fix(signature): skeleton template in shared exc-C14N profile; xmlsec1 path verified + in CI - #27
Merged
Merged
Conversation
…mlsec1 path verified + in CI The committed Signed_Fund_Skeleton.xml doubled as the xmlsec1 signing template but used inclusive C14N, only the enveloped transform and a bare ds:KeyName, so the xmlsec1 output did not follow the profile every other stack uses (exclusive C14N, enveloped + exc-C14N transforms, RSA-SHA256, signer cert embedded) and could not be verified from its embedded KeyInfo. Switch the template to the shared profile and add an empty <ds:X509Certificate/> placeholder (XSD-valid; xmlsec1 fills it from the "key,cert" --privkey-pem pair). Verified with xmlsec1 1.2.33: sign -> verify, tamper detected; the signed file is XSD-valid and verifies in Java (pinned and embedded) and .NET; xmlsec1 verifies the Java- and .NET-signed files. VerifyFundsXml: Santuario exceptions raised while parsing/checking the signature (empty X509Certificate, malformed SignatureValue, ...) are properties of the document under test - report INVALID / exit 1 instead of a MojoExecutionException stack trace. The unsigned skeleton now exits 1 cleanly in both modes. CI: install xmlsec1 and add a step that signs the skeleton with the CLI script, verifies it with xmlsec1 and Java (pinned + embedded), verifies the Java-signed file with xmlsec1, and checks tamper detection. Docs: sign-verify-xmlsec1.sh header, XML_Signature/README.md (row + note), FundsXML_Files/4.2.9/signed/README.md and the skeleton's header comment describe the template/profile instead of the former mismatch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YXZWhwE5EbHSybt55K6oUZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the last open signature item from the review: the xmlsec1 CLI variant now follows the same profile as Java/.NET and is verified, including in CI.
FundsXML_Files/4.2.9/signed/Signed_Fund_Skeleton.xml): inclusive C14N +KeyName→ exclusive C14N, enveloped + exc-C14N transforms, empty<ds:X509Certificate/>placeholder (XSD-valid). xmlsec1 signs it in place and embeds the signer cert.VerifyFundsXml: Santuario exceptions while parsing/checking the signature (empty cert, malformedSignatureValue) now →INVALID, exit 1 (previously aMojoExecutionExceptionstack trace on the unsigned skeleton).xmlsec1installed; new step signs the skeleton viacli/sign-verify-xmlsec1.sh, verifies with xmlsec1 and Java (pinned + embedded), verifies the Java-signed file with xmlsec1, and asserts tamper detection.XML_Signature/README.md,signed/README.md, skeleton comment) describe the template/profile; CLI row marked verified.Verification (local, xmlsec1 1.2.33 / JDK 26 / .NET 8)
sign-verify-xmlsec1.sh signskeleton →verifyINVALID: Could not parse certificate…exit 1 /INVALID: Bad signature length…exit 1🤖 Generated with Claude Code
https://claude.ai/code/session_01YXZWhwE5EbHSybt55K6oUZ