Changelog for "Apache xml-security" <http://xml.apache.org/security/>
New in 1.4.0
	Fixed bug 40896
	
New in 1.4RC4
	Fixed bug 40880
	
New in 1.4RC3
	Fixed bug 40796
	
New in 1.4RC2a
    Fixed bug 40783

New in 1.4RC2
	Fixed bug 40512. Made TransformSPI backward compatible. Now it is possible 
		to use implementations for the >1.3 versions paying the performance hit
		of the old implementation.
    Fix a small & unneeded java 1.4 dependecy.
    KeyResolver & ResourceResolver can work like <1.3 mode when used with old implementations.

New in 1.4RC1	
	Fixed bug 40290.
	Fixed bug 40298.
	Fixed bug 40360. Changed a little  the way the IdResolver works when 
	    Document.getElementById fails.
	Fixed bug 40404.

New in v1.4beta2
    Optimization in c14n in node-sets.
	Optimization for the xml:* inheritance in inclusive  c14n.
	Added ECDSA signature thanks Markus Lindner 
	Optimization in RetrievelMethod handling. Don't reparse the bytes into a DOM tree if not needed thanks David Garcia.
	Fixed bug 40215: Base64 is not working in EBCDIC platform. Thanks to
	     acastro.dit@aeat.es for fix.
	Big optimizations in XPath2 transformation.
	Fixed bug 40245 in XPATH2 transformation(only in development version)
	Fixed bug no resolver for X509Data with just a X509Certificate.	
	Optimization in Base64 to do simple transformation from String to  byte[]

New in v1.4beta1
    Fixed bug 40032. Fixed BUG 40031 Fixed bug when the prefix digital signature uri is not null.
	Changes in the NodeFilter API in order to let the transformations
         do some optimizations take into account the c14n order.
	Optimization in signature transformation in node-sets(xpath, xpath2), 20-40% speed-up.	    
	
New in v1.4beta0
	Fixed bug 38668: Add XMLCipher.encryptData method that takes 
			 serialized data as parameter (mullan)
	Fixed bug 39273: JSR 105 DOMCryptoContext.setIdAttributeNS not working 
			 when validating signatures (mullan)
	Fixed bug 38405: ElementProxy.length() is not working (Java) (mullan)
	Fixed bug 37708: Different behaviour with NodeSet and RootNode with 
			 InclusiveNamespaces (mullan)
	Fixed bug 37456: Signing throws an exception if custom resource 
			 resolver is registered (mullan)
        Fixed bug 38655
	Fixed bug 38444.
	Fixed bug 38605.
	Fixed bug 39200(API CHANGE)
		Refactored the way keyresolver works instead of calling canResolve/resolveX only resolveX is used  
		and if it returns null it means it cannot resolve.
	Minor Optimizations. 
		Lazy fields initialization, initialize with null and create the object only when needed
		Registered Class reorder, in several parts the library contains a list of workers
			that are asked if it can solve a problem. Now the one that said yes is move to the front
			wishing that the next time it also hits.
	API Change: Make Transform & TransformSpi reusable between threads.	
		remove setTransform(Transform t) method in TransformSpi and pass 
		the Transform object in enginePerformTransfor methods.
	Fixed bug 39685: bugs reported by findbugs (mullan)
	Added support for SHA256 & SHA512 DigestMethods to JSR 105. (mullan)
	Fix JSR 105 unmarshaling bug: now recognizes PGPData. (mullan)
	Optimization to not create instances of Signature or MessageDigest objects, but mantain one for thread. 
		Also don't change the key if it was already used. (raul)
		
New in v1.3
	Init-Don't fail if a transformation don't have all of its dependecies.
		Remove XPath initialization from Init and do only when xpath is needed.
    Resolv-Removed the use of xpath expressions to search the elements to sign/verify, now use only plain DOM searching.
	Resolvers-Remove wantsOctectStream wantsNodeSet and his returns pair they are not used, right now and some are incorrect.	
	Remove the Use of xalan or xerces class URI
	Removed the expandSystemId
	Changed from Vector<String> to List<Class>, so we don't need to use classForName everytime and used it just the first time.
	Removed PRNG,HexDump,Version, X509CertificateValidator
	Added an unsync buffer outputstream.
	Changed Symbol table to a more efficient and simple structure
	Fixed bug 34743 , Submitted by: Lee Coomber <lee.at.lshift.net>
	Minor speedups in b64, Halved the table lookups.
	Reduce Object creation during c14n, from one to level to one per c14n.
	Change all Vector to List(ArrayList), we don't need synchronization safety.
	*Refactor the way we handle c14n of nodesets:
	    Before this patch every transformation creates a set with the nodes that should
	    be outputed. Every set is obtaining visiting the whole dom tree every time,
	    and then do it other time at c14n time. So it does <number of transformations>+1
	    visitings, very slow and memory costly.
	    Now every transformation just return a NodeFilter that tells if the node is included or not.
	    So only one visiting is done.
	Unified http://www.w3.org/2002/06/xmldsig-filter2 and http://www.w3.org/2002/04/xmldsig-filter2 transformation implementations.
	Removed http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter transformation
	Canonicalization tree travesing is not recursive. it gives better memory handling and performance.
	Fixed bug 33936, Submited by: Raymond Wong <rwong.at.ariba.com>
	Fixed bug 35919, Submited by: Luda <ludab.at.lanl.gov>
	out of the box j2se 1.5 ready(no adding xalan in the classpath or endorsed if no
	   xpath transformation is needed)
	

New in v1.2.1
 * Fix the memory leak when using xpath or using ResourceResolver and not hitting 
  	  getElementByIdUsingDOM() [http://issues.apache.org/bugzilla/show_bug.cgi?id=32836]
 * Fix the bug with using XPath2Filter and inclusive c14n
 * Fix the bug arrouse in reusing Canonicalizers
 * Fix base64transformation bug [http://issues.apache.org/bugzilla/show_bug.cgi?id=33393 ]
 * Fix the XMLsignatureInput reset() bug.
 * Clean unused jar (xmlParserAPI.jar,etc) and check and stored new versions.
 * generated the dist jar with version (i.e. xmlsec-1.2.1.jar instead of plain xmlsec.jar)
 * Clean unused build*.xml files.


