{"id":15866164,"url":"https://github.com/perl-net-saml2/perl-xml-sig","last_synced_at":"2025-09-14T18:50:17.934Z","repository":{"id":45610227,"uuid":"268851639","full_name":"perl-net-saml2/perl-XML-Sig","owner":"perl-net-saml2","description":"XML::Sig - A Perl toolkit to help sign and verify XML Digital Signatures.","archived":false,"fork":false,"pushed_at":"2025-05-09T00:14:42.000Z","size":341,"stargazers_count":1,"open_issues_count":2,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-08-12T21:41:20.033Z","etag":null,"topics":["dsa","dsig","ecdsa","hmac","hmac-signature","perl","ripemd160","rsa","sha","xml","xmlsec"],"latest_commit_sha":null,"homepage":"https://metacpan.org/pod/XML::Sig","language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/perl-net-saml2.png","metadata":{"files":{"readme":"README","changelog":"Changes","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-06-02T16:25:12.000Z","updated_at":"2025-05-09T00:13:21.000Z","dependencies_parsed_at":"2024-06-21T14:14:21.368Z","dependency_job_id":"fbe2bda8-62d7-4895-a0b6-29702c88b058","html_url":"https://github.com/perl-net-saml2/perl-XML-Sig","commit_stats":{"total_commits":214,"total_committers":12,"mean_commits":"17.833333333333332","dds":0.2289719626168224,"last_synced_commit":"8cd5c375e1f29469c13b9925b28ab02cf1024468"},"previous_names":[],"tags_count":47,"template":false,"template_full_name":null,"purl":"pkg:github/perl-net-saml2/perl-XML-Sig","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/perl-net-saml2%2Fperl-XML-Sig","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/perl-net-saml2%2Fperl-XML-Sig/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/perl-net-saml2%2Fperl-XML-Sig/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/perl-net-saml2%2Fperl-XML-Sig/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/perl-net-saml2","download_url":"https://codeload.github.com/perl-net-saml2/perl-XML-Sig/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/perl-net-saml2%2Fperl-XML-Sig/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":275151928,"owners_count":25414445,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-14T02:00:10.474Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dsa","dsig","ecdsa","hmac","hmac-signature","perl","ripemd160","rsa","sha","xml","xmlsec"],"created_at":"2024-10-05T23:04:45.212Z","updated_at":"2025-09-14T18:50:17.890Z","avatar_url":"https://github.com/perl-net-saml2.png","language":"Perl","funding_links":[],"categories":[],"sub_categories":[],"readme":"NAME\n    XML::Sig - XML::Sig - A toolkit to help sign and verify XML Digital\n    Signatures\n\nVERSION\n    version 0.66\n\nSYNOPSIS\n       my $xml = '\u003cfoo ID=\"abc\"\u003e123\u003c/foo\u003e';\n       my $signer = XML::Sig-\u003enew({\n         key =\u003e 'path/to/private.key',\n       });\n\n       # create a signature\n       my $signed = $signer-\u003esign($xml);\n       print \"Signed XML: $signed\\n\";\n\n       # verify a signature\n       $signer-\u003everify($signed)\n         or die \"Signature Invalid.\";\n       print \"Signature valid.\\n\";\n\nDESCRIPTION\n    This perl module provides two primary capabilities: given an XML string,\n    create and insert digital signatures, or if one is already present in\n    the string verify it -- all in accordance with the W3C standard\n    governing XML signatures.\n\nNAME\n    XML::Sig - A toolkit to help sign and verify XML Digital Signatures.