Changelog for "Apache xml-security" <http://santuario.apache.org/>
New in v1.4.4-SNAPSHOT
    Fixed Bug 49483: KeyResolver.registerAtStart() leads to ClassCastException. Thanks to Clement Pellerin.
    Fixed Bug 49458: StorageResolver always exhausted after first use. Thanks to Clement Pellerin.
    Fixed Bug 49456: StorageResolver.next() gives ClassCastException. Thanks to Clement Pellerin.
    Fixed Bug 49450: KeyStoreResolver always exhausted after first use. Thanks to Clement Pellerin.
    Fixed Bug 49447: KeyStoreResolver iterator returns null for symmetric keys. Thanks to Clement Pellerin.
    Fixed Bug 48368: Digest Value of References inside Manifest - calculation order problem
    Fixed Bug 47779: ConcurrentModificationException in XMLUtils.  
    Fixed Bug 47761: xmlns:xml namespace improperly emitted during excl c14n. Thanks to Scott Cantor.
    Fixed Bug 36526: Out of memory error when signing or verifying big files. Thanks to Agnes Juhasz.
    Fixed Bug 47784: ClassNotFoundException when init the xml security in OSGi plateform
    Fixed Bug 47762: contextChild parameter of Transform.getInstance may be null 
New in v1.4.3
    Fixed Bug 47526: XML signature HMAC truncation authentication bypass
    Fixed Bug 47525: Fix checkstyle problems with source and tests.
    Fixed Bug 42239: ECDSA signature value interopability patch.
    Fixed Bug 45744: XPath transform and xml-stylesheet.
    Fixed Bug 42986: The </#document> node inserted at the end of SOAPEnvelope.
    Fixed Bug 47029: Unnecessary namespace declarations on EncryptedData children.
    Fixed Bug 44335: Can't validate after invalid validation.
    Fixed Bug 47260: Improve Java unit testing.
    Fixed Bug 47265: Some website updates.
    Fixed Bug 45388: We need a POM file added to the Maven repository.
    Fixed Bug 47483: Remove JDK 1.5 API dependencies
    Fixed bug 47057: Downgrade signature verification logging from "info". Thanks to Colm O hEigeartaigh.
    Fixed bug 42061: Method to disable XMLUtils.addReturnToElement (reopened): changed Base64 code to ignore line breaks, if enabled. Thanks to Colm O hEigeartaigh.
    Fixed bug 47097: Reusing XMLSignature for signing and verifying fails on same thread. Thanks to Bruno Harbulot.
    Fixed bug 46732: Failed to add more than one child element to EncryptionMethod.
    Fixed bug 46101: org.apache.xml.security.utils.IdResolver is not thread safe
    Fixed bug 45961: verify with own canonicalization method. Thanks to Anton Kosyakov.
    Fixed bug 45475: XMLSignature::getKeyInfo method modifies document
    Fixed bug 45811: Fix XMLSec 1.4.2 problems reported by findbugs
    Fixed bug 45706: Transform.register class loading and recursive instantiation problems
    Fixed bug 45664: Some calls should be wrapped in AccessController.doPrivileged
    Fixed bug 45634: Restore XMLUtils.createDSctx method.
    Fixed bug 45095: log4j.properties in xmlsec sources and builds has side
effects in production environment. Thanks to Joachim Rousseau.

New in v1.4.2rc1
    Fixed bug 44999: DOMException is thrown at XMLSignature creation. Thanks to Giedrius Noreikis.
    Fixed bug 44863: Improved logging in signature handling. Thanks to Wally Dennis.
    Fixed bug 44956: Concurrent creation of a XMLSignature instance produces an ArrayIndexOutOfBoundsException. Thanks to Giedrius Noreikis
    Fixed bug 44991: Concurrent invocation of KeyInfo.getX509Certificate() occasionally fails. Thanks to Giedrius Noreikis
    
