hanko_xml 0.1.0-aarch64-linux

data/lib/hanko_xml/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module HankoXml
+  VERSION = "0.1.0"
+end

data/lib/hanko_xml/xades/verifier.rb

@@ -0,0 +1,319 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "time"
+
+module HankoXml
+  module Xades
+    # A {HankoXml::Verification} that also carries the XAdES signed
+    # properties. #valid?, #signed? and #at_signed are false/raise whenever
+    # the XAdES checks failed, not only when XML-DSig did.
+    class Verification < HankoXml::Verification
+      # @return [SignedProperties, nil] Only when #valid?.
+      attr_reader :signed_properties
+
+      def initialize(signed_properties: nil, **attributes)
+        @signed_properties = signed_properties
+        super(**attributes)
+      end
+    end
+
+    # Verifies a XAdES-B signature (#58): the XML-DSig signature through
+    # {HankoXml::Verifier}, then its <xades:SignedProperties>.
+    #
+    # Everything read comes from the SignedProperties element that xmlsec
+    # itself resolved and digested for the Type=SignedProperties Reference, and
+    # that element must be the one inside this signature's single
+    # QualifyingProperties. A decoy SignedProperties placed where a lookup by
+    # XPath would find it is never read (XAdES signature wrapping). The
+    # SigningCertificate(V2) must then name the certificate that verified.
+    #
+    # Reads XAdES 1.3.2 and the older 1.2.2 and 1.1.1 namespaces (#86); the
+    # whole signature must use one.
+    #
+    # Needs certificate-based trust (certificate:, certificates:, store:), and
+    # Nokogiri: the signed properties are read from the DOM (#102).
+    # Unsigned properties (XAdES-T/LT/LTA) are ignored: #81, #82.
+    class Verifier < HankoXml::Verifier # rubocop:disable Metrics/ClassLength
+      # @param signature_policy [SignaturePolicy, Hash, :implied, nil] When given, the signed
+      #   SignaturePolicyIdentifier must be exactly this.
+      # All other keywords are {HankoXml::Verifier}'s.
+      def initialize(signature_policy: nil, **options)
+        Dom.require!("HankoXml::Xades::Verifier")
+        if options[:key] || options[:keys]
+          raise HankoXml::ConfigurationError,
+                "XAdES verification needs certificate:, certificates: or store:, since the signed properties " \
+                "commit to a certificate"
+        end
+
+        @expected_signature_policy = coerce_signature_policy(signature_policy)
+        super(**options)
+      end
+
+      # The signed properties commit to a certificate, so XAdES needs trust in
+      # it; there is no integrity-only XAdES verification (#103).
+      def self.without_trust_verification(**)
+        raise HankoXml::ConfigurationError,
+              "XAdES verification needs certificate:, certificates: or store:; " \
+              "without_trust_verification is not available for it"
+      end
+
+      def verify(xml)
+        xades(super)
+      end
+
+      def verify_all(xml)
+        super.map { |verification| xades(verification) }
+      end
+
+      private
+
+      def xades(verification)
+        return rebuild(verification) unless verification.valid?
