#62452 - Extract configuration while verifying XML signatures

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1833477 13f79535-47bb-0310-9956-ffa450edef68

src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureConfig.java

@@ -23,10 +23,14 @@ import static org.apache.poi.poifs.crypt.dsig.facets.SignatureFacet.XADES_132_NS
 import java.security.PrivateKey;
 import java.security.Provider;
 import java.security.cert.X509Certificate;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.UUID;
 
@@ -49,6 +53,7 @@ import org.apache.poi.poifs.crypt.dsig.services.SignaturePolicyService;
 import org.apache.poi.poifs.crypt.dsig.services.TSPTimeStampService;
 import org.apache.poi.poifs.crypt.dsig.services.TimeStampService;
 import org.apache.poi.poifs.crypt.dsig.services.TimeStampServiceValidator;
+import org.apache.poi.util.LocaleUtil;
 import org.apache.poi.util.POILogFactory;
 import org.apache.poi.util.POILogger;
 import org.apache.xml.security.signature.XMLSignature;
@@ -60,10 +65,16 @@ import org.w3c.dom.events.EventListener;
  * Apart of the thread local members (e.g. opc-package) most values will probably be constant, so
  * it might be configured centrally (e.g. by spring) 
  */
+@SuppressWarnings({"unused","WeakerAccess"})
 public class SignatureConfig {
 
+    public static final String SIGNATURE_TIME_FORMAT = "yyyy-MM-dd'T'HH:mm:ss'Z'";
+
     private static final POILogger LOG = POILogFactory.getLogger(SignatureConfig.class);
-    
+    private static final String DigestMethod_SHA224 = "http://www.w3.org/2001/04/xmldsig-more#sha224";
+    private static final String DigestMethod_SHA384 = "http://www.w3.org/2001/04/xmldsig-more#sha384";
+
+
     public interface SignatureConfigurable {
         void setSignatureConfig(SignatureConfig signatureConfig);        
     }
@@ -150,14 +161,20 @@ public class SignatureConfig {
      * with certain namespaces, so this EventListener is used to interfere
      * with the marshalling process.
      */
-    EventListener signatureMarshalListener;
+    private EventListener signatureMarshalListener;
 
     /**
      * Map of namespace uris to prefix
      * If a mapping is specified, the corresponding elements will be prefixed
      */
-    Map<String,String> namespacePrefixes = new HashMap<>();
-    
+    private final Map<String,String> namespacePrefixes = new HashMap<>();
+
+    /**
+     * if true, the signature config is updated based on the validated document
+     */
+    private boolean updateConfigOnValidate = false;
+
+
     /**
      * Inits and checks the config object.
      * If not set previously, complex configuration properties also get 
@@ -308,7 +325,36 @@ public class SignatureConfig {
     public void setExecutionTime(Date executionTime) {
         this.executionTime = executionTime;
     }
-    
+
+    /**
+     * @return the formatted execution time ({@link #SIGNATURE_TIME_FORMAT})
+     *
+     * @since POI 4.0.0
+     */
+    public String formatExecutionTime() {
+        final DateFormat fmt = new SimpleDateFormat(SIGNATURE_TIME_FORMAT, Locale.ROOT);
+        fmt.setTimeZone(LocaleUtil.TIMEZONE_UTC);
+        return fmt.format(getExecutionTime());
+    }
+
+    /**
+     * Sets the executionTime which is in standard format ({@link #SIGNATURE_TIME_FORMAT})
+     * @param executionTime the execution time
+     *
+     * @since POI 4.0.0
+     */
+    public void setExecutionTime(String executionTime) {
+        if (executionTime != null && !"".equals(executionTime)){
+            final DateFormat fmt = new SimpleDateFormat(SIGNATURE_TIME_FORMAT, Locale.ROOT);
+            fmt.setTimeZone(LocaleUtil.TIMEZONE_UTC);
+            try {
+                this.executionTime = fmt.parse(executionTime);
+            } catch (ParseException e) {
+                LOG.log(POILogger.WARN, "Illegal execution time: "+executionTime);
+            }
+        }
+    }
+
     /**
      * @return the service to be used for XAdES-EPES properties. There's no default implementation
      */
@@ -364,7 +410,24 @@ public class SignatureConfig {
      * @param canonicalizationMethod the default canonicalization method
      */
     public void setCanonicalizationMethod(String canonicalizationMethod) {
-        this.canonicalizationMethod = canonicalizationMethod;
+        this.canonicalizationMethod = verifyCanonicalizationMethod(canonicalizationMethod, CanonicalizationMethod.INCLUSIVE);
+    }
+
+    private static String verifyCanonicalizationMethod(String canonicalizationMethod, String defaultMethod) {
+        if (canonicalizationMethod == null || canonicalizationMethod.isEmpty()) {
+            return defaultMethod;
+        }
+
+        switch (canonicalizationMethod) {
+            case CanonicalizationMethod.INCLUSIVE:
+            case CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS:
+            case CanonicalizationMethod.ENVELOPED:
+            case CanonicalizationMethod.EXCLUSIVE:
+            case CanonicalizationMethod.EXCLUSIVE_WITH_COMMENTS:
+                return canonicalizationMethod;
+        }
+
+        throw new EncryptedDocumentException("Unknown CanonicalizationMethod: "+canonicalizationMethod);
     }
 