New in v1.4.2beta2
    Fixed bug 44810: Add support for more XMLDSig algorithms listed in RFC 4051
    Fixed bug 44617: Regression when processing XPath transform (additional fix)
New in v1.4.2beta1
    Fixed bug 44629: Switch order of XML Signature validation steps
    Fixed bug 44617: Regression when processing XPath transform
    Fixed bug 44586: XMLX509IssuerSerial.getIssuerName incorrectly escapes '#' in hex values
    Fixed rfe 42653: Add support for C14N 1.1 to Java implementation. Thanks
	to Sean Mullan.
    Fixed bug 44205: XMLX509Certificate.getX509Certificate() results in certificate parsing error. Thanks to Vishal Mahajan.
    Fixed Bug 44177: when using xslt transformation there is problem with xalan newline. Thanks to Matej Spiller.
    Small refactor for ElementProxy to get rid of the state, it was an old 
        vestige that where taking space and obfuscating the code.
    Fixed bug 40897: String comparisons using '==' causes validation errors 
        with some parsers. Thanks Vishal Mahajan
    Fixed bug 43056: Library does not allow specify provider for private key 
	operations. Thanks to Alon Bar-Lev.
    Fixed bug 44102: XMLCipher loadEncryptedKey error. Thanks to Butler.
    Fixed bug 43239: "No installed provider supports this key" when checking a 
	RSA signature against a DSA key before RSA key. Thanks to Matthias
	Germann.
    Fixed bug 42597: Unnecessary namespace declarations on Signature children
	Thanks to Brent Putnam.
    Fixed bug 42061: Method to disable XMLUtils.addReturnToElement. Thanks to
	Michael McIntosh.
    Fixed bug 42865: Problem with empty BaseURI in ResolverLocalFilesystem.
	Thanks to Frank Cornelis.
    Fixed bug 43230: Inclusive C14n doesn't always handle xml:space & xml:lang 
	attributes correctly
    Fixed bug 38668: Add XMLCipher.encryptData method that takes serialized 
	data as parameter. Thanks to Vladimir Ionescu.
    Fixed bug 42886: Error when removing encrypted content in 1.4.1. Thanks to
	Julien Taupin and Daniele Gagliardi.
    Fixed bug 42820: ClassLoader issue causing NoSuchAlgorithmException loading 
	Provider Implementation. Thanks to James Washington.
New in 1.4.1
    Fixed bug 42239: ECDSA signature value interoperability patch. Thanks to Wolfgang Glas for fix.

New in v1.4.1beta1
    Fixed bug 41892: XML Security 1.4.0 does not build with IBM's JDK
    Fixed bug 41927: Cannot canonicalize with XSLT transform. Thanks to
Lijun Liao for fix.
    Fixed bug 41805: Resolution of SAML 1.x ID attributes, incorrect namespace. Thanks to
	Brent Putman for fix.
    Fixed bug 41474: two text nodes with the value '\n' in succession within
        <ds:SignedInfo> and <ds:X509IssuerSerial>. Thanks to Lijun Liao for fix.
    Fixed bug 41510: org.apache.xml.security.keys.content.KeyValue.getPublicKey() 
        returns null for DSA key. Thanks to Stepan Hrbacek for fix.
    Fixed bug 41569: Cannot specify dynamically a specific JCE Provider with 
        the DSA Signature. Thanks to Julien Pasquier for fix.
    Fixed bug 41573: XMLCipher StackOverflowError. Thanks to Marek Jablonski 
        for fix.
    Fixed bug 41462: Xml canonization - UTF-8 encoding issue in Xml security 1.4.0 Thanks to Karol Rewera.    
    Fixed bug 41520: Cannot generate signatures with the same key but different algorithms in sucession. Thanks to Lijun Liao
New in 1.4
	Fixed bug 40896
	
New in 1.4RC4
	Fixed bug 40880
	
New in 1.4RC3
	Fixed bug 40796
	
New in 1.4RC2a
    Fixed bug 40783

New in 1.4RC2
	Fixed bug 40512. Made TransformSPI backward compatible. Now it is possible 
		to use implementations for the >1.3 versions paying the performance hit
		of the old implementation.
    Fix a small & unneeded java 1.4 dependecy.
    KeyResolver & ResourceResolver can work like <1.3 mode when used with old implementations.

New in 1.4RC1	
	Fixed bug 40290.
	Fixed bug 40298.
	Fixed bug 40360. Changed a little  the way the IdResolver works when 
	    Document.getElementById fails.
	Fixed bug 40404.

New in v1.4beta2
    Optimization in c14n in node-sets.
	Optimization for the xml:* inheritance in inclusive  c14n.
	Added ECDSA signature thanks Markus Lindner 
	Optimization in RetrievelMethod handling. Don't reparse the bytes into a DOM tree if not needed thanks David Garcia.
	Fixed bug 40215: Base64 is not working in EBCDIC platform. Thanks to
	     acastro.dit@aeat.es for fix.
	Big optimizations in XPath2 transformation.
	Fixed bug 40245 in XPATH2 transformation(only in development version)
	Fixed bug no resolver for X509Data with just a X509Certificate.	
	Optimization in Base64 to do simple transformation from String to  byte[]

New in v1.4beta1
    Fixed bug 40032. Fixed BUG 40031 Fixed bug when the prefix digital signature uri is not null.
	Changes in the NodeFilter API in order to let the transformations
         do some optimizations take into account the c14n order.
	Optimization in signature transformation in node-sets(xpath, xpath2), 20-40% speed-up.	    
	
