(AutoIt) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

; This example requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

; The signed XML we wish to verify contains external references such as this:

;     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
;       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
;       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
;     </ds:Reference>
;     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
;       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
;       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
;     </ds:Reference>

$oVerifier = ObjCreate("Chilkat.XmlDSig")
$oHttp = ObjCreate("Chilkat.Http")

; First load the signed XML
$oSbSignedXml = ObjCreate("Chilkat.StringBuilder")
Local $bSuccess = $oSbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8")
If ($bSuccess = False) Then
    ConsoleWrite("Failed to load signed XML." & @CRLF)
    Exit
EndIf

$bSuccess = $oVerifier.LoadSignatureSb($oSbSignedXml)
If ($bSuccess = False) Then
    ConsoleWrite($oVerifier.LastErrorText & @CRLF)
    Exit
EndIf

; Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
$oSbRefUri = ObjCreate("Chilkat.StringBuilder")
$oBd = ObjCreate("Chilkat.BinData")
Local $iNumRefs = $oVerifier.NumReferences
Local $i = 0
While $i < $iNumRefs
    If ($oVerifier.IsReferenceExternal($i) = True) Then
        $oSbRefUri.Clear 
        $oSbRefUri.Append($oVerifier.ReferenceUri($i))
        If ($oSbRefUri.StartsWith("https://",False) = True) Then
            ConsoleWrite("External URL Reference: " & $oSbRefUri.GetAsString() & @CRLF)

            ; Download the data at the URL and provide to the verifier.
            $bSuccess = $oHttp.DownloadBd($oSbRefUri.GetAsString(),$oBd)
            If ($bSuccess = False) Then
                ConsoleWrite($oHttp.LastErrorText & @CRLF)
                Exit
            EndIf

            $bSuccess = $oVerifier.SetRefDataBd($i,$oBd)
            If ($bSuccess = False) Then
                ConsoleWrite($oVerifier.LastErrorText & @CRLF)
                Exit
            EndIf

        EndIf

    EndIf

    $i = $i + 1
Wend

; Now that we have the external data, verify the signature..
Local $bVerified = $oVerifier.VerifySignature(True)
If ($bVerified = False) Then
    ConsoleWrite($oVerifier.LastErrorText & @CRLF)
EndIf

ConsoleWrite("Signature verified = " & $bVerified & @CRLF)