     /**
@@ -532,6 +595,16 @@ public class SignatureConfig {
         this.xadesDigestAlgo = xadesDigestAlgo;
     }
 
+    /**
+     * @param xadesDigestAlgo hash algorithm used for XAdES.
+     * When <code>null</code>, defaults to {@link #getDigestAlgo()}
+     *
+     * @since POI 4.0.0
+     */
+    public void setXadesDigestAlgo(String xadesDigestAlgo) {
+        this.xadesDigestAlgo = getDigestMethodAlgo(xadesDigestAlgo);
+    }
+
     /**
      * @return the user agent used for http communication (e.g. to the TSP)
      */
@@ -700,16 +773,17 @@ public class SignatureConfig {
      * @param namespacePrefixes the map of namespace uri (key) to prefix (value)
      */
     public void setNamespacePrefixes(Map<String, String> namespacePrefixes) {
-        this.namespacePrefixes = namespacePrefixes;
+        this.namespacePrefixes.clear();
+        this.namespacePrefixes.putAll(namespacePrefixes);
     }
 
     /**
      * helper method for null/default value handling
-     * @param value
-     * @param defaultValue
+     * @param value the value to be tested
+     * @param defaultValue the default value
      * @return if value is not null, return value otherwise defaultValue
      */
-    protected static <T> T nvl(T value, T defaultValue)  {
+    private static <T> T nvl(T value, T defaultValue)  {
         return value == null ? defaultValue : value;
     }
 
@@ -729,34 +803,92 @@ public class SignatureConfig {
             +getDigestAlgo()+" not supported for signing.");
         }
     }
-    
+
     /**
      * @return the uri for the main digest
      */
     public String getDigestMethodUri() {
         return getDigestMethodUri(getDigestAlgo());
     }
-    
+
     /**
-     * Sets the digest algorithm - currently only sha* and ripemd160 is supported.
+     * Converts the digest algorithm - currently only sha* and ripemd160 is supported.
      * MS Office only supports sha1, sha256, sha384, sha512. 
      * 
-     * @param digestAlgo the digest algorithm  
+     * @param digestAlgo the digest algorithm
      * @return the uri for the given digest
      */
     public static String getDigestMethodUri(HashAlgorithm digestAlgo) {
         switch (digestAlgo) {
         case sha1:   return DigestMethod.SHA1;
-        case sha224: return "http://www.w3.org/2001/04/xmldsig-more#sha224";
+        case sha224: return DigestMethod_SHA224;
         case sha256: return DigestMethod.SHA256;
-        case sha384: return "http://www.w3.org/2001/04/xmldsig-more#sha384";
+        case sha384: return DigestMethod_SHA384;
         case sha512: return DigestMethod.SHA512;
         case ripemd160: return DigestMethod.RIPEMD160;
         default: throw new EncryptedDocumentException("Hash algorithm "
             +digestAlgo+" not supported for signing.");
         }
     }
-    
+
+    /**
+     * Converts the digest algorithm ur - currently only sha* and ripemd160 is supported.
+     * MS Office only supports sha1, sha256, sha384, sha512.
+     *
+     * @param digestAlgo the digest algorithm uri
+     * @return the hash algorithm for the given digest
+     */
+    private static HashAlgorithm getDigestMethodAlgo(String digestMethodUri) {
+        if (digestMethodUri == null || digestMethodUri.isEmpty()) {
+            return null;
+        }
+        switch (digestMethodUri) {
+            case DigestMethod.SHA1:   return HashAlgorithm.sha1;
+            case DigestMethod_SHA224: return HashAlgorithm.sha224;
+            case DigestMethod.SHA256: return HashAlgorithm.sha256;
+            case DigestMethod_SHA384: return HashAlgorithm.sha384;
+            case DigestMethod.SHA512: return HashAlgorithm.sha512;
+            case DigestMethod.RIPEMD160: return HashAlgorithm.ripemd160;
+            default: throw new EncryptedDocumentException("Hash algorithm "
+                    +digestMethodUri+" not supported for signing.");
+        }
+    }
+
+    /**
+     * Set the digest algorithm based on the method uri.
+     * This is used when a signature was successful validated and the signature
+     * configuration is updated
+     *
+     * @param signatureMethodUri the method uri
+     *
+     * @since POI 4.0.0
+     */
+    public void setSignatureMethodFromUri(final String signatureMethodUri) {
+        switch (signatureMethodUri) {
+            case XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA1:
+                setDigestAlgo(HashAlgorithm.sha1);
+                break;
+            case XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA224:
+                setDigestAlgo(HashAlgorithm.sha224);
+                break;
+            case XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA256:
+                setDigestAlgo(HashAlgorithm.sha256);
+                break;
+            case XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA384:
+                setDigestAlgo(HashAlgorithm.sha384);
+                break;
+            case XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA512:
+                setDigestAlgo(HashAlgorithm.sha512);
+                break;
+            case XMLSignature.ALGO_ID_SIGNATURE_RSA_RIPEMD160:
+                setDigestAlgo(HashAlgorithm.ripemd160);
+                break;
+            default: throw new EncryptedDocumentException("Hash algorithm "
+                    +signatureMethodUri+" not supported.");
+        }
+    }
+
+
     /**
      * @param signatureFactory the xml signature factory, saved as thread-local
      */
@@ -852,6 +984,28 @@ public class SignatureConfig {
      * @see <a href="http://docs.oracle.com/javase/7/docs/api/javax/xml/crypto/dsig/CanonicalizationMethod.html">javax.xml.crypto.dsig.CanonicalizationMethod</a>
      */
     public void setXadesCanonicalizationMethod(String xadesCanonicalizationMethod) {
-        this.xadesCanonicalizationMethod = xadesCanonicalizationMethod;
+        this.xadesCanonicalizationMethod = verifyCanonicalizationMethod(xadesCanonicalizationMethod, CanonicalizationMethod.EXCLUSIVE);
     }
-}
+
+    /**
+     * @return true, if the signature config is to be updated based on the successful validated document
+     *
+     * @since POI 4.0.0
+     */
+    public boolean isUpdateConfigOnValidate() {
+        return updateConfigOnValidate;
+    }
+
+    /**
+     * The signature config can be updated if a document is succesful validated.
+     * This flag is used for activating this modifications.
+     * Defaults to {@code false}<p>
+     *
+     * @param updateConfigOnValidate if true, update config on validate
+     *
+     * @since POI 4.0.0
+     */
+    public void setUpdateConfigOnValidate(boolean updateConfigOnValidate) {
+        this.updateConfigOnValidate = updateConfigOnValidate;
+    }
+}

