pyFF 3.0.0__tar.gz → 3.1.0__tar.gz

{pyff-3.0.0 → pyff-3.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: pyFF
-Version: 3.0.0
+Version: 3.1.0
 Summary: Federation Feeder
 Author: Leif Johansson, Fredrik Thulin, Enrique Pérez Arnaud, Mikael Frykholm
 Author-email: Leif Johansson <leifj@sunet.se>, Fredrik Thulin <redrik@thulin.net>, Mikael Frykholm <mifr@sunet.se>
@@ -40,8 +40,8 @@ Requires-Dist: pyconfig>=3.3.0
 Requires-Dist: pydantic>=2.8
 Requires-Dist: pyramid>=2.1
 Requires-Dist: pytz>=2025.2
-Requires-Dist: pyuppsala>=0.13.0
-Requires-Dist: pybergshamra>=0.11.0
+Requires-Dist: pyuppsala>=0.13.1
+Requires-Dist: pybergshamra>=0.11.1
 Requires-Dist: pyyaml>=3.10
 Requires-Dist: redis>=5.3.0
 Requires-Dist: redis-collections>=0.13.0
@@ -101,8 +101,8 @@ Features
 Dependencies
 ============
 
-* pybergshamra >= 0.11.0 (XML signatures and PKCS#11 support)
-* pyuppsala >= 0.11.0 (XML processing)
+* pybergshamra >= 0.11.1 (XML signatures and PKCS#11 support)
+* pyuppsala >= 0.13.1 (XML processing)
 * pygments
 * gunicorn (for the standalone pyffd server)
 * ... cf pyproject.toml

{pyff-3.0.0 → pyff-3.1.0}/README.rst

@@ -41,8 +41,8 @@ Features
 Dependencies
 ============
 
-* pybergshamra >= 0.11.0 (XML signatures and PKCS#11 support)
-* pyuppsala >= 0.11.0 (XML processing)
+* pybergshamra >= 0.11.1 (XML signatures and PKCS#11 support)
+* pyuppsala >= 0.13.1 (XML processing)
 * pygments
 * gunicorn (for the standalone pyffd server)
 * ... cf pyproject.toml

{pyff-3.0.0 → pyff-3.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyFF"
-version = "3.0.0"
+version = "3.1.0"
 readme = "README.rst"
 description = "Federation Feeder"
 requires-python = ">=3.11"
@@ -15,8 +15,8 @@ dependencies = [
     "pydantic>=2.8",
     "pyramid>=2.1",
     "pytz>=2025.2",
-    "pyuppsala>=0.13.0",
-    "pybergshamra>=0.11.0",
+    "pyuppsala>=0.13.1",
+    "pybergshamra>=0.11.1",
     "pyyaml>=3.10",
     "redis>=5.3.0",
     "redis-collections>=0.13.0",

{pyff-3.0.0 → pyff-3.1.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "pyFF"
-version = "3.0.0"
+version = "3.1.0"
 readme = "README.rst"
 description = "Federation Feeder"
 requires-python = ">=3.11"
@@ -26,8 +26,8 @@ dependencies = [
     "pydantic>=2.8",
     "pyramid>=2.1",
     "pytz>=2025.2",
-    "pyuppsala>=0.13.0",
-    "pybergshamra>=0.11.0",
+    "pyuppsala>=0.13.1",
+    "pybergshamra>=0.11.1",
     "pyyaml>=3.10",
     "redis>=5.3.0",
     "redis-collections>=0.13.0",

{pyff-3.0.0 → pyff-3.1.0}/src/pyff/builtins.py

@@ -693,7 +693,8 @@ def load(req: Plumbing.Request, *opts):
     - ``as``: name the resource, e.g. to refer to it in later pipeline steps.
     - ``verify``: check the XML signature of the resource, using either a PEM certificate file or a SHA-1
       fingerprint of the signing certificate. With a fingerprint, the certificate embedded in the signature is
-      used and the fingerprint pins it.
+      used and the fingerprint pins it. ``verify`` may be repeated to support key rollovers; a signature by any
+      one of the given certificates (or fingerprints) is accepted. Certificates and fingerprints cannot be mixed.
     - ``via``: name of a ``when`` clause in the same pipeline that is applied to the loaded metadata, for
       example to remove entities with ``fork merge remove``.
     - ``cleanup``: name of a ``when`` clause used to pre-process the parsed metadata before it is validated.
@@ -718,7 +719,7 @@ def load(req: Plumbing.Request, *opts):
         log.debug(f"load parsing '{stripped}'")
         r = stripped.split()
 
-        assert len(r) in range(1, 8), PipeException(
+        assert len(r) in range(1, 12), PipeException(
             "Usage: load resource [as url] [[verify] verification] [via pipeline] [cleanup pipeline]"
         )
 
