moxml 0.1.25 → 0.1.26

data/spec/moxml/c14n/c14n_spec.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+
+RSpec.describe "Moxml C14N engine" do
+  describe Moxml::C14n::Exclusive do
+    let(:ctx) { Moxml.new(:nokogiri) }
+    let(:canon) { described_class.new }
+
+    it "renders a simple element without namespaces" do
+      doc = ctx.parse("<root>hello</root>")
+      expect(canon.canonicalize(doc.root)).to eq("<root>hello</root>")
+    end
+
+    it "preserves nested element structure" do
+      doc = ctx.parse("<root><child>text</child></root>")
+      expect(canon.canonicalize(doc.root)).to eq("<root><child>text</child></root>")
+    end
+
+    it "renders declared namespaces" do
+      doc = ctx.parse(<<~XML.strip)
+        <root xmlns:foo="http://example.com/foo"><foo:child>x</foo:child></root>
+      XML
+      result = canon.canonicalize(doc.root)
+      # Exclusive C14N renders the namespace on the element where it's visibly
+      # used (foo:child), not on ancestors that don't use it.
+      expect(result).to include('<foo:child xmlns:foo="http://example.com/foo">')
+      expect(result).to include("</foo:child>")
+    end
+
+    it "excludes ancestor-inherited namespaces when not visibly used (exclusive)" do
+      doc = ctx.parse(<<~XML.strip)
+        <outer xmlns:unused="http://example.com/unused"><inner>text</inner></outer>
+      XML
+      inner = doc.at_xpath("//inner")
+      result = canon.canonicalize(inner)
+      expect(result).to eq("<inner>text</inner>")
+    end
+
+    it "escapes special characters in text content" do
+      doc = ctx.parse("<root>a&lt;b&gt;c&amp;d</root>")
+      expect(canon.canonicalize(doc.root)).to eq("<root>a&lt;b&gt;c&amp;d</root>")
+    end
+
+    it "escapes special characters in attribute values" do
+      doc = ctx.parse(%(<root attr="a&amp;b&quot;c"/>))
+      expect(canon.canonicalize(doc.root))
+        .to include(%(attr="a&amp;b&quot;c"))
+    end
+
+    it "sorts attributes by namespace URI then local name" do
+      doc = ctx.parse(%(<root b="2" a="1" c="3"/>))
+      result = canon.canonicalize(doc.root)
+      expect(result).to include('a="1" b="2" c="3"')
+    end
+
+    it "omits comments by default" do
+      doc = ctx.parse("<root>a<!-- comment -->b</root>")
+      expect(canon.canonicalize(doc.root)).to eq("<root>ab</root>")
+    end
+
+    it "includes comments when with_comments is true" do
+      doc = ctx.parse("<root>a<!-- comment -->b</root>")
+      expect(canon.canonicalize(doc.root, with_comments: true))
+        .to eq("<root>a<!-- comment -->b</root>")
+    end
+  end
+
+  describe ".escape_text" do
+    it "escapes &, <, >" do
+      expect(Moxml::C14n.escape_text("a & b < c > d"))
+        .to eq("a &amp; b &lt; c &gt; d")
+    end
+
+    it "escapes bare CR as &#xD;" do
+      expect(Moxml::C14n.escape_text("a\rb"))
+        .to eq("a&#xD;b")
+    end
+  end
+
+  describe ".escape_attribute" do
+    it "escapes quotes and tabs/newlines" do
+      expect(Moxml::C14n.escape_attribute(%(a"b\tc\nd)))
+        .to eq(%(a&quot;b&#x9;c&#xA;d))
+    end
+  end
+end

