moxml 0.1.25 → 0.1.26

data/spec/moxml/signature/algorithms/hmac_sha_spec.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+RSpec.describe Moxml::Signature::Algorithms::HmacSha do
+  let(:secret) { "super-secret-shared-key" }
+  let(:data) { "the quick brown fox" }
+
+  describe "HMAC-SHA256" do
+    let(:uri) { "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" }
+    let(:algo) { described_class.new(identifier_uri: uri) }
+
+    it "produces a verifiable MAC" do
+      mac = algo.sign(data, secret)
+      expect(algo.verify(data, secret, mac)).to be true
+    end
+
+    it "rejects a tampered payload" do
+      mac = algo.sign(data, secret)
+      expect(algo.verify("#{data}!", secret, mac)).to be false
+    end
+
+    it "matches OpenSSL HMAC for the same inputs" do
+      mac = algo.sign(data, secret)
+      expected = OpenSSL::HMAC.digest("SHA256", secret, data)
+      expect(mac).to eq(expected)
+    end
+  end
+
+  describe "HMAC truncation" do
+    let(:uri) { "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" }
+
+    it "truncates to the specified bit length" do
+      algo = described_class.new(
+        identifier_uri: uri,
+        parameters: { hmac_output_length: 128 },
+      )
+      mac = algo.sign(data, secret)
+      expect(mac.bytesize).to eq(16)
+    end
+
+    it "rejects truncation below hash_bits / 2" do
+      expect do
+        described_class.new(
+          identifier_uri: uri,
+          parameters: { hmac_output_length: 64 },
+        )
+      end.to raise_error(Moxml::Signature::SignatureError)
+    end
+
+    it "rejects truncation below 80 bits even for SHA-1" do
+      expect do
+        described_class.new(
+          identifier_uri: "http://www.w3.org/2000/09/xmldsig#hmac-sha1",
+          parameters: { hmac_output_length: 72 },
+        )
+      end.to raise_error(Moxml::Signature::SignatureError)
+    end
+
+    it "rejects truncation that is not a multiple of 8" do
+      expect do
+        described_class.new(
+          identifier_uri: uri,
+          parameters: { hmac_output_length: 130 },
+        )
+      end.to raise_error(Moxml::Signature::SignatureError)
+    end
+  end
+end

data/spec/moxml/signature/algorithms/rsa_pkcs1_sha_spec.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+RSpec.describe Moxml::Signature::Algorithms::RsaPkcs1Sha do
+  let(:key) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:data) { "the quick brown fox jumps over the lazy dog" }
+
+  describe "RSA-SHA256" do
+    let(:uri) { "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" }
+    let(:algo) { described_class.new(identifier_uri: uri) }
+
+    it "produces a verifiable signature" do
+      signature = algo.sign(data, key)
+      expect(algo.verify(data, key, signature)).to be true
+    end
+
+    it "rejects a tampered payload" do
+      signature = algo.sign(data, key)
+      expect(algo.verify("#{data}!", key, signature)).to be false
+    end
+
+    it "rejects verification with a different key" do
+      other_key = OpenSSL::PKey::RSA.generate(2048)
+      signature = algo.sign(data, key)
+      expect(algo.verify(data, other_key, signature)).to be false
+    end
+  end
+
+  describe "RSA-SHA1 / SHA224 / SHA384 / SHA512" do
+    %w[
+      http://www.w3.org/2000/09/xmldsig#rsa-sha1
+      http://www.w3.org/2001/04/xmldsig-more#rsa-sha224
+      http://www.w3.org/2001/04/xmldsig-more#rsa-sha384
+      http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
+    ].each do |uri|
+      it "#{uri} round-trips sign/verify" do
+        algo = described_class.new(identifier_uri: uri)
+        sig = algo.sign(data, key)
+        expect(algo.verify(data, key, sig)).to be true
+      end
+    end
+  end
+
+  it "rejects a non-RSA key" do
+    algo = described_class.new(
+      identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+    )
