Fix/356 shadow copy

.github/scripts/manylinux_build_and_test.sh

@@ -56,6 +56,11 @@ echo "== [container] Step: Install test dependencies =="
 echo "== [container] Step: Run tests =="
 /opt/python/${PY_ABI}/bin/pytest -v --color=yes
 
+# Step: Run tests again on the shadow-copy path (issue #356), which the
+# matched libxml2 build would otherwise never exercise.
+echo "== [container] Step: Run tests (forced shadow path) =="
+PYXMLSEC_FORCE_SHADOW=1 /opt/python/${PY_ABI}/bin/pytest -v --color=yes
+
 # Step: Fix mounted workspace file ownership on host
 echo "== [container] Step: Fix mounted workspace file ownership on host =="
 chown -R "${HOST_UID}:${HOST_GID}" dist wheelhouse build libs || true

.github/workflows/linuxbrew.yml

@@ -48,3 +48,6 @@ jobs:
           pip3 install --upgrade --no-binary=lxml -r requirements-test.txt
           pip3 install xmlsec --only-binary=xmlsec --no-index --find-links=dist/
           pytest -v --color=yes
+          # Same suite on the shadow-copy path (issue #356), which the
+          # matched libxml2 build would otherwise never exercise.
+          PYXMLSEC_FORCE_SHADOW=1 pytest -v --color=yes

.github/workflows/macosx.yml

@@ -87,6 +87,14 @@ jobs:
         run: |
           coverage run -m pytest -v --color=yes
 
+      # Same suite on the shadow-copy path (issue #356), which the matched
+      # libxml2 build would otherwise never exercise.
+      - name: Run tests (forced shadow path)
+        env:
+          PYXMLSEC_FORCE_SHADOW: "1"
+        run: |
+          pytest -v --color=yes
+
       - name: Report coverage to codecov
         if: matrix.static_deps != 'static'
         run: |

src/ds.c

@@ -146,6 +146,18 @@ static PyObject* PyXmlSec_SignatureContextRegisterId(PyObject* self, PyObject* a
         goto ON_FAIL;
     }
 
+    // Shadow mode: never touch lxml's document (its ID hash) with our libxml2
+    // (issue #356). The registration is validated through lxml's API and
+    // recorded instead; the whole-document shadows (sign/verify/decrypt)
+    // replay it onto their private copies.
+    if (PyXmlSec_LxmlShadowIsActive()) {
+        if (PyXmlSec_LxmlShadowRegisterId(node, id_attr, id_ns) < 0) {
+            goto ON_FAIL;
+        }
+        PYXMLSEC_DEBUGF("%p: register id - ok", self);
+        Py_RETURN_NONE;
+    }
+
     if (id_ns != NULL) {
         attr = xmlHasNsProp(node->_c_node, XSTR(id_attr), XSTR(id_ns));
     } else {
@@ -189,19 +201,28 @@ static PyObject* PyXmlSec_SignatureContextSign(PyObject* self, PyObject* args, P
 
     PyXmlSec_SignatureContext* ctx = (PyXmlSec_SignatureContext*)self;
     PyXmlSec_LxmlElementPtr node = NULL;
+    xmlNodePtr target;
+    PyXmlSec_LxmlShadow shadow;
     int rv;
 
     PYXMLSEC_DEBUGF("%p: sign - start", self);
     if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O&:sign", kwlist, PyXmlSec_LxmlElementConverter, &node)) {
         goto ON_FAIL;
     }
 
+    // References (URI="", "#id") reach anywhere in the document, so the
+    // shadow covers the whole tree (issue #356), with the registered IDs
+    // replayed onto the copy. Signing fills several places inside
+    // <Signature> (DigestValue, SignatureValue, KeyInfo); the reflect carries
+    // them all back.
+    if (PyXmlSec_LxmlShadowBeginDoc(&shadow, node, &target) < 0) {
+        goto ON_FAIL;
+    }
     Py_BEGIN_ALLOW_THREADS;
-    rv = xmlSecDSigCtxSign(ctx->handle, node->_c_node);
+    rv = xmlSecDSigCtxSign(ctx->handle, target);
     PYXMLSEC_DUMP(xmlSecDSigCtxDebugDump, ctx->handle);
     Py_END_ALLOW_THREADS;
-    if (rv < 0) {
-        PyXmlSec_SetLastError("failed to sign");
+    if (PyXmlSec_LxmlShadowReflect(&shadow, rv, "failed to sign") < 0) {
         goto ON_FAIL;
     }
     PYXMLSEC_DEBUGF("%p: sign - ok", self);
@@ -224,17 +245,25 @@ static PyObject* PyXmlSec_SignatureContextVerify(PyObject* self, PyObject* args,
 
     PyXmlSec_SignatureContext* ctx = (PyXmlSec_SignatureContext*)self;
     PyXmlSec_LxmlElementPtr node = NULL;
+    xmlNodePtr target;
+    PyXmlSec_LxmlShadow shadow;
     int rv;
 
     PYXMLSEC_DEBUGF("%p: verify - start", self);
     if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O&:verify", kwlist, PyXmlSec_LxmlElementConverter, &node)) {
         goto ON_FAIL;
     }
 
+    // Verification is read-only: whole-document shadow (with the registered
+    // IDs replayed) and no reflection at all — the copy is simply discarded.
+    if (PyXmlSec_LxmlShadowBeginDoc(&shadow, node, &target) < 0) {
+        goto ON_FAIL;
+    }
     Py_BEGIN_ALLOW_THREADS;
-    rv = xmlSecDSigCtxVerify(ctx->handle, node->_c_node);
+    rv = xmlSecDSigCtxVerify(ctx->handle, target);
     PYXMLSEC_DUMP(xmlSecDSigCtxDebugDump, ctx->handle);
     Py_END_ALLOW_THREADS;
+    PyXmlSec_LxmlShadowDiscard(&shadow);
 
     if (rv < 0) {
         PyXmlSec_SetLastError("failed to verify");