##############################################################################
# New in v1.0.3                                                   24. May 2002
##############################################################################

IMPORTANT:

 - The different classes do not call Init.init() any longer. This must be done 
   by YOU in your application. If you miss that, you'll get many 
   AlgorithmNotRegistered exceptions...

--------------------------------

Summary:
 
 - The software is faster. Especially canonicalization is between 
   factor 5--80 faster than the old one.
 
 - Some deprecated methods in the Canonicalizer are deleted.
 
 - We support Exclusive Canonicalization
 
 - We support the XPath Filter version 2.0 Draft.

--------------------------------

Optimizations and speed-up

 - canonicalization
   - inclusive c14n is now faster (factor between 5 and 80)
 - transforms
   - enveloped-signature is now faster (no XPath ops any more)
   - base64 is now faster (no XPath ops any more)
   - c14n is now faster (due to faster c14n algo)

--------------------------------

Signature package:

 - The XMLSignatureInput which is used for passing node sets and octet 
   streams into transforms and which is also the result of transforms
   uses a java.util.Set now instead of a NodeList for the internal
   representation of xpath node sets. This allows easier queries in the
   form: Is node N part of the node set. 
   
   The implication is that you can also pass a Set which contains the nodes
   to be canonicalized to the Canonicalizers using
   public byte[] canonicalizeXPathNodeSet(Set xpathNodeSet)

--------------------------------

Canonicalizer:

 - A bug (well, my understanding of c14n) is corrected regarding the
   canonicalization of node sets. That bug related to the xml:* 
   attributes. See xmldsig mailing list archive @ w3.org for details.

 - removed are the methods

   - public byte[] canonicalize(Node node)
   - public byte[] canonicalizeDocument(Document doc)
   - public byte[] canonicalizeSingleNode(Node rootNode)

     replaced by public byte[] canonicalizeSubtree(Node node)

   - public byte[] canonicalize(NodeList xpathNodeSet)

     replaced by public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet)
   
   - public void setXPath(Object xpath)
   - public Object getXPath()
   - public String getXPathString()
   - public void setXPathNodeSet(NodeList nodeList)
   
     These are no longer in use. If you want to c14nize an xpath 
     node set, select it using CachedXPathAPI and then apply 
     canonicalizeXPathNodeSet to the node set. 
   
   - public void setRemoveNSAttrs(boolean remove)
   - public boolean getRemoveNSAttrs() 
   
     The c14nizers do not add any attributes (namespaces or xml:*)
     to the document, so these method make no sense.
     
 - The Canonicalizer now supports "Exclusive XML Canonicalization 
   Version 1.0" <http://www.w3.org/Signature/Drafts/xml-exc-c14n>, Rev 1.58.
   
   For that reason, the c14n methods allow an additional String parameter 
   for passing the inclusive namespaces.
   
   public byte[] canonicalizeSubtree(Node node, 
                                     String inclusiveNamespaces)
   public byte[] canonicalizeXPathNodeSet(NodeList xpathNodeSet, 
                                          String inclusiveNamespaces)
   
   Such a string looks e.g. like this 
   
     String inclusiveNamespaces = "ds xenc ex #default";
     
   For more on exclusive c14n, see the spec. If you pass this parameter to the
   regular (inclusive) c14nizer, you'll get a 
   CanonicalizationException("c14n.Canonicalizer.UnsupportedOperation")
   
--------------------------------

Transforms:
   
 - The exclusive c14n is also supported by the transform framework. 
   The parameter for the inclusive namespaces is the class
   org.apache.xml.security.transforms.params.InclusiveNamespaces
   
   If you want to make a Transform like this, do that:
   
   Document doc = ...;
   Transforms transforms = new Transforms(doc);
   InclusiveNamespaces incNS = new InclusiveNamespaces(doc, "ns2");
   transforms.addTransform(Transforms.TRANSFORM_C14N_EXCL_OMIT_COMMENTS,
                           incNS.getElement());
                           
 - The XPathContainer for the XPath transform is now moved from the
   org.apache.xml.security.c14n.helper package to 
   org.apache.xml.security.transforms.params.XPathContainer

 - The enveloped-signature transform is faster now. We don't do costly
   XPath operations but 'simple' DOM ops.

 - Base64 is faster (no XPath ops).

 - The TransformXPath2Filter is now supported by the package. It can be used by
   using the identifier Transforms.TRANSFORM_XPATH2FILTER in conjuction with the 
   XPath2FilterContainer for passing parameters. To know what xfilter2 is, see
   http://www.w3.org/Signature/Drafts/xmldsig-xfilter2/ :

   Document doc = ...;
   Transforms transforms = new Transforms(doc);
   XPath2FilterContainer x2c = 
         // intersect
         XPath2FilterContainer.newInstanceIntersect(doc, "//a");
         // subtract
         XPath2FilterContainer.newInstanceSubtract(doc, "//a");
         // union
         XPath2FilterContainer.newInstanceUnion(doc, "//a");
   
   transforms.addTransform(Transforms.TRANSFORM_XPATH2FILTER,
                           x2c.getElement());
   
--------------------------------