(Delphi DLL) Signed Zip as Base64 with XAdES-BES

This example is to help companies implement a solution for sending XAdES-BES to the Polish government for reporting purposes. Specifically:

Przed podpisaniem deklaracja zbiorcza (PIT-11Z, PIT-8CZ, PIT-40Z, PIT-RZ) musi zostać
umieszczona w archiwum ZIP. W tym przypadku, podpisywany jest plik archiwum ZIP,
przyjmujący w podpisie XAdES-BES formę zakodowaną base64.

The example demonstrates the following:

Zip an XML file (PIT-11Z.xml is zipped to PIT-11Z.zip)
Create XML to be signed, where the XML contains the base64 encoded content of the PIT-11Z.zip archive.
XAdES-BES sign the XML containing the base64 zip.

This example will also show the reverse:

Verify the signed XML.
Extract the PIT-11z.zip from the signed XML.
Unzip the PIT-11Z.zip to get the original PIT-11Z.xml

Chilkat for Delphi Downloads

Chilkat non-ActiveX DLL for Delphi

Chilkat ActiveX DLL for Delphi

* The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, XmlDSigGen, XmlDSig, Zip, Cert, StringBuilder, BinData, ZipEntry, Xml;

...

procedure TForm1.Button1Click(Sender: TObject);
var
sbXmlToZip: HCkStringBuilder;
success: Boolean;
zip: HCkZip;
entry: HCkZipEntry;
bdZip: HCkBinData;
gen: HCkXmlDSigGen;
object1: HCkXml;
cert: HCkCert;
sbXml: HCkStringBuilder;
verifier: HCkXmlDSig;
verified: Boolean;
xml: HCkXml;
strZipBase64: PWideChar;
origXml: PWideChar;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Zip the PIT-11Z.xml to create PIT-11Z.zip (not as a .zip file, but in-memory).
sbXmlToZip := CkStringBuilder_Create();
success := CkStringBuilder_LoadFile(sbXmlToZip,'qa_data/xml/PIT-11Z.xml','utf-8');
if (success <> True) then
  begin
    Memo1.Lines.Add('Failed to load the XML to be zipped.');
    Exit;
  end;

zip := CkZip_Create();

// Initialize the zip object. No file is created in this call.
// It should always return True.
success := CkZip_NewZip(zip,'PIT-11Z.zip');

// Add the XML to be zipped.
entry := CkZip_AppendString(zip,'PIT-11Z.xml',CkStringBuilder__getAsString(sbXmlToZip));
CkZipEntry_Dispose(entry);

// Write the zip to a BinData object.
bdZip := CkBinData_Create();
CkZip_WriteBd(zip,bdZip);
// The contents of the bdZip will be retrieved in base64 format when needed below..

gen := CkXmlDSigGen_Create();

CkXmlDSigGen_putSigLocation(gen,'');
CkXmlDSigGen_putSigLocationMod(gen,0);

CkXmlDSigGen_putSigId(gen,'Signature_2a8df7f8-b958-40cc-83f6-edb53b837347_19');
CkXmlDSigGen_putSigNamespacePrefix(gen,'ds');
CkXmlDSigGen_putSigNamespaceUri(gen,'http://www.w3.org/2000/09/xmldsig#');
CkXmlDSigGen_putSigValueId(gen,'SignatureValue_2a8df7f8-b958-40cc-83f6-edb53b837347_52');
CkXmlDSigGen_putSignedInfoId(gen,'SignedInfo_2a8df7f8-b958-40cc-83f6-edb53b837347_41');
CkXmlDSigGen_putSignedInfoCanonAlg(gen,'C14N');
CkXmlDSigGen_putSignedInfoDigestMethod(gen,'sha1');

// Set the KeyInfoId before adding references..
CkXmlDSigGen_putKeyInfoId(gen,'KeyInfo_2a8df7f8-b958-40cc-83f6-edb53b837347_24');

// Create an Object to be added to the Signature.
object1 := CkXml_Create();
CkXml_putTag(object1,'xades:QualifyingProperties');
CkXml_AddAttribute(object1,'xmlns:xades','http://uri.etsi.org/01903/v1.3.2#');
CkXml_AddAttribute(object1,'Id','QualifyingProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_43');
CkXml_AddAttribute(object1,'Target','#Signature_2a8df7f8-b958-40cc-83f6-edb53b837347_19');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties',True,'Id','SignedProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_4e');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedSignatureProperties',True,'Id','SignedSignatureProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_0a');
// Chilkat will replace the strings "TO BE GENERATED BY CHILKAT" with actual values when the signature is created.
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime','TO BE GENERATED BY CHILKAT');
// Note: It may be that http://www.w3.org/2001/04/xmlenc#sha256 is needed in the following line instead of http://www.w3.org/2000/09/xmldsig#sha1
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestMethod',True,'Algorithm','http://www.w3.org/2000/09/xmldsig#sha1');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestValue','TO BE GENERATED BY CHILKAT');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:IssuerSerialV2','TO BE GENERATED BY CHILKAT');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedDataObjectProperties',True,'Id','SignedDataObjectProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_4b');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat',True,'ObjectReference','#Reference1_2a8df7f8-b958-40cc-83f6-edb53b837347_27');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:Description','MIME-Version: 1.0' + #13#10 + 'Content-Type: application/zip' + #13#10 + 'Content-Transfer-Encoding: binary' + #13#10 + 'Content-Disposition: filename=&quot;PIT-11Z.zip&quot;');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Identifier',True,'Qualifier','OIDAsURI');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Identifier','http://www.certum.pl/OIDAsURI/signedFile/1.2.616.1.113527.3.1.1.3.1');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Description','Opis formatu dokumentu oraz jego pelna nazwa');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:DocumentationReferences|xades:DocumentationReference','http://www.certum.pl/OIDAsURI/signedFile.pdf');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:MimeType','application/zip');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:CommitmentTypeIndication|xades:CommitmentTypeId|xades:Identifier','http://uri.etsi.org/01903/v1.2.2#ProofOfApproval');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:CommitmentTypeIndication|xades:AllSignedDataObjects','');
CkXml_UpdateAttrAt(object1,'xades:UnsignedProperties',True,'Id','UnsignedProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_55');