src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignaturePart.java

@@ -18,24 +18,31 @@
 package org.apache.poi.poifs.crypt.dsig;
 
 import static org.apache.poi.ooxml.POIXMLTypeLoader.DEFAULT_XML_OPTIONS;
+import static org.apache.poi.poifs.crypt.dsig.facets.SignatureFacet.MS_DIGSIG_NS;
+import static org.apache.poi.poifs.crypt.dsig.facets.SignatureFacet.XML_DIGSIG_NS;
 
 import java.io.IOException;
 import java.security.cert.X509Certificate;
+import java.util.HashMap;
+import java.util.Iterator;
 import java.util.List;
+import java.util.Map;
+import java.util.function.Consumer;
 
 import javax.xml.crypto.MarshalException;
 import javax.xml.crypto.dsig.XMLSignature;
 import javax.xml.crypto.dsig.XMLSignatureException;
 import javax.xml.crypto.dsig.XMLSignatureFactory;
 import javax.xml.crypto.dsig.dom.DOMValidateContext;
+import javax.xml.namespace.NamespaceContext;
 import javax.xml.xpath.XPath;
 import javax.xml.xpath.XPathConstants;
 import javax.xml.xpath.XPathExpressionException;
 import javax.xml.xpath.XPathFactory;
 
 import org.apache.poi.EncryptedDocumentException;
-import org.apache.poi.openxml4j.opc.PackagePart;
 import org.apache.poi.ooxml.util.DocumentHelper;
+import org.apache.poi.openxml4j.opc.PackagePart;
 import org.apache.poi.util.POILogFactory;
 import org.apache.poi.util.POILogger;
 import org.apache.xmlbeans.XmlException;
@@ -92,7 +99,7 @@ public class SignaturePart {
         // TODO: check for XXE
         return SignatureDocument.Factory.parse(signaturePart.getInputStream(), DEFAULT_XML_OPTIONS);
     }
-    
+
     /**
      * @return true, when the xml signature is valid, false otherwise
      * 
@@ -100,9 +107,11 @@ public class SignaturePart {
      */
     public boolean validate() {
         KeyInfoKeySelector keySelector = new KeyInfoKeySelector();
+        XPath xpath = XPathFactory.newInstance().newXPath();
+        xpath.setNamespaceContext(new XPathNSContext());
+
         try {
             Document doc = DocumentHelper.readDocument(signaturePart.getInputStream());
-            XPath xpath = XPathFactory.newInstance().newXPath();
             NodeList nl = (NodeList)xpath.compile("//*[@Id]").evaluate(doc, XPathConstants.NODESET);
             final int length = nl.getLength();
             for (int i=0; i<length; i++) {
@@ -121,6 +130,7 @@ public class SignaturePart {
             if (valid) {
                 signer = keySelector.getSigner();
                 certChain = keySelector.getCertChain();
+                extractConfig(doc, xmlSignature);
             }
             
