---
title: "Development"
description: "How derafu/xades is tested against the XSDs of ETSI, xmlsec1 and signxml"
type: "docs"
category: "doc"
tags: []
authors: [Anonymous]
date: "2026-11-09"
last_update: "2026-11-09"
time_minutes: 2
draft: false
unlisted: false
url: "https://www.derafu.dev/docs/data/xades/development"
---

# Development

The tests run with PHPUnit with coverage (`XDEBUG_MODE=coverage vendor/bin/phpunit`), PHPStan at level 10 and php-cs-fixer.

## Checks Against Other Implementations

The package does not trust only its own reading of the standard. What it signs, and what it validates, is compared with:

- **The official schemas of ETSI** (`resources/schemas/`, the same that the validator uses): the `QualifyingProperties` of each version, with every optional property, are valid against the schema of that version.
- **`xmlsec1`**: verifies the signatures that the package makes (the XML Signature of the document, including the signature of the `SignedProperties`), detects a change in the signed properties, and signs a template with the properties of the package, that the validator accepts.
- **`signxml`** (Python): verifies the signatures with its `XAdESVerifier`, that also checks the certificate of the signer against the one of the signature, refuses a document where that certificate was changed, and signs a document that the validator accepts.

The tests that need `xmlsec1` or `signxml` are skipped if they are not installed. `signxml` is looked for in the Python of the environment variable `XADES_PYTHON` or, if it is not set, in `python3`:

```bash
python3 -m venv /tmp/signxml
/tmp/signxml/bin/pip install signxml
XADES_PYTHON=/tmp/signxml/bin/python XDEBUG_MODE=coverage vendor/bin/phpunit
```

The CI installs `xmlsec1` (with its OpenSSL backend) and `signxml`, so those tests are not skipped there.



---
Last updated on 09/11/2026