Problem
XMLDSig References may use the standard Base64 transform to digest decoded binary content. The transform pipeline currently rejects that algorithm, so conforming signatures using encoded same-document objects cannot be signed or verified.
Implementation
- Parse and serialize the standard Base64 transform URI.
- Support both octet-stream input and node-set input.
- Convert node sets by concatenating included text nodes in document order before decoding.
- Wire the transform into signing, verification, and transform allow-list policy.
- Preserve deterministic errors for malformed transform parameters and Base64 data.
Acceptance criteria
- Binary and node-set Base64 inputs decode to identical octets.
- Nested markup, comments, processing instructions, XML whitespace, and excluded nodes follow XMLDSig text-node semantics.
- Invalid alphabet, padding, or unexpected transform children fail closed.
- Signing and verification use the same transform implementation.
- A generated signature interoperates with xmlsec1.
- Unit, integration, interoperability, doctest, clippy, and package checks pass.
Problem
XMLDSig References may use the standard Base64 transform to digest decoded binary content. The transform pipeline currently rejects that algorithm, so conforming signatures using encoded same-document objects cannot be signed or verified.
Implementation
Acceptance criteria