New in v1.4beta0
	Fixed bug 38668: Add XMLCipher.encryptData method that takes 
			 serialized data as parameter (mullan)
	Fixed bug 39273: JSR 105 DOMCryptoContext.setIdAttributeNS not working 
			 when validating signatures (mullan)
	Fixed bug 38405: ElementProxy.length() is not working (Java) (mullan)
	Fixed bug 37708: Different behaviour with NodeSet and RootNode with 
			 InclusiveNamespaces (mullan)
	Fixed bug 37456: Signing throws an exception if custom resource 
			 resolver is registered (mullan)
        Fixed bug 38655
	Fixed bug 38444.
	Fixed bug 38605.
	Fixed bug 39200(API CHANGE)
		Refactored the way keyresolver works instead of calling canResolve/resolveX only resolveX is used  
		and if it returns null it means it cannot resolve.
	Minor Optimizations. 
		Lazy fields initialization, initialize with null and create the object only when needed
		Registered Class reorder, in several parts the library contains a list of workers
			that are asked if it can solve a problem. Now the one that said yes is move to the front
			wishing that the next time it also hits.
	API Change: Make Transform & TransformSpi reusable between threads.	
		remove setTransform(Transform t) method in TransformSpi and pass 
		the Transform object in enginePerformTransfor methods.
	Fixed bug 39685: bugs reported by findbugs (mullan)
	Added support for SHA256 & SHA512 DigestMethods to JSR 105. (mullan)
	Fix JSR 105 unmarshaling bug: now recognizes PGPData. (mullan)
	Optimization to not create instances of Signature or MessageDigest objects, but mantain one for thread. 
		Also don't change the key if it was already used. (raul)
		
New in v1.3
	Init-Don't fail if a transformation don't have all of its dependecies.
		Remove XPath initialization from Init and do only when xpath is needed.
    Resolv-Removed the use of xpath expressions to search the elements to sign/verify, now use only plain DOM searching.
	Resolvers-Remove wantsOctectStream wantsNodeSet and his returns pair they are not used, right now and some are incorrect.	
	Remove the Use of xalan or xerces class URI
	Removed the expandSystemId
	Changed from Vector<String> to List<Class>, so we don't need to use classForName everytime and used it just the first time.
	Removed PRNG,HexDump,Version, X509CertificateValidator
	Added an unsync buffer outputstream.
	Changed Symbol table to a more efficient and simple structure
	Fixed bug 34743 , Submitted by: Lee Coomber <lee.at.lshift.net>
	Minor speedups in b64, Halved the table lookups.
	Reduce Object creation during c14n, from one to level to one per c14n.
	Change all Vector to List(ArrayList), we don't need synchronization safety.
	*Refactor the way we handle c14n of nodesets:
	    Before this patch every transformation creates a set with the nodes that should
	    be outputed. Every set is obtaining visiting the whole dom tree every time,
	    and then do it other time at c14n time. So it does <number of transformations>+1
	    visitings, very slow and memory costly.
	    Now every transformation just return a NodeFilter that tells if the node is included or not.
	    So only one visiting is done.
	Unified http://www.w3.org/2002/06/xmldsig-filter2 and http://www.w3.org/2002/04/xmldsig-filter2 transformation implementations.
	Removed http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter transformation
	Canonicalization tree travesing is not recursive. it gives better memory handling and performance.
	Fixed bug 33936, Submited by: Raymond Wong <rwong.at.ariba.com>
	Fixed bug 35919, Submited by: Luda <ludab.at.lanl.gov>
	out of the box j2se 1.5 ready(no adding xalan in the classpath or endorsed if no
	   xpath transformation is needed)
	

New in v1.2.1
 * Fix the memory leak when using xpath or using ResourceResolver and not hitting 
  	  getElementByIdUsingDOM() [http://issues.apache.org/bugzilla/show_bug.cgi?id=32836]
 * Fix the bug with using XPath2Filter and inclusive c14n
 * Fix the bug arrouse in reusing Canonicalizers
 * Fix base64transformation bug [http://issues.apache.org/bugzilla/show_bug.cgi?id=33393 ]
 * Fix the XMLsignatureInput reset() bug.
 * Clean unused jar (xmlParserAPI.jar,etc) and check and stored new versions.
 * generated the dist jar with version (i.e. xmlsec-1.2.1.jar instead of plain xmlsec.jar)
 * Clean unused build*.xml files.


##############################################################################
# New in v1.0.3                                                   24. May 2002
##############################################################################

IMPORTANT:

 - The different classes do not call Init.init() any longer. This must be done 
   by YOU in your application. If you miss that, you'll get many 
   AlgorithmNotRegistered exceptions...