+
+        properties = signed_properties(verification)
+        rebuild(verification, signed_properties: properties)
+      rescue HankoXml::XadesError, HankoXml::PolicyError => e
+        rebuild(verification, error: e)
+      end
+
+      def rebuild(verification, signed_properties: nil, error: nil)
+        Verification.new(
+          valid: verification.valid? && error.nil?,
+          errors: [*verification.errors, *error],
+          signature_info: verification.signature_info,
+          signature_node: verification.signature_node,
+          document: verification.document,
+          namespaces: verification.namespaces,
+          certificate: verification.certificate,
+          certificate_chain: verification.certificate_chain,
+          trusted: verification.trusted?,
+          root_signature: verification.send(:root_signature),
+          id_attributes: verification.id_attributes,
+          resolver: verification.resolver,
+          reference_element_indexes: verification.reference_element_indexes,
+          reference_valid: verification.reference_valid,
+          signature_element_index: verification.signature_element_index,
+          signed_properties: signed_properties
+        )
+      end
+
+      def signed_properties(verification)
+        node, ns = signed_properties_node(verification)
+        signature_properties = node.at_xpath("xades:SignedSignatureProperties", ns)
+        fail!("<xades:SignedProperties> has no <xades:SignedSignatureProperties>") unless signature_properties
+
+        check_signing_certificate!(signature_properties, verification.certificate, ns)
+        policy = signature_policy(signature_properties, ns)
+        check_signature_policy!(policy)
+
+        SignedProperties.new(
+          signing_time: signing_time(signature_properties, ns),
+          signature_policy: policy,
+          claimed_roles: signature_properties.xpath("xades:SignerRoleV2/xades:ClaimedRoles/xades:ClaimedRole | " \
+                                                    "xades:SignerRole/xades:ClaimedRoles/xades:ClaimedRole", ns)
+                                             .map { |role| role.text.strip.freeze }.freeze,
+          data_object_formats: data_object_formats(node, ns)
+        )
+      end
+
+      # The SignedProperties xmlsec digested, checked to be the one this
+      # signature's QualifyingProperties holds, and the namespaces to read it
+      # with.
+      def signed_properties_node(verification)
+        info, reference = signed_properties_reference(verification)
+        qualifying, ns = qualifying_properties(verification.signature_node)
+
+        type_namespace = VERSIONED_SIGNED_PROPERTIES_TYPES[info.type]
+        if type_namespace && type_namespace != ns["xades"]
+          fail!("the SignedProperties <Reference> Type names another XAdES version than its QualifyingProperties")
+        end
+
+        expected = qualifying.xpath("xades:SignedProperties", ns)
+        unless expected.size == 1 && expected.first.pointer_id == reference.node.pointer_id
+          fail!("the signed <xades:SignedProperties> is not the one in this signature's QualifyingProperties")
+        end
+
+        [reference.node, ns]
+      end
+
+      # The single SignedProperties Reference, as SignedInfo claims it and as
+      # it verified.
+      def signed_properties_reference(verification)
+        pairs = verification.signature_info.references.zip(verification.references)
+                            .select { |info, reference| signed_properties_reference?(info, reference) }
+        unless pairs.size == 1
+          fail!("a XAdES signature has exactly one <Reference> of Type #{SIGNED_PROPERTIES_TYPE}, " \
+                "this one has #{pairs.size}")
+        end
+
+        reference = pairs.first.last
+        fail!("the SignedProperties <Reference> did not verify") unless reference.valid? && reference.node
+
+        pairs.first
+      end
+
+      # This signature's single QualifyingProperties, in any XAdES namespace,
+      # and the namespaces to read it with.
+      def qualifying_properties(signature)
+        signature_id = signature["Id"].to_s
+        fail!("the <Signature> has no Id for QualifyingProperties to target") if signature_id.empty?
+
+        qualifying = signature.xpath("ds:Object/*[local-name()='QualifyingProperties']", "ds" => HankoXml::NS["ds"])
+                              .select { |node| NAMESPACES.include?(node.namespace&.href) }
+        fail!("a XAdES signature has exactly one <xades:QualifyingProperties>") unless qualifying.size == 1
+
+        qualifying = qualifying.first
+        fail!("<xades:QualifyingProperties> does not target this <Signature>") unless targets?(qualifying, signature_id)
+
+        [qualifying, { "ds" => HankoXml::NS["ds"], "xades" => qualifying.namespace.href }]
+      end
+
+      # By its Type, or, with no Type (as some 1.2.2 signatures write it), by
+      # what xmlsec resolved and digested: a SignedProperties element in a
+      # XAdES namespace. Never by the URI text (#86).
+      def signed_properties_reference?(info, reference)
+        return info.type == SIGNED_PROPERTIES_TYPE || VERSIONED_SIGNED_PROPERTIES_TYPES.key?(info.type) if info.type
+
+        node = reference.node
+        !node.nil? && node.name == "SignedProperties" && NAMESPACES.include?(node.namespace&.href)
+      end
+
+      # Target is "#" + the Signature Id. The older namespaces also had
+      # signers write the bare Id (Target="Signature"). Either way the
+      # QualifyingProperties must sit in this <Signature>'s own <Object>.
