(Ruby) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat Ruby Downloads install from rubygems.org gem install chilkat or download... Ruby Library for Windows, MacOS, Linux, Alpine Linux

require 'chilkat'

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# The signed XML we wish to verify contains external references such as this:

#     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
#       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
#     </ds:Reference>
#     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
#       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
#     </ds:Reference>

verifier = Chilkat::CkXmlDSig.new()
http = Chilkat::CkHttp.new()

# First load the signed XML
sbSignedXml = Chilkat::CkStringBuilder.new()
success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8")
if (success == false)
    print "Failed to load signed XML." + "\n";
    exit
end

success = verifier.LoadSignatureSb(sbSignedXml)
if (success == false)
    print verifier.lastErrorText() + "\n";
    exit
end

# Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
sbRefUri = Chilkat::CkStringBuilder.new()
bd = Chilkat::CkBinData.new()
numRefs = verifier.get_NumReferences()
i = 0
while i < numRefs
    if (verifier.IsReferenceExternal(i) == true)
        sbRefUri.Clear()
        sbRefUri.Append(verifier.referenceUri(i))
        if (sbRefUri.StartsWith("https://",false) == true)
            print "External URL Reference: " + sbRefUri.getAsString() + "\n";

            # Download the data at the URL and provide to the verifier.
            success = http.DownloadBd(sbRefUri.getAsString(),bd)
            if (success == false)
                print http.lastErrorText() + "\n";
                exit
            end

            success = verifier.SetRefDataBd(i,bd)
            if (success == false)
                print verifier.lastErrorText() + "\n";
                exit
            end

        end

    end

    i = i + 1
end

# Now that we have the external data, verify the signature..
bVerified = verifier.VerifySignature(true)
if (bVerified == false)
    print verifier.lastErrorText() + "\n";
end

print "Signature verified = " + bVerified.to_s() + "\n";