\n\nPREREQUISITES\n    *   Digest::SHA\n\n    *   XML::LibXML\n\n    *   MIME::Base64\n\n    *   Crypt::OpenSSL::X509\n\n    *   Crypt::OpenSSL::Bignum\n\n    *   Crypt::OpenSSL::RSA\n\n    *   Crypt::OpenSSL::DSA\n\n    *   Crypt::PK::ECC\n\nUSAGE\n  SUPPORTED ALGORITHMS \u0026 TRANSFORMS\n    This module supports the following signature methods:\n\n    *   DSA\n\n    *   RSA\n\n    *   RSA encoded as x509\n\n    *   ECDSA\n\n    *   ECDSA encoded as x509\n\n    *   HMAC\n\n    This module supports the following canonicalization methods and\n    transforms:\n\n    *   Enveloped Signature\n\n    *   REC-xml-c14n-20010315#\n\n    *   REC-xml-c14n-20010315#WithComments\n\n    *   REC-xml-c14n11-20080502\n\n    *   REC-xml-c14n11-20080502#WithComments\n\n    *   xml-exc-c14n#\n\n    *   xml-exc-c14n#WithComments\n\n  OPTIONS\n    Each of the following options are also accessors on the main XML::Sig\n    object. TODO Not strictly correct rewrite\n\n    key The path to a file containing the contents of a private key. This\n        option is used only when generating signatures.\n\n    cert\n        The path to a file containing a PEM-formatted X509 certificate. This\n        option is used only when generating signatures with the \"x509\"\n        option. This certificate will be embedded in the signed document,\n        and should match the private key used for the signature.\n\n    cert_text\n        A string containing a PEM-formatted X509 certificate. This option is\n        used only when generating signatures with the \"x509\" option. This\n        certificate will be embedded in the signed document, and should\n        match the private key used for the signature.\n\n    x509\n        Takes a true (1) or false (0) value and indicates how you want the\n        signature to be encoded. When true, the X509 certificate supplied\n        will be encoded in the signature. Otherwise the native encoding\n        format for RSA, DSA and ECDSA will be used.\n\n    sig_hash\n        Passing sig_hash to new allows you to specify the SignatureMethod\n        hashing algorithm used when signing the SignedInfo. RSA and ECDSA\n        supports the hashes specified sha1, sha224, sha256, sha384 and\n        sha512\n\n        DSA supports only sha1 and sha256 (but you really should not sign\n        anything with DSA anyway). This is over-ridden by the key's\n        signature size which is related to the key size. 1024-bit keys\n        require sha1, 2048-bit and 3072-bit keys require sha256.\n\n    digest_hash\n        Passing digest_hash to new allows you to specify the DigestMethod\n        hashing algorithm used when calculating the hash of the XML being\n        signed. Supported hashes can be specified sha1, sha224, sha256,\n        sha384, sha512, ripemd160\n\n    hmac_key\n        Base64 encoded hmac_key\n\n    key_name\n        The name of the key that should be referenced. In the case of xmlsec\n        the --keys-file (ex. t/xmlsec-keys.xml) holds keys with a KeyName\n        that is referenced by this name.\n\n    no_xml_declaration\n        Some applications such as Net::SAML2 expect to sign a fragment of\n        the full XML document so is this is true (1) it will not include the\n        XML Declaration at the beginning of the signed XML. False (0) or\n        undefined returns an XML document starting with the XML Declaration.\n\n    The following options act similar to \"xmlsec --id-attr:ID\n    \u003cnode-namespace-uri\u003e:\u003cname\u003e\"\n\n    ns  A HashRef to namespaces you want to define to select the correct\n        attribute ID on\n\n    id_attr\n        The xpath string you want to sign your XML message on.\n\n  METHODS\n   new(...)\n    Constructor; see OPTIONS above.\n\n   sign($xml)\n    When given a string of XML, it will return the same string with a\n    signature generated from the key provided when the XML::Sig object was\n    initialized.