+      def targets?(qualifying, signature_id)
+        target = qualifying["Target"]
+        return true if target == "##{signature_id}"
+
+        LEGACY_NAMESPACES.include?(qualifying.namespace.href) && target == signature_id
+      end
+
+      def check_signing_certificate!(signature_properties, certificate, ns)
+        fail!("no certificate verified the signature, so SigningCertificate cannot be checked") unless certificate
+
+        v2 = signature_properties.xpath("xades:SigningCertificateV2/xades:Cert", ns)
+        v1 = signature_properties.xpath("xades:SigningCertificate/xades:Cert", ns)
+        if v1.empty? == v2.empty?
+          fail!("exactly one of <xades:SigningCertificate> or <xades:SigningCertificateV2> is required")
+        end
+
+        cert = (v2.empty? ? v1 : v2).find { |candidate| certificate_digest_matches?(candidate, certificate, ns) }
+        fail!("SigningCertificate does not name the certificate that verified the signature") unless cert
+
+        check_issuer_serial!(cert, certificate, ns)
+      end
+
+      def certificate_digest_matches?(cert, certificate, ns)
+        digest_method = cert.at_xpath("xades:CertDigest/ds:DigestMethod/@Algorithm", ns)&.value
+        digest_value = cert.at_xpath("xades:CertDigest/ds:DigestValue", ns)&.text
+        fail!("a <xades:Cert> has no CertDigest") unless digest_method && digest_value
+
+        @policy.enforce_algorithm!(:digest, digest_method)
+        name = HankoXml::Algorithms.name_for(:digest, digest_method)
+        actual = Xades.openssl_digest(name, certificate.to_der)
+        decoded = digest_value.gsub(/\s/, "").unpack1("m")
+        OpenSSL.fixed_length_secure_compare(actual, decoded) if actual.bytesize == decoded.bytesize
+      end
+
+      # IssuerSerialV2 must decode to the certificate's issuer and serial.
+      # The v1 IssuerSerial's issuer is a DN string whose formatting varies
+      # between implementations, so only its serial number is compared.
+      def check_issuer_serial!(cert, certificate, ns)
+        v2 = cert.at_xpath("xades:IssuerSerialV2", ns)&.text
+        v1 = cert.at_xpath("xades:IssuerSerial/ds:X509SerialNumber", ns)&.text
+
+        if v2
+          issuer, serial = decode_issuer_serial(v2)
+          return if issuer == certificate.issuer && serial == certificate.serial
+
+          fail!("IssuerSerialV2 does not match the certificate that verified the signature")
+        elsif v1
+          fail!("the IssuerSerial of <xades:SigningCertificate> is malformed") unless v1.strip.match?(/\A\d+\z/)
+          return if OpenSSL::BN.new(v1.strip) == certificate.serial
+
+          fail!("IssuerSerial does not match the certificate that verified the signature")
+        end
+      end
+
+      # RFC 5035 IssuerSerial: SEQUENCE { GeneralNames, INTEGER }, the issuer
+      # being the GeneralNames' directoryName [4].