data/spec/moxml/c14n/comments_pis_spec.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/c14n"
+
+# Edge cases for comment and processing-instruction handling per
+# W3C C14N 1.0 §2.6, §2.7.
+RSpec.describe "C14N comments and PIs" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+
+  describe "comments inside elements" do
+    it "omits comments by default" do
+      doc = ctx.parse("<root>a<!-- c -->b</root>")
+      expect(Moxml::C14n.canonicalize(doc.root)).to eq("<root>ab</root>")
+    end
+
+    it "includes comments when with_comments: true" do
+      doc = ctx.parse("<root>a<!-- c -->b</root>")
+      expect(Moxml::C14n.canonicalize(doc.root, with_comments: true))
+        .to eq("<root>a<!-- c -->b</root>")
+    end
+
+    it "preserves comment content verbatim" do
+      doc = ctx.parse("<root><!-- &amp; <stuff> --></root>")
+      expect(Moxml::C14n.canonicalize(doc.root, with_comments: true))
+        .to eq("<root><!-- &amp; <stuff> --></root>")
+    end
+  end
+
+  describe "processing instructions" do
+    it "always renders PIs (not affected by with_comments)" do
+      doc = ctx.parse("<root><?pi data?>x</root>")
+      expect(Moxml::C14n.canonicalize(doc.root))
+        .to eq("<root><?pi data?>x</root>")
+    end
+
+    it "renders PI without data when data is empty" do
+      doc = ctx.parse("<root><?pi?>x</root>")
+      expect(Moxml::C14n.canonicalize(doc.root))
+        .to eq("<root><?pi?>x</root>")
+    end
+
+    it "preserves PI target and data verbatim" do
+      doc = ctx.parse(%(<root><?xml-stylesheet href="a.css" type="text/css"?>x</root>))
+      expect(Moxml::C14n.canonicalize(doc.root))
+        .to include(%(<?xml-stylesheet href="a.css" type="text/css"?>))
+    end
+  end
+
+  describe "PIs at document level" do
+    # TODO.c14n/09: Document-level PIs (outside the document element) are
+    # not yet rendered correctly. The moxml PI parser mis-parses document-level
+    # PIs, and the DataModel.from_document path drops them. Fixing requires
+    # adapter-level work and is tracked separately.
+    it "renders PIs outside the document element (KNOWN LIMITATION)" do
+      skip "document-level PI rendering not yet implemented"
+    end
+  end
+
+  describe "comments at document level" do
+    it "renders document-level comments when with_comments: true (KNOWN LIMITATION)" do
+      skip "document-level comment rendering not yet implemented"
+    end
+  end
+end

data/spec/moxml/c14n/inclusive10_spec.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+
+RSpec.describe Moxml::C14n::Inclusive10 do
+  let(:ctx) { Moxml.new(:nokogiri) }
+  let(:canon) { described_class.new }
+
+  it "renders a simple element" do
+    doc = ctx.parse("<root>hello</root>")
+    expect(canon.canonicalize(doc.root)).to eq("<root>hello</root>")
+  end
+
+  it "attracts ancestor namespaces at the apex (the key inclusive behavior)" do
+    xml = <<~XML.strip
+      <outer xmlns:foo="http://example.com/foo" xmlns:bar="http://example.com/bar">
+        <inner x="1"><foo:child>hello</foo:child></inner>
+      </outer>
+    XML
+    doc = ctx.parse(xml)
+    inner = doc.at_xpath("//*[local-name()='inner']")
+    result = canon.canonicalize(inner)
+    # Both inherited namespaces are rendered on <inner>, even though
+    # <inner> itself does not visibly use them. This is the inclusive
+    # "ancestor attraction" behavior.
+    expect(result).to include('xmlns:bar="http://example.com/bar"')
+    expect(result).to include('xmlns:foo="http://example.com/foo"')
+  end
+
+  it "renders each namespace declaration only once per chain" do
+    xml = <<~XML.strip
+      <root xmlns:a="http://example.com/a">
+        <child xmlns:a="http://example.com/a"><grand/></child>
+      </root>
+    XML
+    doc = ctx.parse(xml)
+    result = canon.canonicalize(doc.root)
+    expect(result.scan('xmlns:a="http://example.com/a"').count).to eq(1)
+  end
+
+  it "re-renders a namespace when re-declared with a different URI" do
+    xml = <<~XML.strip
+      <root xmlns:a="http://example.com/a">
+        <child xmlns:a="http://example.com/other"><grand/></child>
+      </root>
+    XML
+    doc = ctx.parse(xml)
+    result = canon.canonicalize(doc.root)
+    expect(result.scan("xmlns:a=").count).to eq(2)
+  end
+
+  it "renders the default namespace at apex when inherited" do
+    xml = '<outer xmlns="http://example.com"><inner/></outer>'
+    doc = ctx.parse(xml)
+    inner = doc.at_xpath("//*[local-name()='inner']")
+    result = canon.canonicalize(inner)
+    expect(result).to include('xmlns="http://example.com"')
+  end
+end

