Problem
Signing templates currently contain empty <DigestValue> nodes, but the library has no signing-side pass that dereferences each <Reference>, applies transforms, computes the digest, and writes the base64 digest back into the XML before later <SignedInfo> canonicalization.
Solution
Implement the XMLDSig signing digest computation pass for direct <SignedInfo>/<Reference> elements:
- Parse signing-template references without weakening the verification parser that requires populated
<DigestValue> content.
- Dereference same-document URIs with the existing URI resolver.
- Reuse the existing transform pipeline and digest algorithms.
- Reject SHA-1 for signing digests.
- Fill
<DigestValue> nodes in document order using the existing XML mutation layer.
- Update the p384 dependency from the release candidate to the stable 0.14 series.
Acceptance Criteria
- Public API can compute digest values for all signing-template references.
- Public API can return XML with all
<DigestValue> nodes populated.
- Empty template
<DigestValue> is accepted for signing but verification parsing remains strict.
- Single-reference and multi-reference templates preserve reference order.
- Enveloped-signature transform output can be verified by the existing reference verification path after filling.
- Missing URI and SHA-1 signing digest templates fail explicitly.
cargo fmt -- --check, cargo clippy --all-targets --all-features -- -D warnings, cargo nextest run --all-features, and cargo test --doc --all-features pass.
Estimate
3d: 1d parser/API, 1d digest/mutation integration, 0.5d regression tests, 0.5d dependency update and full verification.
Problem
Signing templates currently contain empty
<DigestValue>nodes, but the library has no signing-side pass that dereferences each<Reference>, applies transforms, computes the digest, and writes the base64 digest back into the XML before later<SignedInfo>canonicalization.Solution
Implement the XMLDSig signing digest computation pass for direct
<SignedInfo>/<Reference>elements:<DigestValue>content.<DigestValue>nodes in document order using the existing XML mutation layer.Acceptance Criteria
<DigestValue>nodes populated.<DigestValue>is accepted for signing but verification parsing remains strict.cargo fmt -- --check,cargo clippy --all-targets --all-features -- -D warnings,cargo nextest run --all-features, andcargo test --doc --all-featurespass.Estimate
3d: 1d parser/API, 1d digest/mutation integration, 0.5d regression tests, 0.5d dependency update and full verification.