java - Xades4j - XML 签名验证错误 - SignaturePolicyNotAvailableException

Question

我收到带有 Xades EPES 签名的 XML 发票，我必须控制它。所以我尝试使用 Xades4j 来做到这一点。我已经修复了很多错误，但我仍然坚持错误:

errxades4j.verification.SignaturePolicyNotAvailableException: Verification failed for property 'SignaturePolicyIdentifier': signature policy document is not available
    at xades4j.verification.SignaturePolicyVerifier.verify(SignaturePolicyVerifier.java:67)
    at xades4j.verification.SignaturePolicyVerifier.verify(SignaturePolicyVerifier.java:38)
    at xades4j.verification.QualifyingPropertiesVerifierImpl.verifyProperties(QualifyingPropertiesVerifierImpl.java:58)
    at xades4j.verification.XadesVerifierImpl.verify(XadesVerifierImpl.java:202)

Java 代码用于验证签名:

FileInputStream fis = new FileInputStream("keystore.jks");
KeyStore trustAnchors = KeyStore.getInstance("jks");
trustAnchors.load(fis,"password".toCharArray());
fis.close();

CertificateValidationProvider certValidator = new PKIXCertificateValidationProvider(trustAnchors, false);
XadesVerificationProfile p = new XadesVerificationProfile(certValidator);
XadesVerifier v = p.newVerifier();

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
DocumentBuilder db =  dbf.newDocumentBuilder();
FileInputStream is = new FileInputStream(filename);
Document doc = db.parse(is);

Element sigElem = (Element)doc.getElementsByTagNameNS(Constants.SignatureSpecNS, Constants._TAG_SIGNATURE).item(0);
XAdESVerificationResult r = null;
r = v.verify(sigElem,null);

如有必要，我可以发布我在匿名化后尝试验证的那种 XML 文件的摘录。

谢谢。我查看并尝试了我找到的所有内容(在网上，xades4j 示例，xades4j junit 类...)但似乎没有任何方法可以解决我的错误。

Answer 1

您需要像这样指定自己的策略文档提供程序:p.withPolicyDocumentProvider()。您必须实现自己的策略提供程序，该策略提供程序实现接口(interface) SignaturePolicyInfoProvider 和 SignaturePolicyDocumentProvider。 (至少我是那样做的)

编辑您的评论:

您需要实现 SignaturePolicyInfoProvider.getSignaturePolicyDocumentStream()，它会返回一个 InputStream。这可以是一个 FileInputStream

示例:

public class FilebasedSignaturePolicyProvider implements  SignaturePolicyDocumentProvider {

    @Override
    public InputStream getSignaturePolicyDocumentStream(ObjectIdentifier sigPolicyId) {
        String oid = sigPolicyId.getIdentifier();

        try {
            return new FileInputStream("directory-to-my-policy-files/" + oid);
        } catch (FileNotFoundException e) {
            // handle error
        }
    }
}