From securityjoseph67@example.org Tue Jun 01 20:33:27 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 91638 invoked from network); 1 Jun 2004 20:33:26 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 1 Jun 2004 20:33:26 -0000 Received: (qmail 56682 invoked by uid 500); 1 Jun 2004 20:33:40 -0000 Delivered-To: joseph67@example.org Received: (qmail 56666 invoked by uid 500); 1 Jun 2004 20:33:40 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 56652 invoked by uid 99); 1 Jun 2004 20:33:40 -0000 Date: 01 Jun 04 20:32:11 From: Sam Ruby <joseph67@example.org> To: joseph67@example.org Subject: [GUMP@brutus]: xml-security/xml-security failed X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N To whom it may engage... This is an automated request, but not an unsolicited one. For more information please visit http://gump.apache.org/nagged.html, and/or contact folk at joseph67@example.org. Project xml-security has an issue affecting its community integration. This issue affects 1 projects, and has been outstanding for 27 runs. Project State : 'Failed', Reason 'Build Failed' The following are affected: - wss4j : Web Services Security (WS-Security) Java Implemenatation Full details are available at: http://brutus.apache.org:8080/gump/xml-security/xml-security/index.html That said, some snippets follow: The following annotations were provided: -INFO- Sole jar [xmlsec.jar] identifier set to project name -INFO- Dependency on jce exists, no need to add for property lib.jce. -INFO- Enable "debug" output, due to a sequence of 26 previous errors. -INFO- Failed with reason build failed The following work was performed: http://brutus.apache.org:8080/gump/xml-security/xml-security/gump_work/build_xml-security_xml-security.html Work Name: build_xml-security_xml-security (Type: Build) State: Failed Elapsed: 0 hours, 0 minutes, 8 seconds Command Line: java -Djava.awt.headless=true -Dbuild.clonevm=true -Xbootclasspath/p:/usr/local/gump/public/workspace/xml-xerces2/java/build/xercesImpl.jar:/usr/local/gump/public/workspace/xml-xerces2/java/build/xml-apis.jar:/usr/local/gump/public/workspace/xml-xalan/java/build/xalan-unbundled.jar:/usr/local/gump/public/workspace/xml-commons/java/external/build/xml-apis.jar org.apache.tools.ant.Main -debug -Dgump.merge=/usr/local/gump/public/gump/work/merge.xml -Dbuild.sysclasspath=only -Djce.download.sha1=c1f0e975e8c8e0a0105787b249a50615b485d109 -Dlib.jce=/usr/local/gump/packages/jce/jce-jdk13-116.jar -Djce.download.md5=85c64cd754719a4bc8da7e9aa0e113fd gump [Working Directory: /usr/local/gump/public/workspace/xml-security] CLASSPATH : /usr/local/j2sdk1.4.2_04/lib/tools.jar:/usr/local/gump/public/workspace/xml-security/build/classes:/usr/local/gump/public/workspace/xml-security:/usr/local/gump/public/workspace/ant/dist/lib/ant-stylebook.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-swing.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-trax.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-junit.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-xalan2.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-nodeps.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant.jar:/usr/local/gump/packages/jce/jce-jdk13-116.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging-api.jar:/usr/local/gump/public/workspace/dist/junit/junit.jar--------------------------------------------- [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/HexDump.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/I18n.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/IdResolver.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/IgnoreAllErrorHandler.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/JavaUtils.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/PRNG.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/RFC2253Parser.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/SignatureElementProxy.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/Version.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/X509CertificateValidator.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/XMLUtils.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/XPathFuncHereAPI.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/ResourceResolver.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/ResourceResolverException.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/ResourceResolverSpi.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java:25: package org.apache.bcel.classfile does not exist [javac] import org.apache.bcel.classfile.Node; [javac] ^ [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/Init.java:149: m_functions has private access in org.apache.xpath.compiler.FunctionTable [javac] for (int i = 0; i < FunctionTable.m_functions.length; i++) { [javac] ^ [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/Init.java:150: m_functions has private access in org.apache.xpath.compiler.FunctionTable [javac] FuncLoader loader = FunctionTable.m_functions[i]; [javac] ^ [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/Init.java:156: m_functions has private access in org.apache.xpath.compiler.FunctionTable [javac] FunctionTable.m_functions[i] = funcHereLoader; [javac] ^ [javac] 4 errors BUILD FAILED /usr/local/gump/public/workspace/xml-security/build.xml:298: Compile failed; see the compiler error output for details. at org.apache.tools.ant.taskdefs.Javac.compile(Javac.java:938) at org.apache.tools.ant.taskdefs.Javac.execute(Javac.java:758) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275) at org.apache.tools.ant.Task.perform(Task.java:363) at org.apache.tools.ant.Target.execute(Target.java:321) at org.apache.tools.ant.Target.performTasks(Target.java:348) at org.apache.tools.ant.Project.executeTarget(Project.java:1212) at org.apache.tools.ant.Project.executeTargets(Project.java:1060) at org.apache.tools.ant.Main.runBuild(Main.java:666) at org.apache.tools.ant.Main.startAnt(Main.java:187) at org.apache.tools.ant.Main.start(Main.java:151) at org.apache.tools.ant.Main.main(Main.java:234) Total time: 7 seconds --------------------------------------------- To subscribe to this information via syndicated feeds: RSS: http://brutus.apache.org:8080/gump/xml-security/xml-security/rss.xml Atom: http://brutus.apache.org:8080/gump/xml-security/xml-security/atom.xml -- Produced by Gump 2.0.3-alpha-0002. [Run (20040601 09:00:06, brutus:brutus-public:20040601 09:00:06)] http://brutus.apache.org:8080/gump/index.html http://brutus.apache.org:8080/gump/options.html -- Apache Gump http://gump.apache.org/ [Instance: brutus] From securityjoseph67@example.org Tue Jun 01 22:16:58 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 47081 invoked from network); 1 Jun 2004 22:16:58 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 1 Jun 2004 22:16:58 -0000 Received: (qmail 70598 invoked by uid 500); 1 Jun 2004 22:17:14 -0000 Delivered-To: joseph67@example.org Received: (qmail 70557 invoked by uid 500); 1 Jun 2004 22:17:13 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 70534 invoked by uid 99); 1 Jun 2004 22:17:13 -0000 Date: 1 Jun 2004 22:17:51 -0000 Message-ID: <joseph67@example.org> From: joseph67@example.org To: joseph67@example.org Cc: Subject: DO NOT REPLY [Bug 29188] - Minor clean-ups and speed/memory improvment X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=29188>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=29188 Minor clean-ups and speed/memory improvment ------- Additional Comments From joseph67@example.org 2004-06-01 22:17 ------- Created an attachment (id=11714) New version of the patch with several bugs fixed, and various eclipse warnings removed. From securityjoseph67@example.org Wed Jun 02 19:43:11 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 35737 invoked from network); 2 Jun 2004 19:43:11 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 2 Jun 2004 19:43:11 -0000 Received: (qmail 53637 invoked by uid 500); 2 Jun 2004 19:43:24 -0000 Delivered-To: joseph67@example.org Received: (qmail 53618 invoked by uid 500); 2 Jun 2004 19:43:24 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 53592 invoked by uid 99); 2 Jun 2004 19:43:23 -0000 Message-ID: <joseph67@example.org> Date: Wed, 2 Jun 2004 12:43:05 -0700 (PDT) From: trebor iksrazal <joseph67@example.org> Subject: test - please ignore To: joseph67@example.