Docs/CLI help: clarify --enabled-key-data usage (example: rsa,key-value,x509) and add FAQ note#917
Merged
lsh123 merged 11 commits intoMay 26, 2025
Conversation
Change comment to use apostrophes instead of backticks for 'DIR' to match project convention and increase consistency. No functional changes.
This patch adds a new command-line option, --add-key-value, which inserts the <KeyValue> element with the public RSA key (modulus and exponent) into the <KeyInfo> node during signature generation. Implementation is compatible with all supported OpenSSL versions, using provider APIs to retrieve key parameters and ensuring type safety. No changes to default behavior unless the option is specified.
Correct a minor typo by replacing ".." with "." at the end of the copyright line in apps/xmlsec.c and man/xmlsec1.1. No functional changes.
* tests/testAddKeyValue.sh
- Runs only when the selected crypto backend is OpenSSL
(skipped for NSS, GnuTLS, MSCrypto, MSCNG, etc., `--add-key-value` is a no-op stub).
- Signs an enveloping-SHA256 template with the new
`--add-key-value` switch and existing `rsakey.p12`.
- Confirms that `<RSAKeyValue>/<Modulus|Exponent>` were added.
- Verifies the signature with
`--lax-key-search --X509-skip-strict-checks`, allowing xmlsec
to fall back to the injected `<KeyValue>` even though the
bundled test certificate is self-signed.
* Makefile.am
- Adds `check-addkeyvalue` target so the test is executed by
`make check` when the build is configured with OpenSSL.
No changes to production code.
Mac platforms (Darwin/BSD) do not support `uname -o`, so every test
invocation printed:
uname: illegal option -- o
usage: uname [-amnprsv]
This patch keeps the original behaviour on Linux (where `uname -o`
returns “GNU/Linux”) but redirects the error and falls back to an
empty string on systems that lack the flag.
tests/testrun.sh
• replace
OS_ARCH=`uname -o`
with
OS_ARCH=`uname -o 2>/dev/null || echo ''`
No other logic is touched; the modification eliminates noisy stderr
output during `make check` on macOS.
…n KeyInfo" This reverts commit 7497160.
This reverts commit 59518b6.
* apps/xmlsec.c, xmlsec-man.html – add explicit "rsa,key-value,x509" example so users see how to add <RSAKeyValue> via <KeyValue/> placeholder. * faq.html – reference the same example in the security note. Docs only; no code behaviour changes.
lsh123
reviewed
May 25, 2025
This reverts commit 2501d45.
* Removed the empty line before “.vscode/”.
Owner
Technically it is in the FAQ :) but good examples are always appreciated. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
While trying to satisfy a bank’s requirement to include both
<RSAKeyValue>and<X509Data>inside<KeyInfo>, I first proposed a new--add-key-valueflag.@lsh123 pointed out that the existing command
already does the trick when the template contains
<KeyValue/>(and<X509Data/>).Because this behaviour is essentially undocumented (a Google search for the exact flag returns no hits) I’ve converted the PR into a documentation-only change.
What changed
apps/xmlsec.c--enabled-key-datadescription with a concretersa,key-value,x509example.doc/xmlsec-man.htmldoc/faq.htmltests/testrun.shuname: illegal option -- onoise on macOS by redirectingstderrand falling back to an empty string.apps/xmlsec.c,man/xmlsec1.1No functional changes; tests remain green.
Usage reminder
Template must include both
<KeyValue/>and<X509Data/>placeholders.Why it helps
Makes the feature discoverable in
--help, the man page, and the FAQ.Prevents future users from spending days hunting for the right flag combo.
Leaves default behaviour and security warnings unchanged.
Supersedes #916.