+    expect do
+      algo.sign(data, "not-a-key")
+    end.to raise_error(Moxml::Signature::SignatureKeyError)
+  end
+end

data/spec/moxml/signature/algorithms_spec.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+
+RSpec.describe Moxml::Signature::Algorithms do
+  describe "registry" do
+    before { described_class.load_builtins! }
+
+    it "registers built-in digest algorithms" do
+      expect(described_class.registered?(:digest,
+                                         "http://www.w3.org/2001/04/xmlenc#sha256")).to be true
+      expect(described_class.registered?(:digest,
+                                         "http://www.w3.org/2000/09/xmldsig#sha1")).to be true
+    end
+
+    it "registers built-in signature methods" do
+      expect(described_class.registered?(:signature_method,
+                                         "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")).to be true
+      expect(described_class.registered?(:signature_method,
+                                         "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256")).to be true
+    end
+
+    it "registers built-in canonicalization algorithms" do
+      expect(described_class.registered?(:canonicalization,
+                                         "http://www.w3.org/2001/10/xml-exc-c14n#")).to be true
+      expect(described_class.registered?(:canonicalization,
+                                         "http://www.w3.org/2001/10/xml-exc-c14n#WithComments")).to be true
+    end
+
+    it "registers built-in transform algorithms" do
+      expect(described_class.registered?(:transform,
+                                         "http://www.w3.org/2000/09/xmldsig#base64")).to be true
+      expect(described_class.registered?(:transform,
+                                         "http://www.w3.org/2000/09/xmldsig#enveloped-signature")).to be true
+    end
+
+    it "looks up a registered algorithm class" do
+      klass = described_class.lookup(:digest,
+                                     "http://www.w3.org/2001/04/xmlenc#sha256")
+      expect(klass).to eq(Moxml::Signature::Algorithms::SHA256)
+    end
+
+    it "raises UnknownAlgorithm for unregistered URIs" do
+      expect do
+        described_class.lookup(:digest, "http://example.com/nonexistent")
+      end.to raise_error(Moxml::Signature::UnknownAlgorithm)
+    end
+
+    it "validates category names" do
+      expect do
+        described_class.register(:bogus, "http://example.com", Class.new)
+      end.to raise_error(ArgumentError)
+    end
+  end
+
+  describe "custom algorithm registration" do
+    after do
+      described_class.instance_variable_get(:@registry)[:digest]
+        &.delete("http://test.example/custom-digest")
+    end
+
+    it "accepts a custom algorithm class" do
+      custom = Class.new(Moxml::Signature::Algorithms::DigestBase) do
+        identifier "http://test.example/custom-digest"
+
+        def compute_digest(data)
+          "x" * data.bytesize
+        end
+      end
+
+      expect(described_class.lookup(:digest,
+                                    "http://test.example/custom-digest")).to eq(custom)
+    end
+  end
+end

data/spec/moxml/signature/cross_verify_spec.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+RSpec.describe "Ported reference fixtures (cross-verification)" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+  let(:fixtures_dir) do
+    File.expand_path("../../fixtures/xmldsig", __dir__)
+  end
+
+  describe "sign3-result.xml (libxmlsec1 with embedded X509Certificate)" do
+    let(:xml) { File.read(File.join(fixtures_dir, "sign3-result.xml")) }
+    let(:doc) { ctx.parse(xml) }
+
+    it "auto-extracts the verification key from X509Certificate" do
+      # No explicit key passed — Verifier should auto-extract from KeyInfo.