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/ From securityjoseph67@example.org Wed Jun 02 21:59:10 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 20634 invoked from network); 2 Jun 2004 21:59:10 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 2 Jun 2004 21:59:10 -0000 Received: (qmail 34465 invoked by uid 500); 2 Jun 2004 21:59:26 -0000 Delivered-To: joseph67@example.org Received: (qmail 34442 invoked by uid 500); 2 Jun 2004 21:59:26 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 34429 invoked by uid 99); 2 Jun 2004 21:59:26 -0000 Date: 2 Jun 2004 22:00:08 -0000 Message-ID: <joseph67@example.org> From: joseph67@example.org To: joseph67@example.org Cc: Subject: DO NOT REPLY [Bug 29188] - Minor clean-ups and speed/memory improvment X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=29188>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=29188 Minor clean-ups and speed/memory improvment ------- Additional Comments From joseph67@example.org 2004-06-02 22:00 ------- This patch does mainly: * Reduce the number of objects generated while processing (in some case thousands of unneeded AttrCompare were insatiate). * Remove unneeded methods. * Changed all the rest of XPathAPI to CachedXPathAPI(or a selectNode) * Fixed the javadocs, eclipse warnings in the touched files * Removed some use of DocumentTraversal(only left in TransformXPathFilterCHGP, is it still needed?). * Shared the same CachedXPathAPI for all the methods in the same thread(i.e. ThreadLocal). The memory footprint (in my test cases) during the check has goes from 7M-9M to 5M-7M. The speed up in my test case is about 5-10% The changelog for the changed files: * Init.java o Used cachedXpathAPi instead of XPathAPI for speed reasons. o Modify the patch of the xalan FunctionTable, and do it using reflection api, so it can compile in new Xalan versions. o Removed all readUserConfiguration methods(not done correctly), registerKeyinfoContentHandler(), qualifyNamespaces() and getContentHandlerClass() not used in the library(This behavior is more or less done in JCEMapper) o Fixed JAVADOCS * JCEMapper o Used cachedXpathAPi instead of XPathAPI for speed reasons. o Fixed JAVADOCS * IntegrityHmac.java o Remove XPathAPI for XMLUtils.selectDSNode o Fixed JAVADOCS o Refactor a little engineVerify to sharing log functions. o Removed some else when return is used in then(eclipse) * Cannicalizer.java o Fixed JAVADOCS o Removed XPATH_* (except C14N_W_COMMENTS_SINGLE_NODE) as they are not used in the library anymore. * AttrCompare.java o Refactor to reduce the call to Node methods. * C14NHelper o Fixed JAVADOCS o Removed sortAttributes(not needed any more) normalizeAttr, normalizeComment, normalizaeProcessingInstraction, normalizeText, (they are not used and are similar to ones in C14NBase) o Refactor namespaceIsAbsolute to one line in string. * Canonicalizer20010315.java o Fixed JAVADOCS o Extract string constants o Used SortedSet instead of a List to do the sorting while inserting nodes o Do the namespaceIsRelative check only in Nodes that are going to be emitted. * Canonicalizer20010315Excl.java o Fixed JAVADOCS o Extract string constants o Used SortedSet instead of a List to do the sorting while inserting nodes o Do the namespaceIsRelative check only in Nodes that are going to be emitted. o Remove the garbage generated at use in visiblyUtilezed without appending xmlns: to the prefixes. o Clone (instead of created anew) some structures for speed reasons. * CanonicalizerBase.java o Fixed JAVADOCS o Extract string constants o Used char arrays or simple chars wherever is possible. o NameSpaceSymbTable used clone instead of a list of removes, generates less garbage. * XMLCipherInput.java o Fixed JAVADOCS o Removed the handling of exceptions that now are not happening. * KeyInfo.java o Fixed JAVADOCS o Removed unneeded private members o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Remove getChildNodes iteraction for getFirstChild, getNextSibling looping. o Change Vector to a List/ArrayList o Remove registerKeyInfoContentHandler (not needed). * X509Data.java o Fixed JAVADOCS o Removed unneeded private members o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Remove getChildNodes iteraction for getFirstChild, getNextSibling looping. * RetrievalMethodResolver.java o Avoid to use exceptions to implement engineCanResolve o Fixed JAVADOCS o Remove so declared but not thrown exceptions o Do getFirstChildElement private(before was public) * X509CertificateResolver.java o Avoid to use exceptions to implement engineCanResolve o Remove so declared but not thrown exceptions o Fixed JAVADOCS * X509SKIResolver.java o Avoid to use exceptions to implement engineCanResolve o Remove so declared but not thrown exceptions o Fixed JAVADOCS * X509SubjectNameResolver.java o Avoid to use exceptions to implement engineCanResolve o Remove so declared but not thrown exceptions o Fixed JAVADOCS * Manifest.java o Fixed JAVADOCS o Don't search for references elements, use a cached Element[] o Used a CachedXPathAPI for all the operations in the document of the manifest o Remove in the [set|get]ResolverProperty to no search in the keys for the key(why is this done?) * Reference.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Remove getChildNodes iteraction for getFirstChild, getNextSibling looping. o Used a CachedXPathAPI for all the operations in the document of the reference o Removed some unused constructors. * SignedInfo.java o Fixed JAVADOCS o Used selectDsNode method instead of using DOM to search for a specific node. * XMLSignature.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Throws some unneeded IOException handling o Add some if (log.isDebugEnable()) wrapping * XMLSignatureInput.java o Fixed JAVADOCS o Changed CachedXPathAPI to CachedXPathAPIHolder o Reuse the c14n bytes if there are already calculated. o Make a lot of HTML constants private. * Transforms.java o Used selectDsNode method instead of using DOM to search for a specific node. o Reused the Element to cached transforms between getLength and item o Fixed JAVADOCS * TransformBase64Decode.java o Fixed JAVADOCS o Don't use DocumentTraversal to obtain the text nodes of all subchildren o Remove process and AlwaysAcceptNodeFilter * TransformC14NExclusive.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode * TransformC14NExclusiveWithComments.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode * TransformEnvelopedSignature.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Avoid excessive castings in searchSignatureElement * TransformsXPath.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Fixed some weird log (introduce by me in a previous patch). * TransformXPath2Filter.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode o Change Vector to List/ArrayList * TransformXPath2Filter04.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode * TransformXPathFilterCHGP o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode. * TransformXSLT.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode. o Made constants private. * InclusiveNamespaces o Use SortedSet instead of vector. o Don't concat xmlns: to the prefixes. * XPathFilter.java o Fixed JAVADOCS o Change ElementProxy.getChildLocalName for XMLUtils.selectDsNode. * Base64.java o Fixed JAVADOCS o Remove [get|set]Base64WrapLength (doesn't work) o Remove getChildNodes iteraction for getFirstChild, getNextSibling looping. o Remove private method encodeBlock, encodeFullBlock and getValue o Import & modified(to use variable wrapping) the Base64 implementation from the used in xerces * CachedXPathFuncHereAPI.java o Reset the cachedXpathAPI dtm if here() function is used. o Fixed JAVADOCS * ElementProxy.java o Fixed JAVADOCS o Add some if (log.isDebugEnable()) wrapping o Generate less garbage doing guaranteeThatElementInCorrectSpace o Remove getChildElementLocalName (used XMLUtils.selectNode instead) o Remove getChildNodes iteraction for getFirstChild, getNextSibling looping. * IdResolver.java o Used cachedXpathAPi instead of XPathAPI for speed reasons. o Fixed JAVADOCS * XMLUtils.java o Fixed JAVADOCS o Removed getNodeTypeString, all getAncestorElements, getDirectChildrenElements, getDirectChild, outputDOM, elementToNodeList, createAttr, setAttr, setAttr,createElementFromBigint, getBigintFromElement, getBytesFromElement, createElementInEncryptionSpace, guaranteeThatElementInSignatureSpace, guaranteeThatElementInEncryptionSpace, randomNSprefix field, getRandomNamespacePrefix, createDSctx(doc,prefix), converSetToNodeList, getXPath() * ResolverFrament.java o Fixed JAVADOCS o Do pass cachedXpathapiholder to XMLSignatureInput constructor. * ResolverXPointer.java o Fixed JAVADOCS o Do pass cachedXpathapiholder to XMLSignatureInput constructor. o Remove some unused parameters in the private methods. * AllTests.java o In the static initialization if the basedir property is not set, set it to the current dir. * CachedXPathAPIHolder.java o For hold & cache XPathAPIHolder. Now the cacheXPathAPI is matain & sometime reset via ThreadLocal. From securityjoseph67@example.org Thu Jun 03 