XML attributes with defaults

[Tom Scavo]

On Sun, Jul 7, 2013 at 1:31 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 7/7/13 1:14 PM, "Ian Young" <ian at iay.org.uk> wrote:
>
>>I'm not sure if you can demonstrate the classic issue using just
>>xmlsectool, due to the way it handles schemas.  But if you wanted to try,
>>you could:
>>
>>* sign a document (one where the attribute is absent) WITH schema
>>validation, then try and verify it WITHOUT, or
>>
>>* sign a document WITHOUT schema validation, then try and verify it WITH
>
> Or just not use xmlsectool to verify. Sign a metadata document without the
> schemas, and leaving out the Scope regexp attribute. Then give it to an SP
> with the validate="1" option in the MetadataProvider loading it, and add a
> filter to verify it. It will fail, unless validate is turned back off.

What do you mean by "sign a metadata document without the schemas?"
Are you suggesting the signer should always sign with schema
validation? Something like this:

$ ./xmlsectool --validateSchema --sign ...

or am I missing something?

Thanks,

Tom