v2.4.0

• #259 Support custom XML element IDs
• #304 Add element IDs on demand instead of upfront
• #311 Add support for signature algorithm parameters
• #302 Support verification of signature protecting the signing certificate in KeyInfo only
• Bump org.apache.santuario:xmlsec from 4.0.1 to 4.0.2
• Bump jakarta.xml.bind:jakarta.xml.bind-api from 4.0.1 to 4.0.2
• Bump com.google.guava:guava from 33.2.1-jre to 33.3.1-jre
• Upgrade test and build dependencies
  • Bump org.slf4j:slf4j-simple from 2.0.13 to 2.0.16
  • Bump org.apache.maven.plugins:maven-gpg-plugin from 3.2.4 to 3.2.5
  • Bump org.sonatype.plugins:nexus-staging-maven-plugin from 1.6.13 to 1.7.0
  • Bump org.apache.maven.plugins:maven-gpg-plugin from 3.2.5 to 3.2.7
  • Bump org.junit:junit-bom from 5.10.3 to 5.11.1
  • Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.6.3 to 3.10.1

v2.3.0

• #289 Support omitting the SigningCertificate property
• #282 Prevent Observable Timing Discrepancy
• Update different dependencies:
  • JAXB runtime from 4.0.4 to 4.0.5 (#292)
  • Guava from 32.1.3-jre to 33.2.1-jre (#293)
  • Bouncy Castle from 1.77 to 1.78.1 (#286 , #290)

v2.2.2

• Upgrade different dependencies:
  • Apache Santuario to 4.0.0
  • Guice to 7.0.0
  • JAXB to 4.0.X
• Upgrade tests to JUnit 5
• Multiple code cleanups

v2.2.1

• #272 Update Apache Santuario and Bouncy Castle

v2.2.0

• #267 - Add an option to skip certificate validity checks (not before / not after) during signature production (thanks @mjechow)

v2.1.0

#256 - Replace javax.xml.bind with jakarta.xml.bind
#261 - Upgrade Apache Santuario (xmlsec) to version 2.3.0

• This version of xmlsec removes the local file-system and HTTP resolvers by default: https://issues.apache.org/jira/browse/SANTUARIO-573.
• If you're using using data object references that require such resolvers, use one of the following options:
  • Add the resolvers to SignedDataObjects/SignatureSpecificVerificationOptions (see this commit)
  • Register the resolvers directly with xmlsec using ResourceResolver.register().

v2.0.0

This major release requires Java 11 and includes breaking changes and removal of deprecated classes/APIs.

For details refer to the upgrade guide.

• #242 - Refactor PKCS11KeyStoreKeyingDataProvider for Java 11
• #243 - Replace AlgorithmsProviderEx with SignatureAlgorithms
• #244 - Remove deprecated BasicSignatureOptionsProvider
• #245 - Improvements to SigningCertSelector
• #246 - Add a builder for PKCS11KeyStoreKeyingDataProvider
• #247 - Add a builder for FileSystemKeyStoreKeyingDataProvider
• #248 - Remove deprecated TS providers
• #249 - Improvements to the API of PropertiesDataGenerationContext
• #250 - Add a builder for PKIXCertificateValidationProvider
• #255 - Remove default TSA configuration
• #252 - Improve test assertions

v1.7.0

• #230 - Check key usage of the signer certificate during validation
  • Can be disabled via SignatureSpecificVerificationOptions.checkKeyUsage()
• #226 - Support for ds:Manifest
  • Use the newly added EnvelopedManifest class
• #225 - Add support for EC keys to the default algorithms provider
  • By default ECDSA_SHA256 is used when an EC key is supplied
• #222 - Update Guice to version 5

v1.6.0

• #175 - Support validation of signatures without KeyInfo. In this case, if the SigningCertificate property contains a single reference, it will be used to select the signing certificate during validation.
• #207 - Update Apache Santuario (xmlsec) to version 2.2.0.
  • This version of xmlsec includes some important bugfixes and a couple of new features that xades4j should be able to leverage, namely support for RSASSA-PSS with parameters and support for embedding elliptic curve public keys in the KeyValue element (allows using BasicSignatureOptions.includePublicKey() with EC keys). For more information see Apache Santuario release notes.
  • Unfortunately, this version of xmlsec introduces a breaking change on the API (not behavior) due to a refactoring of ResourceResolvers. For that reason, the following two methods of xades4j have changed in this release to accept ResourceResolverSpi instead of ResourceResolver. Changes for consumers are minimal; just use Spi classes directly instead of wrapping them in a ResourceResolver.
    • SignedDataObjects.withResourceResolver
    • SignatureSpecificVerificationOptions.useResourceResolver
• #212 - Add JAXB dependencies.

v1.5.1

• #166 - Fix comparison of UTF8String and PrintableString in DNs
• Builds and tests
  • #179 - Fix failing test on Windows
  • #178 - Run builds on different versions of JDK
  • #176 - Use JKS keystores for better interop