             return valid;
@@ -146,4 +156,50 @@ public class SignaturePart {
             throw new EncryptedDocumentException(s, e);
         }
     }
+
+    private void extractConfig(final Document doc, final XMLSignature xmlSignature) throws XPathExpressionException {
+        if (!signatureConfig.isUpdateConfigOnValidate()) {
+            return;
+        }
+
+        signatureConfig.setSigningCertificateChain(certChain);
+        signatureConfig.setSignatureMethodFromUri(xmlSignature.getSignedInfo().getSignatureMethod().getAlgorithm());
+
+        final XPath xpath = XPathFactory.newInstance().newXPath();
+        xpath.setNamespaceContext(new XPathNSContext());
+
+        final Map<String,Consumer<String>> m = new HashMap();
+        m.put("//mdssi:SignatureTime/mdssi:Value", signatureConfig::setExecutionTime);
+        m.put("//xd:ClaimedRole", signatureConfig::setXadesRole);
+        m.put("//dsss:SignatureComments", signatureConfig::setSignatureDescription);
+        m.put("//xd:QualifyingProperties//xd:SignedSignatureProperties//ds:DigestMethod/@Algorithm", signatureConfig::setXadesDigestAlgo);
+        m.put("//ds:CanonicalizationMethod", signatureConfig::setCanonicalizationMethod);
+
+        for (Map.Entry<String,Consumer<String>> me : m.entrySet()) {
+            String val = (String)xpath.compile(me.getKey()).evaluate(doc, XPathConstants.STRING);
+            me.getValue().accept(val);
+        }
+    }
+
+    private class XPathNSContext implements NamespaceContext {
+        final Map<String,String> nsMap = new HashMap<>();
+
+        {
+            for (Map.Entry<String,String> me : signatureConfig.getNamespacePrefixes().entrySet()) {
+                nsMap.put(me.getValue(), me.getKey());
+            }
+            nsMap.put("dsss", MS_DIGSIG_NS);
+            nsMap.put("ds", XML_DIGSIG_NS);
+        }
+
+        public String getNamespaceURI(String prefix) {
+            return nsMap.get(prefix);
+        }
+        public Iterator getPrefixes(String val) {
+            return null;
+        }
+        public String getPrefix(String uri) {
+            return null;
+        }
+    }
 }

src/ooxml/java/org/apache/poi/poifs/crypt/dsig/facets/OOXMLSignatureFacet.java

@@ -221,15 +221,11 @@ public class OOXMLSignatureFacet extends SignatureFacet {
         /*
          * SignatureTime
          */
-        DateFormat fmt = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.ROOT);
-        fmt.setTimeZone(LocaleUtil.TIMEZONE_UTC);
-        String nowStr = fmt.format(signatureConfig.getExecutionTime());
-        LOG.log(POILogger.DEBUG, "now: " + nowStr);
-
         SignatureTimeDocument sigTime = SignatureTimeDocument.Factory.newInstance();
         CTSignatureTime ctTime = sigTime.addNewSignatureTime();
         ctTime.setFormat("YYYY-MM-DDThh:mm:ssTZD");
-        ctTime.setValue(nowStr);
+        ctTime.setValue(signatureConfig.formatExecutionTime());
+        LOG.log(POILogger.DEBUG, "execution time: " + ctTime.getValue());
 
         Element n = (Element)document.importNode(ctTime.getDomNode(),true);
         List<XMLStructure> signatureTimeContent = new ArrayList<>();
@@ -253,6 +249,11 @@ public class OOXMLSignatureFacet extends SignatureFacet {
         SignatureInfoV1Document sigV1 = SignatureInfoV1Document.Factory.newInstance();
         CTSignatureInfoV1 ctSigV1 = sigV1.addNewSignatureInfoV1();
         ctSigV1.setManifestHashAlgorithm(signatureConfig.getDigestMethodUri());
+
+        if (signatureConfig.getSignatureDescription() != null) {
+            ctSigV1.setSignatureComments(signatureConfig.getSignatureDescription());
+        }
+
         Element n = (Element)document.importNode(ctSigV1.getDomNode(), true);
         n.setAttributeNS(XML_NS, XMLConstants.XMLNS_ATTRIBUTE, MS_DIGSIG_NS);
 

src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java

@@ -56,11 +56,14 @@ import java.util.Date;
 import java.util.Iterator;
 import java.util.List;
 