data/spec/moxml/c14n/namespace_edge_cases_spec.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/c14n"
+
+# Edge cases for namespace rendering per W3C C14N 1.0 §2.3 / 1.1 §2.3.
+# These cover the bugs that historically plague C14N implementations.
+RSpec.describe "C14N namespace rendering" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+
+  describe "default namespace" do
+    it "renders xmlns= declaration when default ns is set" do
+      doc = ctx.parse(%(<root xmlns="urn:foo"/>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      expect(result).to eq('<root xmlns="urn:foo"></root>')
+    end
+
+    it "renders xmlns='' when transitioning to empty default" do
+      doc = ctx.parse(%(<a xmlns="urn:foo"><b xmlns=""><c/></b></a>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      # <b> has empty default; <a> has urn:foo → xmlns="" appears
+      expect(result).to include('xmlns=""')
+    end
+
+    it "does not render xmlns when default ns is empty everywhere" do
+      doc = ctx.parse(%(<root><child/></root>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      expect(result).to eq("<root><child></child></root>")
+    end
+  end
+
+  describe "prefix redeclaration" do
+    it "renders both declarations when URI changes" do
+      doc = ctx.parse(%(<a xmlns:x="urn:1"><b xmlns:x="urn:2"/></a>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      expect(result.scan("xmlns:x=").length).to eq(2)
+    end
+
+    it "renders only once when URI is unchanged" do
+      doc = ctx.parse(%(<a xmlns:x="urn:1"><b xmlns:x="urn:1"/></a>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      expect(result.scan("xmlns:x=").length).to eq(1)
+    end
+  end
+
+  describe "xml namespace" do
+    it "does not render xmlns:xml declaration" do
+      doc = ctx.parse(%(<root xmlns:xml="http://www.w3.org/XML/1998/namespace"/>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      expect(result).not_to include("xmlns:xml=")
+    end
+  end
+
+  describe "namespace sorting" do
+    it "sorts xmlns declarations by prefix" do
+      doc = ctx.parse(%(<root xmlns:z="urn:z" xmlns:a="urn:a"/>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      # a should appear before z
+      expect(result.index("xmlns:a=")).to be < result.index("xmlns:z=")
+    end
+
+    it "renders default namespace first" do
+      doc = ctx.parse(%(<root xmlns="urn:default" xmlns:a="urn:a"/>))
+      result = Moxml::C14n.canonicalize(doc.root)
+      # Default (xmlns=) before prefixed
+      expect(result.index("xmlns=")).to be < result.index("xmlns:a=")
+    end
+  end
+
+  describe "deeply nested inheritance" do
+    it "renders each prefix at the level it is first declared" do
+      xml = <<~XML.strip
+        <root xmlns:a="urn:a">
+          <level1 xmlns:b="urn:b">
+            <level2 xmlns:c="urn:c">
+              <apex/>
+            </level2>
+          </level1>
+        </root>
+      XML
+      doc = ctx.parse(xml)
+      result = Moxml::C14n.canonicalize(doc.root)
+      # Inclusive: all in-scope ns render on apex. But we're canonicalizing
+      # the whole tree, so each ns renders at its declaration point.
+      expect(result.scan("xmlns:").length).to eq(3)
+    end
+  end
+end

data/spec/moxml/c14n/xml_attributes_spec.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/c14n"
+
+# xml:lang and xml:space are "simple inheritable" attributes per W3C C14N
+# 1.1 §2.4. When an element is in the node-set but an ancestor is not,
+# the canonical form inherits these attributes from the nearest ancestor
+# in which they were declared.
+#
+# These specs exercise the inclusive behavior at full-document
+# canonicalization (where everything is in the set, so inheritance
+# doesn't trigger). For subset scenarios, see TODO.c14n/07.
+RSpec.describe "C14N xml:* inheritable attributes" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+
+  it "renders xml:lang attribute" do
+    doc = ctx.parse(%(<root xml:lang="en">hello</root>))
+    expect(Moxml::C14n.canonicalize(doc.root))
+      .to eq(%(<root xml:lang="en">hello</root>))
+  end
+
+  it "renders xml:space attribute" do
+    doc = ctx.parse(%(<root xml:space="preserve">data</root>))
+    expect(Moxml::C14n.canonicalize(doc.root))
+      .to eq(%(<root xml:space="preserve">data</root>))
+  end
+
+  it "renders xml:lang on descendant that declares its own" do
+    doc = ctx.parse(%(<a xml:lang="en"><b xml:lang="fr"/></a>))
+    result = Moxml::C14n.canonicalize(doc.root)
+    expect(result).to include('<b xml:lang="fr">')
+  end
+
+  it "renders xml:id attribute" do
+    doc = ctx.parse(%(<root xml:id="foo"/>))
+    expect(Moxml::C14n.canonicalize(doc.root))
+      .to eq(%(<root xml:id="foo"></root>))
+  end
+
+  it "renders xml:base attribute" do
+    doc = ctx.parse(%(<root xml:base="http://example.com/"/>))
+    expect(Moxml::C14n.canonicalize(doc.root))
+      .to eq(%(<root xml:base="http://example.com/"></root>))
+  end
+
+  it "sorts xml:* attributes by namespace URI then local name" do
+    doc = ctx.parse(%(<root xml:space="default" xml:lang="en" xml:id="x"/>))
+    result = Moxml::C14n.canonicalize(doc.root)
+    # All in XML namespace; sort by local name: id < lang < space
+    expect(result.index("xml:id=")).to be < result.index("xml:lang=")
+    expect(result.index("xml:lang=")).to be < result.index("xml:space=")
+  end
+end

