RE: Possible signature verify bug?

2006-10-11 Thread Scott Cantor
> Do you mind if I add the test case into our data set? I'd like to have > it as one of the standard interop tests. The code itself isn't a stand alone test, it's written on top of my library, which doesn't directly expose the xmlsec APIs. If you mean the XML itself, you're welcome to that, and

Re: Possible signature verify bug?

2006-10-11 Thread Berin Lautenbach
Do you mind if I add the test case into our data set? I'd like to have it as one of the standard interop tests. (And yes the fix will go into 1.3.1 :>.) Cheers, Berin Scott Cantor wrote: Berin, The patch you sent fixes my test case, thanks. -- Scott

RE: Possible signature verify bug?

2006-10-11 Thread Scott Cantor
Berin, The patch you sent fixes my test case, thanks. -- Scott

RE: Possible signature verify bug?

2006-10-11 Thread Scott Cantor
> That's probably not explained it well - suffice to say the attached > patch will add ancestor namespaces into the XPath nodeset that is > handled by the canonicaliser. I think I follow you. I'll pull the latest code and apply the patch and report back if it doesn't work. I'm assuming this can

Re: Possible signature verify bug?

2006-10-11 Thread Berin Lautenbach
Scott, Very interesting. The issue is because you take an identifier (essentially a document subset) and then apply an envelope transform. In dsig terms that means there is an intersection of two nodesets, so the XPath handling kicks in within the canonicaliser. Unfortunately, there was a

Re: Possible signature verify bug?

2006-10-11 Thread Berin Lautenbach
That definitely looks wrong. I will take a look. It's very wierd - this is straight excl c14n and a very simple case. It's exactly the sort of thing the basic test cases look at. Cheers, Berin Scott Cantor wrote: Berin, I think there's a really blatant bug in the C++ c14n code th