Development

The tests run with PHPUnit with coverage (XDEBUG_MODE=coverage vendor/bin/phpunit), PHPStan at level 10 and php-cs-fixer.

Checks Against Other Implementations

The package does not trust only its own reading of the standard. What it signs, and what it validates, is compared with:

• The official schemas of ETSI (resources/schemas/, the same that the validator uses): the QualifyingProperties of each version, with every optional property, are valid against the schema of that version.
• xmlsec1: verifies the signatures that the package makes (the XML Signature of the document, including the signature of the SignedProperties), detects a change in the signed properties, and signs a template with the properties of the package, that the validator accepts.
• signxml (Python): verifies the signatures with its XAdESVerifier, that also checks the certificate of the signer against the one of the signature, refuses a document where that certificate was changed, and signs a document that the validator accepts.

The tests that need xmlsec1 or signxml are skipped if they are not installed. signxml is looked for in the Python of the environment variable XADES_PYTHON or, if it is not set, in python3:

python3 -m venv /tmp/signxml
/tmp/signxml/bin/pip install signxml
XADES_PYTHON=/tmp/signxml/bin/python XDEBUG_MODE=coverage vendor/bin/phpunit

The CI installs xmlsec1 (with its OpenSSL backend) and signxml, so those tests are not skipped there.