XML Security Library

Frequently Asked Questions

0. Why have you wrote xmlsec?

Very simple: when I decided to understand the XML Digital Signature and XML Encrytpion specs there were no open source C/C++ implementation available. After spending a couple days trying to install Java implementation (Apache XML Security Suite) I gave up and decided to implement these specs by myself.

1. License(s).

1.1. Licensing Terms for xmlsec.

XML Security Library is released under the MIT License, see the file Copyright in the distribution for the precise wording.

1.2. Can I embed xmlsec in a proprietary application ?

Yes. The MIT License allows you to also keep proprietary the changes you made to xmlsec, but it would be graceful to provide back bug fixes and improvements as patches for possible incorporation in the main development tree.

1.3. Can I use xmlsec with a GNU GPL library?

Yes. MIT license is compatible with GNU GPL library. However, xmlsec is based on OpenSSL and OpenSSL license is not compatible with GNU GPL. In most cases, this should not cause any problems because of a special exception in the GPL.

2. Installation.

2.1. Where can I get xmlsec?

The original distribution comes from XML Security Library page. Also xmlsec is available from rpmfind.net miror.

2.2. How to compile xmlsec?

On Unix just follow the "standard":
gunzip -c xmlsec-xxx.tar.gz | tar xvf -
cd xmlsec-xxxx
./configure --help
./configure [possible options]
make
make install
make check
At that point you may have to rerun ldconfig or similar utility to update your list of installed shared libs.
On Windows the process is more complicated. Please check readme file in xmlsec-xxxx/win32 folder.

2.3. What other libraries are needed to compile/install xmlsec?

The XML Security Library requires:

2.4. Why does make check fail for some tests?

First of all, some tests must fail! Please read the messages printed before the tests.
If you have other failed tests then the next possible reason is that you use OpenSSL 0.9.6 and some xmlsec features are disabled in this case. Please try to upgrade to OpenSSL 0.9.7 and re-configure/re-compile xmlsec.
if this does not help then probably there is a bug in the xmlsec or in the xmlsec tests. Please submit the bug report and I'll try to fix it.

2.5. I get the xmlsec sources from CVS and there is no configure script. Where can I get it?

The configure (and other Makefiles) are generated. Use the autogen.sh script to regenerate the configure and Makefiles, like:
./autogen.sh --prefix=/usr

2.5. I do not need all these features supported by xmlsec. Can I disable some of them?

Yes, you can. Please run ./configure --help for the list of possible configuration options.

3. Programming with XMLSec.

3.1. xmlSecDSigValidate() function returned 0. Does this mean that the signature is valid?

No! Function xmlSecDSigValidate() returns 0 when there were no processing errors during signature validation (i.e. the document has correct syntax, all keys were found, etc.). The signature is valid if and only if the xmlSecDSigValidate() function returns 0 and the result member of the returned xmlSecDSigResult structure is equal to xmlSecTransformStatusOk.

Aleksey Sanin