@@ -736,7 +737,7 @@ def load(req: Plumbing.Request, *opts):
                     if elt == "as":
                         child_opts.alias = value
                     elif elt == "verify":
-                        child_opts.verify = value
+                        child_opts.verify = [*(child_opts.verify or []), value]
                     elif elt == "via":
                         child_opts.via.append(PipelineCallback(value, req, store=req.md.store))
                     elif elt == "cleanup":
@@ -748,7 +749,7 @@ def load(req: Plumbing.Request, *opts):
                         "Usage: load resource [as url] [[verify] verification] [via pipeline]* [cleanup pipeline]*"
                     )
             else:
-                child_opts.verify = elt
+                child_opts.verify = [*(child_opts.verify or []), elt]
 
         # override anything in child_opts with what is in opts
         child_opts = child_opts.model_copy(update=_opts)

{pyff-3.0.0 → pyff-3.1.0}/src/pyff/resource.py

@@ -18,7 +18,7 @@ from typing import TYPE_CHECKING, Any, Callable
 from urllib.parse import quote as urlescape
 
 import requests
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 from pyuppsala.etree import ElementTree
 from requests.adapters import Response
 
@@ -204,8 +204,9 @@ class _NativeResponse:
 
 class ResourceOpts(BaseModel):
     alias: str | None = Field(None, alias='as')  # TODO: Rename to 'name'?
-    # a certificate (file) or a SHA1 fingerprint to use for signature verification
-    verify: str | None = None
+    # certificates (file or PEM text) or SHA1 fingerprints to use for signature verification; a signature by any
+    # one of them is accepted, which allows key rollovers
+    verify: list[str] | None = None
     # TODO: move classes to make the correct typing work: Iterable[Union[Lambda, PipelineCallback]] = Field([])
     via: list[Callable] = Field([])
     # A list of callbacks that can be used to pre-process parsed metadata before validation. Use as a clue-bat.
@@ -219,6 +220,11 @@ class ResourceOpts(BaseModel):
     verify_tls: bool = False
     model_config = ConfigDict(arbitrary_types_allowed=True)
 
+    @field_validator('verify', mode='before')
+    @classmethod
+    def _wrap_single_verify(cls, value):
+        return [value] if isinstance(value, str) else value
+
     def to_dict(self) -> dict[str, Any]:
         res = self.model_dump()
         # Compensate for the 'alias' field options

{pyff-3.0.0 → pyff-3.1.0}/src/pyff/samlmd.py

@@ -20,6 +20,7 @@ from pyff.parse import ParserInfo, PyffParser, add_parser
 from pyff.utils import (
     Lambda,
     b2u,
+    b64_to_pem,
     cert_dict,
     check_signature,
     collect_attr,
@@ -112,7 +113,7 @@ def parse_saml_metadata(
 
         expire_time_offset = metadata_expiration(t)
 
-        t = check_signature(t, opts.verify)
+        t = check_signature(t, opts.verify, source=base_url)
 
         trust_info = None
         extensions = t.find('{{{}}}Extensions'.format(NS['md']))
@@ -305,23 +306,22 @@ class MDServiceListParser(PyffParser):
                 if location:
                     certs = cert_dict(ml)
                     fingerprints = list(certs.keys())
-                    fp = None
-                    if len(fingerprints) > 0:
-                        fp = fingerprints[0]
 
                     ep = ml.find("{{{}}}Endpoint".format(NS['ser']))
-                    if ep is not None and fp is not None:
+                    if ep is not None and fingerprints:
                         args = dict(
                             country_code=mdl.get('Territory'),
                             hide_from_discovery=str2bool(ep.get('HideFromDiscovery', 'false')),
                         )
                         log.debug(
                             "MDSL[{}]: {} verified by {} for country {}".format(
-                                info.scheme_territory, location, fp, args.get('country_code')
+                                info.scheme_territory, location, ', '.join(fingerprints), args.get('country_code')
                             )
                         )
                         child_opts = resource.opts.model_copy(update={'alias': None}, deep=True)
-                        child_opts.verify = fp
+                        # The listed certificates are the trusted signers; all of them are accepted so that a
+                        # key rollover can list both the old and the new certificate.
+                        child_opts.verify = [b64_to_pem(cert_b64) for cert_b64 in certs.values()]
                         r = resource.add_child(location, child_opts)
 
                         # this is specific post-processing for MDSL files

{pyff-3.0.0 → pyff-3.1.0}/src/pyff/test/data/metadata/edugain-trustinfo-2.0.xml

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
-name: pyff-3.0.0/src/pyff/test/data/metadata/edugain-trustinfo-2.0.xml
+name: pyff-3.1.0/src/pyff/test/data/metadata/edugain-trustinfo-2.0.xml
 size: 83107927 bytes
 sha256: 9646f2c1428ee2522e2c8f493daa3b80d11825e23d827a2d6e16dabdc58ca466

