hanko_xml 0.1.0-aarch64-linux → 0.2.0-aarch64-linux

data/lib/hanko_xml/xades.rb

@@ -12,6 +12,10 @@ module HankoXml
   module Xades
     NS = "http://uri.etsi.org/01903/v1.3.2#"
 
+    # XAdES 1.4.1 (EN 319 132-1), the namespace of ArchiveTimeStamp and
+    # TimeStampValidationData (#169).
+    NS141 = "http://uri.etsi.org/01903/v1.4.1#"
+
     # Earlier XAdES namespaces (TS 101 903 v1.1.1, v1.2.2) that Xades::Verifier
     # also reads (#86). Xades::Signer writes only NS.
     LEGACY_NAMESPACES = %w[http://uri.etsi.org/01903/v1.2.2# http://uri.etsi.org/01903/v1.1.1#].freeze
@@ -70,8 +74,8 @@ module HankoXml
     end
 
     # The authenticated view of a verified <xades:SignedProperties>
-    # (Xades::Verification#signed_properties). Unsigned properties
-    # (timestamps, validation data) are never read.
+    # (Xades::Verification#signed_properties). Timestamps are
+    # Xades::Verification#signature_timestamps (#163).
     SignedProperties = Struct.new(:signing_time, :signature_policy, :claimed_roles, :data_object_formats,
                                   keyword_init: true) do
       def initialize(**)
@@ -88,10 +92,17 @@ module HankoXml
     # certificate:), and optionally SignaturePolicyIdentifier, SignerRoleV2
     # and DataObjectFormat.
     #
-    # Always builds a new <Signature> (template: :build). Timestamps and
-    # validation data (XAdES-T/LT/LTA) are separate: #81, #82.
+    # With timestamper:, a XAdES-T signature (#162): an RFC 3161 token over
+    # the canonicalized <ds:SignatureValue> in a <xades:SignatureTimeStamp>.
+    #
+    # With validation_data: as well, XAdES-LT (#167): CertificateValues and
+    # RevocationValues after the SignatureTimeStamp. Xades::Augmenter adds
+    # either to a signature that already exists.
+    #
+    # Always builds a new <Signature> (template: :build).
     class Signer < HankoXml::Signer
-      attr_reader :signing_time, :signature_policy, :claimed_roles, :data_object_format
+      attr_reader :signing_time, :signature_policy, :claimed_roles, :data_object_format,
+                  :timestamper, :timestamp_canonicalization_method, :validation_data
 
       # @param certificate [Key, OpenSSL::X509::Certificate, String, Pathname] Required: SigningCertificateV2
       #   commits to it.
@@ -102,9 +113,18 @@ module HankoXml
       #   of this Signer's own references, which get an Id when they have none.
       # @param signature_id [String, nil] The <Signature> Id; generated when nil, since QualifyingProperties
       #   targets it.
+      # @param timestamper [#call, nil] Called with a DER RFC 3161 TimeStampReq, returns the TSA's DER
+      #   TimeStampResp. The library never opens a connection: the callable owns the TSA exchange.
+      # @param timestamp_digest_method [Symbol, nil] The imprint digest; nil means digest_method:.
+      # @param timestamp_canonicalization_method [Symbol] How <ds:SignatureValue> is canonicalized for the
+      #   imprint.
+      # @param validation_data [ValidationData, Hash, nil] Certificates, CRLs and OCSP responses to embed
+      #   (XAdES-LT); needs timestamper:, since B-LT builds on B-T.
       # All other keywords are {HankoXml::Signer}'s.
       def initialize(certificate: nil, signing_time: nil, signature_policy: nil, claimed_roles: [],
-                     data_object_format: nil, signature_id: nil, template: :build, **options, &block)
+                     data_object_format: nil, signature_id: nil, template: :build, timestamper: nil,
+                     timestamp_digest_method: nil, timestamp_canonicalization_method: :exc_c14n, validation_data: nil,
+                     **options, &block)
         unless template.to_sym == :build
           raise HankoXml::ConfigurationError,
                 "template: #{template.inspect} is not supported for XAdES; it always builds a new <Signature>"
@@ -117,6 +137,14 @@ module HankoXml
         @signature_policy = coerce_signature_policy(signature_policy)
         @claimed_roles = Array(claimed_roles).map { |role| role.to_s.dup.freeze }.freeze
         @data_object_format = coerce_data_object_format(data_object_format)
+        SignatureTimeStamper.check_timestamper!(timestamper)
+        @timestamper = timestamper
+        @timestamp_digest_method = timestamp_digest_method
+        @timestamp_canonicalization_method = timestamp_canonicalization_method
+        @validation_data = ValidationData.coerce(validation_data)
+        if @validation_data && !timestamper
+          raise HankoXml::ConfigurationError, "validation_data: needs timestamper: (XAdES-LT builds on XAdES-T)"
+        end
 