11:47:14 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 92543 invoked from network); 3 Jun 2004 11:47:13 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Jun 2004 11:47:13 -0000 Received: (qmail 13745 invoked by uid 500); 3 Jun 2004 11:47:12 -0000 Delivered-To: joseph67@example.org Received: (qmail 13721 invoked by uid 500); 3 Jun 2004 11:47:12 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 13708 invoked by uid 99); 3 Jun 2004 11:47:12 -0000 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: [Patch] Patch proposed for solving memory retention problem in XMLSecurity 1.1.0 java library Date: Thu, 3 Jun 2004 13:46:57 +0200 Message-ID: <joseph67@example.org> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Patch] Patch proposed for solving memory retention problem in XMLSecurity 1.1.0 java library Thread-Index: AcRJYHafRXaR7IaoSX+YO7LBWZmlCA== From: "Deltoro, Salvador" <joseph67@example.org> To: <joseph67@example.org> X-OriginalArrivalTime: 03 Jun 2004 11:46:58.0556 (UTC) FILETIME=[79FD7BC0:01C44960] X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Hello. We have been doing exhaustive performance tests of an application that uses the XMLSecurity 1.1.0 java library and we have found out a memory retention problem in this library. The problem is produced by the class org.apache.xml.security.utils.IdResolver. The reason lies inside the method "public static void registerElementById(Element element, String idValue)", specifically in this line: >> elementMap.put(idValue, element); >> This instruction adds elements to a WeakHashMap using "strong" references, not "weak" references (please see http://java.sun.com/j2se/1.4.2/docs/api/java/util/WeakHashMap.html for details). (These elements contain xerces DeferredDocumentImpl objects). The JVM's garbage collector will automatically remove from the memory heap all the objects referenced "weakly" that are no longer used, but not the objects referenced "strongly". Therefore, this instruction provokes that the gc cannot remove all objects from memory, so each invocation to the IdResolver class leaves new objects in the heap that cannot removed after use. The result is that the heap consumption grows constantly until the maximum configured for the JVM, making the performance degrade more and more. Our environment is based on HP-UX SDK 1.4.2_03. We have developed locally a patch in order to solve this issue that has worked perfectly well under performance testing. I have substituted the former instruction by this one: >> elementMap.put(idValue, new java.lang.ref.WeakReference(element)); >> In this way, the IdResolver class puts the element as a explicit "weak" reference, so the garbage collector can remove it when no longer used and=20 We think that this XMLSecurity 1.1.0 performance problem can pose a big hurdle for using it broadly in real production environments, so it is worth that the persons responsible for the code repository assess the suitability of including this patch into XMLSecurity main development line in order to be included in next releases. We look forward to your feedback regarding this patch proposal. Please let me know if you need more information on this. Regards, Salvador Deltoro. From securityjoseph67@example.org Thu Jun 03 15:28:47 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 40596 invoked from network); 3 Jun 2004 15:28:47 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Jun 2004 15:28:47 -0000 Received: (qmail 45563 invoked by uid 500); 3 Jun 2004 15:28:56 -0000 Delivered-To: joseph67@example.org Received: (qmail 45448 invoked by uid 500); 3 Jun 2004 15:28:55 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 45434 invoked by uid 99); 3 Jun 2004 15:28:55 -0000 Message-ID: <joseph67@example.org> Date: Thu, 3 Jun 2004 08:28:27 -0700 From: joseph67@example.org To: joseph67@example.org, "Deltoro, Salvador" <joseph67@example.org> Subject: Re: [Patch] Patch proposed for solving memory retention problem in XMLSecurity 1.1.0 java library References: <joseph67@example.org> In-Reply-To: <joseph67@example.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit User-Agent: Internet Messaging Program (IMP) 3.2.2 X-Originating-IP: 83.161.120.155 X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian GNU/Linux) at oregonstate.edu X-Spam-Status: No, hits=0.3 tagged_above=-999.0 required=5.0 tests=NO_REAL_NAME X-Spam-Level: X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N IMHO, the current usage of WeakHashMap in the library is correct. The effect of the current usage is that when there are no more active references to the key, the mapping can be removed, which means the map no longer has a strong reference to the value object. Therefore if the garbage collector determines that the value object can be reclaimed, it won't be blocked from doing so by the presence of the mapping (as in a normal HashMap); this holds true regardless of whether the value objects are strongly referenced in the map. You may still have problems with memory retention, however, if strong references to the keys are not being released when they should (or in a timely manner), or if other strong references to the value object are not being released (in which case it is not the fault of the WeakHashMap implementation or its current usage). Either one of these may be issues to check for elsewhere. A more degenerate case is if the value object strongly references the key, but I doubt that is the case here. In any case, the proposed patch appears to me to be dangerous. It effectively converts the map to a soft-memory cache, where values of the mappings may be cleared at any time once they are no longer referenced anywhere else. This means that attempts to retrieve mappings may unexpectedly return null references (the key still exists but the value has been gc'ed), which probably is not expected behavior for this map and could cause failures in parts of the code that use it. > We have been doing exhaustive performance tests of an application that > uses the XMLSecurity 1.1.0 java library and we have found out a memory > retention problem in this library. > > The problem is produced by the class > org.apache.xml.security.utils.IdResolver. > > The reason lies inside the method "public static void > registerElementById(Element element, String idValue)", specifically in > this line: > > >> > elementMap.put(idValue, element); > >> > > This instruction adds elements to a WeakHashMap using "strong" > references, not "weak" references (please see > http://java.sun.com/j2se/1.4.2/docs/api/java/util/WeakHashMap.html for > details). (These elements contain xerces DeferredDocumentImpl objects). > The JVM's garbage collector will automatically remove from the memory > heap all the objects referenced "weakly" that are no longer used, but > not the objects referenced "strongly". > > Therefore, this instruction provokes that the gc cannot remove all > objects from memory, so each invocation to the IdResolver class leaves > new objects in the heap that cannot removed after use. The result is > that the heap consumption grows constantly until the maximum configured > for the JVM, making the performance degrade more and more. > > Our environment is based on HP-UX SDK 1.4.2_03. > > We have developed locally a patch in order to solve this issue that has > worked perfectly well under performance testing. I have substituted the > former instruction by this one: > > >> > elementMap.put(idValue, new java.lang.ref.WeakReference(element)); > >> > > In this way, the IdResolver class puts the element as a explicit "weak" > reference, so the garbage collector can remove it when no longer used > and > > We think that this XMLSecurity 1.1.0 performance problem can pose a big > hurdle for using it broadly in real production environments, so it is > worth that the persons responsible for the code repository assess the > suitability of including this patch into XMLSecurity main development > line in order to be included in next releases. > > We look forward to your feedback regarding this patch proposal. Please > let me know if you need more information on this. > > Regards, > Salvador Deltoro. > From securityjoseph67@example.org Thu Jun 03 20:24:32 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 67271 invoked from network); 3 Jun 2004 20:24:32 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Jun 2004 20:24:32 -0000 Received: (qmail 15298 invoked by uid 500); 3 Jun 2004 20:24:47 -0000 Delivered-To: joseph67@example.org Received: (qmail 15249 invoked by uid 500); 3 Jun 2004 20:24:46 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 15236 invoked by uid 99); 3 Jun 2004 20:24:46 -0000 Message-ID: <joseph67@example.org> Date: Thu, 03 Jun 2004 22:24:22 +0200 From: Raul Benito <joseph67@example.org> User-Agent: Mozilla Thunderbird 0.6 (X11/20040505) X-Accept-Language: en-us, en MIME-Version: 1.0 To: joseph67@example.org Subject: Re: [Patch] Patch proposed for solving memory retention problem in XMLSecurity 1.1.0 java library References: <joseph67@example.org> <joseph67@example.org> In-Reply-To: <joseph67@example.