Can we have the option of not canonicalising the signed XML file?

[Ian Young]

> On 2020-09-29, at 10:03, Weiwu Zhang <weiwu.zhang at alphawallet.com> wrote:
> 
> 1. that xmlsectool inserts the signature as the last element of the
> document, within the document element, not outside of it.

OK, the --signaturePosition LAST option should be doing that for you.


> 3. that the signature is applied on the digest of the canonicalised
> node or nodes that it applies to (i.e. the canonicalised XML is only used in memory, not written to the output).

That's what the code does.


> 2. that in doing so, every line of the input (typically unsigned) XML
> document remain intact, not canonicalised, up to the point where the
> signature is inserted before the closing of the document element.

The input document is not canonicalised before being written to the output file. Canonicalisation is a process performed entirely inside the signature generation library as part of generating the digest.

If you're seeing differences between the input and output, it's not because of canonicalisation. It's probably down to the serialiser that is used to write the XML document back out again. In general, things that are not part of the document model may not be preserved:

* Any text prior to the document element (including the "<?xml" header)

* White space within tags

* Order of XML attributes within tags

This is just part of life with XML; if your application depends on preservation of this kind of detailed formatting information, XML may not be the right data format for you.

It's *particularly* part of life with XML in Java: the language execution environment dictates all aspects of this, and they are not configurable to do what you want. It's possible that other languages make it possible to do this, but I can't help you with that.

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200929/aff23af2/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20200929/aff23af2/attachment.p7s>