         super(certificate: certificate, signature_id: signature_id || "xades-#{SecureRandom.hex(8)}",
               template: :build, **options, &block)
@@ -142,8 +170,37 @@ module HankoXml
         "#{signature_id}-signedprops"
       end
 
+      # The imprint digest: timestamp_digest_method:, or else digest_method:.
+      def timestamp_digest_method
+        @timestamp_digest_method || digest_method
+      end
+
+      def signature_timestamp_id
+        "#{signature_id}-sigts"
+      end
+
+      def to_h
+        super.merge(signing_time: signing_time, signature_policy: signature_policy, claimed_roles: claimed_roles,
+                    data_object_format: data_object_format, timestamper: timestamper,
+                    timestamp_digest_method: timestamp_digest_method,
+                    timestamp_canonicalization_method: timestamp_canonicalization_method,
+                    validation_data: validation_data)
+      end
+
       private
 
+      # xmlsec has signed; before the signed values reach the caller's
+      # document, obtain the timestamp over the new SignatureValue. A failure
+      # raises before anything is written back.
+      def write_back_signature(doc, signed_bytes, index, caller_sig_node)
+        token = timestamper && SignatureTimeStamper.new(self).token(signed_bytes, index)
+        super
+        return unless token
+
+        caller_sig_node.at_xpath(SignatureTimeStamper::ENCAPSULATED_XPATH, "ds" => HankoXml::NS["ds"], "xades" => NS)
+                       .content = [token].pack("m0")
+      end
+
       def signed_properties_reference
         HankoXml::Reference.new(uri: "##{signed_properties_id}", type: SIGNED_PROPERTIES_TYPE,
                                 transforms: [:exc_c14n], digest_method: digest_method)
@@ -179,6 +236,10 @@ module HankoXml
       # Checked with the key material, after the block may have set certificate:.
       def check_key_material!
         super
+        if timestamper
+          SignatureTimeStamper.check_algorithms!(policy, digest: timestamp_digest_method,
+                                                         canonicalization: timestamp_canonicalization_method)
+        end
         return if certificate.is_a?(HankoXml::Key) && certificate.certificate?
 
         raise HankoXml::ConfigurationError, "XAdES needs certificate:, which SigningCertificateV2 commits to"
@@ -207,6 +268,7 @@ module HankoXml
 
         build_signature_properties(xades(signed, "SignedSignatureProperties"))
         build_data_object_properties(signed) if @signer.data_object_format
+        build_unsigned_properties(qualifying) if @signer.timestamper
         object
       end
 
@@ -247,6 +309,26 @@ module HankoXml
         hash.add_child(element("DigestValue")).content = policy.digest_value
       end
 
+      # SignatureTimeStamp, then any validation data (#167).
+      def build_unsigned_properties(qualifying)
+        unsigned = xades(xades(qualifying, "UnsignedProperties"), "UnsignedSignatureProperties")
+        build_signature_timestamp(unsigned)
+        @signer.validation_data&.append_to(unsigned, @xades_ns)
+      end
+
+      # The SignatureTimeStamp skeleton: the CanonicalizationMethod is in the
+      # document before signing, so xmlsec reads it to canonicalize the
+      # SignatureValue (#161), as the verifier will. No Reference covers
+      # UnsignedProperties, so filling EncapsulatedTimeStamp afterwards
+      # changes nothing signed.
+      def build_signature_timestamp(unsigned)
+        timestamp = xades(unsigned, "SignatureTimeStamp")
+        timestamp["Id"] = @signer.signature_timestamp_id
+        method = timestamp.add_child(element("CanonicalizationMethod"))
+        method["Algorithm"] = HankoXml::Algorithms.uri_for(:canonicalization, @signer.timestamp_canonicalization_method)
+        xades(timestamp, "EncapsulatedTimeStamp")
+      end
+
       def build_data_object_properties(signed)
         properties = xades(signed, "SignedDataObjectProperties")
         format = @signer.data_object_format
@@ -284,4 +366,9 @@ module HankoXml
   end
 end
 