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by AMaViS perl-11 SZ CT ATT ML UV X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N joseph67@example.org wrote: >IMHO, the current usage of WeakHashMap in the library is correct. The effect of >the current usage is that when there are no more active references to the key, >the mapping can be removed, which means the map no longer has a strong >reference to the value object. Therefore if the garbage collector determines >that the value object can be reclaimed, it won't be blocked from doing so by >the presence of the mapping (as in a normal HashMap); this holds true >regardless of whether the value objects are strongly referenced in the map. > >You may still have problems with memory retention, however, if strong references >to the keys are not being released when they should (or in a timely manner), or >if other strong references to the value object are not being released (in which >case it is not the fault of the WeakHashMap implementation or its current >usage). Either one of these may be issues to check for elsewhere. A more >degenerate case is if the value object strongly references the key, but I doubt >that is the case here. > > This is exactly what is happening in one call path, see this code XMLSignature(but the same code is Manifest,Reference, and several others) /** * Sets the <code>Id</code> attribute * * @param Id Id value to be used by the id attribute on the Signature Element */ public void setId(String Id) { if ((this._state == MODE_SIGN) && (Id != null)) { this._constructionElement.setAttributeNS(null, Constants._ATT_ID, Id); IdResolver.registerElementById(this._constructionElement, Id); } } If you see when the setId is called it is called the Key is referenced by the value in a hard way. We can modify the put or we can modify this call but it seams a memory leak that needs to be fixed. >In any case, the proposed patch appears to me to be dangerous. It effectively >converts the map to a soft-memory cache, where values of the mappings may be >cleared at any time once they are no longer referenced anywhere else. This >means that attempts to retrieve mappings may unexpectedly return null >references (the key still exists but the value has been gc'ed), which probably >is not expected behavior for this map and could cause failures in parts of the >code that use it. > > > It is not a real problem because it is only a cached optimization, if it is not found in the table, the document is search again with XPath expressions. Anyhow when dom3 api will be released and used this function can be removed and used the setAttributeId API in DOM, instead of the cache table. From securityjoseph67@example.org Thu Jun 03 21:56:39 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 28045 invoked from network); 3 Jun 2004 21:56:39 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Jun 2004 21:56:39 -0000 Received: (qmail 94565 invoked by uid 500); 3 Jun 2004 21:56:56 -0000 Delivered-To: joseph67@example.org Received: (qmail 94548 invoked by uid 500); 3 Jun 2004 21:56:55 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 94535 invoked by uid 99); 3 Jun 2004 21:56:55 -0000 Message-ID: <joseph67@example.org> Date: Thu, 3 Jun 2004 14:56:27 -0700 From: joseph67@example.org To: joseph67@example.org, Raul Benito <joseph67@example.org> Subject: Re: [Patch] Patch proposed for solving memory retention problem in XMLSecurity 1.1.0 java library References: <joseph67@example.org> <joseph67@example.org> <joseph67@example.org> In-Reply-To: <joseph67@example.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit User-Agent: Internet Messaging Program (IMP) 3.2.2 X-Originating-IP: 83.161.120.155 X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian GNU/Linux) at oregonstate.edu X-Spam-Status: No, hits=0.3 tagged_above=-999.0 required=5.0 tests=NO_REAL_NAME X-Spam-Level: X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Quoting Raul Benito <joseph67@example.org>: > >... A more > >degenerate case is if the value object strongly references the key, but I > doubt > >that is the case here. > > This is exactly what is happening in one call path, see this code > ... > If you see when the setId is called it is called the Key is referenced > by the value in a hard way. > We can modify the put or we can modify this call but it seams a memory > leak that needs to be fixed. Yes, can't argue with that (I'm not familiar with the code, I was just speaking from a theoretical standpoint). Fixing the put or call is probably the 'better' solution, though. > It is not a real problem because it is only a cached optimization, if it > is not found in the table, the document is search again with XPath > expressions. Okay - just *looked* dangerous, but apparently not. Still, if changing the reference type of the value objects is the preferred solution, it would probably be better to use soft references instead of weak references (as with a commons-collections reference map). Then they would only be reclaimed when the memory is actually needed instead of every time the gc runs. From securityjoseph67@example.org Fri Jun 04 09:09:02 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 11845 invoked from network); 4 Jun 2004 09:09:02 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 4 Jun 2004 09:09:02 -0000 Received: (qmail 89247 invoked by uid 500); 4 Jun 2004 09:09:25 -0000 Delivered-To: joseph67@example.org Received: (qmail 89120 invoked by uid 500); 4 Jun 2004 09:09:24 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 89100 invoked by uid 99); 4 Jun 2004 09:09:24 -0000 From: "Milan Tomic" <joseph67@example.org> To: <joseph67@example.org> Subject: DSIGSignatur888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4sign() Date: Fri, 4 Jun 2004 11:08:27 +0200 Message-ID: <007c01c44a13$82875dc0$ce018ac1@Majestix> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_007D_01C44A24.46102DC0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Virus-Scanned: by joseph67@example.org X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N This is a multi-part message in MIME format. ------=_NextPart_000_007D_01C44A24.46102DC0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I've found this line in sign() function: hashLen = calculateSignedInfoHash(hash, 4096); The size 4096 is size of buffer for SignedInfo node (after canonicalization), but what will happen if someone have, for example, 20 references in doc to sign and SignedInfo node will be bigger than 4096 bytes. I belive we need one function to calculate size of SignedInfo node or this: unsigned int size = 0; hashLen = calculateSignedInfoHash(NULL, &size); XMLChar *hash = new XMLChar[size]; hashLen = calculateSignedInfoHash(hash, &size); Best regards, Milan ------=_NextPart_000_007D_01C44A24.46102DC0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.0.4630.0"> <TITLE>DSIGSignatur888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4sign()</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <BR> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2 = FACE=3D"Arial CE">I've found this line in sign() function:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial CE">hashLen =3D = calculateSignedInfoHash(hash, 4096);</FONT> </P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2 = FACE=3D"Arial CE">The size 4096 is size of buffer for SignedInfo node = (after canonicalization), but what will happen if someone have, for = example, 20 references in doc to sign and SignedInfo node will be bigger = than 4096 bytes. I belive we need one function to calculate size of = SignedInfo node or this:</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial CE">unsigned int size =3D 0;</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">hashLen =3D = calculateSignedInfoHash(NULL, &amp;size);</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">XMLChar *hash =3D new = XMLChar[size];</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">hashLen =3D = calculateSignedInfoHash(hash, &amp;size);</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial CE">Best regards,</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">Milan</FONT> </P> </BODY> </HTML> ------=_NextPart_000_007D_01C44A24.46102DC0-- From securityjoseph67@example.org Fri Jun 04 10:07:02 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 52593 invoked from network); 