Can we have the option of not canonicalising the signed XML file?

[Weiwu Zhang]

On Tue, 29 Sep 2020, Ian Young wrote:

> This is just part of life with XML; if your application depends on
> preservation of this kind of detailed formatting information, XML
> may not be the right data format for you.

I'll check the serialisation process instead of looking for clues with 
canonicalisation as you adviced.

For a bit of context, the case I am working on does not depend on 
preservation of formatting (I developed with & used XML for about 20 
years), it's the debugging that mattered.

For an example, suppose you have an XML based UI form, which is how 
layouts are done in Android, and there is a button that has an onClick 
event. It should be like this:

     <Button onClick="clickHandler" …>

Unfortunately, it was written as:

     <Button onClick="clikHandler" …>

A validator wouldn't be able to report an error since it doesn't know what 
are the allowed values, which are only known at the run-time. So if the 
software crashes, the error will be:

     Event handler not found: clikHandler (layout.xml - 383)

The developer, understandablly, prefer to look at line 383, instead of do 
a document-wide search for the offending line.

One argument is you should debug your layout files before signing, but 
sometimes an elusive bug is reported at the receiving end of a signed XML.

Due to the nature of xml data processing, the receiver the xml data may 
not keep the format or line number untouched, since it's already 
transformed or reorgainsed. That's okay. As an real life example,
Android translation string formatting errors are rarely reported 
on the correct line because they were transformed before used for 
formatting. But in the meanwhile there are *more* cases where the XML is 
found having errors without going through later-stage transformation or
mixing with other xml data. That's where line number is still useful. For 
exmaple, Android SDK tried the best effort to report errors in layout file 
with the correct line number.

So it's not an either-or-case (either format doesn't matter or it does), 
it's a degree of convenience to the developres.

Does this explanation justify this wishlist item for you?

Of course, the answer (how to retain line-number) may not be within the 
reach of xmlsectool. Kindly consider this post an exploration.