+      def decode_issuer_serial(base64)
+        sequence = OpenSSL::ASN1.decode(base64.gsub(/\s/, "").unpack1("m"))
+        general_names, serial = sequence.value if sequence.is_a?(OpenSSL::ASN1::Sequence)
+        names = general_names.is_a?(OpenSSL::ASN1::Sequence) ? general_names.value : []
+        directory_name = names.find { |name| name.tag == 4 && name.tag_class == :CONTEXT_SPECIFIC }
+        name = directory_name&.value&.first
+        unless name && serial.is_a?(OpenSSL::ASN1::Integer)
+          fail!("the IssuerSerialV2 of <xades:SigningCertificateV2> is malformed")
+        end
+
+        [OpenSSL::X509::Name.new(name.to_der), serial.value]
+      rescue OpenSSL::ASN1::ASN1Error, OpenSSL::X509::NameError
+        fail!("the IssuerSerialV2 of <xades:SigningCertificateV2> is malformed")
+      end
+
+      def signing_time(signature_properties, ns)
+        text = signature_properties.at_xpath("xades:SigningTime", ns)&.text
+        return nil unless text
+
+        Time.iso8601(text.strip).utc.freeze
+      rescue ArgumentError
+        fail!("<xades:SigningTime> is not an xs:dateTime")
+      end
+
+      def signature_policy(signature_properties, ns)
+        identifier = signature_properties.at_xpath("xades:SignaturePolicyIdentifier", ns)
+        return nil unless identifier
+        return :implied if identifier.at_xpath("xades:SignaturePolicyImplied", ns)
+
+        policy_id = identifier.at_xpath("xades:SignaturePolicyId", ns)
+        SignaturePolicy.new(
+          identifier: policy_id&.at_xpath("xades:SigPolicyId/xades:Identifier", ns)&.text.to_s.strip,
+          description: policy_id&.at_xpath("xades:SigPolicyId/xades:Description", ns)&.text,
+          digest_method: policy_id&.at_xpath("xades:SigPolicyHash/ds:DigestMethod/@Algorithm", ns)&.value.to_s,
+          digest_value: policy_id&.at_xpath("xades:SigPolicyHash/ds:DigestValue", ns)&.text.to_s.gsub(/\s/, "")
+        )
+      rescue HankoXml::ConfigurationError
+        fail!("<xades:SignaturePolicyIdentifier> is malformed")
+      end
+
+      def check_signature_policy!(policy)
+        expected = @expected_signature_policy
+        return if expected.nil?
+        return if expected == :implied && policy == :implied
+        return if policy.is_a?(SignaturePolicy) && expected.is_a?(SignaturePolicy) &&
+                  policy.identifier == expected.identifier &&
+                  policy.digest_value == expected.digest_value &&
+                  policy.digest_method == HankoXml::Algorithms.uri_for(:digest, expected.digest_method)
+
+        fail!("the signed SignaturePolicyIdentifier is not the expected signature policy")
+      end
+
+      def data_object_formats(signed_properties, ns)
+        signed_properties.xpath("xades:SignedDataObjectProperties/xades:DataObjectFormat", ns).map do |format|
+          {
+            object_reference: format["ObjectReference"],
+            mime_type: format.at_xpath("xades:MimeType", ns)&.text,
+            description: format.at_xpath("xades:Description", ns)&.text,
+            encoding: format.at_xpath("xades:Encoding", ns)&.text
+          }.freeze
+        end.freeze
+      end
+
+      def coerce_signature_policy(value)
+        case value
+        when nil, :implied, SignaturePolicy then value
+        when Hash then SignaturePolicy.new(**value)
+        else
+          raise HankoXml::ConfigurationError,
+                "signature_policy: must be a Xades::SignaturePolicy, a Hash of its keywords, :implied or nil"
+        end
+      end
+
+      def fail!(message)
+        raise HankoXml::XadesError, message
+      end
+    end
+  end
+end

data/lib/hanko_xml/xades.rb

@@ -0,0 +1,287 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+require "time"
+
+module HankoXml
+  # XAdES (ETSI EN 319 132-1) baseline signatures: XML-DSig plus signed
+  # qualifying properties. Only structure lives here. xmlsec digests the
+  # SignedProperties Reference and signs, exactly as for any other same-document
+  # Reference. See API_CONTRACT.md §12 and docs/src/content/guide/comparison-signxml.md.
+  module Xades
+    NS = "http://uri.etsi.org/01903/v1.3.2#"
+
+    # Earlier XAdES namespaces (TS 101 903 v1.1.1, v1.2.2) that Xades::Verifier
+    # also reads (#86). Xades::Signer writes only NS.
+    LEGACY_NAMESPACES = %w[http://uri.etsi.org/01903/v1.2.2# http://uri.etsi.org/01903/v1.1.1#].freeze
+
+    # Every namespace Xades::Verifier reads QualifyingProperties in.