4 Jun 2004 10:07:02 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 4 Jun 2004 10:07:02 -0000 Received: (qmail 3326 invoked by uid 500); 4 Jun 2004 10:07:23 -0000 Delivered-To: joseph67@example.org Received: (qmail 3302 invoked by uid 500); 4 Jun 2004 10:07:22 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 3280 invoked by uid 99); 4 Jun 2004 10:07:22 -0000 Message-ID: <joseph67@example.org> Date: Fri, 04 Jun 2004 20:06:34 +1000 From: Berin Lautenbach <joseph67@example.org> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: joseph67@example.org Subject: Re: DSIGSignatur888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4sign() References: <007c01c44a13$82875dc0$ce018ac1@Majestix> In-Reply-To: <007c01c44a13$82875dc0$ce018ac1@Majestix> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Milan, It's not the most elegant code is it? :>. Having said that - the return is the size of the hash, not the size of the data being hashed. Given the SignedInfo is generally SHA-1, the size returned should be 20 bytes. (My 4096 buffer is probably overkill :>.) But you are right, I am being lazy. Cheers, Berin Milan Tomic wrote: > > I've found this line in sign() function: > > hashLen = calculateSignedInfoHash(hash, 4096); > > The size 4096 is size of buffer for SignedInfo node (after > canonicalization), but what will happen if someone have, for example, 20 > references in doc to sign and SignedInfo node will be bigger than 4096 > bytes. I belive we need one function to calculate size of SignedInfo > node or this: > > unsigned int size = 0; > hashLen = calculateSignedInfoHash(NULL, &size); > XMLChar *hash = new XMLChar[size]; > hashLen = calculateSignedInfoHash(hash, &size); > > Best regards, > Milan > From securityjoseph67@example.org Fri Jun 04 12:25:34 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 45058 invoked from network); 4 Jun 2004 12:25:34 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 4 Jun 2004 12:25:34 -0000 Received: (qmail 88602 invoked by uid 500); 4 Jun 2004 12:25:34 -0000 Delivered-To: joseph67@example.org Received: (qmail 88460 invoked by uid 500); 4 Jun 2004 12:25:33 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 88446 invoked by uid 99); 4 Jun 2004 12:25:32 -0000 From: "Milan Tomic" <joseph67@example.org> To: <joseph67@example.org> Subject: RE: DSIGSignatur888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4sign() Date: Fri, 4 Jun 2004 14:25:27 +0200 Message-ID: <009201c44a2f$04804510$ce018ac1@Majestix> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 In-Reply-To: <joseph67@example.org> X-Virus-Scanned: by joseph67@example.org X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N > Having said that - the return is the size of the hash, not > the size of > the data being hashed. I've been tracing TXFMC14n888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4readBytes() to see how you calculate buffer length, and mixed it with TXFMBas888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4readBytes() (BinInputStream methods). > Given the SignedInfo is generally SHA-1 Yes, it is allways SHA1 (HMAC, RSA, DSA) and XSEC doesn't support other, so 20 would be enough. If hash algorithm is different than SHA1 error message is: "Hash method unknown in DSIGSignatur888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4verify()" although calculateSignedInfoHash() function is beeing called from both sign() and verify(). Best regards, Milan From securityjoseph67@example.org Fri Jun 04 13:41:08 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 6276 invoked from network); 4 Jun 2004 13:41:08 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 4 Jun 2004 13:41:08 -0000 Received: (qmail 82789 invoked by uid 500); 4 Jun 2004 13:41:08 -0000 Delivered-To: joseph67@example.org Received: (qmail 82765 invoked by uid 500); 4 Jun 2004 13:41:07 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 82752 invoked by uid 99); 4 Jun 2004 13:41:07 -0000 X-Injected-Via-Gmane: http://gmane.org/ To: joseph67@example.org From: Pete <joseph67@example.org> Subject: Re: XML Security library & Websphere Date: Fri, 4 Jun 2004 12:40:19 +0000 (UTC) Lines: 133 Message-ID: <joseph67@example.org> References: <joseph67@example.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: joseph67@example.org X-Gmane-NNTP-Posting-Host: main.gmane.org User-Agent: Loom/3.14 (http://gmane.org/) X-Loom-IP: 83.161.120.155 (Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)) Sender: news <joseph67@example.org> X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Even though bouncycastle is free, I'd still like to use the IBM JCE provider in WebSphere v5. I was able to get it working with the Apache Axis samples.security (http://www.w3.org/2000/09/xmldsig#dsa-sha1) by updating the config.xml as follows: <Provider Id="IBM" Class="com.ibm.crypto.provider.IBMJCE" Info="IBM JCE Provider" ProviderURL="http://www.ibm.com/" /> i had to guess on these algorithms - there may be more...or less. i found some documentation here: http://www-1.ibm.com/servers/eserver/zseries/software/java/jcealgo.htm l http://www-1.ibm.com/servers/eserver/zseries/software/java/jce.html Maybe someone out there knows enought to make this complete. <Algorithm URI="http://www.w3.org/2001/04/xmldsig-more#md5" Description="MD5 message digest from RFC 1321" AlgorithmClass="MessageDigest" RequirementLevel="NOT RECOMMENDED" SpecificationURL="http://www.ietf.org/internet-drafts/draft-eastlake- xmldsig-uri-02.txt"> <ProviderAlgo ProviderId="IBMJCE" JCEName="MD5" /> <ProviderAlgo ProviderId="BC" JCEName="MD5" /> <ProviderAlgo ProviderId="SUN" JCEName="MD5" /> </Algorithm> <Algorithm URI="http://www.w3.org/2000/09/xmldsig#sha1" Description="SHA-1 message digest" AlgorithmClass="MessageDigest" RequirementLevel="REQUIRED"> <ProviderAlgo ProviderId="IBMJCE" JCEName="SHA1" /> <ProviderAlgo ProviderId="BC" JCEName="SHA-1" /> <ProviderAlgo ProviderId="SUN" JCEName="SHA-1" /> <ProviderAlgo ProviderId="IAIK" JCEName="SHA-1" /> <ProviderAlgo ProviderId="Cryptix" JCEName="SHA-1" /> </Algorithm> <Algorithm URI="http://www.w3.org/2000/09/xmldsig#dsa-sha1" Description="Digital Signature Algorithm with SHA-1 message digest" AlgorithmClass="Signature" RequirementLevel="REQUIRED"> <ProviderAlgo ProviderId="IBMJCE" JCEName="SHA1WithDSA" /> <ProviderAlgo ProviderId="BC" JCEName="DSA" /> <ProviderAlgo ProviderId="SUN" JCEName="DSAWithSHA1" /> <ProviderAlgo ProviderId="IAIK" JCEName="DSA" /> </Algorithm> <Algorithm URI="http://www.w3.org/2001/04/xmldsig-more#rsa- md5" Description="RSA Signature with MD5 message digest" AlgorithmClass="Signature" RequirementLevel="NOT RECOMMENDED" SpecificationURL="http://www.ietf.org/internet-drafts/draft-eastlake- xmldsig-uri-02.txt"> <ProviderAlgo ProviderId="IBMJCE" JCEName="MD5WithRSA" /> <ProviderAlgo ProviderId="BC" JCEName="MD5WithRSAEncryption" /> <ProviderAlgo ProviderId="SunRsaSign" JCEName="MD5WithRSA" /> </Algorithm> <Algorithm URI="http://www.w3.org/2000/09/xmldsig#rsa-sha1" Description="RSA Signature with SHA-1 message digest" AlgorithmClass="Signature" RequirementLevel="RECOMMENDED"> <ProviderAlgo ProviderId="IBMJCE" JCEName="SHA1withRSA" /> <ProviderAlgo ProviderId="BC" JCEName="SHA1WithRSAEncryption" /> <ProviderAlgo ProviderId="SunRsaSign" JCEName="SHA1withRSA" /> <ProviderAlgo ProviderId="IAIK" JCEName="SHA-1/RSA" /> <ProviderAlgo ProviderId="Cryptix" JCEName="SHA-1/RSA" /> </Algorithm> <Algorithm URI="http://www.w3.org/2001/04/xmldsig-more#hmac- md5" Description="Message Authentication code using MD5" AlgorithmClass="Mac" RequirementLevel="NOT RECOMMENDED" SpecificationURL="http://www.ietf.org/internet-drafts/draft-eastlake- xmldsig-uri-02.txt"> <ProviderAlgo ProviderId="IBMJCE" JCEName="HMAC-MD5" /> <ProviderAlgo ProviderId="BC" JCEName="HMACMD5" /> <ProviderAlgo ProviderId="SunJCE" JCEName="HmacMD5" /> </Algorithm> <Algorithm URI="http://www.w3.org/2000/09/xmldsig#hmac-sha1" Description="Message Authentication code using SHA1" AlgorithmClass="Mac" RequirementLevel="REQUIRED"> <ProviderAlgo ProviderId="IBMJCE" JCEName="HMAC-SHA1" /> <ProviderAlgo ProviderId="BC" JCEName="HMACSHA1" /> <ProviderAlgo ProviderId="SunJCE" JCEName="HmacSHA1" /> <ProviderAlgo ProviderId="IAIK" JCEName="HMAC/SHA" /> <ProviderAlgo ProviderId="Cryptix" JCEName="HMAC-SHA-1" /> </Algorithm> From securityjoseph67@example.org Sun Jun 06 22:57:37 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 22319 invoked from network); 6 Jun 2004 22:57:37 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 6 Jun 2004 22:57:37 -0000 Received: (qmail 69993 invoked by uid 500); 6 Jun 2004 22:57:34 -0000 Delivered-To: joseph67@example.org Received: (qmail 69939 invoked by uid 500); 6 Jun 2004 22:57:33 