+      result = Moxml::Signature.verify(context: ctx, document: doc)
+      expect(result.valid?).to be true
+      expect(result.results.first.signature_valid?).to be true
+      expect(result.results.first.references.first.valid?).to be true
+    end
+
+    it "parses the X509Data correctly" do
+      sig_elem = doc.at_xpath(
+        "//ds:Signature", "ds" => "http://www.w3.org/2000/09/xmldsig#"
+      )
+      parsed = Moxml::Signature::Parser.new(context: ctx).parse(sig_elem)
+      expect(parsed.key_info).not_to be_nil
+      expect(parsed.key_info.x509_data).not_to be_nil
+      expect(parsed.key_info.x509_data.certificates.size).to eq(1)
+
+      extractor = Moxml::Signature::KeyExtractor.new
+      key = extractor.extract(parsed.key_info)
+      expect(key).to be_a(OpenSSL::PKey::RSA)
+    end
+  end
+
+  describe "sign2-result.xml (libxmlsec1 with KeyName only)" do
+    let(:xml) { File.read(File.join(fixtures_dir, "sign2-result.xml")) }
+    let(:doc) { ctx.parse(xml) }
+    let(:pub_key_path) { File.join(fixtures_dir, "keys", "rsa_ref.pub") }
+
+    it "cross-verifies with the Ruby ref's RSA public key" do
+      skip "public key fixture not present" unless File.exist?(pub_key_path)
+
+      pub = OpenSSL::PKey::RSA.new(File.read(pub_key_path))
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: pub)
+      expect(result.valid?).to be true
+    end
+
+    it "auto-resolves KeyName via the application key_map" do
+      skip "public key fixture not present" unless File.exist?(pub_key_path)
+
+      pub = OpenSSL::PKey::RSA.new(File.read(pub_key_path))
+      # The fixture uses <KeyName>test</KeyName>; map it.
+      result = Moxml::Signature.verify(
+        context: ctx, document: doc, key_map: { "test" => pub },
+      )
+      expect(result.valid?).to be true
+    end
+  end
+end

data/spec/moxml/signature/edge_cases_spec.rb

@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+# Edge cases and defensive behavior. Per the audit (TODO.complete/20),
+# the original suite lacked:
+# - malformed input handling
+# - attack-scenario rejection
+# - KeyExtractor failure modes
+# - HMAC truncation at exact boundaries
+# - multi-signature documents
+# - adapter portability
+RSpec.describe "Moxml::Signature edge cases and defense" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+
+  describe "malformed Signature elements" do
+    it "rejects a document with no Signature element" do
+      doc = ctx.parse("<doc/>")
+      result = Moxml::Signature.verify(
+        context: ctx, document: doc, key: OpenSSL::PKey::RSA.generate(2048),
+      )
+      expect(result.signature_count).to eq(0)
+      expect(result.valid?).to be true # vacuously — no signatures
+    end
+
+    it "raises on SignatureValue with invalid base64" do
+      key = OpenSSL::PKey::RSA.generate(2048)
+      doc = ctx.parse(<<~XML.strip)
+        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <ds:SignedInfo>
+            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+            <ds:Reference URI="">
+              <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+              <ds:DigestValue>!!!!not base64!!!!</ds:DigestValue>
+            </ds:Reference>
+          </ds:SignedInfo>
+          <ds:SignatureValue>also not base64!!!</ds:SignatureValue>
+        </ds:Signature>
+      XML
+      expect do
+        Moxml::Signature.verify(context: ctx, document: doc, key: key)
+      end.to raise_error(Moxml::Signature::MalformedSignatureError)
+    end
+
+    it "returns false for a Signature with empty SignatureValue" do
+      key = OpenSSL::PKey::RSA.generate(2048)
+      doc = ctx.parse(<<~XML.strip)
+        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <ds:SignedInfo>
+            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+            <ds:Reference URI="">
+              <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+              <ds:DigestValue>YWJjZA==</ds:DigestValue>
+            </ds:Reference>
+          </ds:SignedInfo>
+          <ds:SignatureValue></ds:SignatureValue>
+        </ds:Signature>
+      XML
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: key)
+      expect(result.valid?).to be false
+    end
+
+    it "returns false for an unknown signature method URI" do
+      key = OpenSSL::PKey::RSA.generate(2048)
+      doc = ctx.parse(<<~XML.strip)
+        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <ds:SignedInfo>
+            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+            <ds:SignatureMethod Algorithm="http://example.com/bogus-alg"/>
+            <ds:Reference URI="">
+              <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+              <ds:DigestValue>YWJjZA==</ds:DigestValue>
+            </ds:Reference>
+          </ds:SignedInfo>
+          <ds:SignatureValue>YWJjZA==</ds:SignatureValue>
+        </ds:Signature>
+      XML
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: key)
+      expect(result.valid?).to be false
+      expect(result.results.first.error).to be_a(Moxml::Signature::UnknownAlgorithm)
+    end
+  end
+
+  describe "HMAC truncation boundary" do
+    let(:secret) { "shared-secret" }
+    let(:data) { "data" }
+
+    it "accepts truncation at exactly the minimum (hash_bits/2)" do
+      # For SHA-256, minimum is 128 bits. Should be accepted.
