Can we have the option of not canonicalising the signed XML file?

[Weiwu Zhang]

On Tue, 29 Sep 2020, Ian Young wrote:

> An XML document has only one element at the top level (the document
> element). It is invalid to drop another XML blob in after the
> document element. The closest you can get in a single document is an
> enveloped signature with the signature blob dropped in as the last
> child of the document element.

> XMLSecTool actually theoretically supports that using the following
> option:

> --signaturePosition LAST

Thanks for reminding me and actually I've been using xmlsectool to
insert signature at the end of the document for a while. I think I
didn't express myself clearly in the first post and sorry for that.

What I wish to see is:

1. that xmlsectool inserts the signature as the last element of the
document, within the document element, not outside of it.

2. that in doing so, every line of the input (typically unsigned) XML
document remain intact, not canonicalised, up to the point where the
signature is inserted before the closing of the document element.

3. that the signature is applied on the digest of the canonicalised
node or nodes that it applies to (i.e. the canonicalised XML is only 
used in memory, not written to the output).

And the use-cases where such behaviour is needed was described in the
first email. Thanks again for writing to clarify and explain!