Skip to content

Commit 3fdc0f6

Browse files
smittals2smittals2
authored
Add Xmlsec to our CI (#2333)
### Issues: `2909` ### Description of changes: Add xmlsec to our CI ### Call-outs: 2 callouts regarding the patch file: 1) we lower the overall percentage of tests required to succeed with openSSL. Xmlsec verifies the percentage of tests that passed as an additional check. Skipped tests can skew this (and we skip a bunch because of missing features like ossl_store). 2) 10 tests are commented out in the Xmlsec test suite. These 10 tests all have certs that use MD5 digests. AWS-LC rejects these certs by default. OS level patching of OpenSSL adds support for OPENSSL_ENABLE_MD5_VERIFY to allow validating these certs. We don't support this in AWS-LC. I have verified that these 10 tests pass if we were to start accepting md5 digests. ### Testing: How is this change tested (unit tests, fuzz tests, etc.)? Are there any testing steps to be verified by the reviewer? By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
1 parent 995e123 commit 3fdc0f6

File tree

3 files changed

+364
-1
lines changed

3 files changed

+364
-1
lines changed

‎tests/ci/cdk/cdk/codebuild/github_ci_integration_omnibus.yaml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -400,7 +400,17 @@ batch:
400400
image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_integration_latest
401401
variables:
402402
AWS_LC_CI_TARGET: "tests/ci/integration/run_openvpn_integration.sh master"
403-
403+
404+
- identifier: xmlsec_integration_x86_64
405+
buildspec: tests/ci/codebuild/common/run_ipv6_target.yml
406+
env:
407+
type: LINUX_CONTAINER
408+
privileged-mode: true
409+
compute-type: BUILD_GENERAL1_MEDIUM
410+
image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_integration_latest
411+
variables:
412+
AWS_LC_CI_TARGET: "tests/ci/integration/run_xmlsec_integration.sh"
413+
404414
- identifier: python_main_integration_x86_64
405415
buildspec: tests/ci/codebuild/common/run_ipv6_target.yml
406416
env:

‎tests/ci/integration/run_xmlsec_integration.sh

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/usr/bin/env bash
2+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
# SPDX-License-Identifier: Apache-2.0 OR ISC
4+
5+
set -exu
6+
7+
source tests/ci/common_posix_setup.sh
8+
9+
# Set up environment.
10+
11+
# SYS_ROOT
12+
# - SRC_ROOT(aws-lc)
13+
# - SCRATCH_FOLDER
14+
# - XMLSEC_SRC_FOLDER
15+
# - AWS_LC_BUILD_FOLDER
16+
# - AWS_LC_INSTALL_FOLDER
17+
18+
# Assumes script is executed from the root of aws-lc directory
19+
SCRATCH_FOLDER="${SRC_ROOT}/XMLSEC_BUILD_ROOT"
20+
XMLSEC_SRC_FOLDER="${SCRATCH_FOLDER}/xmlsec"
21+
XMLSEC_SRC_FOLDER_BUILD_PREFIX="${XMLSEC_SRC_FOLDER}/build/install"
22+
XMLSEC_SRC_FOLDER_BUILD_EPREFIX="${XMLSEC_SRC_FOLDER}/build/exec-install"
23+
XMLSEC_PATCH_FOLDER="${SRC_ROOT}/tests/ci/integration/xmlsec_patch"
24+
25+
AWS_LC_BUILD_FOLDER="${SCRATCH_FOLDER}/aws-lc-build"
26+
AWS_LC_INSTALL_FOLDER="${SCRATCH_FOLDER}/aws-lc-install"
27+
28+
mkdir -p ${SCRATCH_FOLDER}
29+
rm -rf "${SCRATCH_FOLDER:?}"/*
30+
cd ${SCRATCH_FOLDER}
31+
32+
function xmlsec_build() {
33+
34+
export OPENSSL_CFLAGS="-I${AWS_LC_INSTALL_FOLDER}/include"
35+
export OPENSSL_LIBS="-L${AWS_LC_INSTALL_FOLDER}/lib -lssl -lcrypto"
36+
export LD_FLAGS="-Wl,-rpath=${AWS_LC_INSTALL_FOLDER}/lib"
37+
38+
./autogen.sh --prefix="$XMLSEC_SRC_FOLDER_BUILD_PREFIX" \
39+
--exec-prefix="$XMLSEC_SRC_FOLDER_BUILD_EPREFIX"
40+
41+
make -j install
42+
43+
local xmlsec_executable="${XMLSEC_SRC_FOLDER}/build/exec-install/lib/libxmlsec1-openssl.so"
44+
ldd ${xmlsec_executable} \
45+
| grep "${AWS_LC_INSTALL_FOLDER}/lib/libcrypto.so" || exit 1
46+
}
47+
48+
function xmlsec_patch() {
49+
patchfile="${XMLSEC_PATCH_FOLDER}/xmlsec_master.patch"
50+
echo "Apply patch $patchfile..."
51+
patch -p1 --quiet -i "$patchfile"
52+
}
53+
54+
function xmlsec_run_tests() {
55+
make check XMLSEC_TEST_IGNORE_PERCENT_SUCCESS=y
56+
}
57+
58+
git clone https://github.com/lsh123/xmlsec.git ${XMLSEC_SRC_FOLDER}
59+
mkdir -p ${AWS_LC_BUILD_FOLDER} ${AWS_LC_INSTALL_FOLDER}
60+
ls
61+
62+
aws_lc_build "$SRC_ROOT" "$AWS_LC_BUILD_FOLDER" "$AWS_LC_INSTALL_FOLDER" -DCMAKE_INSTALL_LIBDIR=lib -DBUILD_TESTING=OFF -DBUILD_TOOL=OFF -DCMAKE_BUILD_TYPE=Debug -DBUILD_SHARED_LIBS=1
63+
64+
# Build xmlsec from source.
65+
apt update -y
66+
apt install -y libtool libtool-bin libltdl-dev
67+
export LD_LIBRARY_PATH="${AWS_LC_INSTALL_FOLDER}/lib"
68+
pushd ${XMLSEC_SRC_FOLDER}
69+
xmlsec_patch
70+
xmlsec_build
71+
xmlsec_run_tests