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 69911 invoked by uid 99); 6 Jun 2004 22:57:33 -0000 Date: 06 Jun 04 22:56:04 From: Sam Ruby <joseph67@example.org> To: joseph67@example.org Subject: [GUMP@brutus]: xml-security/xml-security failed X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N To whom it may engage... This is an automated request, but not an unsolicited one. For more information please visit http://gump.apache.org/nagged.html, and/or contact folk at joseph67@example.org. Project xml-security has an issue affecting its community integration. This issue affects 1 projects, and has been outstanding for 43 runs. Project State : 'Failed', Reason 'Build Failed' The following are affected: - wss4j : Web Services Security (WS-Security) Java Implemenatation Full details are available at: http://brutus.apache.org:8080/gump/xml-security/xml-security/index.html That said, some snippets follow: The following annotations were provided: -DEBUG- Sole jar [xmlsec.jar] identifier set to project name -INFO- Dependency on jce exists, no need to add for property lib.jce. -INFO- Enable "debug" output, due to a sequence of 42 previous errors. -INFO- Failed with reason build failed The following work was performed: http://brutus.apache.org:8080/gump/xml-security/xml-security/gump_work/build_xml-security_xml-security.html Work Name: build_xml-security_xml-security (Type: Build) State: Failed Elapsed: 0 hours, 0 minutes, 8 seconds Command Line: java -Djava.awt.headless=true -Dbuild.clonevm=true -Xbootclasspath/p:/usr/local/gump/public/workspace/xml-xerces2/java/build/xercesImpl.jar:/usr/local/gump/public/workspace/xml-xerces2/java/build/xml-apis.jar:/usr/local/gump/public/workspace/xml-xalan/java/build/xalan-unbundled.jar:/usr/local/gump/public/workspace/xml-commons/java/external/build/xml-apis.jar org.apache.tools.ant.Main -debug -Dgump.merge=/usr/local/gump/public/gump/work/merge.xml -Dbuild.sysclasspath=only -Djce.download.sha1=c1f0e975e8c8e0a0105787b249a50615b485d109 -Dlib.jce=/usr/local/gump/packages/jce/jce-jdk13-116.jar -Djce.download.md5=85c64cd754719a4bc8da7e9aa0e113fd gump [Working Directory: /usr/local/gump/public/workspace/xml-security] CLASSPATH : /usr/local/j2sdk1.4.2_04/lib/tools.jar:/usr/local/gump/public/workspace/xml-security/build/classes:/usr/local/gump/public/workspace/xml-security:/usr/local/gump/public/workspace/ant/dist/lib/ant-stylebook.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-swing.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-trax.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-junit.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-nodeps.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant.jar:/usr/local/gump/packages/jce/jce-jdk13-116.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging-api.jar:/usr/local/gump/public/workspace/dist/junit/junit.jar--------------------------------------------- [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/HexDump.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/I18n.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/IdResolver.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/IgnoreAllErrorHandler.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/JavaUtils.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/PRNG.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/RFC2253Parser.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/SignatureElementProxy.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/Version.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/X509CertificateValidator.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/XMLUtils.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/XPathFuncHereAPI.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/ResourceResolver.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/ResourceResolverException.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/ResourceResolverSpi.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverAnonymous.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverDirectHTTP.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverFragment.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/utils/resolver/implementations/ResolverXPointer.java [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/transforms/implementations/TransformC14NExclusive.java:25: package org.apache.bcel.classfile does not exist [javac] import org.apache.bcel.classfile.Node; [javac] ^ [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/Init.java:149: m_functions has private access in org.apache.xpath.compiler.FunctionTable [javac] for (int i = 0; i < FunctionTable.m_functions.length; i++) { [javac] ^ [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/Init.java:150: m_functions has private access in org.apache.xpath.compiler.FunctionTable [javac] FuncLoader loader = FunctionTable.m_functions[i]; [javac] ^ [javac] /usr/local/gump/public/workspace/xml-security/src/org/apache/xml/security/Init.java:156: m_functions has private access in org.apache.xpath.compiler.FunctionTable [javac] FunctionTable.m_functions[i] = funcHereLoader; [javac] ^ [javac] 4 errors BUILD FAILED /usr/local/gump/public/workspace/xml-security/build.xml:298: Compile failed; see the compiler error output for details. at org.apache.tools.ant.taskdefs.Javac.compile(Javac.java:938) at org.apache.tools.ant.taskdefs.Javac.execute(Javac.java:758) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275) at org.apache.tools.ant.Task.perform(Task.java:363) at org.apache.tools.ant.Target.execute(Target.java:341) at org.apache.tools.ant.Target.performTasks(Target.java:368) at org.apache.tools.ant.Project.executeTarget(Project.java:1212) at org.apache.tools.ant.Project.executeTargets(Project.java:1060) at org.apache.tools.ant.Main.runBuild(Main.java:666) at org.apache.tools.ant.Main.startAnt(Main.java:187) at org.apache.tools.ant.Main.start(Main.java:151) at org.apache.tools.ant.Main.main(Main.java:234) Total time: 7 seconds --------------------------------------------- To subscribe to this information via syndicated feeds: RSS: http://brutus.apache.org:8080/gump/xml-security/xml-security/rss.xml Atom: http://brutus.apache.org:8080/gump/xml-security/xml-security/atom.xml -- Produced by Gump 2.0.3-alpha-0002. [Run (20040606 09:00:05, brutus:brutus-public:20040606 09:00:05)] http://brutus.apache.org:8080/gump/index.html http://brutus.apache.org:8080/gump/options.html -- Apache Gump http://gump.apache.org/ [Instance: brutus] From securityjoseph67@example.org Mon Jun 07 14:48:45 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 84661 invoked from network); 7 Jun 2004 14:48:45 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 7 Jun 2004 14:48:45 -0000 Received: (qmail 88746 invoked by uid 500); 7 Jun 2004 14:48:46 -0000 Delivered-To: joseph67@example.org Received: (qmail 88725 invoked by uid 500); 7 Jun 2004 14:48:46 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 88712 invoked by uid 99); 7 Jun 2004 14:48:46 -0000 From: "Milan Tomic" <joseph67@example.org> To: <joseph67@example.org> Subject: I give up :> Date: Mon, 7 Jun 2004 16:48:19 +0200 Message-ID: <000c01c44c9e$7c88a450$ce018ac1@Majestix> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000D_01C44CAF.40117450" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal X-Virus-Scanned: by joseph67@example.org X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N This is a multi-part message in MIME format. ------=_NextPart_000_000D_01C44CAF.40117450 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I've been trying to use XSEC in Win32 DLL project, using VC6, but it is not possible. I've created Win32 DLL project and added only this line in myDLL.cpp file: #include <xsec/utils/XSECPlatformUtils.hpp> XSECPlatformUtils.hpp includes XSECDefs.hpp, and it contains those lines: #if defined (_WIN32) # if defined (_DEBUG) # include <afx.h> # include <crtdbg.h> # else # define WIN32_LEAN_AND_MEAN # include <windows.h> # endif # include <xsec/framework/XSECW32Config.hpp> #else # include <xsec/framework/XSECConfig.hpp> #endif It includes afx.h, and afx.h includes MFC. Release configuration builds, but Debug fails. I couldn't find a way to build it and I've tried everything (include MFC, use different run-times...). Best regards, Milan ------=_NextPart_000_000D_01C44CAF.40117450 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.0.4630.0"> <TITLE>I give up :&gt;</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <BR> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2 = FACE=3D"Arial CE">I've been trying to use XSEC in Win32 DLL project, = using VC6, but it is not possible. I've created Win32 DLL project and = added only this line in myDLL.cpp