Lua Requires Chilkat v9.5.0.75+

Create Egypt ITIDA CAdES-BES Signature with Automatic JSON Canonicalization

See more Egypt ITIDA Examples

Demonstrates how to create a .p7s signature that fits Egypt's ITIDA requirements where Chilkat automatically does the ITIDA JSON canonicalization. Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()
crypt.verbose_logging = true

local cert = chilkat.Cert.new()
cert.verbose_logging = true

-- Set the smart card PIN, which will be needed for signing.
cert.smart_card_pin = "12345678"

-- There are many ways to load the certificate.
-- This example was created for a customer using an ePass2003 USB token.
-- Assuming the USB token is the only source of a hardware-based private key..
local success = cert:load_from_smartcard("")
if not success then
    print(cert.last_error_text)
    return
end

-- Tell the crypt class to use this cert.
success = crypt:set_signing_cert(cert)
if not success then
    print(crypt.last_error_text)
    return
end

local cmsOptions = chilkat.JsonObject.new()
-- Setting "DigestData" causes OID 1.2.840.113549.1.7.5 (digestData) to be used.
cmsOptions:update_bool("DigestData", true)
cmsOptions:update_bool("OmitAlgorithmIdNull", true)

-- Indicate that we are passing normal JSON and we want Chilkat do automatically
-- do the ITIDA JSON canonicalization:
cmsOptions:update_bool("CanonicalizeITIDA", true)

crypt.cms_options = cmsOptions:emit()

-- The CadesEnabled property applies to all methods that create CMS/PKCS7 signatures.
-- To create a CAdES-BES signature, set this property equal to true.
crypt.cades_enabled = true

crypt.hash_algorithm = "sha256"

local jsonSigningAttrs = chilkat.JsonObject.new()
jsonSigningAttrs:update_int("contentType", 1)
jsonSigningAttrs:update_int("signingTime", 1)
jsonSigningAttrs:update_int("messageDigest", 1)
jsonSigningAttrs:update_int("signingCertificateV2", 1)
crypt.signing_attributes = jsonSigningAttrs:emit()

-- By default, all the certs in the chain of authentication are included in the signature.
-- If desired, we can choose to only include the signing certificate:
crypt.include_cert_chain = false

-- Pass a JSON document such as the following.  Chilkat will do the ITIDA canonicalization.
-- (It is the canonicalized JSON that gets signed.)

--       {
--          "issuer":{
--             "address":{
--                "branchID":"0",
--                "country":"EG",
--                "regionCity":"Cairo",
--                "postalCode":"",
--                "buildingNumber":"0",
--                "street":"123rd Street",
--                "governate":"GOVERNATE"
--             },
--             "type":"B",
--             "id":"209999899",
--             "name":"Xyz SAE"
--          },
--          "receiver":{
--             "address":{
--                "country":"EG",
--                "regionCity":"CAIRO",
--                "postalCode":"11435",
--                "buildingNumber":"0",
--                "street":"Autostrad Road Abc",
--                "governate":"GOVERNATE"
--             },
--             "type":"B",
--             "id":"999999999",
--             "name":"XYZ EGYPT FOR TRADE"
--          },
--          "documentType":"I",
--          "documentTypeVersion":"1.0",
--          "dateTimeIssued":"2020-11-15T11:04:53Z",
--          "taxpayerActivityCode":"1073",
--          "internalID":"ZZZZ999",
--          "purchaseOrderReference":"2009199918",
--          "salesOrderReference":"",
--          "payment":{
--             "bankName":"",
--             "bankAddress":"",
--             "bankAccountNo":"",
--             "bankAccountIBAN":"",
--             "swiftCode":"",
--             "terms":""
--          },
--          "delivery":{
--             "approach":"",
--             "packaging":"",
--             "dateValidity":"",
--             "exportPort":"",
--             "countryOfOrigin":"EG",
--             "grossWeight":0,
--             "netWeight":0,
--             "terms":""
--          },
--          "invoiceLines":[
--             {
--                "description":"CDM Widget 48GX99X12BA",
--                "itemType":"GS1",
--                "itemCode":"7622213335056",
--                "unitType":"CS",
--                "quantity":1.00,
--                "unitValue":{
--                   "currencySold":"EGP",
--                   "amountEGP":588.67,
--                   "amountSold":0,
--                   "currencyExchangeRate":0
--                },
--                "salesTotal":588.67,
--                "total":603.97,
--                "valueDifference":0,
--                "totalTaxableFees":0,
--                "netTotal":529.8,
--                "itemsDiscount":0,
--                "discount":{
--                   "rate":10.00,
--                   "amount":58.87
--                },
--                "taxableItems":[
--                   {
--                      "taxType":"T1",
--                      "amount":74.17,
--                      "subType":"No sub",
--                      "rate":14.00
--                   }
--                ],
--                "internalCode":"9099994"
--             }
--          ],
--          "totalSales":588.67,
--          "totalSalesAmount":588.67,
--          "totalDiscountAmount":58.87,
--          "netAmount":529.80,
--          "taxTotals":[
--             {
--                "taxType":"T1",
--                "amount":74.17
--             }
--          ],
--          "extraDiscountAmount":0,
--          "totalItemsDiscountAmount":0,
--          "totalAmount":603.97,
--       }
--

local json = chilkat.JsonObject.new()
success = json:load_file("qa_data/itida/sdk.invoicing.eta.gov.eg/files/one-doc.json")
if not success then
    print(json.last_error_text)
    return
end

json.emit_compact = false

-- Create the CAdES-BES signature.
crypt.encoding_mode = "base64"

-- Make sure we sign the utf-8 byte representation of the JSON string
crypt.charset = "utf-8"

local sigBase64 = crypt:sign_string_enc(json:emit())
if not crypt.last_method_success then
    print(crypt.last_error_text)
    return
end

print("Base64 signature:")
print(sigBase64)

-- Add the signature to the JSON.
json:update_string("signatures[0].signatureType", "I")
json:update_string("signatures[0].value", sigBase64)

print("JSON with signature added:")
print(json:emit())