Package: minisignxml
minisignxmlPython library to sign and verify XML documents.This library,on purpose, only supports a limited part of the xmldsig specification. It is mainly aimed at allowing SAML documents to be signed and verified.Supported features:Simple API.Only support enveloped signatures (http://www.w3.org/2000/09/xmldsig#enveloped-signature)Require and only support exclusive XML canonincalization without comments (http://www.w3.org/2001/10/xml-exc-c14n#)Support SHA-256 (default) and SHA-1 (for compatibility, not recommended) for signing and digest (https://www.w3.org/2000/09/xmldsig#sha1,https://www.w3.org/2000/09/xmldsig#rsa-sha1,http://www.w3.org/2001/04/xmlenc#sha256,http://www.w3.org/2001/04/xmldsig-more#rsa-sha256)Only support X509 certificates and RSA private keysUseslxmlfor XML handling andcryptographyfor cryptography.Only supports a single signature, with a single reference in a document.Support certificate rollover by providing multiple certificates when verifying a document.minisignxmlperforms no IO and you have to manage and load the keys/certificates yourself.APISigningminisignxml.sign.signdefsign(*,element:Element,private_key:RSAPrivateKey,certificate:Certificate,config:SigningConfig=SigningConfig.default(),index:int=0,attribute:str="ID")->bytes:Signs the givenlxml.etree._Elementwith the givencryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyprivate key, embedding thecryptography.x509.Certificatein the signature. Useminisignxml.config.SigningConfigto control the hash algorithms uses (default is SHA-256). Theindexcontrols at which index the signature element is appended to the element.If theelementpassed in does not have an attribute matchingattribute, an exception is raised. It is the callers responsibility to ensure the value of theattributeattribute of theElementis unique for the whole document.Returnsbytescontaining the serialized XML including the signature.SigningConfigminisignxml.config.SigningConfigis adataclasswith the following fields:signature_method: Acryptography.hazmat.primitives.hashes.HashAlgorithmto use for the signature. Defaults to an instance ofcryptography.hazmat.primitives.hashes.SHA256.digest_method: Acryptography.hazmat.primitives.hashes.HashAlgorithmto use for the content digest. Defaults to an instance ofcryptography.hazmat.primitives.hashes.SHA256.Verifyingminisignxml.verify.extract_verified_elementdefextract_verified_element(*,xml:bytes,certificate:Certificate,config:VerifyConfig=VerifyConfig.default(),attribute:str="ID")->Element:Verifies that the XML document given (as bytes) is correctly signed using the private key of thecryptography.x509.Certificateprovided.A successful call toextract_verified_elementdoes not guarantee the integrity of the whole document passed to it via thexmlparameter. Only the sub-tree returned from the function has been verified. The caller should use the returnedlxml.etree._Elementfor further processing.Raises an exception (seeminisignxml.errors, though other exceptions such asValueError,KeyErroror others may also be raised) if the verification failed. Otherwise returns the signedlxml.etree._Element(not necessarily the whole document passed toextract_verified_element), with the signature removed.You can control the allowed signature and digest method by using a customVerifyConfiginstance. By default only SHA-256 is allowed.minisignxml.verify.extract_verified_element_and_certificatedefextract_verified_element_and_certificate(*,xml:bytes,certificates:Collection[Certificate],config:VerifyConfig=VerifyConfig.default(),attribute:str="ID")->Tuple[Element,Certificate]:Similar toextract_verified_element, but allows specifying multiple certificates to aid certificate rollover.
The certificate that was used to sign the xml will be returned with the verified element.VerifyConfigminisignxml.config.SigningConfigis adataclasswith the following fields:allowed_signature_methods: A container ofcryptography.hazmat.primitives.hashes.HashAlgorithmtypes to allow for signing. Defaults to{cryptography.hazmat.primitives.hashes.SHA256}.allowed_digest_methods: A container ofcryptography.hazmat.primitives.hashes.HashAlgorithmtypes to allow for the content digest. Defaults to{cryptography.hazmat.primitives.hashes.SHA256}.