pyff-3.1.0/src/pyff/test/data/metadata/test07-xsi-type-middleware.xml

@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:eidas="http://eidas.europa.eu/saml-extensions" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_eumiddleware" entityID="https://test.demw.eidas.swedenconnect.se/eidas-middleware/Metadata" validUntil="2026-12-09T09:46:59.594Z">
+  <ds:Signature>
+    <ds:SignedInfo>
+      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+      <ds:SignatureMethod Algorithm="http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1"/>
+      <ds:Reference URI="#_eumiddleware">
+        <ds:Transforms>
+          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+            <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xsd"/>
+          </ds:Transform>
+        </ds:Transforms>
+        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+        <ds:DigestValue>gVjWffnS2gYWlNyqxkCbQynU425D1pqZiHJvNQr1xtU=</ds:DigestValue>
+      </ds:Reference>
+    </ds:SignedInfo>
+    <ds:SignatureValue>MgE/0IKAPG2+TkzbVOj6NZpcMMMJVN+1pqdqF6nKPNCE0Lfy4vLdap9qxtzDpbQpl7Ece0zYQnHYn6J/x9FjRm6N/jBth+YNxwmNtyE5GyxsVmNIAhSvMkerKqgHBxKmkTrp17au7bQzxHexvGEnkA0OzmuHstO0cKiCZ7B6ykCCOnh8ydSXkUeUAFfSzpoBraIz0FqcSnoK5LfxzZfSiA3Q1JzaPkmdLf5tIzw1OxwR1ggyIXLsh3q8buWV4otEFRS6cPF9iRvwlIIEqLn8klIlzFTNC5mVcoVUNuShdEsU03xkTATfnJMKdbFa4P3ArIMDtEV3KEoi5SY5mnpXSPtfstYyVn0Y0nDnBhWpDCdy/2xEq/0B6JxMlqwuWlI8XP+ayn5c7pw7Y2m/3tBZIr8IQftQBYGBrpGQk1eYJmKH9SeT6iX5mXi9ElqGee5UPIb/ogAMdSBWpp2wQwcPC+Xe3vNlt8o1P4XAehElzBhj7loMvqbC+BUVMCLDHJ58Zvy8bE5d54mb4M+tlpZnYU+sgqqm3DHmCZJw4sQ0odXoYQFsQeQOlMXFxN+mMZvDNi0eOoirN8euwLWy/sSbhpP0zp6ELT/kurmqxx//QGfGWHANu8Ab+qhmBm374frL4ehd8dLx28JYCP+0It5br0pJrNi3uaLNKhGexslyCOk=</ds:SignatureValue>
+    <ds:KeyInfo>
+      <ds:X509Data>
+        <ds:X509Certificate>MIIE5TCCAs2gAwIBAgIBfTANBgkqhkiG9w0BAQsFADAsMQ8wDQYDVQQKEwZTQ1RFU1QxGTAXBgNVBAMTEFNBTUwgU2lnbmVyIFRlc3QwHhcNMjMxMjEzMDAwMDAwWhcNMjcxMjEyMDAwMDAwWjAsMQ8wDQYDVQQKEwZTQ1RFU1QxGTAXBgNVBAMTEFNBTUwgU2lnbmVyIFRlc3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCpRC2dXoyg26aWMvWshKF6LEGBgti6frNnBDehY/xPtSsaJgfA3Ba413GgGbFS6sxYUlzLR1XljnNvOaPIMfENYVN/JxMCtLZs2/UiqD06F7PwGQzargHgTWxfApEyJFxl08IkDYNILxd7r7kFOiDEAYhHOFqtaCAFz1w8xAAGq5M499TfyPTkbXp/hgBLu2OcNqwjztV3W8WIp8XwwLS7iBW5yZOzTHlWy/SHpl9N1tZscDVPIAumLrDAGHOxrKgVKdRmUqscpe+XoqpubE0841C/Bt/3YQbXxYLTn7R5nqHi59y5MzmlokIQYJ4cS90OQeJZ10yXXuQSyWDBUEKqi3KMzPpQCs0Bnn8yHEtDjFdkpkTVf/iHupsvb4cPwt/XDt0z0pzRXIA+/jFfI/UrvjHskaoBJvBc/Nhi9sisHKtoIuLWfbVQGkkjZgTaIkUCB2X192cuPTNDnwPoHjHYmI364rQ99oWuxAt/U6hs+ipnOP6U2CBW+4+ynqu9GZYji5SR9RgKdG/j5e9uVhe0eKT2rAN88TfIfBz2fRzNU4HV2jExIb6L13SAyO/9WyNC5uv7cJA6VYHG8ygZjoY79HfnZb3wPW3W7a32hr4YD36vKXi+6exFVel1uJNWu3rdGRdTL6OiVF2HW1Gl1iqHwdvh7OR8Upv6TnnlnxlodwIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCAgQwDQYJKoZIhvcNAQELBQADggIBAEXwkfny+YEBO9ALqTrTUK/1baIKi0CLQ/CZ0We/5BFjIp6KQphTGy5lzqtBG3Y68FO6JjOHbcDPZJfyjfniYjuRWh4bHgaBdu7NSdHZW9t6PeT14by6r9/pSjx9llDKchG2gSObuMuH5uI4t3c/hNhW17gv8m5/MzxxBJrR5lULPvMC3+v0Uy60