+require_relative "xades/locator"
+require_relative "xades/timestamp"
+require_relative "xades/validation_data"
+require_relative "xades/augmenter"
+require_relative "xades/long_term"
 require_relative "xades/verifier"

data/sig/hanko_xml/native.rbs

@@ -8,5 +8,7 @@ module HankoXml
     def self.sign: (String xml_bytes, String key_pem, Array[String] cert_pems, Array[String] id_attributes, Integer index) -> String
     def self.scan: (String xml_bytes, Array[String] id_attributes, bool strict) -> Hash[Symbol, untyped]
     def self.validate_schema: (String xml_bytes, Integer index, String xsd_path) -> Array[String]
+    def self.reference_data: (String xml_bytes, Array[String] trusted_pems, Array[String] id_attributes, Integer index, Array[[String, String]] referenced_documents, bool allow_xpath_filter2) -> Array[String?]
+    def self.canonicalize: (String xml_bytes, Integer index, Array[[String, String, Integer?]] target_path, Array[[String, String, Integer?]] method_path) -> String
   end
 end

data/sig/hanko_xml/xades.rbs

@@ -1,6 +1,7 @@
 module HankoXml
   module Xades
     NS: String
+    NS141: String
     LEGACY_NAMESPACES: Array[String]
     NAMESPACES: Array[String]
     SIGNED_PROPERTIES_TYPE: String
@@ -23,11 +24,19 @@ module HankoXml
       def initialize: (?mime_type: String?, ?description: String?, ?encoding: String?) -> void
     end
 
+    # Takes a DER TimeStampReq, returns the TSA's DER TimeStampResp (#162).
+    interface _Timestamper
+      def call: (String request_der) -> String
+    end
+
     class Signer < HankoXml::Signer
       attr_reader signing_time: Time?
       attr_reader signature_policy: (SignaturePolicy | :implied)?
       attr_reader claimed_roles: Array[String]
       attr_reader data_object_format: DataObjectFormat?
+      attr_reader timestamper: _Timestamper?
+      attr_reader timestamp_canonicalization_method: Symbol
+      attr_reader validation_data: ValidationData?
 
       def initialize: (
         ?certificate: (Key | OpenSSL::X509::Certificate | String | _ToPath)?,
@@ -37,10 +46,52 @@ module HankoXml
         ?data_object_format: (DataObjectFormat | Hash[Symbol, untyped])?,
         ?signature_id: String?,
         ?template: Symbol,
+        ?timestamper: _Timestamper?,
+        ?timestamp_digest_method: Symbol?,
+        ?timestamp_canonicalization_method: Symbol,
+        ?validation_data: (ValidationData | Hash[Symbol, untyped])?,
         **untyped
       ) ?{ (self) -> void } -> void
 