+import javax.xml.crypto.dsig.CanonicalizationMethod;
 import javax.xml.crypto.dsig.dom.DOMSignContext;
 
 import org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo;
 import org.apache.poi.POIDataSamples;
 import org.apache.poi.POITestCase;
+import org.apache.poi.ooxml.util.DocumentHelper;
+import org.apache.poi.openxml4j.exceptions.InvalidFormatException;
 import org.apache.poi.openxml4j.opc.OPCPackage;
 import org.apache.poi.openxml4j.opc.PackageAccess;
 import org.apache.poi.openxml4j.opc.PackageRelationshipTypes;
@@ -69,6 +72,7 @@ import org.apache.poi.poifs.crypt.dsig.SignatureInfo;
 import org.apache.poi.poifs.crypt.dsig.SignaturePart;
 import org.apache.poi.poifs.crypt.dsig.facets.EnvelopedSignatureFacet;
 import org.apache.poi.poifs.crypt.dsig.facets.KeyInfoSignatureFacet;
+import org.apache.poi.poifs.crypt.dsig.facets.OOXMLSignatureFacet;
 import org.apache.poi.poifs.crypt.dsig.facets.XAdESSignatureFacet;
 import org.apache.poi.poifs.crypt.dsig.facets.XAdESXLSignatureFacet;
 import org.apache.poi.poifs.crypt.dsig.services.RevocationData;
@@ -77,7 +81,6 @@ import org.apache.poi.poifs.crypt.dsig.services.TimeStampService;
 import org.apache.poi.poifs.crypt.dsig.services.TimeStampServiceValidator;
 import org.apache.poi.poifs.storage.RawDataUtil;
 import org.apache.poi.ss.usermodel.WorkbookFactory;
-import org.apache.poi.ooxml.util.DocumentHelper;
 import org.apache.poi.util.IOUtils;
 import org.apache.poi.util.LocaleUtil;
 import org.apache.poi.util.POILogFactory;
@@ -186,7 +189,7 @@ public class TestSignatureInfo {
         bos.reset();
         pkg1.save(bos);
         pkg1.close();
-        
+
         XSSFWorkbook wb2 = new XSSFWorkbook(new ByteArrayInputStream(bos.toByteArray()));
         assertEquals("Test", wb2.getSheetAt(0).getRow(1).getCell(1).getStringCellValue());
         OPCPackage pkg2 = wb2.getPackage();
@@ -395,142 +398,173 @@ public class TestSignatureInfo {
     @Test
     public void testSignEnvelopingDocument() throws Exception {
         String testFile = "hello-world-unsigned.xlsx";
-        OPCPackage pkg = OPCPackage.open(copy(testdata.getFile(testFile)), PackageAccess.READ_WRITE);
+        File sigCopy = testdata.getFile(testFile);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream(50000);
 
-        initKeyPair("Test", "CN=Test");
-        final X509CRL crl = PkiTestUtils.generateCrl(x509, keyPair.getPrivate());
-        
-        // setup
-        SignatureConfig signatureConfig = new SignatureConfig();
-        signatureConfig.setOpcPackage(pkg);
-        signatureConfig.setKey(keyPair.getPrivate());
+        final String execTimestr;
 
-        /*
-         * We need at least 2 certificates for the XAdES-C complete certificate
-         * refs construction.
-         */
-        List<X509Certificate> certificateChain = new ArrayList<>();
-        certificateChain.add(x509);
-        certificateChain.add(x509);
-        signatureConfig.setSigningCertificateChain(certificateChain);
-        
-        signatureConfig.addSignatureFacet(new EnvelopedSignatureFacet());
-        signatureConfig.addSignatureFacet(new KeyInfoSignatureFacet());
-        signatureConfig.addSignatureFacet(new XAdESSignatureFacet());
-        signatureConfig.addSignatureFacet(new XAdESXLSignatureFacet());
-        
-        // check for internet, no error means it works
-        boolean mockTsp = (getAccessError("http://timestamp.comodoca.com/rfc3161", true, 10000) != null);
-        
-        // http://timestamping.edelweb.fr/service/tsp
-        // http://tsa.belgium.be/connect
-        // http://timestamp.comodoca.com/authenticode
-        // http://timestamp.comodoca.com/rfc3161
-        // http://services.globaltrustfinder.com/adss/tsa
-        signatureConfig.setTspUrl("http://timestamp.comodoca.com/rfc3161");
-        signatureConfig.setTspRequestPolicy(null); // comodoca request fails, if default policy is set ...
-        signatureConfig.setTspOldProtocol(false);
-        
-        //set proxy info if any
-        String proxy = System.getProperty("http_proxy");
-        if (proxy != null && proxy.trim().length() > 0) {
-            signatureConfig.setProxyUrl(proxy);
-        }
 