‎tests/ci/integration/xmlsec_patch/xmlsec_master.patch

Lines changed: 282 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,282 @@
1+
diff --git a/configure.ac b/configure.ac
2+
index 7fd22877..9f8c4156 100644
3+
--- a/configure.ac
4+
+++ b/configure.ac
5+
@@ -825,7 +825,7 @@ if test "z$OPENSSL_FOUND" = "zyes" ; then
6+
#include <openssl/opensslv.h>
7+
#include <openssl/crypto.h>
8+
#if OPENSSL_VERSION_NUMBER >= 0x10100010L
9+
- #ifdef OPENSSL_IS_BORINGSSL
10+
+ #if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
11+
greater-than-minvers
12+
#endif
13+
#endif
14+
diff --git a/src/openssl/app.c b/src/openssl/app.c
15+
index bad1f849..03d07d8d 100644
16+
--- a/src/openssl/app.c
17+
+++ b/src/openssl/app.c
18+
@@ -50,7 +50,7 @@
19+
#include <openssl/engine.h>
20+
#endif /* !defined(OPENSSL_NO_ENGINE) && (!defined(XMLSEC_OPENSSL_API_300) || defined(XMLSEC_OPENSSL3_ENGINES)) */
21+
22+
-#ifndef OPENSSL_IS_BORINGSSL
23+
+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
24+
#include <openssl/ui.h>
25+
#endif /* OPENSSL_IS_BORINGSSL */
26+
27+
@@ -150,11 +150,11 @@ xmlSecOpenSSLAppInit(const char* config) {
28+
opts |= OPENSSL_INIT_ADD_ALL_DIGESTS;
29+
opts |= OPENSSL_INIT_LOAD_CONFIG;
30+
31+
-#if !defined(OPENSSL_IS_BORINGSSL)
32+
+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
33+
opts |= OPENSSL_INIT_ASYNC;
34+
#endif /* !defined(OPENSSL_IS_BORINGSSL) */
35+
36+
-#if !defined(OPENSSL_IS_BORINGSSL) && !defined(XMLSEC_OPENSSL_API_300)
37+
+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_AWSLC)
38+
opts |= OPENSSL_INIT_ENGINE_ALL_BUILTIN;
39+
#endif /* !defined(OPENSSL_IS_BORINGSSL) && !defined(XMLSEC_OPENSSL_API_300) */
40+
41+
diff --git a/src/openssl/crypto.c b/src/openssl/crypto.c
42+
index d9e8423c..c63e812c 100644
43+
--- a/src/openssl/crypto.c
44+
+++ b/src/openssl/crypto.c
45+
@@ -46,7 +46,7 @@ static void xmlSecOpenSSLErrorsShutdown (void);
46+
static xmlSecCryptoDLFunctionsPtr gXmlSecOpenSSLFunctions = NULL;
47+
static xmlChar* gXmlSecOpenSSLTrustedCertsFolder = NULL;
48+
49+
-#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ERR)
50+
+#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) && !defined(OPENSSL_NO_ERR)
51+
52+
#define XMLSEC_OPENSSL_ERRORS_FUNCTION 0
53+
54+
@@ -566,7 +566,7 @@ void
55+
xmlSecOpenSSLErrorsDefaultCallback(const char* file, int line, const char* func,
56+
const char* errorObject, const char* errorSubject,
57+
int reason, const char* msg) {
58+
-#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ERR)
59+
+#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) && !defined(OPENSSL_NO_ERR)
60+
ERR_put_error(gXmlSecOpenSSLErrorsLib,
61+
XMLSEC_OPENSSL_ERRORS_FUNCTION,
62+
reason, file, line);
63+
@@ -579,7 +579,7 @@ xmlSecOpenSSLErrorsDefaultCallback(const char* file, int line, const char* func,
64+
65+
static int
66+
xmlSecOpenSSLErrorsInit(void) {
67+
-#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ERR)
68+
+#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) && !defined(OPENSSL_NO_ERR)
69+
xmlSecSize pos;
70+
71+
/* get XMLSec library id */
72+
@@ -620,7 +620,7 @@ xmlSecOpenSSLErrorsShutdown(void) {
73+
/* remove callback */
74+
xmlSecErrorsSetCallback(NULL);
75+
76+
-#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ERR)
77+
+#if !defined(XMLSEC_OPENSSL_API_300) && !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) && !defined(OPENSSL_NO_ERR)
78+
/* unload xmlsec strings from OpenSSL */
79+
ERR_unload_strings(gXmlSecOpenSSLErrorsLib, xmlSecOpenSSLStrLib);
80+
ERR_unload_strings(gXmlSecOpenSSLErrorsLib, xmlSecOpenSSLStrDefReason);
81+
diff --git a/src/openssl/openssl_compat.h b/src/openssl/openssl_compat.h
82+
index 968c7eee..92ff1027 100644
83+
--- a/src/openssl/openssl_compat.h
84+
+++ b/src/openssl/openssl_compat.h
85+
@@ -20,7 +20,7 @@
86+