       def signed_properties_id: () -> String
+      def signature_timestamp_id: () -> String
+      def timestamp_digest_method: () -> Symbol
+    end
+
+    # XAdES-LT validation material (#167). Embedded, never trusted.
+    class ValidationData
+      attr_reader certificates: Array[OpenSSL::X509::Certificate]
+      attr_reader crls: Array[OpenSSL::X509::CRL]
+      attr_reader ocsp_responses: Array[OpenSSL::OCSP::Response]
+
+      def initialize: (
+        ?certificates: Array[OpenSSL::X509::Certificate | String | Key],
+        ?crls: Array[OpenSSL::X509::CRL | String],
+        ?ocsp_responses: Array[OpenSSL::OCSP::Response | String]
+      ) -> void
+      def self.coerce: ((ValidationData | Hash[Symbol, untyped])? value) -> ValidationData?
+    end
+
+    # Adds a SignatureTimeStamp and XAdES-LT validation data to an existing signature (#167).
+    class Augmenter
+      attr_reader timestamper: _Timestamper?
+      attr_reader timestamp_digest_method: Symbol
+      attr_reader timestamp_canonicalization_method: Symbol
+      attr_reader validation_data: ValidationData?
+      attr_reader archive_timestamp: bool
+      attr_reader archive_canonicalization_method: Symbol
+      attr_reader policy: Policy
+
+      def initialize: (
+        ?timestamper: _Timestamper?,
+        ?timestamp_digest_method: Symbol,
+        ?timestamp_canonicalization_method: Symbol,
+        ?validation_data: (ValidationData | Hash[Symbol, untyped])?,
+        ?archive_timestamp: bool,
+        ?archive_canonicalization_method: Symbol,
+        ?policy: Policy
+      ) -> void
+      def augment: (untyped source, ?signature: Integer?) -> SignedDocument
     end
   end
 end
@@ -57,12 +108,51 @@ module HankoXml
       attr_reader data_object_formats: Array[Hash[Symbol, String?]]
     end
 
+    class SignatureTimeStamp
+      attr_reader id: String?
+      attr_reader time: Time
+      attr_reader serial_number: Integer
+      attr_reader tsa_certificate: OpenSSL::X509::Certificate?
+      attr_reader digest_method: String
+      attr_reader policy_id: String?
+    end
+
+    # The revocation evidence a chain certificate passed with (#168).
+    class RevocationStatus
+      attr_reader certificate: OpenSSL::X509::Certificate
+      attr_reader source: :ocsp | :crl
+      attr_reader issued_at: Time
+      attr_reader status: :good | :revoked_later
+    end
+
+    # A passed XAdES-LT validation (#168).
+    class LongTermValidation
+      attr_reader time: Time
+      attr_reader certificate_chain: Array[OpenSSL::X509::Certificate]
+      attr_reader revocation: Array[RevocationStatus]
+    end
+
     class Verification < HankoXml::Verification
       attr_reader signed_properties: SignedProperties?
+      attr_reader signature_timestamps: Array[SignatureTimeStamp]?
+      attr_reader long_term_validation: LongTermValidation?
+      attr_reader archive_timestamps: Array[SignatureTimeStamp]?
+      def timestamp_time: () -> Time?
     end
 
     class Verifier < HankoXml::Verifier
-      def initialize: (?signature_policy: (SignaturePolicy | Hash[Symbol, untyped] | :implied)?, **untyped) -> void
+      TIMESTAMP_MODES: Array[Symbol]
+      LONG_TERM_MODES: Array[Symbol]
+
+      def initialize: (
+        ?signature_policy: (SignaturePolicy | Hash[Symbol, untyped] | :implied)?,
+        ?timestamps: :verify | :require | :ignore,
+        ?tsa_store: OpenSSL::X509::Store?,
+        ?tsa_certificates: Array[OpenSSL::X509::Certificate | String | Key]?,
+        ?long_term: (:verify | :require | :ignore)?,
+        ?revocation_grace: Numeric,
+        **untyped
+      ) -> void
       def verify: (untyped xml) -> Verification
       def verify_all: (untyped xml) -> Array[Verification]
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hanko_xml
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: aarch64-linux
 authors:
 - Danimar Ribeiro
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-10-15 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies: []
 description: hanko_xml signs and verifies XML-DSig signatures by binding to libxmlsec1
   through a Rust extension built with Magnus and rb-sys. It works with Nokogiri documents
@@ -50,6 +50,11 @@ files:
 - lib/hanko_xml/verifier.rb
 - lib/hanko_xml/version.rb
 - lib/hanko_xml/xades.rb
+- lib/hanko_xml/xades/augmenter.rb
+- lib/hanko_xml/xades/locator.rb
+- lib/hanko_xml/xades/long_term.rb
+- lib/hanko_xml/xades/timestamp.rb
+- lib/hanko_xml/xades/validation_data.rb
 - lib/hanko_xml/xades/verifier.rb
 - lib/hanko_xml/xml.rb
 - lib/hanko_xml/xmldsig-core-schema.xsd