Repository navigation
test_sign_case5 fails with xmlsec 1.2.36 #244
Description
- xmlsec: 1.2.36
- libxmlsec1: 1.2.36
- libxml2: 2.10.3
- pkg-config --cflags xmlsec1:
-DXMLSEC_CRYPTO_DYNAMIC_LOADING=1 -D__XMLSEC_FUNCTION__=__func__ -DXMLSEC_NO_SIZE_T -DXMLSEC_NO_MD5=1 -DXMLSEC_NO_GOST=1 -DXMLSEC_NO_GOST2012=1 -DXMLSEC_DL_LIBLTDL=1 -I/usr/include/xmlsec1 -I/usr/include/libxml2
self = <tests.test_ds.TestSignContext testMethod=test_sign_case5>
def test_sign_case5(self):
"""Should sign a file using a dynamicaly created template, key from PEM file and an X509 certificate."""
root = self.load_xml("sign5-in.xml")
sign = xmlsec.template.create(root, consts.TransformExclC14N, consts.TransformRsaSha1)
self.assertIsNotNone(sign)
root.append(sign)
ref = xmlsec.template.add_reference(sign, consts.TransformSha1)
xmlsec.template.add_transform(ref, consts.TransformEnveloped)
ki = xmlsec.template.ensure_key_info(sign)
x509 = xmlsec.template.add_x509_data(ki)
xmlsec.template.x509_data_add_subject_name(x509)
xmlsec.template.x509_data_add_certificate(x509)
xmlsec.template.x509_data_add_ski(x509)
x509_issuer_serial = xmlsec.template.x509_data_add_issuer_serial(x509)
xmlsec.template.x509_issuer_serial_add_issuer_name(x509_issuer_serial, 'Test Issuer')
xmlsec.template.x509_issuer_serial_add_serial_number(x509_issuer_serial, '1')
ctx = xmlsec.SignatureContext()
ctx.key = xmlsec.Key.from_file(self.path("rsakey.pem"), format=consts.KeyDataFormatPem)
self.assertIsNotNone(ctx.key)
ctx.key.load_cert_from_file(self.path('rsacert.pem'), consts.KeyDataFormatPem)
ctx.key.name = 'rsakey.pem'
self.assertEqual("rsakey.pem", ctx.key.name)
ctx.sign(sign)
> self.assertEqual(self.load_xml("sign5-out.xml"), root)
tests/test_ds.py:186:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
tests/base.py:128: in assertXmlEqual
self.assertXmlEqual(c1, c2)
tests/base.py:128: in assertXmlEqual
self.assertXmlEqual(c1, c2)
tests/base.py:128: in assertXmlEqual
self.assertXmlEqual(c1, c2)
tests/base.py:128: in assertXmlEqual
self.assertXmlEqual(c1, c2)
tests/base.py:118: in assertXmlEqual
self.fail('text: {!r} != {!r}. {}'.format(first.text, second.text, msg))
E AssertionError: text: 'JIQs8tRZIGKLLlyGkKOqMLonGpw=' != None.
Activity
kapouer commentedon Jan 4, 2023
More precisely,
xmlsec.template.x509_data_add_ski(x509)does not fill<X509SKI>:kapouer commentedon Jan 4, 2023
Compiled with PYXMLSEC_ENABLE_DEBUG=1 and there is something odd logged right on the test:
Full test log:
test.log
kapouer commentedon Jan 5, 2023
Could it be related to openssl 3.0 ?
kapouer commentedon Jan 6, 2023
Update: this test is expected to fail in debian bookworm, since libxmlsec1 in debian bookworm is also expecting this test to fail.
nbastin commentedon Feb 12, 2023
I ran into an issue with a signed document of this format, and it turns out the problem (at least in our case, and it might also be here), is that there is a spurious newline in the document at the end of the X509Certificate tag data (the close tag should be on the same line as the end of the data, not on the next line). I have no idea what is triggering this change in generation, but if you remove the newline the document is properly handled.
mgorny commentedon Feb 17, 2023
I don't think so.
I've verified that the test passes if the extension is built against libxmlsec 1.2.34 or older, and fails with 1.2.36 and .37. I haven't been able to test 1.2.35 since it fails to build.
tdivis commentedon Mar 21, 2023
I diffed the expected and actulat xml in the test and difference is, that
<X509SubjectName>and<X509SKI>are empty for xmlsec>=1.2.36, and when I looked to thegit diff xmlsec-1_2_33..xmlsec-1_2_36i found them newly marked as "DEPRECATED", so it's probably intended change.I will try to make change of the test expected XML depending on version of libxmlsec1.
Fix xmlsec#244 - Fix failing test with libxmlsec-1.2.36, also make li…
Fix xmlsec#244 - Fix failing test with libxmlsec-1.2.36, also make li…
Fix xmlsec#244 - Fix failing test with libxmlsec-1.2.36, also make li…
Fix xmlsec#244 - Fix failing test with libxmlsec-1.2.36, also make li…
upgpkg: python-xmlsec 1.3.13-3: Rebuild against Python 3.11.
upgpkg: python-xmlsec 1.3.13-3: Rebuild against Python 3.11.
Fix xmlsec#244 - Fix failing test with libxmlsec-1.2.36, also make li…
Fix xmlsec#244 - Fix failing test with libxmlsec-1.2.36, also make li…