-        if (mockTsp) {
-            TimeStampService tspService = new TimeStampService(){
-                @Override
-                public byte[] timeStamp(byte[] data, RevocationData revocationData) {
-                    revocationData.addCRL(crl);
-                    return "time-stamp-token".getBytes(LocaleUtil.CHARSET_1252);                
+        try (OPCPackage pkg = OPCPackage.open(copy(sigCopy), PackageAccess.READ_WRITE)) {
+
+            initKeyPair("Test", "CN=Test");
+            final X509CRL crl = PkiTestUtils.generateCrl(x509, keyPair.getPrivate());
+
+            // setup
+            SignatureConfig signatureConfig = new SignatureConfig();
+            signatureConfig.setOpcPackage(pkg);
+            signatureConfig.setKey(keyPair.getPrivate());
+
+            /*
+             * We need at least 2 certificates for the XAdES-C complete certificate
+             * refs construction.
+             */
+            List<X509Certificate> certificateChain = new ArrayList<>();
+            certificateChain.add(x509);
+            certificateChain.add(x509);
+            signatureConfig.setSigningCertificateChain(certificateChain);
+
+            signatureConfig.addSignatureFacet(new OOXMLSignatureFacet());
+            signatureConfig.addSignatureFacet(new EnvelopedSignatureFacet());
+            signatureConfig.addSignatureFacet(new KeyInfoSignatureFacet());
+            signatureConfig.addSignatureFacet(new XAdESSignatureFacet());
+            signatureConfig.addSignatureFacet(new XAdESXLSignatureFacet());
+
+            // check for internet, no error means it works
+            boolean mockTsp = (getAccessError("http://timestamp.comodoca.com/rfc3161", true, 10000) != null);
+
+            // http://timestamping.edelweb.fr/service/tsp
+            // http://tsa.belgium.be/connect
+            // http://timestamp.comodoca.com/authenticode
+            // http://timestamp.comodoca.com/rfc3161
+            // http://services.globaltrustfinder.com/adss/tsa
+            signatureConfig.setTspUrl("http://timestamp.comodoca.com/rfc3161");
+            signatureConfig.setTspRequestPolicy(null); // comodoca request fails, if default policy is set ...
+            signatureConfig.setTspOldProtocol(false);
+
+            signatureConfig.setXadesDigestAlgo(HashAlgorithm.sha512);
+            signatureConfig.setXadesRole("Xades Reviewer");
+            signatureConfig.setSignatureDescription("test xades signature");
+
+            execTimestr = signatureConfig.formatExecutionTime();
+
+            //set proxy info if any
+            String proxy = System.getProperty("http_proxy");
+            if (proxy != null && proxy.trim().length() > 0) {
+                signatureConfig.setProxyUrl(proxy);
+            }
+
+            if (mockTsp) {
+                TimeStampService tspService = new TimeStampService() {
+                    @Override
+                    public byte[] timeStamp(byte[] data, RevocationData revocationData) {
+                        revocationData.addCRL(crl);
+                        return "time-stamp-token".getBytes(LocaleUtil.CHARSET_1252);
+                    }
+
+                    @Override
+                    public void setSignatureConfig(SignatureConfig config) {
+                        // empty on purpose
+                    }
+                };
+                signatureConfig.setTspService(tspService);
+            } else {
+                TimeStampServiceValidator tspValidator = (validateChain, revocationData) -> {
+                    for (X509Certificate certificate : validateChain) {
+                        LOG.log(POILogger.DEBUG, "certificate: " + certificate.getSubjectX500Principal());
+                        LOG.log(POILogger.DEBUG, "validity: " + certificate.getNotBefore() + " - " + certificate.getNotAfter());
+                    }
+                };
+                signatureConfig.setTspValidator(tspValidator);
+                signatureConfig.setTspOldProtocol(signatureConfig.getTspUrl().contains("edelweb"));
+            }
+
+            final RevocationData revocationData = new RevocationData();
+            revocationData.addCRL(crl);
+            OCSPResp ocspResp = PkiTestUtils.createOcspResp(x509, false,
+                    x509, x509, keyPair.getPrivate(), "SHA1withRSA", cal.getTimeInMillis());
+            revocationData.addOCSP(ocspResp.getEncoded());
+
+            RevocationDataService revocationDataService = revocationChain -> revocationData;
+            signatureConfig.setRevocationDataService(revocationDataService);
+
+            // operate
+            SignatureInfo si = new SignatureInfo();
+            si.setSignatureConfig(signatureConfig);
+            try {
+                si.confirmSignature();
+            } catch (RuntimeException e) {
+                pkg.close();
+                // only allow a ConnectException because of timeout, we see this in Jenkins from time to time...
+                if (e.getCause() == null) {
+                    throw e;
                 }
-                @Override
-                public void setSignatureConfig(SignatureConfig config) {
-                    // empty on purpose
+                if ((e.getCause() instanceof ConnectException) || (e.getCause() instanceof SocketTimeoutException)) {
+                    Assume.assumeFalse("Only allowing ConnectException with 'timed out' as message here, but had: " + e,
+                            e.getCause().getMessage().contains("timed out"));
+                } else if (e.getCause() instanceof IOException) {
+                    Assume.assumeFalse("Only allowing IOException with 'Error contacting TSP server' as message here, but had: " + e,
+                            e.getCause().getMessage().contains("Error contacting TSP server"));
