(CkPython) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# The signed XML we wish to verify contains external references such as this:

#     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
#       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
#     </ds:Reference>
#     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
#       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
#     </ds:Reference>

verifier = chilkat.CkXmlDSig()
http = chilkat.CkHttp()

# First load the signed XML
sbSignedXml = chilkat.CkStringBuilder()
success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8")
if (success == False):
    print("Failed to load signed XML.")
    sys.exit()

success = verifier.LoadSignatureSb(sbSignedXml)
if (success == False):
    print(verifier.lastErrorText())
    sys.exit()

# Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
sbRefUri = chilkat.CkStringBuilder()
bd = chilkat.CkBinData()
numRefs = verifier.get_NumReferences()
i = 0
while i < numRefs :
    if (verifier.IsReferenceExternal(i) == True):
        sbRefUri.Clear()
        sbRefUri.Append(verifier.referenceUri(i))
        if (sbRefUri.StartsWith("https://",False) == True):
            print("External URL Reference: " + sbRefUri.getAsString())

            # Download the data at the URL and provide to the verifier.
            success = http.DownloadBd(sbRefUri.getAsString(),bd)
            if (success == False):
                print(http.lastErrorText())
                sys.exit()

            success = verifier.SetRefDataBd(i,bd)
            if (success == False):
                print(verifier.lastErrorText())
                sys.exit()

    i = i + 1

# Now that we have the external data, verify the signature..
bVerified = verifier.VerifySignature(True)
if (bVerified == False):
    print(verifier.lastErrorText())

print("Signature verified = " + str(bVerified))