From 8afb51649e2b407f56c0af0be21397c778783314 Mon Sep 17 00:00:00 2001 From: Chris Barth Date: Sun, 4 Oct 2026 09:37:59 -0400 Subject: [PATCH] test: record who signed each InclusiveNamespaces fixture test/README.md said the listed fixtures were signed by other implementations, then that some inclusive_namespaces_* fixtures were signed by xml-crypto 6.3.2. It now names the signer of each one, and says that the 6.3.2 fixture checks that old signatures still verify rather than interoperability. That fixture carries InclusiveNamespaces outside the exc-c14n namespace on purpose, so the test that loads it says so and links #633. Remove the JSDoc block from the private loadedPrefixLists field; AGENTS.md reserves that form for exported API. Co-Authored-By: Claude Opus 5.5 --- src/signed-xml.ts | 4 ---- test/README.md | 6 ++++-- test/signature-integration-tests.spec.ts | 2 ++ 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/signed-xml.ts b/src/signed-xml.ts index 58ad061b..841e23c1 100644 --- a/src/signed-xml.ts +++ b/src/signed-xml.ts @@ -137,10 +137,6 @@ export class SignedXml { */ private references: Reference[] = []; - /** - * The PrefixList each Transform of a loaded {@link Reference} carries, in transform order, which - * verification applies. - */ private loadedPrefixLists = new WeakMap(); /** diff --git a/test/README.md b/test/README.md index 12e7e5d7..98935dde 100644 --- a/test/README.md +++ b/test/README.md @@ -1,7 +1,9 @@ # Test fixtures -These fixtures in `static/` were signed by other XML-DSig implementations, so the tests that use them check interoperability rather than only this library's agreement with itself. This library can't regenerate them. +This records who signed these fixtures in `static/`. One signed by another XML-DSig implementation checks interoperability rather than only this library's agreement with itself. - `hmac_signature.xml` and `hmac.key`: signed with the JDK's `javax.xml.crypto.dsig`. -- `inclusive_namespaces_*.xml`: signed with `client.pem` by other signers or by xml-crypto 6.3.2. +- `inclusive_namespaces_exc_c14n.xml`, `inclusive_namespaces_exc_c14n_with_comments.xml`, `inclusive_namespaces_enveloped_signature_after_exc_c14n.xml`, `inclusive_namespaces_on_second_of_two_exc_c14n.xml` and `inclusive_namespaces_after_custom_transform.xml`: signed with .NET's `System.Security.Cryptography.Xml.SignedXml` and `client.pem`. +- `inclusive_namespaces_prefix_list_with_tab.xml`: its document and reference digest come from .NET's `SignedXml`. Its `SignedInfo` was canonicalized with libxml2 and signed with openssl and `client.pem`. +- `inclusive_namespaces_in_with_comments_namespace.xml`: signed with xml-crypto 6.3.2 and `client.pem`. It checks that a signature from 6.3.2 or earlier still verifies, not interoperability. Those releases wrote a reference's `InclusiveNamespaces` under every `Transform`, in a namespace named after that Transform's `Algorithm`. - `windows_store_signature.xml` and `windows_store_certificate.pem`: a Windows Store app receipt and the certificate that verifies it. diff --git a/test/signature-integration-tests.spec.ts b/test/signature-integration-tests.spec.ts index 9d8d5e28..50b8ef93 100644 --- a/test/signature-integration-tests.spec.ts +++ b/test/signature-integration-tests.spec.ts @@ -478,6 +478,8 @@ describe("Signature integration tests", function () { "inclusive_namespaces_exc_c14n.xml", "inclusive_namespaces_exc_c14n_with_comments.xml", "inclusive_namespaces_enveloped_signature_after_exc_c14n.xml", + // Signed by xml-crypto 6.3.2, which wrote InclusiveNamespaces outside the exc-c14n namespace: + // https://github.com/node-saml/xml-crypto/issues/633 "inclusive_namespaces_in_with_comments_namespace.xml", // PrefixList="a b" is white space delimited: https://www.w3.org/TR/xml-exc-c14n/#sec-Use "inclusive_namespaces_prefix_list_with_tab.xml",