+                } else if (e.getCause() instanceof RuntimeException) {
+                    Assume.assumeFalse("Only allowing RuntimeException with 'This site is cur' as message here, but had: " + e,
+                            e.getCause().getMessage().contains("This site is cur"));
                 }
-            };
-            signatureConfig.setTspService(tspService);
-        } else {
-            TimeStampServiceValidator tspValidator = (validateChain, revocationData) -> {
-                for (X509Certificate certificate : validateChain) {
-                    LOG.log(POILogger.DEBUG, "certificate: " + certificate.getSubjectX500Principal());
-                    LOG.log(POILogger.DEBUG, "validity: " + certificate.getNotBefore() + " - " + certificate.getNotAfter());
-                }
-            };
-            signatureConfig.setTspValidator(tspValidator);
-            signatureConfig.setTspOldProtocol(signatureConfig.getTspUrl().contains("edelweb"));
-        }
-        
-        final RevocationData revocationData = new RevocationData();
-        revocationData.addCRL(crl);
-        OCSPResp ocspResp = PkiTestUtils.createOcspResp(x509, false,
-                x509, x509, keyPair.getPrivate(), "SHA1withRSA", cal.getTimeInMillis());
-        revocationData.addOCSP(ocspResp.getEncoded());
-
-        RevocationDataService revocationDataService = revocationChain -> revocationData;
-        signatureConfig.setRevocationDataService(revocationDataService);
-
-        // operate
-        SignatureInfo si = new SignatureInfo();
-        si.setSignatureConfig(signatureConfig);
-        try {
-            si.confirmSignature();
-        } catch (RuntimeException e) {
-            pkg.close();
-            // only allow a ConnectException because of timeout, we see this in Jenkins from time to time...
-            if(e.getCause() == null) {
                 throw e;
             }
-            if((e.getCause() instanceof ConnectException) || (e.getCause() instanceof SocketTimeoutException)) {
-                Assume.assumeFalse("Only allowing ConnectException with 'timed out' as message here, but had: " + e,
-                        e.getCause().getMessage().contains("timed out"));
-            } else if (e.getCause() instanceof IOException) {
-                Assume.assumeFalse("Only allowing IOException with 'Error contacting TSP server' as message here, but had: " + e,
-                        e.getCause().getMessage().contains("Error contacting TSP server"));
-            } else if (e.getCause() instanceof RuntimeException) {
-                Assume.assumeFalse("Only allowing RuntimeException with 'This site is cur' as message here, but had: " + e,
-                        e.getCause().getMessage().contains("This site is cur"));
+
+            // verify
+            Iterator<SignaturePart> spIter = si.getSignatureParts().iterator();
+            assertTrue("Had: " + si.getSignatureConfig().getOpcPackage().
+                            getRelationshipsByType(PackageRelationshipTypes.DIGITAL_SIGNATURE_ORIGIN),
+                    spIter.hasNext());
+            SignaturePart sp = spIter.next();
+            boolean valid = sp.validate();
+            assertTrue(valid);
+
+            SignatureDocument sigDoc = sp.getSignatureDocument();
+            String declareNS =
+                    "declare namespace xades='http://uri.etsi.org/01903/v1.3.2#'; "
+                            + "declare namespace ds='http://www.w3.org/2000/09/xmldsig#'; ";
+
+            String digestValXQuery = declareNS +
+                    "$this/ds:Signature/ds:SignedInfo/ds:Reference";
+            for (ReferenceType rt : (ReferenceType[]) sigDoc.selectPath(digestValXQuery)) {
+                assertNotNull(rt.getDigestValue());
+                assertEquals(signatureConfig.getDigestMethodUri(), rt.getDigestMethod().getAlgorithm());
             }
-            throw e;
-        }
-        
-        // verify
-        Iterator<SignaturePart> spIter = si.getSignatureParts().iterator();
-        assertTrue("Had: " + si.getSignatureConfig().getOpcPackage().
-                        getRelationshipsByType(PackageRelationshipTypes.DIGITAL_SIGNATURE_ORIGIN),
-                spIter.hasNext());
-        SignaturePart sp = spIter.next();
-        boolean valid = sp.validate();
-        assertTrue(valid);
-        
-        SignatureDocument sigDoc = sp.getSignatureDocument();
-        String declareNS = 
-            "declare namespace xades='http://uri.etsi.org/01903/v1.3.2#'; "
-          + "declare namespace ds='http://www.w3.org/2000/09/xmldsig#'; ";
-        
-        String digestValXQuery = declareNS +
-            "$this/ds:Signature/ds:SignedInfo/ds:Reference";
-        for (ReferenceType rt : (ReferenceType[])sigDoc.selectPath(digestValXQuery)) {
-            assertNotNull(rt.getDigestValue());
-            assertEquals(signatureConfig.getDigestMethodUri(), rt.getDigestMethod().getAlgorithm());
+
+            String certDigestXQuery = declareNS +
+                    "$this//xades:SigningCertificate/xades:Cert/xades:CertDigest";
+            XmlObject xoList[] = sigDoc.selectPath(certDigestXQuery);
+            assertEquals(xoList.length, 1);
+            DigestAlgAndValueType certDigest = (DigestAlgAndValueType) xoList[0];
+            assertNotNull(certDigest.getDigestValue());
+
+            String qualPropXQuery = declareNS +
+                    "$this/ds:Signature/ds:Object/xades:QualifyingProperties";
+            xoList = sigDoc.selectPath(qualPropXQuery);
+            assertEquals(xoList.length, 1);
+            QualifyingPropertiesType qualProp = (QualifyingPropertiesType) xoList[0];
+            boolean qualPropXsdOk = qualProp.validate();
+            assertTrue(qualPropXsdOk);
+
+            pkg.save(bos);
         }
 