*****************************************************************************/
87+
#ifdef OPENSSL_IS_AWSLC
88+
89+
-#ifndef OPENSSL_IS_BORINGSSL
90+
+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
91+
#define OPENSSL_IS_BORINGSSL
92+
#endif /* OPENSSL_IS_BORINGSSL */
93+
94+
@@ -32,7 +32,7 @@
95+
* boringssl compatibility
96+
*
97+
*****************************************************************************/
98+
-#ifdef OPENSSL_IS_BORINGSSL
99+
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
100+
101+
/* Not implemented by LibreSSL (yet?) */
102+
#define XMLSEC_OPENSSL_NO_ASN1_TIME_TO_TM 1
103+
@@ -66,7 +66,7 @@
104+
105+
106+
/* BoringSSL redefines int->size_t or int->unsigned */
107+
-#if defined(OPENSSL_IS_BORINGSSL)
108+
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
109+
110+
/* when BoringSSL replaced int with unisgned */
111+
typedef unsigned xmlSecOpenSSLUInt;
112+
diff --git a/src/openssl/x509.c b/src/openssl/x509.c
113+
index f99325ae..90f8ae14 100644
114+
--- a/src/openssl/x509.c
115+
+++ b/src/openssl/x509.c
116+
@@ -50,7 +50,7 @@
117+
#include <openssl/x509v3.h>
118+
#include <openssl/asn1.h>
119+
120+
-#ifdef OPENSSL_IS_BORINGSSL
121+
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
122+
#include <openssl/mem.h>
123+
#endif /* OPENSSL_IS_BORINGSSL */
124+
125+
diff --git a/tests/testDSig.sh b/tests/testDSig.sh
126+
index b1f40619..6e53a5ef 100755
127+
--- a/tests/testDSig.sh
128+
+++ b/tests/testDSig.sh
129+
@@ -1705,12 +1705,12 @@ execDSigTest $res_success \
130+
"hmac" \
131+
"--lax-key-search --hmackey certs/hmackey.bin"
132+
133+
-execDSigTest $res_success \
134+
- "phaos-xmldsig-three" \
135+
- "signature-rsa-detached" \
136+
- "sha1 rsa-sha1" \
137+
- "rsa x509" \
138+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
139+
+# execDSigTest $res_success \
140+
+# "phaos-xmldsig-three" \
141+
+# "signature-rsa-detached" \
142+
+# "sha1 rsa-sha1" \
143+
+# "rsa x509" \
144+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
145+
146+
execDSigTest $res_success \
147+
"phaos-xmldsig-three" \
148+
@@ -1726,12 +1726,12 @@ execDSigTest $res_success \
149+
"rsa x509" \
150+
"--enabled-key-data key-value,rsa,x509 --trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
151+
152+
-execDSigTest $res_success \
153+
- "phaos-xmldsig-three" \
154+
- "signature-rsa-detached-xslt-transform-retrieval-method" \
155+
- "xslt sha1 rsa-sha1" \
156+
- "rsa x509" \
157+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
158+
+# execDSigTest $res_success \
159+
+# "phaos-xmldsig-three" \
160+
+# "signature-rsa-detached-xslt-transform-retrieval-method" \
161+
+# "xslt sha1 rsa-sha1" \
162+
+# "rsa x509" \
163+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
164+
165+
execDSigTest $res_success \
166+
"phaos-xmldsig-three" \
167+
@@ -1741,54 +1741,54 @@ execDSigTest $res_success \
168+
"--enabled-key-data key-value,rsa,x509 --trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
169+
170+
171+
-execDSigTest $res_success \
172+
- "phaos-xmldsig-three" \
173+
- "signature-rsa-enveloped" \
174+
- "enveloped-signature sha1 rsa-sha1" \
175+
- "rsa x509" \
176+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00"
177+
+# execDSigTest $res_success \
178+
+# "phaos-xmldsig-three" \
179+
+# "signature-rsa-enveloped" \
180+
+# "enveloped-signature sha1 rsa-sha1" \
181+
+# "rsa x509" \
182+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00"
183+
184+
-execDSigTest $res_success \
185+
- "phaos-xmldsig-three" \
186+
- "signature-rsa-enveloping" \
187+
- "sha1 rsa-sha1" \
188+
- "rsa x509" \
189+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00"
190+
+# execDSigTest $res_success \
191+
+# "phaos-xmldsig-three" \
192+
+# "signature-rsa-enveloping" \
193+
+# "sha1 rsa-sha1" \
194+
+# "rsa x509" \
195+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00"