data/spec/moxml/signature/algorithms/base64_transform_spec.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "base64"
+
+RSpec.describe Moxml::Signature::Algorithms::Base64Transform do
+  let(:ctx) { Moxml.new(:nokogiri) }
+  let(:transform) { described_class.new(context: ctx) }
+
+  it "decodes base64 octet input" do
+    encoded = Base64.strict_encode64("hello world")
+    expect(transform.transform(encoded)).to eq("hello world")
+  end
+
+  it "strips whitespace before decoding" do
+    encoded = Base64.strict_encode64("hello world").chars.each_slice(4).map(&:join).join("\n")
+    expect(transform.transform(encoded)).to eq("hello world")
+  end
+
+  it "raises TransformError on invalid base64" do
+    expect do
+      transform.transform("!!!not base64!!!")
+    end.to raise_error(Moxml::Signature::TransformError)
+  end
+end

data/spec/moxml/signature/algorithms/digest_base_spec.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+require "base64"
+
+RSpec.describe Moxml::Signature::Algorithms::DigestBase do
+  describe "SHA-256" do
+    let(:digest) { Moxml::Signature::Algorithms::SHA256.new }
+
+    it "computes raw bytes matching OpenSSL" do
+      data = "hello"
+      expect(digest.digest(data)).to eq(OpenSSL::Digest::SHA256.digest(data))
+    end
+
+    it "computes base64-encoded digest matching OpenSSL" do
+      data = "hello"
+      expected = Base64.strict_encode64(OpenSSL::Digest::SHA256.digest(data))
+      expect(digest.digest_base64(data)).to eq(expected)
+    end
+
+    it "matches the FIPS 180-3 test vector for empty string" do
+      # SHA-256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+      expected_hex = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      expect(digest.digest("").unpack1("H*")).to eq(expected_hex)
+    end
+
+    it "matches the FIPS 180-3 test vector for 'abc'" do
+      expected_hex = "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+      expect(digest.digest("abc").unpack1("H*")).to eq(expected_hex)
+    end
+  end
+
+  describe "SHA-1" do
+    it "matches the FIPS test vector for 'abc'" do
+      digest = Moxml::Signature::Algorithms::SHA1.new
+      expected_hex = "a9993e364706816aba3e25717850c26c9cd0d89d"
+      expect(digest.digest("abc").unpack1("H*")).to eq(expected_hex)
+    end
+
+    it "is registered under its W3C URI" do
+      klass = Moxml::Signature::Algorithms.lookup(
+        :digest, "http://www.w3.org/2000/09/xmldsig#sha1"
+      )
+      expect(klass).to eq(Moxml::Signature::Algorithms::SHA1)
+    end
+  end
+
+  describe "all five SHA digests" do
+    expected_uris = {
+      "http://www.w3.org/2000/09/xmldsig#sha1" =>
+        [Moxml::Signature::Algorithms::SHA1, 20],
+      "http://www.w3.org/2001/04/xmldsig-more#sha224" =>
+        [Moxml::Signature::Algorithms::SHA224, 28],
+      "http://www.w3.org/2001/04/xmlenc#sha256" =>
+        [Moxml::Signature::Algorithms::SHA256, 32],
+      "http://www.w3.org/2001/04/xmldsig-more#sha384" =>
+        [Moxml::Signature::Algorithms::SHA384, 48],
+      "http://www.w3.org/2001/04/xmlenc#sha512" =>
+        [Moxml::Signature::Algorithms::SHA512, 64],
+    }
+
+    expected_uris.each do |uri, (klass, byte_length)|
+      it "#{uri} resolves to #{klass.name.split('::').last} with #{byte_length}-byte output" do
+        instance = klass.new
+        result = instance.digest("test")
+        expect(result.bytesize).to eq(byte_length)
+      end
+    end
+  end
+end

