Versions
A version of XAdES is chosen with the option version of each signature, by its identifier. The VersionRegistry has them, and gives the default one when none is asked for.
| Identifier | Specification | Schema |
|---|---|---|
1.3.2 (default) |
ETSI TS 101 903 | XAdES.xsd |
1.3.2-201601 |
ETSI EN 319 132-1 | XAdES01903v132-201601.xsd |
Both have the namespace http://uri.etsi.org/01903/v1.3.2#: the second one is the revision of 2016 of the schema of the first one, so the identifier says which of the two schemas the properties follow. Each version gives the path of its schema (getSchema()), that the package has in resources/schemas/.
What Is Different
Only three elements of the signed properties of B-B have a form for each version, and what the certificate of the signer has inside:
1.3.2 |
1.3.2-201601 |
|
|---|---|---|
| Certificate of the signer | SigningCertificate, with IssuerSerial (the issuer as a name and the serial number as a number) |
SigningCertificateV2, with IssuerSerialV2 (the issuer and the serial number in DER, base64), that is optional |
| Place of the signature | SignatureProductionPlace |
SignatureProductionPlaceV2, that adds StreetAddress |
| Role of the signer | SignerRole, with claimed roles and certified roles (CertifiedRoles) |
SignerRoleV2, with claimed roles, certified roles (CertifiedRolesV2) and signed assertions (SignedAssertions) |
Everything else is the same: SigningTime, SignaturePolicyIdentifier, DataObjectFormat and CommitmentTypeIndication.
An option that the version does not have is an error, not something that is dropped: the street address of the place and the signed assertions of the role are refused with the version 1.3.2.
Choosing a Version
$signed = $signer->sign($xml, $certificate, ['version' => '1.3.2-201601']);
The default version is the one that the VersionRegistry is built with:
use Derafu\Xades\Service\VersionRegistry;
$signer = new XadesSigner($generator, new VersionRegistry('1.3.2-201601'));
A version that the registry does not have is an error that lists the supported ones.
Validating
The validator does not need to be told the version: it checks each element by the version it belongs to, so a signature with SigningCertificate and one with SigningCertificateV2 are both validated. The schema allows both forms in the same signature, and the validator checks each one.
Version Identifiers and Namespaces
The namespace http://uri.etsi.org/01903/v1.4.1# has only the elements of the levels above B-B (the time-stamps and the data of revocation), so it is not used by the signatures of this package.