def _check_signature(self, decoded_xml, item, node_name=NODE_NAME,
                         origdoc=None, id_attr="", must=False,
                         only_valid_cert=False):
        #print item
        try:
            issuer = item.issuer.text.strip()
        except __HOLE__:
            issuer = None

        # More trust in certs from metadata then certs in the XML document
        if self.metadata:
            try:
                _certs = self.metadata.certs(issuer, "any", "signing")
            except KeyError:
                _certs = []
            certs = []
            for cert in _certs:
                if isinstance(cert, basestring):
                    certs.append(make_temp(pem_format(cert), suffix=".pem",
                                           decode=False,
                                           delete=self._xmlsec_delete_tmpfiles))
                else:
                    certs.append(cert)
        else:
            certs = []

        if not certs and not self.only_use_keys_in_metadata:
            logger.debug("==== Certs from instance ====")
            certs = [make_temp(pem_format(cert), suffix=".pem",
                               decode=False, delete=self._xmlsec_delete_tmpfiles)
                    for cert in cert_from_instance(item)]
        else:
            logger.debug("==== Certs from metadata ==== %s: %s ====" % (issuer,
                                                                        certs))

        if not certs:
            raise MissingKey("%s" % issuer)

        #print certs

        verified = False
        last_pem_file = None
        for _, pem_file in certs:
            try:
                last_pem_file = pem_file
                if origdoc is not None:
                    try:
                        if self.verify_signature(origdoc, pem_file,
                                                 node_name=node_name,
                                                 node_id=item.id,
                                                 id_attr=id_attr):
                            verified = True
                            break
                    except Exception:
                        if self.verify_signature(decoded_xml, pem_file,
                                                 node_name=node_name,
                                                 node_id=item.id,
                                                 id_attr=id_attr):
                            verified = True
                            break
                else:
                    if self.verify_signature(decoded_xml, pem_file,
                                             node_name=node_name,
                                             node_id=item.id, id_attr=id_attr):
                        verified = True
                        break
            except XmlsecError, exc:
                logger.error("check_sig: %s" % exc)
                pass
            except SignatureError, exc:
                logger.error("check_sig: %s" % exc)
                pass
            except Exception, exc:
                logger.error("check_sig: %s" % exc)
                raise

        if (not verified) and (not only_valid_cert):
            raise SignatureError("Failed to verify signature")
        else:
            if not self.cert_handler.verify_cert(last_pem_file):
                raise CertificateError("Invalid certificate!")

        return item
dataset/ETHPy150Open cloudera/hue/desktop/core/ext-py/pysaml2-2.4.0/src/saml2/sigver.py/SecurityContext._check_signature