[SANTUARIO-615] xades extension implementation - #617
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
jrihtarsic
changed the title
|
Hi @coheigea Is it possible And then this: In the second M 617 R I also added a tool which generates simple test certificates on the fly so that there is no need to add new keystore/truststore binaries for new key types. The tool is intentionally minimal, has no external dependencies, and is reusable for future work, including for the future contributions on Post‑Quantum Cryptography. |
|
@jrihtarsic Please resolve the conflicts |
|
@coheigea the conflict is resolved now. |
Adds ML-DSA-44/65/87 XML digital signature support via the JSR-105 API (DOM) and the STAX signature path, wired through JCEMapper and the JSR-105 provider's algorithm URI registrations. Part of the post-quantum work tracked under SANTUARIO-634 (originally proposed in SANTUARIO-633 / apache#645), split out here as the signature-only half per community request. - The ML-DSA test keystore is generated on the fly per test run instead of a committed PKCS12 binary, avoiding the maintenance burden of binary test fixtures. Uses SelfSignedCertGenerator, originally authored by Joze Rihtarsic (unmerged PR apache#617), copied in and extended here with ML-DSA-44/65/87 AlgorithmIdentifier support per his suggestion on apache#645. - Adds negative-test coverage on both the DOM/JSR-105 and STAX paths: a tampered SignatureValue is rejected, and verification against the wrong public key fails. Added per Arpan0995's review feedback on apache#645.
3 participants
The purpose of this PR is to implement XAdES support using the pre/post‑processing mechanism for XML signatures introduced in the previous PR 616. This work addresses the XAdES requirements described in SANTUARIO‑402 and SANTUARIO‑416, and currently covers the Basic Signatures profile.
For composing the XAdES structures, the implementation uses JAXB‑generated classes based on the XAdES schema versions 1.4.1 and 1.3.2, combined with Santuario’s internal ElementProxy model.