This software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only.
Release Notes
Release 2.0.0 (current stable release)
Release date:Â 2016-06-27
For a complete list of issues addressed in this release, see https://issues.shibboleth.net/jira/issues/?filter=11476.
- XSTJ-36:Â
xmlsectool
 has been ported from the old OpenSAML 2 software stack to OpenSAML 3. This means thatxmlsectool
relies only on supported software. - XSTJ-25:Â
xmlsectool
now requires at least Java 7 to run. - XSTJ-52: Now that the Java runtime's XML processing API implementations are sufficiently reliable,Â
xmlsectool
no longer depends on, or bundles, "endorsed" versions of them. One benefit of this change is that some cases in whichÂxmlsectool
previously inserted redundant namespace prefix definitions have been addressed (see XSTJ-4). - XSTJ-11: the Java package name has been changed to correspond to the Maven artifact ID. The main class name has also changed to correspond to Shibboleth project conventions. These changes have no effect on command-line operation, but means that environments in which the Java code is called directly must use a new entry point of
net.shibboleth.tool.xmlsectool.XMLSecTool
. - XSTJ-45:Â
xmlsectool
no longer creates log files in its home directory by default. This means that write access to the installation directory is no longer required to runÂxmlsectool
. If the previous behaviour is desired, use theÂ--logConfig
command line option to supply a custom logging configuration. - XSTJ-54: errors are now still logged ifÂ
--quiet
logging is selected. If the previous behaviour is desired, use theÂ--logConfig
 command line option to supply a custom logging configuration. - XSTJ-55: theÂ
--signatureRequired
command line option has been removed. Its effect was always present by default and there was no way to negate it, rendering it entirely redundant. - XSTJ-35: it is now possible to sign using an elliptic curve credential taken from a file.
- XSTJ-34: in line with current recommendations for digital signatures, the default signing digest algorithm has been changed from SHA-1 to SHA-256. Use theÂ
--digest
command line option if you are sure that you need to override this. - XSTJ-39: in line with current recommendations for digital signatures, the SHA-1 digest algorithm has been added to the default blacklist, which now consists of MD5 and SHA-1. This means that some signatures accepted byÂ
xmlsectool
V1.2.0 will not be accepted by default byÂxmlsectool
V2.0.0. If you are sure that you need to override this, you can do so by using the newÂ--whitelistDigest
option to remove a specific digest algorithm from the blacklist, as an alternative to the combination ofÂ--clearBlacklist
andÂ--blacklistDigest
options already available from V1.2.0. - XSTJ-51: ECDSA signatures are now schema-valid. The emptyÂ
KeyValue
elements produced by previous versions ofÂxmlsectool
are no longer included in the output. - XSTJ-44: (post beta 1) ECDSA signatures may now be made and validated on a wider variety of platforms.