MnycxcPDAi4HQfNkdHf+t3MLwH/HF60OAZ+pXHkahEJn3/F4nKQR8j8rdrn2ZT5mbYwjG27MZ7bhmFLfBtV6jXfQZqDfcxvOP8waEyxyMNah/a5LVQz+PJT+RHF4wqsigiMa248z8YCiz3oj6irpW4Ln/7YnJ8UTatRIOP7xK8hR2gUGtYxHxuGHASqn7tOGRlIdIZFROd28y2HSqgfApg5KUh2eupWMAnXlkcpxiLPz4rx+FX3kditH1z24HzcH2g3ytvL90j/7Gh1cp7BD3e3lf76wzLHUlIH+O573V8XPe1fAyutxsaHIY5S2VHv8fmFODqAS7uPyuZ1pc8gVAJEERGzbLL5WwZETXONrYpRoVIX8ojAU4sOCN8RRnrF5k1obgYj0B72ziXXZ8D/or9AP1BE7npmURLZ2qKM+FeTInZxKcYyLrvpkqVgyX6YM6cV+/XlG3LwS5D8gpKvD5+DIcQMwKXVEXNg3xncodVl2tdPeM8/D</ds:X509Certificate>
+      </ds:X509Data>
+    </ds:KeyInfo>
+  </ds:Signature>
+  <md:Extensions>
+    <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
+      <saml2:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+        <saml2:AttributeValue>http://eidas.europa.eu/LoA/high</saml2:AttributeValue>
+      </saml2:Attribute>
+      <saml2:Attribute Name="http://eidas.europa.eu/entity-attributes/protocol-version" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+        <saml2:AttributeValue xsi:type="xsd:string">1.4.1</saml2:AttributeValue>
+      </saml2:Attribute>
+      <saml2:Attribute Name="http://eidas.europa.eu/entity-attributes/application-identifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+        <saml2:AttributeValue xsi:type="xsd:string">German eIDAS Middleware version: 4.1.0</saml2:AttributeValue>
+      </saml2:Attribute>
+      <saml2:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+        <saml2:AttributeValue>http://eidas.europa.eu/entity-attributes/termsofaccess/requesterid</saml2:AttributeValue>
+      </saml2:Attribute>
+    </mdattr:EntityAttributes>
+    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256" MinKeySize="256"/>
+    <alg:SigningMethod Algorithm="http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1" MaxKeySize="4096" MinKeySize="3072"/>
+  </md:Extensions>
+  <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:Extensions>
+      <eidas:NodeCountry>DE</eidas:NodeCountry>
+    </md:Extensions>
+    <md:KeyDescriptor use="signing">
+      <ds:KeyInfo>
+        <ds:X509Data>
+          <ds:X509Certificate>MIIE5TCCAs2gAwIBAgIBfTANBgkqhkiG9w0BAQsFADAsMQ8wDQYDVQQKEwZTQ1RFU1QxGTAXBgNVBAMTEFNBTUwgU2lnbmVyIFRlc3QwHhcNMjMxMjEzMDAwMDAwWhcNMjcxMjEyMDAwMDAwWjAsMQ8wDQYDVQQKEwZTQ1RFU1QxGTAXBgNVBAMTEFNBTUwgU2lnbmVyIFRlc3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCpRC2dXoyg26aWMvWshKF6LEGBgti6frNnBDehY/xPtSsaJgfA3Ba413GgGbFS6sxYUlzLR1XljnNvOaPIMfENYVN/JxMCtLZs2/UiqD06F7PwGQzargHgTWxfApEyJFxl08IkDYNILxd7r7kFOiDEAYhHOFqtaCAFz1w8xAAGq5M499TfyPTkbXp/hgBLu2OcNqwjztV3W8WIp8XwwLS7iBW5yZOzTHlWy/SHpl9N1tZscDVPIAumLrDAGHOxrKgVKdRmUqscpe+XoqpubE0841C/Bt/3YQbXxYLTn7R5nqHi59y5MzmlokIQYJ4cS90OQeJZ10yXXuQSyWDBUEKqi3KMzPpQCs0Bnn8yHEtDjFdkpkTVf/iHupsvb4cPwt/XDt0z0pzRXIA+/jFfI/UrvjHskaoBJvBc/Nhi9sisHKtoIuLWfbVQGkkjZgTaIkUCB2X192cuPTNDnwPoHjHYmI364rQ99oWuxAt/U6hs+ipnOP6U2CBW+4+ynqu9GZYji5SR9RgKdG/j5e9uVhe0eKT2rAN88TfIfBz2fRzNU4HV2jExIb6L13SAyO/9WyNC5uv7cJA6VYHG8ygZjoY79HfnZb3wPW3W7a32hr4YD36vKXi+6exFVel1uJNWu3rdGRdTL6OiVF2HW1Gl1iqHwdvh7OR8Upv6TnnlnxlodwIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCAgQwDQYJKoZIhvcNAQELBQADggIBAEXwkfny+YEBO9ALqTrTUK/1baIKi0CLQ/CZ0We/5BFjIp6KQphTGy5lzqtBG3Y68FO6JjOHbcDPZJfyjfniYjuRWh4bHgaBdu7NSdHZW9t6PeT14by6r9/pSjx9llDKchG2gSObuMuH5uI4t3c/hNhW17gv8m5/MzxxBJrR5lULPvMC3+v0Uy60MnycxcPDAi4HQfNkdHf+t3MLwH/HF60OAZ+pXHkahEJn3/F4nKQR8j8rdrn2ZT5mbYwjG27MZ7bhmFLfBtV6jXfQZqDfcxvOP8waEyxyMNah/a5LVQz+PJT+RHF4wqsigiMa248z8YCiz3oj6irpW4Ln/7YnJ8UTatRIOP7xK8hR2gUGtYxHxuGHASqn7tOGRlIdIZFROd28y2HSqgfApg5KUh2eupWMAnXlkcpxiLPz4rx+FX3kditH1z24HzcH2g3ytvL90j/7Gh1cp7BD3e3lf76wzLHUlIH+O573V8XPe1fAyutxsaHIY5S2VHv8fmFODqAS7uPyuZ1pc8gVAJEERGzbLL5WwZETXONrYpRoVIX8ojAU4sOCN8RRnrF5k1obgYj0B72ziXXZ8D/or9AP1BE7npmURLZ2qKM+FeTInZxKcYyLrvpkqVgyX6YM6cV+/XlG3LwS5D8gpKvD5+DIcQMwKXVEXNg3xncodVl2tdPeM8/D</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://test.demw.eidas.swedenconnect.se/eidas-middleware/RequestReceiver"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://test.demw.eidas.swedenconnect.se/eidas-middleware/RequestReceiver"/>
+    <saml2:Attribute FriendlyName="FamilyName" Name="http://eidas.europa.eu/attributes/naturalperson/CurrentFamilyName"/>
+    <saml2:Attribute FriendlyName="FirstName" Name="http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName"/>
+    <saml2:Attribute FriendlyName="CurrentAddress" Name="http://eidas.europa.eu/attributes/naturalperson/CurrentAddress"/>
+    <saml2:Attribute FriendlyName="PersonIdentifier" Name="http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier"/>
+    <saml2:Attribute FriendlyName="BirthName" Name="http://eidas.europa.eu/attributes/naturalperson/BirthName"/>
+    <saml2:Attribute FriendlyName="PlaceOfBirth" Name="http://eidas.europa.eu/attributes/naturalperson/PlaceOfBirth"/>
+    <saml2:Attribute FriendlyName="DateOfBirth" Name="http://eidas.europa.eu/attributes/naturalperson/DateOfBirth"/>
+    <saml2:Attribute FriendlyName="Nationality" Name="http://eidas.europa.eu/attributes/naturalperson/Nationality"/>
+  </md:IDPSSODescriptor>
+  <md:Organization>
+    <md:OrganizationName xml:lang="sv">Sweden Connect</md:OrganizationName>
+    <md:OrganizationDisplayName xml:lang="sv">Sweden Connect</md:OrganizationDisplayName>
+    <md:OrganizationURL xml:lang="sv">https://swedenconnect.se</md:OrganizationURL>
+  </md:Organization>
+  <md:ContactPerson contactType="technical">
+    <md:Company>Sweden Connect</md:Company>
+    <md:GivenName>Sweden Connect</md:GivenName>
+    <md:SurName>Operations</md:SurName>
+    <md:EmailAddress>operations@swedenconnect.se</md:EmailAddress>
+    <md:TelephoneNumber>+46105742100</md:TelephoneNumber>
+  </md:ContactPerson>
+  <md:ContactPerson contactType="support">
+    <md:Company>Sweden Connect</md:Company>
+    <md:GivenName>Sweden Connect</md:GivenName>
+    <md:SurName>Operations</md:SurName>
+    <md:EmailAddress>operations@swedenconnect.se</md:EmailAddress>
+    <md:TelephoneNumber>+46105742100</md:TelephoneNumber>
+  </md:ContactPerson>
+</md:EntityDescriptor>