\n\n    This method will sign all elements in your XML with an ID (case\n    sensitive) attribute. Each element with an ID attribute will be the\n    basis for a seperate signature. It will correspond to the URI attribute\n    in the Reference element that will be contained by the signature. If no\n    ID attribute can be found on an element, the signature will not be\n    created.\n\n    The elements are signed in reverse order currently assuming (possibly\n    incorrectly) that the lower element in the tree may need to be signed\n    inclusive of its Signature because it is a child of the higher element.\n\n    Arguments: $xml: string XML string\n\n    Returns: string Signed XML\n\n   verify($xml)\n    Returns true or false based upon whether the signature is valid or not.\n\n    When using XML::Sig exclusively to verify a signature, no key needs to\n    be specified during initialization given that the public key should be\n    transmitted with the signature.\n\n    XML::Sig checks all signature in the provided xml and will fail should\n    any signature pointing to an existing ID in the XML fail to verify.\n\n    Should there be a Signature included that does not point to an existing\n    node in the XML it is ignored and other Signaures are checked. If there\n    are no other Signatures it will return false.\n\n    Arguments: $xml: string XML string\n\n    Returns: string Signed XML\n\n   signer_cert()\n    Following a successful verify with an X509 certificate, returns the\n    signer's certificate as embedded in the XML document for verification\n    against a CA certificate. The certificate is returned as a\n    Crypt::OpenSSL::X509 object.\n\n    Arguments: none\n\n    Returns: Crypt::OpenSSL::X509: Certificate used to sign the XML\n\nABOUT DIGITAL SIGNATURES\n    Just as one might want to send an email message that is\n    cryptographically signed in order to give the recipient the means to\n    independently verify who sent the email, one might also want to sign an\n    XML document. This is especially true in the scenario where an XML\n    document is received in an otherwise unauthenticated context, e.g. SAML.\n\n    However XML provides a challenge that email does not. In XML, two\n    documents can be byte-wise inequivalent, and semanticaly equivalent at\n    the same time. For example:\n\n        \u003c?xml version=\"1.0\"?\u003e\n        \u003cfoo\u003e\n          \u003cbar /\u003e\n        \u003c/foo\u003e\n\n        And:\n\n        \u003c?xml version=\"1.0\"?\u003e\n        \u003cfoo\u003e\n          \u003cbar\u003e\u003c/bar\u003e\n        \u003c/foo\u003e\n\n    Each of these document express the same thing, or in other words they\n    \"mean\" the same thing. However if you were to strictly sign the raw text\n    of these documents, they would each produce different signatures.\n\n    XML Signatures on the other hand will produce the same signature for\n    each of the documents above. Therefore an XML document can be written\n    and rewritten by different parties and still be able to have someone at\n    the end of the line verify a signature the document may contain.\n\n    There is a specially subscribed methodology for how this process should\n    be executed and involves transforming the XML into its canonical form so\n    a signature can be reliably inserted or extracted for verification. This\n    module implements that process.\n\n  EXAMPLE SIGNATURE\n    Below is a sample XML signature to give you some sense of what they look\n    like. First let's look at the original XML document, prior to being\n    signed:\n\n      \u003c?xml version=\"1.0\"?\u003e\n      \u003cfoo ID=\"abc\"\u003e\n        \u003cbar\u003e123\u003c/bar\u003e\n      \u003c/foo\u003e\n\n    Now, let's insert a signature:\n\n      \u003c?xml version=\"1.0\"?