Official example signature validation does not pass

[Gallaecio]

Code:

import os

from lxml import etree
from sii.lib.validation import validate_signatures

print (validate_signatures(etree.parse(os.path.join(
    os.path.dirname(__file__), '..', 'doc', 'F60T33-ejemplo.xml'))))

Actual output:

[('#F60T33', False), ('#SetDoc', True)]

Expected output:

[('#F60T33', True), ('#SetDoc', True)]

Am I missing something?

[lweberk]

SII breaks the namespace inheritance of the XML by ripping out the internal docs for batch processing. Thus the envelope will be OK, but the internal docs not.

The way to work around the shortcoming is to sign everything within an structure separately without adding the proper namespaces to it. Only then you can wrap it into a the proper way with the appropriate namespaces.

Remember to verify only the outer envelope, since all checks on inner signature nodes will be incorrect. The checker assumes proper namespace inheritance, which we are violating to accommodate the SII requirements.

Arguably this function should return True and True... but it is incorrect by the XML standard, and thus it makes me reluctant to go as far as to have something say "OK" when it actually is not. In my opinion it is better to point out the hack and be explicit about what is going on.

[Gallaecio]

I personally think that python-sii should focus on complying with whatever the SII requires, and not with the standards that the SII claims to follow but that the SII does not really follow.

That said, I get your stance, and I am OK with closing this issue as Won’t Fix.

In any case, I leave this code here for future reference (it assumes schema validation has been passed), implemented based on your feedback:

from copy import deepcopy
import os

from lxml import etree, objectify
from sii.lib.validation import validate_signatures


def validate(root, node_name):
    anchor = '#' + root.xpath(
        '//*[local-name()="{}"]'.format(node_name))[0].get('ID')
    for element_id, is_valid in validate_signatures(root):
        if element_id == anchor:
            if is_valid:
                print("Signature of {} element with ID {} is valid".format(
                    node_name, anchor[1:]))
            else:
                print("Signature of {} element with ID {} is not valid".format(
                    node_name, anchor[1:]))
            break
    else:
        print("No {} element found with ID {}".format(node_name, anchor[1:]))


# See http://stackoverflow.com/a/18160164/939364
def remove_namespace(element):
    if not hasattr(element.tag, 'find'): return
    i = element.tag.find('}')
    if i >= 0:
        element.tag = element.tag[i + 1:]


root = etree.parse(os.path.join(
    os.path.dirname(__file__), '..', 'doc', 'F60T33-ejemplo.xml'))
validate(root, 'SetDTE')
for dte in root.xpath('//*[local-name()="DTE"]'):
    dte = deepcopy(dte)
    dte.tag = 'DTE'
    document = dte.xpath('//*[local-name()="Documento"]')[0]
    for element in document.getiterator():
        remove_namespace(element)
    remove_namespace(dte)
    objectify.deannotate(dte, cleanup_namespaces=True)
    validate(dte, 'Documento')

[Gallaecio]

I see that, when you generate a DTE, you apply a hack to sign the DTE the same way SII does, but it looks like you do not apply the same hack to receipts (exchange.py:287), which are conceptually the same as DTEs when it comes to signing (inner XML elements, children of a indirect children of a parent element that is also signed).

Is that because the SII only uses non-standard signatures for DTEs and not for inner XML elements in general? Or is it because receipt deliveries (EnvioRecibos) are not validated by the SII? (since they are sent to other taxpayers, not to the SII)

[lweberk]

You are probably right. I'm going to fix this by returning True on (by SII terms) acceptable signatures/schemas and keep the hack documented. Given the context, the current approach is kind of "hard line".

Yes, but I'm kind of at a loss on why I did it that way. It has been a while. Anyhow, this way it works. The code is in production at our place.

---- edit ----
After some second thought, yes. The is the only thing they rip out for distributed handling. As for all other structures –as far as I've seen so far– they are properly handled. That includes the within a etc..

[lweberk]

For the record. In 's the following nodes are also extracted without consideration for the namespace inheritance;

I cant shake the gut feeling, that by inserting the schema definitions directly into the nodes that get ripped out, it would be possible to work around the issue "the right way". The issue that might possibly arise with that is that it would be difficult to ensure it stays that way for some libraries, since they would do away with duplicates down the hierarchy each time you serialise to a string.

Thank you for the snippet.