{pyff-3.0.0 → pyff-3.1.0}/src/pyff/test/test_pipeline.py

@@ -770,6 +770,85 @@ class SigningTest(PipeLineTest):
         with pytest.raises(OSError):
             self.exec_pipeline("- read_xml:\n    file: /nonexistent.xml\n")
 
+    def test_verify_with_multiple_certificates_and_fingerprints(self):
+        """A key rollover lists several signers; any one of them must verify."""
+        import datetime
+        import hashlib
+
+        from cryptography import x509
+        from cryptography.hazmat.primitives import hashes, serialization
+        from cryptography.hazmat.primitives.asymmetric import rsa
+        from cryptography.x509.oid import NameOID
+
+        from pyff.constants import NS
+        from pyff.exceptions import MetadataException
+        from pyff.utils import check_signature
+
+        other_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, 'other')])
+        now = datetime.datetime.now(datetime.timezone.utc)
+        other_cert = (
+            x509.CertificateBuilder()
+            .subject_name(name)
+            .issuer_name(name)
+            .public_key(other_key.public_key())
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(now)
+            .not_valid_after(now + datetime.timedelta(days=2))
+            .sign(other_key, hashes.SHA256())
+        )
+
+        with open(self.public_keyspec, 'rb') as fd:
+            signer_cert = x509.load_pem_x509_certificate(fd.read())
+
+        def fingerprint(cert):
+            return hashlib.sha1(cert.public_bytes(serialization.Encoding.DER)).hexdigest()
+
+        tmpdir = tempfile.mkdtemp()
+        try:
+            src = os.path.join(tmpdir, 'mdsl.xml')
+            other_pem = os.path.join(tmpdir, 'other.pem')
+            with open(src, 'w') as fd:
+                fd.write(
+                    f'<ser:MetadataServiceList xmlns:ser="{NS["ser"]}" Version="1">'
+                    '<ser:IssuerName>Test</ser:IssuerName></ser:MetadataServiceList>'
+                )
+            with open(other_pem, 'wb') as fd:
+                fd.write(other_cert.public_bytes(serialization.Encoding.PEM))
+            res, _md = self.exec_pipeline(
+                f"""
+- read_xml:
+    file: {src}
+- sign:
+    key: {self.private_keyspec}
+    cert: {self.public_keyspec}
+"""
+            )
+
+            t = root(res)
+            other_pem_text = other_cert.public_bytes(serialization.Encoding.PEM).decode()
+            signer_pem_text = signer_cert.public_bytes(serialization.Encoding.PEM).decode()
+            for keys in (
+                [other_pem, self.public_keyspec],
+                [self.public_keyspec, other_pem],
+                [other_pem_text, signer_pem_text],
+                [signer_pem_text, other_pem_text],
+                [fingerprint(other_cert), fingerprint(signer_cert)],
+                [fingerprint(signer_cert), fingerprint(other_cert)],
+            ):
+                check_signature(t, keys, only_one_signature=True)
+
+            with pytest.raises(MetadataException):
+                check_signature(t, other_pem)
+            with pytest.raises(MetadataException):
+                check_signature(t, [other_pem_text])
+            with pytest.raises(MetadataException, match="does not match"):
+                check_signature(t, fingerprint(other_cert))
+            with pytest.raises(MetadataException, match="cannot be mixed"):
+                check_signature(t, [other_pem, fingerprint(signer_cert)])
+        finally:
+            shutil.rmtree(tmpdir)
+
     def test_signing_and_validation(self):
         self.output = tempfile.NamedTemporaryFile('w').name
         _res_s, _md_s, _ctx_s = self.run_pipeline("signer.fd", self)
@@ -1226,6 +1305,44 @@ class SigningTest(PipeLineTest):
             except OSError:
                 pass
 
+    def test_xslt_cleanup_keeps_xsi_type_prefixes(self):
+        """XSLT-rewritten metadata must stay well-formed when attributes use xsi:/xsd: prefixes.
+
+        eIDAS middleware metadata (test07-xsi-type-middleware.xml) uses
+        xsi:type="xsd:string". Running it through an xslt step must not produce output
+        with an undeclared prefix ("Undeclared namespace prefix: xsi"), which broke
+        loading in pyuppsala (https://github.com/kushaldas/pyuppsala/issues/36).
+        """
+        entity = 'https://test.demw.eidas.swedenconnect.se/eidas-middleware/Metadata'
+        xsi_type = '{http://www.w3.org/2001/XMLSchema-instance}type'
+        tmpfile = tempfile.NamedTemporaryFile('w').name
+        try:
+            self.exec_pipeline(
+                f"""
+- when clean:
+    - xslt:
+       stylesheet: tidy.xsl
+    - check_xml_namespaces
+    - break
+- load:
+   - file://{self.datadir}/metadata/test07-xsi-type-middleware.xml cleanup clean
+- select
+- publish: {tmpfile}
+"""
+            )
+            t2 = parse_xml(tmpfile)
+            assert t2 is not None
+            entity_elt = t2.find(".//{{{}}}EntityDescriptor[@entityID='{}']".format(NS['md'], entity))
+            assert entity_elt is not None, "entity was dropped after the xslt step"
+            typed = entity_elt.findall(".//*[@{http://www.w3.org/2001/XMLSchema-instance}type]")
+            assert typed, "xsi:type attributes were lost or lost their namespace"
+            assert all(e.get(xsi_type) == 'xsd:string' for e in typed)
+        finally:
+            try:
+                os.unlink(tmpfile)
+            except OSError:
+                pass
+
     def test_wsfed_type_prefix_survives(self):
         """A complex-type xsi:type prefix (as opposed to a datatype prefix like xs/xsd)
         needs no special-casing: real WS-Fed metadata also carries elements in that