data/spec/moxml/signature/algorithms/dsa_sha_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+RSpec.describe Moxml::Signature::Algorithms::DsaSha do
+  let(:key) { OpenSSL::PKey::DSA.generate(2048) }
+  let(:data) { "the quick brown fox jumps over the lazy dog" }
+
+  it "round-trips DSA-SHA1" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2000/09/xmldsig#dsa-sha1",
+    )
+    sig = algo.sign(data, key)
+    # DSA q for 2048-bit DSA is 256 bits → 32-byte halves → 64-byte raw sig.
+    expect(sig.bytesize).to eq(64)
+    expect(algo.verify(data, key, sig)).to be true
+  end
+
+  it "round-trips DSA-SHA256" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2009/xmldsig11#dsa-sha256",
+    )
+    sig = algo.sign(data, key)
+    expect(sig.bytesize).to eq(64)
+    expect(algo.verify(data, key, sig)).to be true
+  end
+
+  it "rejects tampered payload" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2009/xmldsig11#dsa-sha256",
+    )
+    sig = algo.sign(data, key)
+    expect(algo.verify("#{data}!", key, sig)).to be false
+  end
+
+  it "rejects non-DSA keys" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2009/xmldsig11#dsa-sha256",
+    )
+    expect do
+      algo.sign(data, OpenSSL::PKey::RSA.generate(2048))
+    end.to raise_error(Moxml::Signature::SignatureKeyError)
+  end
+end

data/spec/moxml/signature/algorithms/ecdsa_sha_spec.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+RSpec.describe Moxml::Signature::Algorithms::EcdsaSha do
+  let(:key) { OpenSSL::PKey::EC.generate("prime256v1") }
+  let(:data) { "the quick brown fox jumps over the lazy dog" }
+
+  %w[
+    http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1
+    http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224
+    http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256
+    http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384
+    http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512
+  ].each do |uri|
+    it "#{uri} round-trips sign/verify on P-256" do
+      algo = described_class.new(identifier_uri: uri)
+      sig = algo.sign(data, key)
+      # P-256: 32-byte r ‖ 32-byte s = 64 bytes
+      expect(sig.bytesize).to eq(64)
+      expect(algo.verify(data, key, sig)).to be true
+    end
+  end
+
+  it "rejects tampered payload" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
+    )
+    sig = algo.sign(data, key)
+    expect(algo.verify("#{data}!", key, sig)).to be false
+  end
+
+  it "rejects verification with a different key" do
+    other = OpenSSL::PKey::EC.generate("prime256v1")
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
+    )
+    sig = algo.sign(data, key)
+    expect(algo.verify(data, other, sig)).to be false
+  end
+
+  it "supports P-384 with 48-byte coordinates" do
+    p384 = OpenSSL::PKey::EC.generate("secp384r1")
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384",
+    )
+    sig = algo.sign(data, p384)
+    expect(sig.bytesize).to eq(96)
+    expect(algo.verify(data, p384, sig)).to be true
+  end
+
+  it "supports P-521 with 66-byte coordinates" do
+    p521 = OpenSSL::PKey::EC.generate("secp521r1")
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512",
+    )
+    sig = algo.sign(data, p521)
+    expect(sig.bytesize).to eq(132)
+    expect(algo.verify(data, p521, sig)).to be true
+  end
+
+  it "rejects non-EC keys" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256",
+    )
+    expect do
+      algo.sign(data, OpenSSL::PKey::RSA.generate(2048))
+    end.to raise_error(Moxml::Signature::SignatureKeyError)
+  end
+end

data/spec/moxml/signature/algorithms/enveloped_signature_transform_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+
+RSpec.describe Moxml::Signature::Algorithms::EnvelopedSignatureTransform do
+  let(:ctx) { Moxml.new(:nokogiri) }
+
+  it "is a no-op when signature_element is nil (signing case)" do
+    doc = ctx.parse("<root><child/></root>")
+    root = doc.root
+    transform = described_class.new(context: ctx, signature_element: nil)
+    expect(transform.transform(root)).to equal(root)
+  end
+
+  it "removes the containing signature from a copy (verification case)" do
+    xml = <<~XML.strip
+      <root>
+        <payload>important</payload>
+        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <ds:SignedInfo/>
+        </ds:Signature>
+      </root>
+    XML
+    doc = ctx.parse(xml)
+    sig_elem = doc.at_xpath("//ds:Signature",
+                            "ds" => "http://www.w3.org/2000/09/xmldsig#")
+
+    transform = described_class.new(context: ctx, signature_element: sig_elem)
+    result = transform.transform(doc.root)
+
+    expect(doc.at_xpath("//ds:Signature",
+                        "ds" => "http://www.w3.org/2000/09/xmldsig#")).not_to be_nil
+
+    c14n = Moxml::C14n::Exclusive.new
+    canonical = c14n.canonicalize(result)
+    expect(canonical).not_to include("Signature")
+    expect(canonical).to include("important")
+  end
+end