+      algo = Moxml::Signature::Algorithms::HmacSha.new(
+        identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256",
+        parameters: { hmac_output_length: 128 },
+      )
+      mac = algo.sign(data, secret)
+      expect(mac.bytesize).to eq(16)
+    end
+
+    it "accepts truncation at exactly 80 bits (SHA-1 minimum)" do
+      algo = Moxml::Signature::Algorithms::HmacSha.new(
+        identifier_uri: "http://www.w3.org/2000/09/xmldsig#hmac-sha1",
+        parameters: { hmac_output_length: 80 },
+      )
+      expect(algo.sign(data, secret).bytesize).to eq(10)
+    end
+
+    it "rejects truncation one bit below the minimum" do
+      expect do
+        Moxml::Signature::Algorithms::HmacSha.new(
+          identifier_uri: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256",
+          parameters: { hmac_output_length: 127 },
+        )
+      end.to raise_error(Moxml::Signature::SignatureError)
+    end
+  end
+
+  describe "KeyExtractor failure modes" do
+    let(:extractor) { Moxml::Signature::KeyExtractor.new }
+
+    it "returns nil for an empty KeyInfo" do
+      key_info = Moxml::Signature::Model::KeyInfo.new
+      expect(extractor.extract(key_info)).to be_nil
+    end
+
+    it "returns nil for nil KeyInfo" do
+      expect(extractor.extract(nil)).to be_nil
+    end
+
+    it "returns nil for a malformed X509Certificate" do
+      key_info = Moxml::Signature::Model::KeyInfo.new(
+        x509_data: Moxml::Signature::Model::Key::X509Data.new(
+          certificates: ["!!!not valid base64!!!"],
+        ),
+      )
+      expect(extractor.extract(key_info)).to be_nil
+    end
+
+    it "returns nil for a valid-base64 but invalid-DER certificate" do
+      require "base64"
+      key_info = Moxml::Signature::Model::KeyInfo.new(
+        x509_data: Moxml::Signature::Model::Key::X509Data.new(
+          certificates: [Base64.strict_encode64("not a certificate")],
+        ),
+      )
+      expect(extractor.extract(key_info)).to be_nil
+    end
+
+    it "returns nil for RSAKeyValue with malformed modulus" do
+      key_info = Moxml::Signature::Model::KeyInfo.new(
+        key_value: Moxml::Signature::Model::KeyValue.new(
+          rsa_key_value: Moxml::Signature::Model::Key::RSAKeyValue.new(
+            modulus: "!!!invalid base64!!!",
+            exponent: "AQAB",
+          ),
+        ),
+      )
+      expect(extractor.extract(key_info)).to be_nil
+    end
+
+    it "returns nil for ECKeyValue with unknown curve URI" do
+      key_info = Moxml::Signature::Model::KeyInfo.new(
+        key_value: Moxml::Signature::Model::KeyValue.new(
+          ec_key_value: Moxml::Signature::Model::Key::ECKeyValue.new(
+            named_curve_uri: "urn:oid:1.2.3.4.unknown",
+            public_key: "abc",
+          ),
+        ),
+      )
+      expect(extractor.extract(key_info)).to be_nil
+    end
+
+    it "returns nil for KeyName not in key_map" do
+      key_info = Moxml::Signature::Model::KeyInfo.new(key_name: "unknown")
+      expect(extractor.extract(key_info)).to be_nil
+    end
+  end
+
+  describe "multi-signature documents" do
+    it "reports each signature separately" do
+      doc = ctx.parse("<doc><a>x</a><b>y</b></doc>")
+      key1 = OpenSSL::PKey::RSA.generate(2048)
+      key2 = OpenSSL::PKey::RSA.generate(2048)
+
+      sig1 = Moxml::Signature.sign(
+        context: ctx, document: doc, key: key1,
+        signature_method: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+        canonicalization_method: "http://www.w3.org/2001/10/xml-exc-c14n#",
+        digest_method: "http://www.w3.org/2001/04/xmlenc#sha256",
+        reference_uri: "",
+        transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature"]
+      )
+      sig2 = Moxml::Signature.sign(
+        context: ctx, document: doc, key: key2,
+        signature_method: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+        canonicalization_method: "http://www.w3.org/2001/10/xml-exc-c14n#",
+        digest_method: "http://www.w3.org/2001/04/xmlenc#sha256",
+        reference_uri: "",
+        transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature"]
+      )
+      serializer = Moxml::Signature::Serializer.new(context: ctx)
+      doc.root.add_child(serializer.serialize(sig1).root)
+      doc.root.add_child(serializer.serialize(sig2).root)
+
+      # Verifying with key1: only sig1 should pass; sig2's SignatureValue
+      # won't verify against key1.