pyff-3.1.0/src/pyff/test/test_xslt_namespaces.py

@@ -0,0 +1,45 @@
+from unittest import TestCase
+
+from pyuppsala import etree
+
+XSI = "http://www.w3.org/2001/XMLSchema-instance"
+XSL_HEAD = b'<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">'
+
+
+def _transform(stylesheet: bytes, source: bytes):
+    result = etree.XSLT(etree.fromstring(stylesheet))(etree.fromstring(source))
+    # getroot() reparses the serialized output, so an undeclared prefix raises here
+    return result.getroot()
+
+
+class TestXSLTNamespaceDeclarations(TestCase):
+    """Created attributes must carry the namespace declaration they need (XSLT 1.0 7.1.3).
+
+    Regression tests for https://github.com/kushaldas/pyuppsala/issues/36.
+    """
+
+    def test_attribute_copied_into_literal_result_element(self):
+        xsl = (
+            XSL_HEAD
+            + b"""
+<xsl:template match="/root"><out><xsl:apply-templates select="node()|@*"/></out></xsl:template>
+<xsl:template match="*"><xsl:copy><xsl:apply-templates select="node()|@*"/></xsl:copy></xsl:template>
+<xsl:template match="text()|@*"><xsl:copy/></xsl:template>
+</xsl:stylesheet>"""
+        )
+        src = b'<root xmlns:xsi="%s" xsi:type="xsd:string"><a xsi:type="x"/></root>' % XSI.encode()
+        out = _transform(xsl, src)
+        assert out.get('{%s}type' % XSI) == 'xsd:string'
+        assert out[0].get('{%s}type' % XSI) == 'x'
+
+    def test_prefix_declared_only_on_dropped_element(self):
+        xsl = (
+            XSL_HEAD
+            + b"""
+<xsl:template match="/"><out><xsl:copy-of select="//a/@*"/><b><xsl:copy-of select="//a/@*"/></b></out></xsl:template>
+</xsl:stylesheet>"""
+        )
+        src = b'<root><a xmlns:xsi="%s" xsi:type="t"/></root>' % XSI.encode()
+        out = _transform(xsl, src)
+        assert out.get('{%s}type' % XSI) == 't'
+        assert out[0].get('{%s}type' % XSI) == 't'

{pyff-3.0.0 → pyff-3.1.0}/src/pyff/utils.py

@@ -17,7 +17,7 @@ import threading
 import time
 import traceback
 from _collections_abc import Mapping, MutableMapping
-from collections.abc import Sequence
+from collections.abc import Iterable, Sequence
 from copy import copy
 from datetime import datetime, timedelta, timezone
 from email.utils import parsedate
@@ -271,6 +271,9 @@ def redis():
     return thread_data.redis
 
 
+PEM_CERT_PREFIX = '-----BEGIN CERTIFICATE-----'
+
+
 def _looks_like_sha1_fingerprint(key: str) -> bool:
     """Return True if ``key`` looks like a SHA1 certificate fingerprint.
 
@@ -283,39 +286,71 @@ def _looks_like_sha1_fingerprint(key: str) -> bool:
     return len(candidate) == 40 and all(c in '0123456789abcdefABCDEF' for c in candidate)
 
 
-def check_signature(t: ElementTree, key: Optional[str], only_one_signature: bool = False) -> ElementTree:
+def check_signature(
+    t: ElementTree,
+    key: Optional[Union[str, Iterable[str]]],
+    only_one_signature: bool = False,
+    source: Optional[str] = None,
+) -> ElementTree:
     """Verify the XML signature on ``t`` using pybergshamra.
 
-    ``key`` is either the path to a PEM-encoded X.509 certificate (the trusted
-    signer) or a SHA1 fingerprint of the expected signing certificate. When a
-    fingerprint is supplied the certificate embedded in the signature's KeyInfo
-    is used to verify, and the fingerprint is checked against it afterwards.
+    ``key`` is one verifier or an iterable of them, which allows key rollovers:
+    the signature is accepted if it was made by any one of them. A verifier is
+    either a path to a PEM-encoded X.509 certificate file, the PEM text of a
+    certificate, or a SHA1 fingerprint of the expected signing certificate.
+    Fingerprints cannot be mixed with certificates.
+
+    Certificates are the trusted signing keys. When fingerprints are supplied
+    the certificate embedded in the signature's KeyInfo is used to verify, and
+    the fingerprint is checked against it afterwards.
+
+    ``source`` (typically the URL) is only used to identify the signed document in log messages.
     """
     if key is None:
         return t
 