\u003e\n      \u003cfoo ID=\"abc\"\u003e\n        \u003cbar\u003e123\u003c/bar\u003e\n        \u003cSignature xmlns=\"http://www.w3.org/2000/09/xmldsig#\"\u003e\n          \u003cSignedInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:xenc=\"http://www.w3.org/2001/04/xmlenc#\"\u003e\n            \u003cCanonicalizationMethod Algorithm=\"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments\" /\u003e\n            \u003cSignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\" /\u003e\n            \u003cReference URI=\"#abc\"\u003e\n              \u003cTransforms\u003e\n                \u003cTransform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\" /\u003e\n              \u003c/Transforms\u003e\n              \u003cDigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\" /\u003e\n              \u003cDigestValue\u003e9kpmrvv3peVJpNSTRycrV+jeHVY=\u003c/DigestValue\u003e\n            \u003c/Reference\u003e\n          \u003c/SignedInfo\u003e\n          \u003cSignatureValue\u003e\n            HXUBnMgPJf//j4ihaWnaylNwAR5AzDFY83HljFIlLmTqX1w1C72ZTuRObvYve8TNEbVsQlTQkj4R\n            hiY0pgIMQUb75GLYFtc+f0YmBZf5rCWY3NWzo432D3ogAvpEzYXEQPmicWe2QozQhybaz9/wrYki\n            XiXY+57fqCkf7aT8Bb6G+fn7Aj8gnZFLkmKxwCdyGsIZOIZdQ8MWpeQrifxBR0d8W1Zm6ix21WNv\n            ONt575h7VxLKw8BDhNPS0p8CS3hOnSk29stpiDMCHFPxAwrbKVL1kGDLaLZn1q8nNRmH8oFxG15l\n            UmS3JXDZAss8gZhU7g9T4XllCqjrAvzPLOFdeQ==\n          \u003c/SignatureValue\u003e\n          \u003cKeyInfo\u003e\n            \u003cKeyValue\u003e\n              \u003cRSAKeyValue\u003e\n                \u003cModulus\u003e\n                  1b+m37u3Xyawh2ArV8txLei251p03CXbkVuWaJu9C8eHy1pu87bcthi+T5WdlCPKD7KGtkKn9vq\n                  i4BJBZcG/Y10e8KWVlXDLg9gibN5hb0Agae3i1cCJTqqnQ0Ka8w1XABtbxTimS1B0aO1zYW6d+U\n                  Yl0xIeAOPsGMfWeu1NgLChZQton1/NrJsKwzMaQy1VI8m4gUleit9Z8mbz9bNMshdgYEZ9oC4bH\n                  n/SnA4FvQl1fjWyTpzL/aWF/bEzS6Qd8IBk7yhcWRJAGdXTWtwiX4mXb4h/2sdrSNvyOsd/shCf\n                  OSMsf0TX+OdlbH079AsxOwoUjlzjuKdCiFPdU6yAJw==\n                \u003c/Modulus\u003e\n                \u003cExponent\u003eIw==\u003c/Exponent\u003e\n              \u003c/RSAKeyValue\u003e\n            \u003c/KeyValue\u003e\n          \u003c/KeyInfo\u003e\n        \u003c/Signature\u003e\n      \u003c/foo\u003e\n\nSEE ALSO\n    \u003chttp://www.w3.org/TR/xmldsig-core/\u003e\n\nVERSION CONTROL\n    \u003chttps://github.com/perl-net-saml2/perl-XML-Sig\u003e\n\nAUTHORS and CREDITS\n    Author: Byrne Reese \u003cbyrne@majordojo.com\u003e\n\n    Thanks to Manni Heumann who wrote Google::SAML::Response from which this\n    module borrows heavily in order to create digital signatures.\n\n    Net::SAML2 embedded version amended by Chris Andrews \u003cchris@nodnol.org\u003e.\n\n    Maintainer: Timothy Legge \u003ctimlegge@cpan.org\u003e\n\nAUTHOR\n    Timothy Legge \u003ctimlegge@gmail.com\u003e\n\nCOPYRIGHT AND LICENSE\n    This software is copyright (c) 2025 by Byrne Reese, Chris Andrews and\n    Others; in detail:\n\n      Copyright 2009       Byrne, Michael Hendricks\n                2010       Chris Andrews\n                2011       Chris Andrews, Oskari Okko Ojala\n                2012       Chris Andrews, Peter Marschall\n                2015       Mike Wisener\n                2016       Jeff Fearn\n                2017       Mike Wisener, xmikew\n                2019-2021  Timothy Legge\n                2022-2023  Timothy Legge, Wesley Schwengle\n                2025       Timothy Legge\n\n    This is free software; you can redistribute it and/or modify it under\n    the same terms as the Perl 5 programming language system itself.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fperl-net-saml2%2Fperl-xml-sig","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fperl-net-saml2%2Fperl-xml-sig","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fperl-net-saml2%2Fperl-xml-sig/lists"}