(Swift 3,4,5...) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat Downloads for the Swift Programming Language MAC OS X (Cocoa) Objective-C/Swift Libs iOS Objective-C/Swift Libs

func chilkatTest() {
    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // The signed XML we wish to verify contains external references such as this:

    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
    //     </ds:Reference>
    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
    //     </ds:Reference>

    let verifier = CkoXmlDSig()!
    let http = CkoHttp()!

    // First load the signed XML
    let sbSignedXml = CkoStringBuilder()!
    var success: Bool = sbSignedXml.loadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml", charset: "utf-8")
    if success == false {
        print("Failed to load signed XML.")
        return
    }

    success = verifier.loadSignatureSb(sbSignedXml)
    if success == false {
        print("\(verifier.lastErrorText!)")
        return
    }

    // Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
    let sbRefUri = CkoStringBuilder()!
    let bd = CkoBinData()!
    var numRefs: Int = verifier.numReferences.intValue
    var i: Int = 0
    while i < numRefs {
        if verifier.isReferenceExternal(i) == true {
            sbRefUri.clear()
            sbRefUri.append(verifier.referenceUri(i))
            if sbRefUri.starts(with: "https://", caseSensitive: false) == true {
                print("External URL Reference: \(sbRefUri.getAsString()!)")

                // Download the data at the URL and provide to the verifier.
                success = http.downloadBd(sbRefUri.getAsString(), binData: bd)
                if success == false {
                    print("\(http.lastErrorText!)")
                    return
                }

                success = verifier.setRefDataBd(i, binData: bd)
                if success == false {
                    print("\(verifier.lastErrorText!)")
                    return
                }

            }

        }

        i = i + 1
    }

    // Now that we have the external data, verify the signature..
    var bVerified: Bool = verifier.verifySignature(true)
    if bVerified == false {
        print("\(verifier.lastErrorText!)")
    }

    print("Signature verified = \(bVerified)")

}