-        String certDigestXQuery = declareNS +
-            "$this//xades:SigningCertificate/xades:Cert/xades:CertDigest";
-        XmlObject xoList[] = sigDoc.selectPath(certDigestXQuery);
-        assertEquals(xoList.length, 1);
-        DigestAlgAndValueType certDigest = (DigestAlgAndValueType)xoList[0];
-        assertNotNull(certDigest.getDigestValue());
+        try (OPCPackage pkg = OPCPackage.open(new ByteArrayInputStream(bos.toByteArray()))) {
+            SignatureConfig signatureConfig = new SignatureConfig();
+            signatureConfig.setOpcPackage(pkg);
+            signatureConfig.setUpdateConfigOnValidate(true);
 
-        String qualPropXQuery = declareNS +
-            "$this/ds:Signature/ds:Object/xades:QualifyingProperties";
-        xoList = sigDoc.selectPath(qualPropXQuery);
-        assertEquals(xoList.length, 1);
-        QualifyingPropertiesType qualProp = (QualifyingPropertiesType)xoList[0];
-        boolean qualPropXsdOk = qualProp.validate();
-        assertTrue(qualPropXsdOk);
+            SignatureInfo si = new SignatureInfo();
+            si.setSignatureConfig(signatureConfig);
 
-        pkg.close();
+            assertTrue(si.verifySignature());
+
+            assertEquals(HashAlgorithm.sha512, signatureConfig.getXadesDigestAlgo());
+            assertEquals("Xades Reviewer", signatureConfig.getXadesRole());
+            assertEquals("test xades signature", signatureConfig.getSignatureDescription());
+            assertEquals(execTimestr, signatureConfig.formatExecutionTime());
+        }
     }
 
     public static String getAccessError(String destinationUrl, boolean fireRequest, int timeout) {
@@ -698,6 +732,27 @@ public class TestSignatureInfo {
         }
     }
 
+    @Test
+    public void testRetrieveCertificate() throws InvalidFormatException, IOException {
+        SignatureConfig sic = new SignatureConfig();
+        final File file = testdata.getFile("PPT2016withComment.pptx");
+        try (final OPCPackage pkg = OPCPackage.open(file, PackageAccess.READ)) {
+            sic.setOpcPackage(pkg);
+            sic.setUpdateConfigOnValidate(true);
+            SignatureInfo si = new SignatureInfo();
+            si.setSignatureConfig(sic);
+            assertTrue(si.verifySignature());
+        }
+
+        final List<X509Certificate> certs = sic.getSigningCertificateChain();
+        assertEquals(1, certs.size());
+        assertEquals("CN=Test", certs.get(0).getSubjectDN().getName());
+        assertEquals("SuperDuper-Reviewer", sic.getXadesRole());
+        assertEquals("Purpose for signing", sic.getSignatureDescription());
+        assertEquals("2018-06-10T09:00:54Z", sic.formatExecutionTime());
+        assertEquals(CanonicalizationMethod.INCLUSIVE, sic.getCanonicalizationMethod());
+    }
+
     private SignatureConfig prepareConfig(String alias, String signerDn, String pfxInput) throws Exception {
         initKeyPair(alias, signerDn, pfxInput);