v0.1.8

Added

• (xmldsig) add signing pipeline
• (xmldsig) compute signing reference digests
• (xmldsig) add XML mutation helpers
• (xmldsig) add signature template builders
• (xmldsig) resolve X509 selectors
• (xmldsig) resolve ECKeyValue keys
• (xmldsig) resolve RSAKeyValue keys
• (xmldsig) wire default key resolver
• (xmldsig) add key resolver configuration
• (xmldsig) verify x509 certificate chains

Documentation

• update implementation dependencies
• (xmldsig) clarify ECDSA curve compatibility

Fixed

• (xmldsig) scope signature replacement
• (xmldsig) scope signing digest replacement
• (xmldsig) import system rng directly
• (xmldsig) enable signing entropy feature
• (xmldsig) harden signing key operations
• (xmldsig) fail closed on skipped values
• (xmldsig) preserve value end after empty child
• (xmldsig) harden NCName validation
• (xmldsig) validate builder XML names
• (xmldsig) require every selector match
• (xmldsig) match configured chain selectors
• (xmldsig) require distinct selector anchor
• (xmldsig) select leaf across chain selectors
• (xmldsig) enforce selector cert policy
• (xmldsig) preserve malformed EC fallback
• (xmldsig) preserve invalid ECKeyValue fallback
• (xmldsig) preserve ECKeyValue decode failures
• (xmldsig) defer malformed ECKeyValue errors
• (xmldsig) continue after unusable ECKeyValue
• (xmldsig) keep ECKeyValue fallback non-fatal
• (xmldsig) bound crypto binary normalization
• (xmldsig) distinguish invalid public keys
• (xmldsig) validate named key material
• (xmldsig) validate rollover root linkage
• (xmldsig) replace rollover trust roots
• (xmldsig) validate x509 signing authority
• (xmldsig) enforce x509 issuer usage