Incompabilities with the SII schema

[Gallaecio]

Signatures generated with signxml are currently not compatible with the XSD that the SII (Chile’s IRS) uses.

I am currently using a fork of signxml in order to sign SII documents, with the following changes:

• Generate a KeyValue element even if a certificate is provided. (RSAKeyValue tag (Modulus and Exponent) #52)
• Remove the second Transform element that signxml generates, the one that describes the C14N
  algorithm.

Also, the SII expects the Signature element to be located as a sibling of the signed node, not within it. Hence, I am using a helper method for signing which receives the parent of the element to sign (which must be the only child):

def _sign(self, parent):
    children = list(parent)
    assert len(children) == 1
    element = children[0]
    element_with_signature = self._signer.sign(
        element, key=self._key, cert=self._certificate)
    signature = element_with_signature.find(
        '{http://www.w3.org/2000/09/xmldsig#}Signature')
    parent.append(signature)

I am hoping that, eventually, signxml will be usable for generating SII-compatible signatures without the need to fork it with these changes.

[kislyuk]

Thanks for reporting.

Regarding the location of the Signature element, what you're describing sounds like a detached signature - you should be able to use sign(method=methods.detached) and attach the signature to the parent node. Does that work?

Regarding the presence of KeyValue if a cert is there, I'll have to read the XML Signature spec to see if that behavior can be made the default. If so, I see no problem doing it.

Regarding the absence of the c14n transform, that sounds like an incompatibility with the XML Signature spec. If so, the best I can do is refactor the code a bit to make it easy to inherit the XMLSigner class and override the transform node insertion process.

Let me know if that sounds reasonable. You're welcome to open any PRs in line with the strategy above.

[edvasqueza]

Sadly I'm working with that api as well, and facing the same problem. As I could see the PR has not been merged. Is there any way to make it work?

[kislyuk]

I requested in the PR (#65) that a test be added, exercising the round trip (sign and verify) and xsd schema validation for this feature. The original submitter did not add a test, and I don't have the resources to do so. You are welcome to update the PR as requested.

[kislyuk]

I added functionality to generate a signature with both X509Data and KeyValue using XMLSigner.sign(always_add_key_value=True).