--------------------------------

Summary:
 
 - The software is faster. Especially canonicalization is between 
   factor 5--80 faster than the old one.
 
 - Some deprecated methods in the Canonicalizer are deleted.
 
 - We support Exclusive Canonicalization
 
 - We support the XPath Filter version 2.0 Draft.

--------------------------------

Optimizations and speed-up

 - canonicalization
   - inclusive c14n is now faster (factor between 5 and 80)
 - transforms
   - enveloped-signature is now faster (no XPath ops any more)
   - base64 is now faster (no XPath ops any more)
   - c14n is now faster (due to faster c14n algo)

--------------------------------

Signature package:

 - The XMLSignatureInput which is used for passing node sets and octet 
   streams into transforms and which is also the result of transforms
   uses a java.util.Set now instead of a NodeList for the internal
   representation of xpath node sets. This allows easier queries in the
   form: Is node N part of the node set. 
   
   The implication is that you can also pass a Set which contains the nodes
   to be canonicalized to the Canonicalizers using
   public byte[] canonicalizeXPathNodeSet(Set xpathNodeSet)

--------------------------------

Canonicalizer:

 - A bug (well, my understanding of c14n) is corrected regarding the
   canonicalization of node sets. That bug related to the xml:* 
   attributes. See xmldsig mailing list archive @ w3.org for details.

 - removed are the methods

   - public byte[] canonicalize(Node node)
   - public byte[] canonicalizeDocument(Document doc)
   - public byte[] canonicalizeSingleNode(Node rootNode)

     replaced by public byte[] canonicalizeSubtree(Node node)

   - public byte[] canonicalize(NodeList xpathNodeSet)

     replaced by public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet)
   
   - public void setXPath(Object xpath)
   - public Object getXPath()
   - public String getXPathString()
   - public void setXPathNodeSet(NodeList nodeList)
   
     These are no longer in use. If you want to c14nize an xpath 
     node set, select it using CachedXPathAPI and then apply 
     canonicalizeXPathNodeSet to the node set. 
   
   - public void setRemoveNSAttrs(boolean remove)
   - public boolean getRemoveNSAttrs() 
   
     The c14nizers do not add any attributes (namespaces or xml:*)
     to the document, so these method make no sense.
     
 - The Canonicalizer now supports "Exclusive XML Canonicalization 
   Version 1.0" <http://www.w3.org/Signature/Drafts/xml-exc-c14n>, Rev 1.58.
   
   For that reason, the c14n methods allow an additional String parameter 
   for passing the inclusive namespaces.
   
   public byte[] canonicalizeSubtree(Node node, 
                                     String inclusiveNamespaces)
   public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet, 
                                          String inclusiveNamespaces)
   
   Such a string looks e.g. like this 
   
     String inclusiveNamespaces = "ds xenc ex #default";
     
   For more on exclusive c14n, see the spec. If you pass this parameter to the
   regular (inclusive) c14nizer, you'll get a 
   CanonicalizationException("c14n.Canonicalizer.UnsupportedOperation")
   
--------------------------------

Transforms:
   
 - The exclusive c14n is also supported by the transform framework. 
   The parameter for the inclusive namespaces is the class
   org.apache.xml.security.transforms.params.InclusiveNamespaces
   
   If you want to make a Transform like this, do that:
   
   Document doc = ...;
   Transforms transforms = new Transforms(doc);
   InclusiveNamespaces incNS = new InclusiveNamespaces(doc, "ns2");
   transforms.addTransform(Transforms.TRANSFORM_C14N_EXCL_OMIT_COMMENTS,
                           incNS.getElement());
                           
 - The XPathContainer for the XPath transform is now moved from the
   org.apache.xml.security.c14n.helper package to 
   org.apache.xml.security.transforms.params.XPathContainer

 - The enveloped-signature transform is faster now. We don't do costly
   XPath operations but 'simple' DOM ops.

 - Base64 is faster (no XPath ops).

 - The TransformXPath2Filter is now supported by the package. It can be used by
   using the identifier Transforms.TRANSFORM_XPATH2FILTER in conjuction with the 
   XPath2FilterContainer for passing parameters. To know what xfilter2 is, see
   http://www.w3.org/Signature/Drafts/xmldsig-xfilter2/ :

   Document doc = ...;
   Transforms transforms = new Transforms(doc);
   XPath2FilterContainer x2c = 
         // intersect
         XPath2FilterContainer.newInstanceIntersect(doc, "//a");
         // subtract
         XPath2FilterContainer.newInstanceSubtract(doc, "//a");
         // union
         XPath2FilterContainer.newInstanceUnion(doc, "//a");
   
   transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER,
                           x2c.getElement());
   
--------------------------------