Normalize RSA signature to modulus width to prevent short XMLDSig SignatureValue

[Copilot]

ninja can serialize RSA signatures without left-padding the result BigInt to modulus width, silently dropping leading 0x00 bytes. For a 2048-bit key this produces 255 bytes (340 Base64 chars) instead of the required 256 bytes (344 Base64 chars), causing intermittent verification failures downstream with no clear error.

Changes

• lib/src/utils.dart — New normalizeRsaSignatureBase64(String base64Sig, BigInt modulus) helper:

  • Left-pads decoded signature bytes with 0x00 to ceil(modulus.bitLength / 8) when short
  • Returns unchanged if already the correct width
  • Throws StateError if longer than the modulus width (indicates a serious upstream bug)

• lib/src/signed_xml.dart — Applied normalization in RSASHA1, RSASHA256, and RSASHA512 getSignature using the private key's .n (modulus):

  final rsa = RSAPrivateKey.fromPEM(utf8.decode(signingKey));
  final raw = rsa.signSsaPkcs1v15ToBase64(utf8.encode(xml), hasher: EmsaHasher.sha1);
  final res = normalizeRsaSignatureBase64(raw, rsa.n); // ← guards against ninja bug

• test/utils_test.dart — Unit tests for normalizeRsaSignatureBase64: correct-length passthrough, one- and two-byte-short padding (the ninja bug scenario), oversized throws StateError, and 1024-bit key variant.

[Copilot]

Pull request overview

This PR prevents intermittent XMLDSig verification failures by ensuring RSA SignatureValue is always encoded at the full modulus width (left-padding with 0x00 when the signing library emits a shorter BigInt-derived byte sequence).

Changes:

• Added normalizeRsaSignatureBase64(base64Sig, modulus) to left-pad decoded RSA signature bytes to ceil(modulus.bitLength / 8) and throw if oversized.
• Applied normalization to RSA-SHA1 / RSA-SHA256 / RSA-SHA512 signing paths using the private key modulus (rsa.n).
• Added unit tests covering passthrough, 1–2 byte short padding, oversized throw, and a 1024-bit modulus case.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
lib/src/utils.dart	Adds signature normalization helper (pad/validate to modulus byte width).
lib/src/signed_xml.dart	Normalizes RSA signature output for SHA1/SHA256/SHA512 signing.
test/utils_test.dart	Adds focused unit tests for normalization behavior and edge cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.