Created attachment 204128 [details]
Template for xmlsec sign command

Running the xmlsec1 "sign" command (or "verify") on an xml file with an external http Reference does not complain if retrieving the referenced URI reports an error such as "404 Not Found"

This happened to me on xmlsec1 1.2.14 (openssl), on Ubuntu 10.10.  The full command line was

$ xmlsec1 sign --privkey rsakey.pem --output EML505-example.xml EML505-example-tmpl.xml

It produced no output, even though there are two URIs to non-existant resources in the file.

Adding the "--store-references" option makes it clear that 404 error input was returned, and running wget on the URI returns a 404 return code.

Here is the command line and output from a "verify" of the resulting signed xml file:

$ xmlsec1 verify --pubkey rsapub.pem EML505-example.xml
OK
SignedInfo References (ok/all): 2/2
Manifests References (ok/all): 2/2

Attached is the input file.  (Note that the URI's for this file may show up soon, so just change them to something that doesn't exist....)

Instead, an error should be raised, like what happens if a URI with a bad protocol scheme like "httpzz://example.com/file.pdf" is used.

I don't see a way to add more than one file as an attachment, but can do so if desired.  The key (rsakey.pem) used here is the public example provided by xmlsec itself.