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: key1)
+      expect(result.signature_count).to eq(2)
+      expect(result.results.map(&:signature_valid?)).to contain_exactly(true, false)
+    end
+  end
+
+  describe "wrapping attack defense" do
+    it "does not verify a Signature whose SignedInfo references a different node" do
+      # Construct: doc has <payload xml:id="real">. Signature references
+      # "#real" but a tampered copy of <payload> lives inside <Object>.
+      # The reference digest matches the tampered copy, not the real one.
+      # This is the canonical wrapping attack pattern.
+      #
+      # The library cannot detect this on its own (the spec allows
+      # Object payloads). The application must check that the signed
+      # node is the one expected. This spec documents that the library
+      # faithfully reports per-reference validity, leaving the trust
+      # decision to the caller.
+      key = OpenSSL::PKey::RSA.generate(2048)
+      doc = ctx.parse(<<~XML.strip)
+        <doc>
+          <payload xml:id="real">original</payload>
+        </doc>
+      XML
+
+      # Sign the real payload
+      signature = Moxml::Signature.sign(
+        context: ctx, document: doc, key: key,
+        signature_method: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+        canonicalization_method: "http://www.w3.org/2001/10/xml-exc-c14n#",
+        digest_method: "http://www.w3.org/2001/04/xmlenc#sha256",
+        reference_uri: "#real",
+        transforms: []
+      )
+      serializer = Moxml::Signature::Serializer.new(context: ctx)
+      doc.root.add_child(serializer.serialize(signature).root)
+
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: key)
+      expect(result.valid?).to be true
+
+      # Library returns the reference result; application must check URI.
+      ref = result.results.first.references.first
+      expect(ref.uri).to eq("#real")
+    end
+  end
+
+  describe "adapter portability" do
+    # Skip on Opal — adapter switching is the whole point of moxml.
+    it "verifies a signature produced under one adapter with another", :adapter_portability do
+      skip "Only Nokogiri available in CI" unless defined?(Nokogiri)
+
+      signing_ctx = Moxml.new(:nokogiri)
+      verify_ctx = Moxml.new(:nokogiri) # would be :rexml in a multi-adapter env
+
+      key = OpenSSL::PKey::RSA.generate(2048)
+      doc = signing_ctx.parse("<doc>payload</doc>")
+      signature = Moxml::Signature.sign(
+        context: signing_ctx, document: doc, key: key,
+        signature_method: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+        canonicalization_method: "http://www.w3.org/2001/10/xml-exc-c14n#",
+        digest_method: "http://www.w3.org/2001/04/xmlenc#sha256",
+        reference_uri: "",
+        transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature"]
+      )
+      serializer = Moxml::Signature::Serializer.new(context: signing_ctx)
+      doc.root.add_child(serializer.serialize(signature).root)
+
+      # Round-trip the XML through a different context
+      xml = doc.to_xml(indent: 0)
+      doc2 = verify_ctx.parse(xml)
+
+      result = Moxml::Signature.verify(context: verify_ctx, document: doc2, key: key)
+      expect(result.valid?).to be true
+    end
+  end
+end

data/spec/moxml/signature/fixtures_spec.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+# Parses fixtures produced by the nokogiri-xmlsec-instructure reference
+# implementation (which wraps libxmlsec1). The fixtures are real-world
+# XML signatures; verifying them byte-for-byte requires byte-exact
+# canonicalization (see TODO.complete/05-c14n-engine.md — inclusive C14N
+# 1.0/1.1 are stubs). These specs assert the parser handles the wire
+# format correctly.