+    NAMESPACES = [NS, *LEGACY_NAMESPACES].freeze
+
+    # RFC 5035 IssuerSerial: issuer as GeneralNames { directoryName [4] Name }.
+    def self.issuer_serial_der(certificate)
+      name = OpenSSL::ASN1.decode(certificate.issuer.to_der)
+      general_names = OpenSSL::ASN1::Sequence([OpenSSL::ASN1::ASN1Data.new([name], 4, :CONTEXT_SPECIFIC)])
+      OpenSSL::ASN1::Sequence([general_names, OpenSSL::ASN1::Integer(certificate.serial)]).to_der
+    end
+
+    # Digests a certificate for <xades:CertDigest> with the registry digest
+    # +name+. OpenSSL spells SHA-3 "sha3-256" where the registry has
+    # :sha3_256 (#60).
+    def self.openssl_digest(name, bytes)
+      OpenSSL::Digest.new(name.to_s.tr("_", "-")).digest(bytes)
+    end
+
+    # The Reference Type that marks the Reference over <xades:SignedProperties>.
+    SIGNED_PROPERTIES_TYPE = "http://uri.etsi.org/01903#SignedProperties"
+
+    # The Types a verified signature may use instead: the namespace-specific
+    # form older signatures write (http://uri.etsi.org/01903/v1.2.2#SignedProperties).
+    # Each only counts with QualifyingProperties in its own namespace (#86).
+    VERSIONED_SIGNED_PROPERTIES_TYPES = NAMESPACES.to_h { |ns| ["#{ns}SignedProperties", ns] }.freeze
+
+    # <xades:SignaturePolicyIdentifier>: the policy document's identifier (an
+    # OID URN or URI) and the digest of that document.
+    SignaturePolicy = Struct.new(:identifier, :digest_value, :digest_method, :description, keyword_init: true) do
+      def initialize(identifier:, digest_value:, digest_method: :sha256, description: nil)
+        begin
+          digest_value.to_s.unpack1("m0")
+        rescue ArgumentError
+          raise HankoXml::ConfigurationError,
+                "signature_policy digest_value: must be Base64 (the policy document's digest)"
+        end
+
+        super
+        freeze
+      end
+    end
+
+    # <xades:DataObjectFormat> for the signed data.
+    DataObjectFormat = Struct.new(:mime_type, :description, :encoding, keyword_init: true) do
+      def initialize(mime_type: nil, description: nil, encoding: nil)
+        if [mime_type, description, encoding].all?(&:nil?)
+          raise HankoXml::ConfigurationError, "data_object_format: needs a mime_type:, description: or encoding:"
+        end
+
+        super
+        freeze
+      end
+    end
+
+    # The authenticated view of a verified <xades:SignedProperties>
+    # (Xades::Verification#signed_properties). Unsigned properties
+    # (timestamps, validation data) are never read.
+    SignedProperties = Struct.new(:signing_time, :signature_policy, :claimed_roles, :data_object_formats,
+                                  keyword_init: true) do
+      def initialize(**)
+        super
+        freeze
+      end
+    end
+
+    # A {HankoXml::Signer} that produces XAdES-B (baseline) signatures (#57).
+    #
+    # On top of the Signer's own references it adds a <ds:Object> holding
+    # <xades:QualifyingProperties>, and a Reference over its
+    # <xades:SignedProperties>: SigningTime, SigningCertificateV2 (digest of
+    # certificate:), and optionally SignaturePolicyIdentifier, SignerRoleV2
+    # and DataObjectFormat.
+    #
+    # Always builds a new <Signature> (template: :build). Timestamps and
+    # validation data (XAdES-T/LT/LTA) are separate: #81, #82.
+    class Signer < HankoXml::Signer
+      attr_reader :signing_time, :signature_policy, :claimed_roles, :data_object_format
+
+      # @param certificate [Key, OpenSSL::X509::Certificate, String, Pathname] Required: SigningCertificateV2
+      #   commits to it.
+      # @param signing_time [Time, nil] The SigningTime to sign; nil means the time #sign runs.
