Can we have the option of not canonicalising the signed XML file?

[Ian Young]

> On 2020-09-29, at 14:58, Weiwu Zhang <weiwu.zhang at alphawallet.com> wrote:
> 
> I'll check the serialisation process instead of looking for clues with canonicalisation as you adviced.

The serialisation code is all inside the JDK. I don't remember if it's pluggable or not, but I don't think it's really going to be practical for you to develop your own. The real issue is that when the XML file is parsed, the information about things like white space inside tags is removed.

> One argument is you should debug your layout files before signing, but sometimes an elusive bug is reported at the receiving end of a signed XML.

If all you care about is line numbers, then you may find that just removing newlines from inside tags makes them stable from input to output (modulo the  prelude).

> Does this explanation justify this wishlist item for you?

I understand why you want it for your use case and you should feel free to open a JIRA issue. I have to reiterate, though, that given that this sounds like a very non-trivial piece of development, we're not likely to ever address this issue in xmlsectool unless it turns out to matter to our consortium members, i.e., the people who actually fund development.

    -- Ian


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200929/b439d13d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20200929/b439d13d/attachment-0001.p7s>