(Chilkat2-Python) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat2 Python Downloads install with pip pip3 install chilkat2 or download... Python Module for Windows, Linux, Alpine Linux, MacOS, Solaris

import sys
import chilkat2

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# The signed XML we wish to verify contains external references such as this:

#     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
#       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
#     </ds:Reference>
#     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
#       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
#     </ds:Reference>

verifier = chilkat2.XmlDSig()
http = chilkat2.Http()

# First load the signed XML
sbSignedXml = chilkat2.StringBuilder()
success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8")
if (success == False):
    print("Failed to load signed XML.")
    sys.exit()

success = verifier.LoadSignatureSb(sbSignedXml)
if (success == False):
    print(verifier.LastErrorText)
    sys.exit()

# Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
sbRefUri = chilkat2.StringBuilder()
bd = chilkat2.BinData()
numRefs = verifier.NumReferences
i = 0
while i < numRefs :
    if (verifier.IsReferenceExternal(i) == True):
        sbRefUri.Clear()
        sbRefUri.Append(verifier.ReferenceUri(i))
        if (sbRefUri.StartsWith("https://",False) == True):
            print("External URL Reference: " + sbRefUri.GetAsString())

            # Download the data at the URL and provide to the verifier.
            success = http.DownloadBd(sbRefUri.GetAsString(),bd)
            if (success == False):
                print(http.LastErrorText)
                sys.exit()

            success = verifier.SetRefDataBd(i,bd)
            if (success == False):
                print(verifier.LastErrorText)
                sys.exit()

    i = i + 1

# Now that we have the external data, verify the signature..
bVerified = verifier.VerifySignature(True)
if (bVerified == False):
    print(verifier.LastErrorText)

print("Signature verified = " + str(bVerified))