+      # @param signature_policy [SignaturePolicy, Hash, :implied, nil] SignaturePolicyIdentifier, if any.
+      # @param claimed_roles [Array<String>] SignerRoleV2/ClaimedRoles.
+      # @param data_object_format [DataObjectFormat, Hash, nil] Describes the signed data; applies to each
+      #   of this Signer's own references, which get an Id when they have none.
+      # @param signature_id [String, nil] The <Signature> Id; generated when nil, since QualifyingProperties
+      #   targets it.
+      # All other keywords are {HankoXml::Signer}'s.
+      def initialize(certificate: nil, signing_time: nil, signature_policy: nil, claimed_roles: [],
+                     data_object_format: nil, signature_id: nil, template: :build, **options, &block)
+        unless template.to_sym == :build
+          raise HankoXml::ConfigurationError,
+                "template: #{template.inspect} is not supported for XAdES; it always builds a new <Signature>"
+        end
+        if signing_time && !signing_time.respond_to?(:utc)
+          raise HankoXml::ConfigurationError, "signing_time: must be a Time, got #{signing_time.class}"
+        end
+
+        @signing_time = signing_time&.dup&.utc&.freeze
+        @signature_policy = coerce_signature_policy(signature_policy)
+        @claimed_roles = Array(claimed_roles).map { |role| role.to_s.dup.freeze }.freeze
+        @data_object_format = coerce_data_object_format(data_object_format)
+
+        super(certificate: certificate, signature_id: signature_id || "xades-#{SecureRandom.hex(8)}",
+              template: :build, **options, &block)
+      end
+
+      # This Signer's own references (the whole document when it has none),
+      # then the Reference over SignedProperties.
+      def references
+        own = super
+        own = [HankoXml::Reference.new(uri: "", digest_method: digest_method)] if own.empty?
+        own = own.each_with_index.map { |ref, i| with_id(ref, i) } if data_object_format
+        [*own, signed_properties_reference]
+      end
+
+      # The <Signature> the Signer would build, with <xades:QualifyingProperties>.
+      def template(doc_or_xml)
+        signature = super
+        signature.add_child(QualifyingProperties.new(signature, self).build)
+        signature
+      end
+
+      def signed_properties_id
+        "#{signature_id}-signedprops"
+      end
+
+      private
+
+      def signed_properties_reference
+        HankoXml::Reference.new(uri: "##{signed_properties_id}", type: SIGNED_PROPERTIES_TYPE,
+                                transforms: [:exc_c14n], digest_method: digest_method)
+      end
+
+      def with_id(ref, index)
+        return ref if ref.id
+
+        HankoXml::Reference.new(uri: ref.uri, transforms: ref.transforms, digest_method: ref.digest_method,
+                                id: "#{signature_id}-ref-#{index}", type: ref.type)
+      end
+
+      def coerce_signature_policy(value)
+        case value
+        when nil, :implied, SignaturePolicy then value
+        when Hash then SignaturePolicy.new(**value)
+        else
+          raise HankoXml::ConfigurationError,
+                "signature_policy: must be a Xades::SignaturePolicy, a Hash of its keywords, :implied or nil"
+        end
+      end
+
+      def coerce_data_object_format(value)
+        case value
+        when nil, DataObjectFormat then value
+        when Hash then DataObjectFormat.new(**value)
+        else
+          raise HankoXml::ConfigurationError,
+                "data_object_format: must be a Xades::DataObjectFormat, a Hash of its keywords or nil"
+        end
+      end
+
+      # Checked with the key material, after the block may have set certificate:.
+      def check_key_material!
+        super
+        return if certificate.is_a?(HankoXml::Key) && certificate.certificate?
+
+        raise HankoXml::ConfigurationError, "XAdES needs certificate:, which SigningCertificateV2 commits to"
+      end
+    end
+
+    # Builds <ds:Object><xades:QualifyingProperties> for a <Signature> template.
+    # Every node gets its namespace explicitly, so the caller's DOM (sign!)
+    # answers XPath the same way a re-parse of the signed bytes would.
