Xades XML签名策略
Xades XML签名策略
提问于 2022-02-28 09:49:05
你好，我正在编写一个脚本，用Xades (强制性)对XML文件进行签名。我以前从未做过XML文件的签名工作，所以我很迷茫。
这个错误似乎是在标志策略中出现的，但我不确定它是如何实现的。我必须添加到"http://ticketbai.eus/politicafirma"“的链接，策略哈希是：http://ticketbai.eus/politicafirma"。我还需要考虑到键必须在1024字节以上。
注意:我正在处理Python，因为我最习惯它，但我不需要更改它。除了脚本之外，证书将被验证并正常工作。
溯源
ctx.sign(signature)
File "C:\Users\acarrera\AppData\Local\Programs\Python\Python39\lib\site-packages\xades\xades_context.py", line 47, in sign
self.calculate_signed_properties(signed_properties, node, True)
File "C:\Users\acarrera\AppData\Local\Programs\Python\Python39\lib\site-packages\xades\xades_context.py", line 102, in calculate_signed_properties
self.calculate_signature_properties(signature_properties, node, sign)
File "C:\Users\acarrera\AppData\Local\Programs\Python\Python39\lib\site-packages\xades\xades_context.py", line 125, in calculate_signature_properties
self.policy.calculate_certificates(
File "C:\Users\acarrera\AppData\Local\Programs\Python\Python39\lib\site-packages\xades\policy.py", line 134, in calculate_certificates
for key_x509 in keys_x509:
TypeError: 'builtins.Certificate' object is not iterablePYTHON代码
import os
import xmlsig
from lxml import etree
from OpenSSL import crypto
from xades import XAdESContext, template, utils
from xades.policy import GenericPolicyId
SIGN_POLICY = f"https://ticketbai.araba.eus/tbai/sinadura/"
CERTIANDER = os.environ.get(
'CERTIANDER',
r'SOLDISP_PF2856A9_CERT.pfx')
parsed_file = etree.parse('Factura1.xml').getroot()
signature = xmlsig.template.create(
xmlsig.constants.TransformInclC14N,
xmlsig.constants.TransformRsaSha256,
"Signature",
)
signature_id = utils.get_unique_id()
ref = xmlsig.template.add_reference(
signature, xmlsig.constants.TransformSha256, uri="", name="REF"
)
xmlsig.template.add_transform(ref, xmlsig.constants.TransformEnveloped)
xmlsig.template.add_reference(
signature, xmlsig.constants.TransformSha256, uri="#" + signature_id
)
xmlsig.template.add_reference(
signature, xmlsig.constants.TransformSha256, uri="#" + signature_id
)
ki = xmlsig.template.ensure_key_info(signature, name="KI")
data = xmlsig.template.add_x509_data(ki)
xmlsig.template.x509_data_add_certificate(data)
serial = xmlsig.template.x509_data_add_issuer_serial(data)
xmlsig.template.x509_issuer_serial_add_issuer_name(serial)
xmlsig.template.x509_issuer_serial_add_serial_number(serial)
xmlsig.template.add_key_value(ki)
qualifying = template.create_qualifying_properties(
signature, name=utils.get_unique_id(), etsi='xades'
)
props = template.create_signed_properties(qualifying, name=signature_id)
policy = GenericPolicyId(
SIGN_POLICY,
xmlsig.constants.TransformSha256,
)
parsed_file.append(signature)
with open(CERTIANDER, "rb") as key_file:
pfx = key_file.read()
certificate = crypto.load_pkcs12(pfx, b'password') #Personal Password
ctx = XAdESContext(
policy,
certificate.get_certificate().to_cryptography(),
)
ctx.load_pkcs12(certificate)
ctx.sign(signature)
parsed_file[0][0][0].append(signature)
et = etree.ElementTree(parsed_file)
nfs_name = 'Firmado'
et.write(nfs_name, pretty_print=True,
encoding='utf-8', xml_declaration=True)回答 2
Stack Overflow用户
发布于 2022-04-05 14:33:26
我也有同样的问题，在这个问题的末尾，如何在Python中使用Xades标准进行签名？他们提到了唯一的区别是库可以有多个证书，而您只能拥有一个证书。我修改了图书馆，去掉了它失败的地方。对我起作用了！
Stack Overflow用户
发布于 2022-06-24 06:30:11
我也遇到了同样的问题，但我阅读了关于git-轮毂的文档，并设法用库的一个函数对xml进行了签名。如果您在西班牙，我签了xml和Autofirma检测有效的签名，但是在网上，Valida Firma不是，我也不知道为什么
导入这些库。
import xmlsig
from lxml import etree
from OpenSSL import crypto
from xades import XAdESContext, template, utils
from xades.policy import GenericPolicyIdclass UrllibMock:
def read(self):
with open(path.join(BASE_DIR, "data/policy.pdf"), "rb") as f:
result = f.read()
return result
def test_create_2(self):
root = parse_xml("data/free-sample.xml")#Tu xml
signature = xmlsig.template.create(
xmlsig.constants.TransformInclC14N,
xmlsig.constants.TransformRsaSha1,
"Signature",
)
ref = xmlsig.template.add_reference(
signature, xmlsig.constants.TransformSha1, uri="", name="R1"
)
xmlsig.template.add_transform(ref, xmlsig.constants.TransformEnveloped)
xmlsig.template.add_reference(
signature, xmlsig.constants.TransformSha1, uri="#KI", name="RKI"
)
ki = xmlsig.template.ensure_key_info(signature, name="KI")
data = xmlsig.template.add_x509_data(ki)
xmlsig.template.x509_data_add_certificate(data)
serial = xmlsig.template.x509_data_add_issuer_serial(data)
xmlsig.template.x509_issuer_serial_add_issuer_name(serial)
xmlsig.template.x509_issuer_serial_add_serial_number(serial)
xmlsig.template.add_key_value(ki)
qualifying = template.create_qualifying_properties(signature)
utils.ensure_id(qualifying)
utils.ensure_id(qualifying)
props = template.create_signed_properties(qualifying, datetime=datetime.now())
template.add_claimed_role(props, "Supp")
signed_do = template.ensure_signed_data_object_properties(props)
template.add_data_object_format(
signed_do, "#R1", identifier=ObjectIdentifier("Idenfitier0", "Description")
)
template.add_commitment_type_indication(
signed_do,
ObjectIdentifier("Idenfitier0", "Description"),
qualifiers_type=["Tipo"],
)
template.add_commitment_type_indication(
signed_do,
ObjectIdentifier("Idenfitier1", references=["#R1"]),
references=["#R1"],
)
template.add_data_object_format(
signed_do,
"#RKI",
description="Desc",
mime_type="application/xml",
encoding="UTF-8",
)
root.append(signature)
ctx = XAdESContext(ImpliedPolicy(xmlsig.constants.TransformSha1))
with open(path.join(BASE_DIR, "data/CertificadoPrueba.p12#Path to your certificate"), "rb") as key_file:
ctx.load_pkcs12(pkcs12.load_key_and_certificates(key_file.read(), b"Certificate Password"))
with patch("xades.policy.urllib.urlopen") as mock:
mock.return_value = UrllibMock()
ctx.sign(signature)
ctx.verify(signature)
et = etree.ElementTree(root)
nfs_name = 'FirmadoMedias'#Name Of New xml signed
et.write(nfs_name, pretty_print=True,
encoding='utf-8', xml_declaration=True)页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/71293125
复制相关文章
相似问题
腾讯云开发者