+RSpec.describe "Ported reference fixtures" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+  let(:fixtures_dir) do
+    File.expand_path("../../fixtures/xmldsig", __dir__)
+  end
+
+  describe "sign2-result.xml (libxmlsec1 enveloped RSA-SHA256)" do
+    let(:xml) { File.read(File.join(fixtures_dir, "sign2-result.xml")) }
+    let(:doc) { ctx.parse(xml) }
+    let(:signature_element) do
+      doc.at_xpath("//ds:Signature", "ds" => "http://www.w3.org/2000/09/xmldsig#") ||
+        doc.at_xpath("//*[local-name()='Signature']")
+    end
+
+    it "is parseable into a model" do
+      parsed = Moxml::Signature::Parser.new(context: ctx).parse(signature_element)
+      expect(parsed.signed_info).not_to be_nil
+      expect(parsed.signed_info.canonicalization_method.algorithm)
+        .to eq("http://www.w3.org/2001/10/xml-exc-c14n#")
+      expect(parsed.signed_info.signature_method.algorithm)
+        .to eq("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
+      expect(parsed.signed_info.references.length).to eq(1)
+
+      ref = parsed.signed_info.references.first
+      expect(ref.digest_method.algorithm)
+        .to eq("http://www.w3.org/2001/04/xmlenc#sha256")
+      expect(ref.digest_value).to eq("Gx8CGUsbi2qvBLd15VCmwELbDMND8F4vY3jPOc7/FJ0=")
+      # Reference uses 1024-bit RSA (libxmlsec1 test key) → 128-byte signature.
+      expect(parsed.signature_value.value.bytesize).to eq(128)
+    end
+
+    it "decodes SignatureValue despite embedded newlines (libxmlsec1 wraps long base64)" do
+      parsed = Moxml::Signature::Parser.new(context: ctx).parse(signature_element)
+      expect(parsed.signature_value.value.bytesize).to eq(128)
+    end
+
+    it "exposes the transforms chain" do
+      parsed = Moxml::Signature::Parser.new(context: ctx).parse(signature_element)
+      transforms = parsed.signed_info.references.first.transforms
+      expect(transforms.size).to eq(2)
+      expect(transforms.transforms.map(&:algorithm)).to eq([
+                                                             "http://www.w3.org/2000/09/xmldsig#enveloped-signature",
+                                                             "http://www.w3.org/2001/10/xml-exc-c14n#",
+                                                           ])
+    end
+
+    it "cross-verifies with the Ruby ref's RSA public key" do
+      pub_pem = File.read(File.join(fixtures_dir, "keys", "rsa_ref.pub"))
+      pub = OpenSSL::PKey::RSA.new(pub_pem)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: pub)
+      expect(result.valid?).to be true
+      expect(result.results.first.signature_valid?).to be true
+      expect(result.results.first.references.first.valid?).to be true
+    end
+  end
+
+  describe "sign2-doc.xml (the unsigned payload)" do
+    let(:xml) { File.read(File.join(fixtures_dir, "sign2-doc.xml")) }
+
+    it "is the expected enveloped payload" do
+      doc = ctx.parse(xml)
+      expect(doc.root.name).to eq("Envelope")
+      # Data is in the default urn:envelope namespace.
+      data = doc.at_xpath("//*[local-name()='Data']")
+      expect(data.text.strip).to eq("Hello, World!")
+    end
+  end
+end