+    class QualifyingProperties
+      def initialize(signature, signer)
+        @doc = signature.document
+        @ds_namespace = signature.namespace
+        @signer = signer
+      end
+
+      def build
+        object = element("Object")
+        qualifying = @doc.create_element("QualifyingProperties")
+        object.add_child(qualifying)
+        @xades_ns = qualifying.add_namespace_definition("xades", NS)
+        qualifying.namespace = @xades_ns
+        qualifying["Target"] = "##{@signer.signature_id}"
+        signed = xades(qualifying, "SignedProperties")
+        signed["Id"] = @signer.signed_properties_id
+
+        build_signature_properties(xades(signed, "SignedSignatureProperties"))
+        build_data_object_properties(signed) if @signer.data_object_format
+        object
+      end
+
+      private
+
+      def build_signature_properties(parent)
+        xades(parent, "SigningTime").content = (@signer.signing_time || Time.now.utc).utc.xmlschema
+        build_signing_certificate(xades(parent, "SigningCertificateV2"))
+        build_signature_policy(parent) if @signer.signature_policy
+        return if @signer.claimed_roles.empty?
+
+        roles = xades(xades(parent, "SignerRoleV2"), "ClaimedRoles")
+        @signer.claimed_roles.each { |role| xades(roles, "ClaimedRole").content = role }
+      end
+
+      def build_signing_certificate(parent)
+        certificate = @signer.certificate.to_openssl
+        cert = xades(parent, "Cert")
+        digest(xades(cert, "CertDigest"), @signer.digest_method, certificate.to_der)
+        xades(cert, "IssuerSerialV2").content = [issuer_serial_der(certificate)].pack("m0")
+      end
+
+      def issuer_serial_der(certificate)
+        Xades.issuer_serial_der(certificate)
+      end
+
+      def build_signature_policy(parent)
+        identifier = xades(parent, "SignaturePolicyIdentifier")
+        policy = @signer.signature_policy
+        return xades(identifier, "SignaturePolicyImplied") if policy == :implied
+
+        policy_id = xades(identifier, "SignaturePolicyId")
+        sig_policy_id = xades(policy_id, "SigPolicyId")
+        xades(sig_policy_id, "Identifier").content = policy.identifier
+        xades(sig_policy_id, "Description").content = policy.description if policy.description
+        hash = xades(policy_id, "SigPolicyHash")
+        hash.add_child(digest_method_element(policy.digest_method))
+        hash.add_child(element("DigestValue")).content = policy.digest_value
+      end
+
+      def build_data_object_properties(signed)
+        properties = xades(signed, "SignedDataObjectProperties")
+        format = @signer.data_object_format
+        @signer.references.reject { |ref| ref.type == SIGNED_PROPERTIES_TYPE }.each do |ref|
+          node = xades(properties, "DataObjectFormat")
+          node["ObjectReference"] = "##{ref.id}"
+          xades(node, "Description").content = format.description if format.description
+          xades(node, "MimeType").content = format.mime_type if format.mime_type
+          xades(node, "Encoding").content = format.encoding if format.encoding
+        end
+      end
+
+      def digest(parent, digest_method, bytes)
+        parent.add_child(digest_method_element(digest_method))
+        algorithm = HankoXml::Algorithms.name_for(:digest, HankoXml::Algorithms.uri_for(:digest, digest_method))
+        parent.add_child(element("DigestValue")).content = [Xades.openssl_digest(algorithm, bytes)].pack("m0")
+      end
+
+      def digest_method_element(digest_method)
+        element("DigestMethod").tap { |node| node["Algorithm"] = HankoXml::Algorithms.uri_for(:digest, digest_method) }
+      end
+
+      def xades(parent, name)
+        node = @doc.create_element(name)
+        parent.add_child(node)
+        node.namespace = @xades_ns
+        node
+      end
+
+      # An XML-DSig element, in the default namespace <Signature> declares.
+      def element(name)
+        @doc.create_element(name).tap { |node| node.namespace = @ds_namespace }
+      end
+    end
+  end
+end
+
+require_relative "xades/verifier"