pjfanning opened a new pull request, #1503: URL: https://github.com/apache/poi/pull/1503
Follow-up to #1498. The OPC relationships transform digests signed `Relationship` elements without their content. .NET's `System.IO.Packaging` builds the digest input by writing each selected relationship as an empty element (`InternalRelationshipCollection.WriteRelationshipsAsXml`), so text or child elements inside a `Relationship` never reach the digest. `RelationshipTransformService` kept them, which the CR/LF stripping removed in #1498 used to hide for a pretty-printed `<Relationship ...>\r\n</Relationship>`. Since #1498, a signed relationship written like that fails verification in POI. - `RelationshipTransformService.transform` now empties each kept `Relationship` element before appending it to the root. A nested relationship that is also kept is collected before, and moved to the root independently of, its parent being emptied. - `OOXMLURIDereferencer`: return the `OctetStreamData` directly from the try block. - `TestSignatureInfo.testSignedRelationshipFormatting` reformats the signed officeDocument relationship of `hello-world-signed.docx` (line breaks between attributes, whitespace content, a child element) and checks the signature still verifies. The two content cases fail without the transform change; the attribute line-break case covers the malformed-XML side effect of the old stripping. The `org.apache.poi.poifs.crypt.dsig` tests pass locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