196+
197+
-execDSigTest $res_success \
198+
- "phaos-xmldsig-three" \
199+
- "signature-rsa-manifest-x509-data-cert-chain" \
200+
- "sha1 rsa-sha1" \
201+
- "rsa x509" \
202+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
203+
+# execDSigTest $res_success \
204+
+# "phaos-xmldsig-three" \
205+
+# "signature-rsa-manifest-x509-data-cert-chain" \
206+
+# "sha1 rsa-sha1" \
207+
+# "rsa x509" \
208+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
209+
210+
-execDSigTest $res_success \
211+
- "phaos-xmldsig-three" \
212+
- "signature-rsa-manifest-x509-data-cert" \
213+
- "sha1 rsa-sha1" \
214+
- "rsa x509" \
215+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
216+
+# execDSigTest $res_success \
217+
+# "phaos-xmldsig-three" \
218+
+# "signature-rsa-manifest-x509-data-cert" \
219+
+# "sha1 rsa-sha1" \
220+
+# "rsa x509" \
221+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
222+
223+
-execDSigTest $res_success \
224+
- "phaos-xmldsig-three" \
225+
- "signature-rsa-manifest-x509-data-issuer-serial" \
226+
- "sha1 rsa-sha1" \
227+
- "rsa x509" \
228+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --untrusted-$cert_format certs/rsa-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
229+
+# execDSigTest $res_success \
230+
+# "phaos-xmldsig-three" \
231+
+# "signature-rsa-manifest-x509-data-issuer-serial" \
232+
+# "sha1 rsa-sha1" \
233+
+# "rsa x509" \
234+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --untrusted-$cert_format certs/rsa-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
235+
236+
-execDSigTest $res_success \
237+
- "phaos-xmldsig-three" \
238+
- "signature-rsa-manifest-x509-data-ski" \
239+
- "sha1 rsa-sha1" \
240+
- "rsa x509" \
241+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --untrusted-$cert_format certs/rsa-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
242+
+# execDSigTest $res_success \
243+
+# "phaos-xmldsig-three" \
244+
+# "signature-rsa-manifest-x509-data-ski" \
245+
+# "sha1 rsa-sha1" \
246+
+# "rsa x509" \
247+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --untrusted-$cert_format certs/rsa-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
248+
249+
-execDSigTest $res_success \
250+
- "phaos-xmldsig-three" \
251+
- "signature-rsa-manifest-x509-data-subject-name" \
252+
- "sha1 rsa-sha1" \
253+
- "rsa x509" \
254+
- "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --untrusted-$cert_format certs/rsa-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
255+
+# execDSigTest $res_success \
256+
+# "phaos-xmldsig-three" \
257+
+# "signature-rsa-manifest-x509-data-subject-name" \
258+
+# "sha1 rsa-sha1" \
259+
+# "rsa x509" \
260+
+# "--trusted-$cert_format certs/rsa-ca-cert.$cert_format --untrusted-$cert_format certs/rsa-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
261+
262+
execDSigTest $res_success \
263+
"phaos-xmldsig-three" \
264+
@@ -1797,12 +1797,12 @@ execDSigTest $res_success \
265+
"rsa x509" \
266+
"--enabled-key-data key-value,rsa,x509 --trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00 $url_map_rfc3161"
267+
268+
-execDSigTest $res_success \
269+
- "phaos-xmldsig-three" \
270+
- "signature-rsa-xpath-transform-enveloped" \
271+
- "enveloped-signature xpath sha1 rsa-sha1" \
272+
- "rsa x509" \
273+
- "--enabled-key-data key-value,rsa,x509 --trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00"
274+
+# execDSigTest $res_success \
275+
+# "phaos-xmldsig-three" \
276+
+# "signature-rsa-xpath-transform-enveloped" \
277+
+# "enveloped-signature xpath sha1 rsa-sha1" \
278+
+# "rsa x509" \
279+
+# "--enabled-key-data key-value,rsa,x509 --trusted-$cert_format certs/rsa-ca-cert.$cert_format --verification-gmt-time 2009-01-01+10:00:00"
280+
281+
282+
extra_message="Negative test: bad retrieval method"

0 commit comments

Comments
 (0)