would ever be used.  The way the current tool works, it does not seem that any state is maintained between executions of the code, and that option doesn't seem to allow you to remove the md5 algorithms from the default blacklist...  

I totally understand the value/purpose of an algorithm blacklist, but it seems like this is not feature complete.  Should I be able to use the command "--blacklistDigest" as an action command to add an algorithm to a tool maintained list?  If that is the intent, such that all 3 of the new commands are action commands as opposed to signature verification options, they make sense...  But they do not work like that as far as I can tell.


________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Ian Young [ian at iay.org.uk]
Sent: Thursday, April 11, 2013 7:43 AM
To: dev at shibboleth.net
Subject: [BULK]  upcoming release of xmlsectool 1.2.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I expect to be able to release version 1.2.0 of the xmlsectool
signature and verification utility next week, probably on Wednesday
17th April 2013.

A full list of changes can be found here:

https://issues.shibboleth.net/jira/secure/ReleaseNote.jspa?projectId=10020&version=10410

or

http://bit.ly/10VItrC

The feature highlight is support for stronger digest algorithms such
as SHA-256, but there are some significant bug fixes as well in the
area of PKCS#11 support.

If you're a user of xmlsectool, you may consider picking up the final
snapshot and giving it a test drive.  Details can be found here:

https://issues.shibboleth.net/jira/browse/XSTJ-33

Enjoy,

        -- Ian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJRZqH5AAoJEJqATpfXB5x3rgkP/AidCnHMnKjd76E51guJ6KSn
vSqTBaZsRFiWBrVQwykwMbrPf0CDVmSPMcTGxXgQqlKLmHyS/cAc0PeGt0Z/dxOC
xC8Xs6hu4aJrgbSY0Y+KIEBpWPwloHsHckGOz0wNLT/YPdu9VdoUIkz2Y1kyTlUG
aXvoUwew/d/pNCv/ECTHEOe1p4Sux+olzkoDvja63GBdUuO/j/Oy7MsXpo5R2u1K
71z3KG89nZUmZM+G69G5laCqGaSMKe8n/YJYQ5JuWUbqXkyXitxB/c5hsAj4rlJT
QVdexOxqPjHP0uAjQvAzqwf14OinNWm1GnFTWajy2uU0RWVXuYHUootV9IZrNnti
Jbij1UEJfE1BYENq05UKNfPbFUI7kSF5nw6DOECRYH29bKgObmXwtCT/G5Zhm7Cm
ubNXUSqFElWEzsQsf7j+yHxwCuNQ4YB0Vjtf0ojou8DQMe2pupJC5IGTNxZQxXnD
ntHDqOnlUwdOvQ1X1fuYYTQtrpXGaj8RcsLdQ1gmtmTmo7cfbn2zBQi64PFBoI1w
3qS7GqVywtjlOy2SHDbu4DAwrcnaOHQENwAbh5L7I8KqMJkpdR6d3iz1+b3fMVPl
5Prv9uA6yX3Mwyb6dXXBXcdm05NacTnUB6y8n3eCBD0RgEFXEbd5rEqHm8YE3TmR
Acs5qFNWvzutE5MF8L+N
=Zo6Y
-----END PGP SIGNATURE-----
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net