signxml

library5.1.0pypypi✓ verified 24d ago

signxml is a Python library that implements the W3C XML Signature standard (XMLDSig), used for payload security in standards like SAML 2.0, XAdES, EBICS, and WS-Security. It provides features for signing and verifying XML documents, including support for X.509 certificate chains and XAdES signatures. The library is actively maintained with regular releases, supporting modern Python versions (3.9-3.13+).

auth-security serialization

pip install signxml

github ↗package ↗docs ↗

INSTALL

IMPORT

SIG · SIGNXML

signxml

auth-securitypythonv5.1.0

Install

3.1s avg

Import

432ms

Disk

46MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v5.1.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.438s · 47.7MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.1s · import 0.426s · 48MB

46MB installed

● package 46MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

XMLSigner

✓ from signxml import XMLSigner

XMLVerifier

✓ from signxml import XMLVerifier

etree

✓ from lxml import etree

✗ from xml.etree import ElementTree as ET

signxml explicitly uses and requires lxml.etree for robust XML handling and security; standard library ElementTree may lead to parsing and namespace issues.

This quickstart demonstrates basic XML signing and verification using `XMLSigner` and `XMLVerifier`. It includes placeholder instructions for generating a test certificate and key using OpenSSL. In production, always load certificates and keys securely and explicitly configure trust for verification. It also highlights the best practice of verifying the `signed_xml` attribute and asserting the signature's expected location.

from lxml import etree from signxml import XMLSigner, XMLVerifier, SignatureConfiguration import os # --- Setup: Generate test certificate and key (requires OpenSSL) --- # openssl req -x509 -nodes -subj "/CN=test" -days 1 -newkey rsa -keyout privkey.pem -out cert.pem # In a real application, you would load these from secure storage. # Ensure cert.pem and privkey.pem exist in the current directory for this example to run. if not (os.path.exists('cert.pem') and os.path.exists('privkey.pem')): print("Please generate 'cert.pem' and 'privkey.pem' using OpenSSL as described in the comments.") exit() cert = open("cert.pem").read() key = open("privkey.pem").read() # --- Signing an XML document --- data_to_sign = "<Test><Data>Hello World!</Data></Test>" root = etree.fromstring(data_to_sign) signer = XMLSigner() signed_root = signer.sign(root, key=key, cert=cert) print("\n--- Signed XML ---") print(etree.tostring(signed_root, pretty_print=True).decode()) # --- Verifying the signed XML document --- verifier = XMLVerifier() try: # It's crucial to explicitly provide the trusted certificate or CA for verification # and to ensure the returned data is what was expected to prevent signature wrapping attacks. verified_data = verifier.verify(signed_root, x509_cert=cert).signed_xml print("\n--- Verification Successful! ---") print("Signed data content:", etree.tostring(verified_data, pretty_print=False).decode()) # Optionally, assert the signature location (best practice for SAML etc.) config = SignatureConfiguration(location='./') verifier.verify(signed_root, x509_cert=cert, expect_config=config) print("Signature location asserted successfully.") except Exception as e: print(f"\n--- Verification Failed: {e} ---")

signxml --version

Debug

Known issues

breakingVersion 4.0.0 introduced a major infrastructure change, replacing PyOpenSSL with Cryptography for core certificate and key handling. The `ca_path` parameter for specifying CA certificate stores was removed and replaced by `ca_pem_file`.

fix

Update your code to use `cryptography` types and `ca_pem_file` where applicable. Review API documentation for updated methods, especially for certificate chain validation.

affects: >=4.0.0

breakingVersion 4.0.4 contained critical security fixes addressing HMAC algorithm confusion and timing attacks. Running older versions with HMAC-based signatures is highly insecure.

fix

Upgrade to signxml version 4.0.4 or newer immediately to mitigate these vulnerabilities.

affects: <4.0.4

breakingAs of version 4.4.0, DTD (Document Type Declaration) declarations are forbidden in XML input for enhanced security, preventing XML External Entity (XXE) attacks.

fix

Ensure your XML inputs do not contain DTD declarations. If you are processing external XML, sanitize or transform it to remove DTDs before passing it to signxml.

affects: >=4.4.0

gotchasignxml relies heavily on `lxml.etree` for its advanced XML parsing, canonicalization, and security features. Using Python's standard `xml.etree.ElementTree` can lead to inconsistent behavior, especially with namespace handling, and may bypass lxml's security protections.

fix

Always import `etree` from `lxml` (`from lxml import etree`) and pass `lxml.etree` objects or raw XML strings directly to signxml. Avoid converting to/from `xml.etree.ElementTree` objects.

affects: all

gotchaFor robust security, always follow the 'See what is signed' principle. After `XMLVerifier.verify()`, explicitly use the `signed_xml` attribute of the return value, as this is the actual data covered by the signature. Also, for specific standards like SAML, it's a best practice to assert the expected signature location using `SignatureConfiguration(location='./')` to prevent signature wrapping attacks.

fix

When verifying, access `result.signed_xml` and incorporate `expect_config=SignatureConfiguration(location='./')` in your `verify()` calls where appropriate.

affects: all

gotchaThe default `XMLVerifier().verify()` behavior trusts any valid X.509 certificate that validates against your system's CA store. For production, you must explicitly establish trust using parameters like `x509_cert` (a pre-shared certificate), `cert_subject_name` (to validate the subject name in the signing certificate), or `ca_pem_file` (a custom CA bundle) to prevent unauthorized signatures.

fix

Always specify trust anchors during verification (e.g., `verifier.verify(..., x509_cert=my_trusted_cert)` or `ca_pem_file="/path/to/my_ca.pem")`).

affects: all

gotchaXML canonicalization, a crucial step in XML Signature, is highly sensitive to whitespace. Pretty-printing an XML document *after* it has been signed will almost certainly invalidate its signature.

fix

Do not pretty-print or reformat signed XML documents if their signatures are to remain valid.

affects: all

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'signxml'

The 'signxml' library has not been installed in the Python environment where the code is being executed.

fix

pip install signxml

signxml.exceptions.InvalidInputError: Unable to locate signature in document

The XMLVerifier could not find an XML Signature element (<ds:Signature>) within the provided XML document, often due to an incorrect XPath or the absence of a signature.

fix

Ensure the XML document actually contains a `<ds:Signature>` element and, if necessary, provide the correct `signature_xpath` argument to `XMLVerifier.verify()`.

signxml.exceptions.SignatureVerificationError: Signature verification failed

The cryptographic verification of the XML signature failed, indicating potential document tampering, an incorrect public key/certificate, or a mismatch in canonicalization or digest algorithms.

fix

Verify that the correct public key or certificate is being used, ensure the signed document has not been altered, and confirm that the canonicalization and digest methods match those used during signing.

signxml.exceptions.InvalidInputError: Document must contain at least one XMLNS

signxml requires the root element of the XML document to have at least one XML namespace declared for proper processing and XPath resolution.

fix

Add a namespace declaration to the root element of your XML document, such as `<root xmlns="http://example.com/ns">`.

Upgrade

Version history

5.1.0latest on PyPI · released Jul 5, 2026

Audit

Dependencies

lxmlrequiredRequired for XML parsing, manipulation, and canonicalization, offering superior resistance to XML attacks.

cryptographyrequiredUsed for core cryptographic operations including certificate parsing, key processing, and signature validation, replacing older PyOpenSSL functionality.

Agent activity

18 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/XML-Security/signxml ↗

packagehttps://pypi.org/project/signxml/ ↗

docshttps://xml-security.github.io/signxml/ ↗