From 4979c9646587a85592283f3ed1a34a4d616718d6 Mon Sep 17 00:00:00 2001 From: Chris Barth Date: Thu, 10 Sep 2026 22:34:22 -0500 Subject: [PATCH 1/2] docs: note the inclusive canonicalization output change for upgraders #541 made inclusive C14N render namespace declarations as the specification requires. For the affected document shapes the digest differs from 6.1.x, so signers and verifiers on different versions reject each other's signatures. Describe the shapes and the upgrade path in the Upgrading section, since the changelog is generated from PR titles and has no room for migration advice. Co-Authored-By: Claude Opus 5 --- README.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/README.md b/README.md index 619bb348..93a32977 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,25 @@ ## Upgrading +### Inclusive canonicalization output + +Inclusive canonicalization (`http://www.w3.org/TR/2001/REC-xml-c14n-20010315` and its +`#WithComments` variant) now renders namespace declarations as the +[C14N specification](https://www.w3.org/TR/2001/REC-xml-c14n-20010315#ProcessingModel) requires. +Earlier releases rendered some documents incorrectly, for example when: + +- a prefixed element in the signed content declares a default namespace, as in + `` +- the signed element inherits a default namespace and declares a prefixed namespace of its own +- the signed element is prefixed, inherits a default namespace, and contains an element that + clears it with `xmlns=""` +- the signed element redeclares a prefix that an ancestor binds, after declaring another namespace + +For such documents this release computes a different digest than 6.1.x and earlier, so a +signature created by one will not verify with the other. Upgrade signers and verifiers that +exchange these documents together. Documents signed in these shapes by other conforming +implementations, which 6.1.x rejected, now verify. Exclusive canonicalization is unaffected. + ### Deprecated ahead of 7.0 The package used to re-export everything in its internal `utils` module, so helpers written for From bd4d1a88c777450771a2e4d449f54a9e46461d86 Mon Sep 17 00:00:00 2001 From: Chris Barth Date: Sun, 13 Sep 2026 21:54:44 -0500 Subject: [PATCH 2/2] docs: cover the exclusive canonicalization case and name 6.2.0 in upgrade notes Co-Authored-By: Claude Opus 5 --- README.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index d9938fb7..1f3f50b6 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ ## Upgrading -### Inclusive canonicalization output +### Canonicalization output Inclusive canonicalization (`http://www.w3.org/TR/2001/REC-xml-c14n-20010315` and its `#WithComments` variant) now renders namespace declarations as the @@ -29,16 +29,20 @@ Earlier releases rendered some documents incorrectly, for example when: clears it with `xmlns=""` - the signed element redeclares a prefix that an ancestor binds, after declaring another namespace -For such documents this release computes a different digest than 6.1.x and earlier, so a +The last case also changes exclusive canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#` +and its `#WithComments` variant) when the redeclared prefix is listed in the +`InclusiveNamespaces` `PrefixList`. Exclusive canonicalization is otherwise unaffected. + +For such documents 6.2.0 and later compute a different digest than 6.1.x and earlier, so a signature created by one will not verify with the other. Upgrade signers and verifiers that exchange these documents together. Documents signed in these shapes by other conforming -implementations, which 6.1.x rejected, now verify. Exclusive canonicalization is unaffected. +implementations, which 6.1.x rejected, now verify. ### Deprecated ahead of 7.0 The package used to re-export everything in its internal `utils` module, so helpers written for -`signed-xml.ts` became public API by accident. These are deprecated as of this release and will -be removed in 7.0: +`signed-xml.ts` became public API by accident. These are deprecated as of 6.2.0 and will be +removed in 7.0: | Deprecated | Instead | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |