signxml

v0.1.0
v0.1.1 v0.1.1
v0.1.2 v0.1.2
v0.1.3 v0.1.3
v0.1.4 v0.1.4
v0.1.5 v0.1.5
v0.1.6 v0.1.6
v0.1.7 v0.1.7
v0.1.8 v0.1.8
v0.1.9 v0.1.9
v0.2.0 v0.2.0
v0.2.2 v0.2.2
v0.2.3 v0.2.3
v0.2.4 v0.2.4
v0.2.5 v0.2.5
v0.2.6 v0.2.6
v0.2.7 v0.2.7
v0.2.8 v0.2.8
v0.2.9 v0.2.9
v0.3.0 v0.3.0
v0.3.1 v0.3.1
v0.3.2 v0.3.2
v0.3.3 v0.3.3
v0.3.4 v0.3.4
v0.3.5 v0.3.5
v0.3.6 v0.3.6
v0.3.7 v0.3.7
v0.3.8 v0.3.8
v0.3.9 v0.3.9
v0.4.0 v0.4.0
v0.4.1 v0.4.1
v0.4.2 v0.4.2
v0.4.4 v0.4.4
v0.4.5 v0.4.5
v0.4.6 v0.4.6
v0.5.0 v0.5.0
v0.6.0 v0.6.0
v1.0.0 v1.0.0
v1.0.1 v1.0.1
v1.0.2 v1.0.2
v2.0.0 v2.0.0
v2.1.0 * Only sign the referenced element when passed reference_uri (thanks
to @soby).

• Add CN validation - instead of a full X.509 certificate, it is now
  possible to pass a common name that will be matched against the CN
  of a cert trusted by the CA store.

• Order-agnostic cert chain validation and friendlier ingestion of
  cert chains.

• Minor/internal changes
  v2.1.1 * Only sign the referenced element when passed reference_uri (thanks
  to @soby).

• Add CN validation - instead of a full X.509 certificate, it is now
  possible to pass a common name that will be matched against the CN of
  a cert trusted by the CA store.

• Order-agnostic cert chain validation and friendlier ingestion of cert
  chains.

• Minor/internal changes; packaging fix for 2.1.0
  v2.1.2 * Only sign the referenced element when passed reference_uri (thanks
  to @soby).

• Add CN validation - instead of a full X.509 certificate, it is now
  possible to pass a common name that will be matched against the CN of
  a cert trusted by the CA store.

• Order-agnostic cert chain validation and friendlier ingestion of cert
  chains.

• Minor/internal changes; packaging fix for 2.1.0
  v2.1.3 - Only sign the referenced element when passed reference_uri (thanks
  to @soby).

• Add CN validation - instead of a full X.509 certificate, it is now
  possible to pass a common name that will be matched against the CN of
  a cert trusted by the CA store.

• Order-agnostic cert chain validation and friendlier ingestion of cert
  chains.

• Minor/internal changes; packaging fix for 2.1.0
  v2.1.4 - Only sign the referenced element when passed reference_uri (thanks
  to @soby).

• Add CN validation - instead of a full X.509 certificate, it is now
  possible to pass a common name that will be matched against the CN of
  a cert trusted by the CA store.

• Order-agnostic cert chain validation and friendlier ingestion of cert
  chains.

• Minor/internal changes; packaging fix for 2.1.0
  v2.10.0 - Excise empty xmlns declarations only in signature, not in payload

• Add pyinstaller support to signxml (#188)

• Documentation, test infrastructure, and code organization improvements
  v2.10.1 - Do not excise any empty xmlns="" declarations by default. This behavior is now configurable as follows

  signer = XMLSigner()
  signer.excise_empty_xmlns_declarations = True
  signer.sign(...)
  

  verifier = XMLVerifier()
  verifier.excise_empty_xmlns_declarations = True
  verifier.verify(...)
  

• Documentation and autoformatting improvements
  v2.2.0 - Support custom key info when signing

• Initial elements of ws-security support

• Support signing and verifying multiple references
  v2.2.1 - Fix handling of reference URIs in detached signing

• Test infra fixes
  v2.2.2 - Expand supported cryptography version range. Fixes #74

• Documentation and release automation improvements
  v2.2.3 - Release automation: parse repo name correctly
  v2.2.4 - Documentation and test fixes
  v2.2.5 - Allow defusedxml>=0.5 (#82)

• Readability improvements
  v2.2.6 - Fix release script
  v2.3.0 - Add explicit dependency on asn1crypto to setup.py (#87)

• Remove use of Exception.message for py3 compatibility. Closes #36 (#86)

• Use asn1crypto instead of pyasn1 to match cryptography lib (#85)

• Pin to major version of lxml instead of minor

• Allow newer versions of several requirements (#84)

• Allow newer version of eight library (#83)
  v2.4.0 - Import asn1crypto on demand

• Allow newer versions of cryptography library (#89)
  v2.5.0 - Relax dependency version constraints.

• Drop Python 3.3 support.

• Support for PEM files with CR+LF line endings (#93).
  v2.5.1 Fix release
  v2.5.2 - Fix release
  v2.6.0 - Update dependencies to baseline on Ubuntu 18.04

• Clarify documentation of Ubuntu installation dependencies

• List ipaddress as a dependency

• Strip PEM header from OpenSSL.crypto.X509 cert

• Doc updates: dependency versions, standard links

• Fix cryptography deprecation warnings. Closes #108

• Allow URI attribute of Reference to be absent (#102)
  v2.7.0 - Drop defusedxml dependency; add security notes

• Add missing c14n transform for enveloping and detached methods (#107)

• Relax pyOpenSSL dependency version range to include version 19

• Apply transforms and digest calculations to copies of root. Closes #125. (#126)

• Documentation and test improvements
  v2.7.1 - Accept PEM keys as either str or bytes
  v2.7.2 - Relax dependency version range on eight

• Update dependency installation documentation

• XMLSigner.sign(): add always_add_key_value kwarg to include both
  X509Data and KeyValue for ill-defined signing applications

• XMLVerifier.verify(): reject signatures that contain both X509Data
  and KeyValue by default; add ignore_ambiguous_key_info kwarg to
  bypass
  v2.7.3 - Fix ECDSA signature encoding/decoding (#150)

• Add InclusiveNamespaces PrefixList support for SignedInfo

• Test and documentation improvements
  v2.8.0 - Compare raw digest bytes instead of base64 encoded digests. Fixes #155

• Initial X509IssuerSerial/X509Digest support

• Support custom inclusive_ns_prefixes when signing
  v2.8.1 - Allow cryptography versions >3 (but <4) (#164)

• Add support for adding Signature Properties to a detached signature (#160)
  v2.8.2 - Allow the combination of X509Data and KeyValue when they represent the same public key (#169)

• Use self.namespaces signature properties "Object" element (#167)
  v2.9.0 - Unlimit cryptography version constraint. Fixes #177

• Bump pyOpenSSL compat range; add dep version strategy note
  v3.0.0 - Add XAdES support

• Migrate all configuration inputs to enums (string identifiers are still supported, but will be deprecated in a future version)

• Migrate structured data inputs to dataclasses

• Deprecate excise_empty_xmlns_declarations

• Documentation and test infrastructure improvements

• Clean up top level signxml and signxml.xades namespaces

• Stop using default_backend for cryptography, it is no longer required

• Drop Python 3.6 support (#200)
  v3.0.1 - Mark SHA1 as deprecated

• Aggregate verification settings in SignatureConfiguration dataclass

• Mark all dataclasses in API as frozen

• Add ability to assert expected signature location

• Add ability to assert expected signature algorithms

• Add ability to assert expected digest algorithms

• Add MGF1 ("RSASSA-PSS without parameters") algorithm identifiers

• Remove PSS ("RSASSA-PSS with parameters") and EdDSA algorithm
  identifiers (given low usage and no interop examples, we will not be
  implementing PSS parameters for now; EdDSA key info additionally has
  no standardized way to serialize it)

• Add debug logging of canonicalization outputs

• Documentation and formatting improvements
  v3.0.2 - Remove incorrect deprecation of xml-c14n11 URI
  v3.1.0 - Use distinct default for payload c14n. Fixes #217

• Deprecate SHA1

• Test and documentation improvements
  v3.1.1 - Add type attribute to XAdES signed properties reference (#224)
  v3.2.0 - Roundtrip referenced XML nodes before c14n to detach them from parent document when verifying (#225)
  v3.2.1 - Use dataclass.replace in SignatureReference construction. Fixes #231
  v3.2.2 - Update upper bound on lxml dependency to allow lxml 5

• Bump minimum dependency versions to align with Ubuntu 20.04

• Test and release infrastructure improvements
  v4.0.0 - Replace PyOpenSSL with Cryptography (#260)

  • This is a major infrastructure change that replaces core
    certificate parsing, key processing, signature validation, and
    certificate chain validation functions previously provided by
    PyOpenSSL with those provided by Cryptography. Care was taken to
    preserve the exisitng API, including exception types, but many
    error messages raised in various error conditions have changed. If
    you see unexpected behavior and you have reason to believe it is
    incorrect, please file an issue.

  • Breaking change: the ca_path parameter, previously used to specify
    CA certificate stores, is no longer supported. Use the ca_pem_file
    parameter instead.

• Raise error when invalid certificate string is passed as input to signer

• Fix public key matching for ECDSA (#245)
  v4.0.1 - Verifier: Accept PyOpenSSL cert input, add deprecation warning
  v4.0.2 - XAdES signing: remove duplicate timezone information from SigningTime (#266)
  v4.0.3 - Fix issue with support for deprecated PyOpenSSL certificates

• Fully remove the ca_path parameter; add docs for signature location pinning
  v4.0.4 This release contains security fixes for two security advisories:

• Signature verification with HMAC is vulnerable to an algorithm confusion attack
  (GHSA-6vx8-pcwv-xhf4)

• Signature verification with HMAC is vulnerable to a timing attack
  (GHSA-gmhf-gg8w-jw42)
  v4.0.5 - Use Python 3.9 compatible typing expression
  v4.1.0 - Add options to exclude the C14N Transform element in signatures (#274)
  v4.2.0 - Align behaviour of expect_references with docs (#279).
  Passing expect_references=True to verify(...) now results in a list
  of verify_results, irrespective of the number of references in the
  signature.

• Accept lxml 6.x
  v4.2.1 - Add legacy SigningCertificate with IssuerSerial for XAdES interoperability (#282)
  v4.2.2 - Support default namespace with no xmlns="" undeclarations in sign/verify round-trip (#286)
  v4.3.0 - Remove registration for ec.SECT* ECDSA curves (#289)

• Fix key info matching behavior (#287)
  v4.3.1 - Fix comparison logic for ECDSA public keys (#290)
  v4.4.0 - Forbid DTD declarations in XML input

• Avoid deprecated method importlib.resources.open_text
  v4.5.0 - Support setting certificate validation policy
  v4.5.1 - fix rst formatting
  v5.0.0 - X.509 certificate valitation now requires the provided certificate to list digital signature as a key usage.

• fix rst formatting

• Forbid DTD declarations in XML input

  • Avoid deprecated method importlib.resources.open_text

• Fix comparison logic for ECDSA public keys (#290)

• Remove registration for ec.SECT* ECDSA curves (#289)

  • Fix key info matching behavior (#287)

• Support default namespace with no xmlns="" undeclarations in sign/verify round-trip (#286)

• Add legacy SigningCertificate with IssuerSerial for XAdES interoperability (#282)

• Align behaviour of expect_references with docs (#279). Passing expect_references=True to verify(...) now results in a list of verify_results, irrespective of the number of references in the signature.

  • Accept lxml 6.x

• Add options to exclude the C14N Transform element in signatures (#274)

• Use Python 3.9 compatible typing expression

This release contains security fixes for two security advisories:

• Signature verification with HMAC is vulnerable to an algorithm confusion attack (https://github.com/XML-Security/signxml/security/advisories/GHSA-6vx8-pcwv-xhf4)

• Signature verification with HMAC is vulnerable to a timing attack (https://github.com/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42)

• Fix issue with support for deprecated PyOpenSSL certificates

  • Fully remove the ca_path parameter; add docs for signature location pinning

• XAdES signing: remove duplicate timezone information from SigningTime (#266)

• Verifier: Accept PyOpenSSL cert input, add deprecation warning

• Replace PyOpenSSL with Cryptography (#260)

  - This is a major infrastructure change that replaces core
    certificate parsing, key processing, signature validation, and
    certificate chain validation functions previously provided by
    PyOpenSSL with those provided by Cryptography. Care was taken to
    preserve the exisitng API, including exception types, but many
    error messages raised in various error conditions have changed. If
    you see unexpected behavior and you have reason to believe it is
    incorrect, please file an issue.
  
  - Breaking change: the ca_path parameter, previously used to specify
    CA certificate stores, is no longer supported. Use the ca_pem_file
    parameter instead.
  