-    log.debug(f"verifying signature using {key}")
+    of_source = f" of {source}" if source else ""
+
+    items = [key] if isinstance(key, str) else list(key)
+    items = [item.strip() for item in items if item.strip()]
+    if not items:
+        raise MetadataException("No certificate or fingerprint given to verify the signature")
+
+    log.debug(f"verifying signature{of_source} using {len(items)} verifier(s)")
 
     mgr = pybergshamra.KeysManager()
     ctx = pybergshamra.DsigContext(mgr)
 
-    pinned_fingerprint = None
-    if _looks_like_sha1_fingerprint(key) and not os.path.exists(key):
+    is_fingerprint = [
+        not item.startswith(PEM_CERT_PREFIX) and _looks_like_sha1_fingerprint(item) and not os.path.exists(item)
+        for item in items
+    ]
+    if any(is_fingerprint) and not all(is_fingerprint):
+        raise MetadataException("Certificates and fingerprints cannot be mixed in a single verification")
+
+    pinned_fingerprints: set[str] = set()
+    if all(is_fingerprint):
         # Fingerprint pinning: trust the cert carried inside the signature's
-        # KeyInfo/X509Data, then compare its SHA1 to the pinned fingerprint.
+        # KeyInfo/X509Data, then compare its SHA1 to the pinned fingerprints.
         # The fingerprint is the trust anchor here, so PKI chain validation is
         # disabled (insecure) - the embedded signing cert is typically
         # self-signed and would otherwise fail to chain to a trusted root.
-        pinned_fingerprint = key.replace(':', '').replace(' ', '').strip().lower()
+        pinned_fingerprints = {item.replace(':', '').replace(' ', '').lower() for item in items}
         ctx.enabled_key_data_x509 = True
         ctx.trusted_keys_only = False
         ctx.insecure = True
     else:
-        # Trusted-cert path: load the PEM certificate and require it as the
-        # only acceptable signing key (skip inline KeyInfo extraction).
-        with open(key, 'rb') as fd:
-            cert_key = pybergshamra.load_x509_cert_pem(fd.read())
-        mgr.add_key(cert_key)
+        # Trusted-cert path: load the PEM certificates and require them as the
+        # only acceptable signing keys (skip inline KeyInfo extraction).
+        cert_keys = []
+        for item in items:
+            if item.startswith(PEM_CERT_PREFIX):
+                pem = item.encode()
+            else:
+                with open(item, 'rb') as fd:
+                    pem = fd.read()
+            cert_keys.append(pybergshamra.load_x509_cert_pem(pem))
+        mgr.add_keys(cert_keys)
         ctx.trusted_keys_only = True
 
     relt = root(t)
@@ -340,16 +375,25 @@ def check_signature(t: ElementTree, key: Optional[str], only_one_signature: bool
             "XML metadata contains %d signatures - exactly 1 is required" % len(references)
         )
 
-    if pinned_fingerprint is not None:
+    # The leaf certificate that verified the signature: the matching trusted key
+    # in certificate mode, the one embedded in KeyInfo in fingerprint mode.
+    chain = result.key_info.x509_chain if result.key_info is not None else []
+    actual_fingerprint = hashlib.sha1(chain[0]).hexdigest().lower() if chain else None
+    if actual_fingerprint is not None:
+        log.debug(
+            f"signature{of_source} verified by certificate "
+            + ":".join(actual_fingerprint[i : i + 2] for i in range(0, len(actual_fingerprint), 2))
+        )
+
+    if pinned_fingerprints:
         # Confirm the certificate that actually verified the signature matches
-        # the pinned fingerprint (SHA1 over the DER-encoded leaf certificate).
-        chain = result.key_info.x509_chain if result.key_info is not None else []
-        if not chain:
+        # one of the pinned fingerprints (SHA1 over the DER-encoded leaf certificate).
+        if actual_fingerprint is None:
             raise MetadataException("No certificate found in signature to match fingerprint")
-        actual_fingerprint = hashlib.sha1(chain[0]).hexdigest().lower()
-        if actual_fingerprint != pinned_fingerprint:
+        if actual_fingerprint not in pinned_fingerprints:
             raise MetadataException(
-                f"Signing certificate fingerprint {actual_fingerprint} does not match expected {pinned_fingerprint}"
+                f"Signing certificate fingerprint {actual_fingerprint} does not match expected "
+                f"{', '.join(sorted(pinned_fingerprints))}"
             )
 
     # Anti-wrapping: the old code returned the verified reference subtree as the
@@ -396,6 +440,13 @@ def cert_dict(t):
     return certs
 
 
+def b64_to_pem(cert_b64: str) -> str:
+    """Wrap the base64 text of a DER certificate (as found in ``X509Certificate``) as PEM."""
+    body = "".join(cert_b64.split())
+    lines = [body[i : i + 64] for i in range(0, len(body), 64)]
+    return "\n".join([PEM_CERT_PREFIX, *lines, "-----END CERTIFICATE-----", ""])
+
+
 class CertInfo:
     """Lightweight wrapper around a parsed X.509 certificate.