savonrb / akami / 35146282717

91%

push

github

Fix signature verification for multi-token documents and signed attachments

Reimplements the functional core of #48 on current main.

- Select the signer certificate via ds:Signature/ds:KeyInfo/
  wsse:SecurityTokenReference/wsse:Reference when a document carries
  more than one BinarySecurityToken, instead of taking the first token.
  Single-token documents behave exactly as before.
- Support digest verification of cid: attachment references through a
  new VerifySignature.new(xml, decrypted_attachments: { id => content })
  keyword argument. Missing attachments raise MissingDecryptedAttachment,
  handled by valid?/verify! like the other verification errors.
- Read each Reference's DigestValue directly from the Reference node
  instead of re-querying the document by element Id, so non-fragment
  (cid:) references verify correctly.
- Recognize the http://www.w3.org/2001/04/xmlenc#sha256 digest algorithm.

Backwards compatible: the new keyword argument defaults to {}, and
single-token documents follow the previous code path.

16 of 21 new or added lines in 1 file covered. (76.19%)

295 of 324 relevant lines covered (91.05%)

21.62 hits per line