// Emit XML in compact (single-line) format to avoid whitespace problems.
CkXml_putEmitCompact(object1,True);
CkXmlDSigGen_AddObject(gen,'',CkXml__getXml(object1),'','');

// Create an Object to be added to the Signature.
// This is where we add the base64 representation of the PIT-11Z.zip
CkXmlDSigGen_AddObject(gen,'Object1_2a8df7f8-b958-40cc-83f6-edb53b837347',CkBinData__getEncoded(bdZip,'base64'),'','http://www.w3.org/2000/09/xmldsig#base64');

// -------- Reference 1 --------
CkXmlDSigGen_AddObjectRef(gen,'Object1_2a8df7f8-b958-40cc-83f6-edb53b837347','sha1','C14N_WithComments','','');
CkXmlDSigGen_SetRefIdAttr(gen,'Object1_2a8df7f8-b958-40cc-83f6-edb53b837347','Reference1_2a8df7f8-b958-40cc-83f6-edb53b837347_27');

// -------- Reference 2 --------
CkXmlDSigGen_AddObjectRef(gen,'SignedProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_4e','sha1','','','http://uri.etsi.org/01903#SignedProperties');
CkXmlDSigGen_SetRefIdAttr(gen,'SignedProperties_2a8df7f8-b958-40cc-83f6-edb53b837347_4e','SignedProperties-Reference_2a8df7f8-b958-40cc-83f6-edb53b837347_28');

// Provide a certificate + private key. (PFX password is test123)
cert := CkCert_Create();
success := CkCert_LoadPfxFile(cert,'qa_data/pfx/cert_test123.pfx','test123');
if (success <> True) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;
CkXmlDSigGen_SetX509Cert(gen,cert,True);

CkXmlDSigGen_putKeyInfoType(gen,'X509Data');
CkXmlDSigGen_putX509Type(gen,'Certificate');

// This will be an enveloping signature where the Signature element
// is the XML document root, the signed data is contained within Object
// tag(s) within the Signature.
// Therefore, pass an empty sbXml to CreateXmlDsigSb.
sbXml := CkStringBuilder_Create();

// The Polish government's XmlDSig implementation requires that we reproduce an attribute-sorting error.
// (This is an error in the XML canonicalization that is not noticed when both the signature-creation code and signature-verification code use
// the same XML canonicalization implementation w/ the bug.)
CkXmlDSigGen_putBehaviors(gen,'AttributeSortingBug,CompactSignedXml');

// Sign the XML...
success := CkXmlDSigGen_CreateXmlDSigSb(gen,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    Exit;
  end;
// -----------------------------------------------

// Save the signed XML to a file.
success := CkStringBuilder_WriteFile(sbXml,'qa_output/signedXml.xml','utf-8',False);

Memo1.Lines.Add(CkStringBuilder__getAsString(sbXml));

// ----------------------------------------
// Verify the signature we just produced...
verifier := CkXmlDSig_Create();
success := CkXmlDSig_LoadSignatureSb(verifier,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
    Exit;
  end;

verified := CkXmlDSig_VerifySignature(verifier,True);
if (verified <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
    Exit;
  end;
Memo1.Lines.Add('This signature was successfully verified.');

// ------------------------------------
// Finally, let's extract the .zip from the signed XML, and then unzip the original PIT-11Z.xml from the in-memory zip.
xml := CkXml_Create();
CkXml_LoadSb(xml,sbXml,True);

// The base64 image of the PIT-11Z.zip is in the 2nd ds:Object child of the ds:Signature (the ds:Signature is the root element of the signed XML).
// (ds:Object[0] would be the 1st ds:Object child.  Index 1 is the 2nd ds:Object child.)
strZipBase64 := CkXml__getChildContent(xml,'ds:Object[1]');

CkBinData_Clear(bdZip);
CkBinData_AppendEncoded(bdZip,strZipBase64,'base64');
if (CkBinData_getNumBytes(bdZip) = 0) then
  begin
    Memo1.Lines.Add('Something went wrong.. we dont'' have any data..');
    Exit;
  end;

success := CkZip_OpenBd(zip,bdZip);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkZip__lastErrorText(zip));
    Exit;
  end;

// Get the 1st file in the zip, which should be the PIT-11Z.xml
entry := CkZip_GetEntryByIndex(zip,0);
if (CkZip_getLastMethodSuccess(zip) <> True) then
  begin
    Memo1.Lines.Add('Zip contains no files...');
    Exit;
  end;

// Get the XML:
origXml := CkZipEntry__unzipToString(entry,0,'utf-8');
Memo1.Lines.Add('Original XML extracted from base64 zip:');
Memo1.Lines.Add(origXml);

CkZipEntry_Dispose(entry);

CkStringBuilder_Dispose(sbXmlToZip);
CkZip_Dispose(zip);
CkBinData_Dispose(bdZip);
CkXmlDSigGen_Dispose(gen);
CkXml_Dispose(object1);
CkCert_Dispose(cert);
CkStringBuilder_Dispose(sbXml);
CkXmlDSig_Dispose(verifier);
CkXml_Dispose(xml);

end;