file:</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial CE">#include = &lt;xsec/utils/XSECPlatformUtils.hpp&gt;</FONT> </P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2 = FACE=3D"Arial CE">XSECPlatformUtils.hpp includes XSECDefs.hpp, and it = contains those lines:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial CE">#if defined (_WIN32)</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if defined (_DEBUG)</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include &lt;afx.h&gt;</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include = &lt;crtdbg.h&gt;</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; define = WIN32_LEAN_AND_MEAN</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include = &lt;windows.h&gt;</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; endif</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include = &lt;xsec/framework/XSECW32Config.hpp&gt;</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">#else</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial = CE">#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include = &lt;xsec/framework/XSECConfig.hpp&gt;</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">#endif</FONT> </P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2 = FACE=3D"Arial CE">It includes afx.h, and afx.h includes MFC. Release = configuration builds, but Debug fails. I couldn't find a way to build it = and I've tried everything (include MFC, use different = run-times...).</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Arial CE">Best regards,</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial CE">Milan</FONT> </P> </BODY> </HTML> ------=_NextPart_000_000D_01C44CAF.40117450-- From securityjoseph67@example.org Mon Jun 07 23:28:22 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 20843 invoked from network); 7 Jun 2004 23:28:22 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 7 Jun 2004 23:28:22 -0000 Received: (qmail 93540 invoked by uid 500); 7 Jun 2004 23:28:23 -0000 Delivered-To: joseph67@example.org Received: (qmail 93439 invoked by uid 500); 7 Jun 2004 23:28:22 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 93312 invoked by uid 99); 7 Jun 2004 23:28:21 -0000 X-MimeOLE: Produced By Microsoft Exchange V6.0.6375.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C44CC2.D9471593" Subject: questions about xml signature in java Date: Mon, 7 Jun 2004 12:08:42 -0700 Message-ID: <joseph67@example.org> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: questions about xml signature in java Thread-Index: AcRMwtkdjvOFESoHS1eUhtnQm6LJ1g== From: "Jinsong Lin" <joseph67@example.org> To: <joseph67@example.org> X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N This is a multi-part message in MIME format. ------_=_NextPart_001_01C44CC2.D9471593 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I am using java xml security 1.1 to sign a simple XML document with c14n exclusive canonicalization. The source file is as follow:=20 - <file:///C:\sample\signatureInput.xml##> < =20 <n<n0:foo xmlns:n0=3D"http://foo.com"> < <n1:bar xmlns:n1=3D"http://bar.com" />=20 </n0:foo> =20 And the signed output is as follow:=20 =20 <n0:foo xmlns=3D"" xmlns:n0=3D"http://foo.com"> <n1:bar xmlns=3D"" xmlns:n0=3D"http://foo.com" xmlns:n1=3D"http://bar.com"/> <ds:Signature xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"> <ds:SignedInfo xmlns=3D"" = xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"> <ds:CanonicalizationMethod Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#WithComments" = xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"/> <ds:SignatureMethod Algorithm=3D"http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"/> <ds:Reference URI=3D"" xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" = xmlns:n0=3D"http://foo.com"> <ds:Transforms xmlns=3D"" = xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"> <ds:Transform Algorithm=3D"http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"/> <ds:Transform Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#WithComments" = xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"/> </ds:Transforms> <ds:DigestMethod Algorithm=3D"http://www.w3.org/2000/09/xmldsig#sha1" xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com"/> <ds:DigestValue xmlns=3D"" = xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com">V7RkxpcANtvovcgSrutRYL3v8xQ=3D</ds:DigestValu= e> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue xmlns=3D"" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" xmlns:n0=3D"http://foo.com">J6jPWF7JUuFz4z8FaDQR6vN9Uw1h3yyBcXm8slhF1kDyU= I w7qr9daQ=3D=3D</ds:SignatureValue> </ds:Signature> </n0:foo> =20 >From the output, it looks like that the signature method has changed the original source file (and the associated in memory DOM tree) by adding namespace definition xmlns=3D"" into element n1:foo and n2:bar, and also the namespace definition xmlns:n0=3D"http://foo.com <http://foo.com/> " to n2:bar. I understand that part of the signing process is to canonicalize the document, but original source (and its associated DOM) should not be changed at the end of the signing (other than being added a Singnature element). The addition of additional namespace definitions has caused the failure of verification when a signed document A is embedded into another document B. After B is signed, the namespace definition in A has also changed and signature verification is failed. Is there anyway to let the signing method to not change the original DOM tree (other than adding the Signature element)?=20 =20 Thanks,=20 =20 Jinsong =20 ------_=_NextPart_001_01C44CC2.D9471593 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 10 (filtered)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} span.EmailStyle17 {font-family:Arial; color:windowtext;} span.m1 {color:blue;} span.pi1 {color:blue;} span.t1 {color:#990000;} span.ns1 {color:red;} span.b1 {font-family:"Courier New"; color:red; font-weight:bold; text-decoration:none none;} span.tx1 {font-weight:bold;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --> </style> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>I am using java xml security 1.1 to sign a simple XML document with c14n exclusive canonicalization. The source file is as = follow: </span></font></p> <p class=3DMsoNormal style=3D'text-indent:-24.0pt'><font size=3D2 = face=3DVerdana><span style=3D'font-size:10.0pt;font-family:Verdana'><a href=3D"file:///C:\sample\signatureInput.xml##"><b><font color=3Dred face=3D"Courier New"><span style=3D'font-family:"Courier = New";color:red;font-weight: bold'>-</span></font></b></a> <span class=3Dm1><font = color=3Dblue>&lt;&nbsp; </font></span></span></font></p> <p class=3DMsoNormal style=3D'text-indent:-24.0pt'><span = class=3Dm1><font size=3D2 color=3Dblue face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana'>&lt;</span></font></span><= span class=3Dt1><font size=3D2 color=3D"#990000" face=3DVerdana><span = style=3D'font-size:10.0pt; font-family:Verdana'>n&lt;n0:foo</span></font></span><span = class=3Dns1><font size=3D2 color=3Dred face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana'> xmlns:n0</span></font></span><span class=3Dm1><font size=3D2 = color=3Dblue face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana'>=3D&quot;</span></font></s= pan><b><font size=3D2 color=3Dred face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana; color:red;font-weight:bold'>http://foo.com</span></font></b><span = class=3Dm1><font size=3D2 color=3Dblue face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana'>&quot;&gt;</span></font></= span></p> <p class=3DMsoNormal style=3D'text-indent:-24.0pt'><span = class=3Db1><b><font size=3D2 color=3Dred face=3D"Courier New"><span = style=3D'font-size:10.0pt'>&nbsp;</span></font></b></span><font size=3D2 face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana'> <span class=3Dm1><font = color=3Dblue>&lt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n= bsp;&nbsp; &lt;</font></span><span class=3Dt1><font color=3D"#990000">n1:bar</font></span> <span = class=3Dns1><font color=3Dred>xmlns:n1</font></span><span class=3Dm1><font = color=3Dblue>=3D&quot;</font></span><b><font color=3Dred><span = style=3D'color:red;font-weight:bold'>http://bar.com</span></font></b><spa= n class=3Dm1><font color=3Dblue>&quot; /&gt;</font></span> = </span></font></p> <p class=3DMsoNormal style=3D'text-indent:-12.0pt'><span = class=3Db1><b><font size=3D2 color=3Dred face=3D"Courier New"><span = style=3D'font-size:10.0pt'>&nbsp;</span></font></b></span><font size=3D2 face=3DVerdana><span = style=3D'font-size:10.0pt;font-family:Verdana'> <span class=3Dm1><font color=3Dblue>&lt;/</font></span><span class=3Dt1><font