Why requiring --certificate when verifySignature?

[Weiwu Zhang]

Hello developers:

I have a question: why the command line tool xmlsectool requires
--certificate when using --verifySignature

If the certificate is already in the XMLDSIG, the tool only need to
validate if the signature matches the key provided in the certificate
in the signature, right? The tool can also display some information of
the certificate.

Adding --certificate only make sure that the signature is validated
against the pubkey contained in the --certificate, instead of the one
contained in the certificate in the XMLDSIG. Which IMHO doesn't make
it a mandantory parameter.

P.S. I had this question when reporting this bug

file signed with xmlsectool-2.0.0 failed to verify with xmlsectool-2.0.0
https://issues.shibboleth.net/jira/browse/XSTJ-83

I though I only needed to run
$ xmlsectool.sh --verifySignature --inFile …