Version 1.0.4 released on 15. July 2002; minor improvements. The most significant is that people who did not install Xalan properly under JDK 1.4.0 get a more specific error message. It uses the most recent version of the BouncyCastle JCE now.

Version 1.0.3 now supports new W3C specs:

• Exclusive XML Canonicalization Version 1.0, W3C Recommendation 18 July 2002. (There is no interop to test vector Y4 because of a problem in Xalan)
• XML-Signature XPath Filter 2.0, W3C Candidate Recommendation 18 July 2002

Canonicalization is written completely new: it's about 5-80 times faster than the implementation in version 1.0.2. It's highly recommended to upgrade to the new version.

If you use JDK 1.4 and want to use this software, be sure that Xalan is properly installed. Check the bottom of the installation guide!!!

I have so many complaints from people who argue that the software throws exceptions during running the examples or during unit testing. This package NEEDS a Xalan version after 2.2D13 (and SUN shipped his JDK 1.4.0 final with a Xalan beta!). I started integrating the installation guide into the exception messages cause it seems that people don't have a look at the installation guide.

The &packagenamelong; &packageversion; supports the XML-Signature Syntax and Processing recommendation.

Note that there is no standard API avaliable at the moment. SUN is working on a JAVA Specification Request JSR-105: XML Digital Signature APIs on an API for XML Signature and JSR-106: XML Digital Encryption APIs, but until now, nothing has been published. So, this software does not conform to any of these specifications.

The XML Security package is available in both source code and precompiled binary (JAR files) form. Both packages are made available under the Apache Software License.

You can download the source and binary packages in the dist directory.

This software can be used to create and verify arbitrary forms of XML Signatures. The documentation available here is not very huge; my first approach is to supply usage examples which are available in the src_samples/ directory to give interested users a first starting point to jump-start with XML Signature. NOTE: The samples divide into two groups: Samples that create and samples that verify Signatures. Eventually, you should adjust the verifying program to another filename if you get FileNotFoundExceptions.

There exists a mailing list which you can subscribe to ask questions:

The ezmlm mailing list controller accepts commands by sending emails to it, generally like the following:

• security-dev-subscribe to subscribe your current email address to the list
• security-dev-unsubscribe to unsubscribe your *current* email address from the list
• security-dev-help to get Help on mailing list commands

An archive of this list is kept under http://news.gmane.org/thread.php?group=gmane.text.xml.security.devel

For comments about the software please send them to the author geuer-pollmann@nue.et-inf.uni-siegen.de