color=3D"#990000">n0:foo</font></span><span class=3Dm1><font = color=3Dblue>&gt;</font></span></span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&nbsp;</span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>And the signed output is as follow: = </span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&nbsp;</span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&lt;n0:foo xmlns=3D&quot;&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;</span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&nbsp;&nbsp; = &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;n1:bar xmlns=3D&quot;&quot; xmlns:n0=3D&quot;http://foo.com&quot; xmlns:n1=3D&quot;http://bar.com&quot;/&gt;</span></font></p> <p class=3DMsoNormal style=3D'text-indent:.5in'><font size=3D2 = face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:Signature = xmlns=3D&quot;&quot; = xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:SignedInfo = xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.0in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:CanonicalizationMetho= d Algorithm=3D&quot;http://www.w3.org/2001/10/xml-exc-c14n#WithComments&quo= t; xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;/&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.0in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:SignatureMethod Algorithm=3D&quot;http://www.w3.org/2000/09/xmldsig#dsa-sha1&quot; = xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;/&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.0in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:Reference URI=3D&quot;&quot; xmlns=3D&quot;&quot; = xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:Transforms = xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:Transform Algorithm=3D&quot;http://www.w3.org/2000/09/xmldsig#enveloped-signature&q= uot; xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;/&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:Transform Algorithm=3D&quot;http://www.w3.org/2001/10/xml-exc-c14n#WithComments&quo= t; xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;/&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;/ds:Transforms&gt;</span= ></font></p> <p class=3DMsoNormal style=3D'margin-left:1.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:DigestMethod Algorithm=3D&quot;http://www.w3.org/2000/09/xmldsig#sha1&quot; = xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;/&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:DigestValue = xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;V7RkxpcANtvovcgSrutRYL3v8xQ=3D&l= t;/ds:DigestValue&gt;</span></font></p> <p class=3DMsoNormal style=3D'margin-left:1.0in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;/ds:Reference&gt;</span>= </font></p> <p class=3DMsoNormal style=3D'margin-left:.5in;text-indent:.5in'><font = size=3D2 face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial'>&lt;/ds:SignedInfo&gt;</span= ></font></p> <p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D2 = face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'>&lt;ds:SignatureValue = xmlns=3D&quot;&quot; xmlns:ds=3D&quot;http://www.w3.org/2000/09/xmldsig#&quot; xmlns:n0=3D&quot;http://foo.com&quot;&gt;J6jPWF7JUuFz4z8FaDQR6vN9Uw1h3yyB= cXm8slhF1kDyUIw7qr9daQ=3D=3D&lt;/ds:SignatureValue&gt;</span></font></p> <p class=3DMsoNormal style=3D'text-indent:.5in'><font size=3D2 = face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'>&lt;/ds:Signature&gt;</span>= </font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&lt;/n0:foo&gt;</span></font></p> <p class=3DMsoNormal style=3D'text-indent:-12.0pt'><font size=3D2 = face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'>&nbsp;&nbsp;</span></font></= p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>From the output, it looks like that the signature = method has changed the original source file (and the associated in memory DOM tree) = by adding namespace definition xmlns=3D&#8221;&#8221; into element n1:foo = and n2:bar, and also the namespace definition &nbsp;xmlns:n0=3D&#8221;<a href=3D"http://foo.com/">http://foo.com</a>&#8221; to n2:bar. &nbsp;I = understand that part of the signing process is to canonicalize the document, but = original source (and its associated DOM) should not be changed at the end of the = signing (other than being added a Singnature element).&nbsp; &nbsp;&nbsp;The = addition of additional namespace definitions has caused the failure of = verification when a signed document A is embedded into another document B. After B is = signed, the namespace definition in A has also changed and signature verification is failed.&nbsp; Is there anyway to let the signing method to not change = the original DOM tree (other than adding the Signature element)? = </span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&nbsp;</span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>Thanks, </span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&nbsp;</span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>Jinsong</span></font></p> <p class=3DMsoNormal><font size=3D2 face=3DArial><span = style=3D'font-size:10.0pt; font-family:Arial'>&nbsp;</span></font></p> </div> </body> </html> =00 ------_=_NextPart_001_01C44CC2.D9471593-- From securityjoseph67@example.org Tue Jun 08 06:35:44 2004 Return-Path: <securityjoseph67@example.org> Delivered-To: joseph67@example.org Received: (qmail 55053 invoked from network); 8 Jun 2004 06:35:44 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 8 Jun 2004 06:35:44 -0000 Received: (qmail 98886 invoked by uid 500); 8 Jun 2004 06:35:54 -0000 Delivered-To: joseph67@example.org Received: (qmail 98849 invoked by uid 500); 8 Jun 2004 06:35:53 -0000 Mailing-List: contact joseph67@example.org; run by ezmlm Precedence: bulk List-Post: <mailto:joseph67@example.org> List-Help: <mailto:joseph67@example.org> List-Unsubscribe: <mailto:joseph67@example.org> List-Subscribe: <mailto:joseph67@example.org> Reply-To: joseph67@example.org Delivered-To: mailing list joseph67@example.org Received: (qmail 98834 invoked by uid 99); 8 Jun 2004 06:35:53 -0000 Message-ID: <joseph67@example.org> Date: Tue, 08 Jun 2004 08:35:46 +0200 From: Raul Benito <joseph67@example.org> User-Agent: Mozilla Thunderbird 0.6 (X11/20040505) X-Accept-Language: en-us, en MIME-Version: 1.0 To: joseph67@example.org Subject: Re: questions about xml signature in java References: <joseph67@example.org> In-Reply-To: <joseph67@example.org> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Virus-Scanned: by AMaViS perl-11 SZ CT ATT ML UV X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Jinsong Lin wrote: > I am using java xml security 1.1 to sign a simple XML document with > c14n exclusive canonicalization. The source file is as follow: > > *-* <file:///C:%5Csample%5CsignatureInput.xml##> < > > <n<n0:foo xmlns:n0="*http://foo.com*"> > > * * < <n1:bar xmlns:n1="*http://bar.com*" /> > > * * </n0:foo> > > And the signed output is as follow: > > <n0:foo xmlns="" xmlns:n0="http://foo.com"> > > <n1:bar xmlns="" xmlns:n0="http://foo.com" xmlns:n1="http://bar.com"/> > > <ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"> > > <ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"> > > <ds:CanonicalizationMethod > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" > xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"/> > > <ds:SignatureMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" > xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:n0="http://foo.com"/> > > <ds:Reference URI="" xmlns="" > xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:n0="http://foo.com"> > > <ds:Transforms xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"> > > <ds:Transform > Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" > xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"/> > > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" > xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"/> > > </ds:Transforms> > > <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" > xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com"/> > > <ds:DigestValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com">V7RkxpcANtvovcgSrutRYL3v8xQ=</ds:DigestValue> > > </ds:Reference> > > </ds:SignedInfo> > > <ds:SignatureValue xmlns="" > xmlns:ds="http://www.w3.org/2000/09/xmldsig#" > xmlns:n0="http://foo.com">J6jPWF7JUuFz4z8FaDQR6vN9Uw1h3yyBcXm8slhF1kDyUIw7qr9daQ==</ds:SignatureValue> > > </ds:Signature> > > </n0:foo> > > From the output, it looks like that the signature method has changed > the original source file (and the associated in memory DOM tree) by > adding namespace definition xmlns="" into element n1:foo
{'source': 'Apache Software Foundation Public Mail Archives'}