  • Raise error when invalid certificate string is passed as input to signer

  • Fix public key matching for ECDSA (#245)

• Update upper bound on lxml dependency to allow lxml 5

  • Bump minimum dependency versions to align with Ubuntu 20.04

  • Test and release infrastructure improvements

• Use dataclass.replace in SignatureReference construction. Fixes #231

• Roundtrip referenced XML nodes before c14n to detach them from parent document when verifying (#225)

• Add type attribute to XAdES signed properties reference (#224)

• Use distinct default for payload c14n. Fixes #217

• Deprecate SHA1

• Test and documentation improvements

• Remove incorrect deprecation of xml-c14n11 URI

• Mark SHA1 as deprecated

  • Aggregate verification settings in SignatureConfiguration dataclass

  • Mark all dataclasses in API as frozen

  • Add ability to assert expected signature location

  • Add ability to assert expected signature algorithms

  • Add ability to assert expected digest algorithms

  • Add MGF1 ("RSASSA-PSS without parameters") algorithm identifiers

  • Remove PSS ("RSASSA-PSS with parameters") and EdDSA algorithm identifiers (given low usage and no interop examples, we will not be implementing PSS parameters for now; EdDSA key info additionally has no standardized way to serialize it)

  • Add debug logging of canonicalization outputs

  • Documentation and formatting improvements

• Add XAdES support

  • Migrate all configuration inputs to enums (string identifiers are still supported, but will be deprecated in a future version)

  • Migrate structured data inputs to dataclasses

  • Deprecate excise_empty_xmlns_declarations

  • Documentation and test infrastructure improvements

  • Clean up top level signxml and signxml.xades namespaces

  • Stop using default_backend for cryptography, it is no longer required

  • Drop Python 3.6 support (#200)

• Do not excise any empty xmlns="" declarations by default. This behavior is now configurable as follows

  ```
  signer = XMLSigner()
  signer.excise_empty_xmlns_declarations = True
  signer.sign(...)
  ```
  ```
  verifier = XMLVerifier()
  verifier.excise_empty_xmlns_declarations = True
  verifier.verify(...)
  ```
  

  • Documentation and autoformatting improvements

• Excise empty xmlns declarations only in signature, not in payload

  • Add pyinstaller support to signxml (#188)

  • Documentation, test infrastructure, and code organization improvements

• Unlimit cryptography version constraint. Fixes #177

  • Bump pyOpenSSL compat range; add dep version strategy note

• Allow the combination of X509Data and KeyValue when they represent the same public key (#169)

  • Use self.namespaces signature properties "Object" element (#167)

• Allow cryptography versions >3 (but <4) (#164)

  • Add support for adding Signature Properties to a detached signature (#160)

• Compare raw digest bytes instead of base64 encoded digests. Fixes #155

  • Initial X509IssuerSerial/X509Digest support

  • Support custom inclusive_ns_prefixes when signing

• Fix ECDSA signature encoding/decoding (#150)

  • Add InclusiveNamespaces PrefixList support for SignedInfo

  • Test and documentation improvements

• Relax dependency version range on eight

  • Update dependency installation documentation

  • XMLSigner.sign(): add always_add_key_value kwarg to include both X509Data and KeyValue for ill-defined signing applications

  • XMLVerifier.verify(): reject signatures that contain both X509Data and KeyValue by default; add ignore_ambiguous_key_info kwarg to bypass

• Accept PEM keys as either str or bytes

• Drop defusedxml dependency; add security notes

  • Add missing c14n transform for enveloping and detached methods (#107)

  • Relax pyOpenSSL dependency version range to include version 19

  • Apply transforms and digest calculations to copies of root. Closes #125. (#126)

  • Documentation and test improvements

• Update dependencies to baseline on Ubuntu 18.04

  • Clarify documentation of Ubuntu installation dependencies

  • List ipaddress as a dependency

  • Strip PEM header from OpenSSL.crypto.X509 cert

  • Doc updates: dependency versions, standard links

  • Fix cryptography deprecation warnings. Closes #108

  • Allow URI attribute of Reference to be absent (#102)

• Fix release

• Import asn1crypto on demand

  • Allow newer versions of cryptography library (#89)

• Add explicit dependency on asn1crypto to setup.py (#87)

  • Remove use of Exception.message for py3 compatibility. Closes #36 (#86)

  • Use asn1crypto instead of pyasn1 to match cryptography lib (#85)

  • Pin to major version of lxml instead of minor

  • Allow newer versions of several requirements (#84)

  • Allow newer version of eight library (#83)

• Documentation and test fixes

• Release automation: parse repo name correctly

• Expand supported cryptography version range. Fixes #74

• Documentation and release automation improvements

• Fix handling of reference URIs in detached signing

• Test infra fixes

• Support custom key info when signing

• Initial elements of ws-security support

• Support signing and verifying multiple references

• Only sign the referenced element when passed reference_uri (thanks to @soby).

• Add CN validation - instead of a full X.509 certificate, it is now possible to pass a common name that will be matched against the CN of a cert trusted by the CA store.

• Order-agnostic cert chain validation and friendlier ingestion of cert chains.

• Minor/internal changes; packaging fix for 2.1.0