Mock Version: 6.1
Mock Version: 6.1
Mock Version: 6.1
ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'], chrootPath='/var/lib/mock/f42-build-58989463-6569521/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x3ffa33e1370>timeout=201600uid=1000gid=425user='mockbuild'unshare_net=TrueprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11'])
Using nspawn with args ['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11']
Executing command: ['/usr/bin/systemd-nspawn', '-q', '-M', '1664e91d562e4cbc81938191cd546bbe', '-D', '/var/lib/mock/f42-build-58989463-6569521/root', '-a', '-u', 'mockbuild', '--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11', '--console=pipe', '--setenv=TERM=vt100', '--setenv=SHELL=/bin/bash', '--setenv=HOME=/builddir', '--setenv=HOSTNAME=mock', '--setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin', '--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"', '--setenv=PS1=<mock-chroot> \\s-\\v\\$ ', '--setenv=LANG=C.UTF-8', '--resolv-conf=off', 'bash', '--login', '-c', '/usr/bin/rpmbuild -bs --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8', 'SYSTEMD_NSPAWN_TMPFS_TMP': '0', 'SYSTEMD_SECCOMP': '0'} and shell False
Building target platforms: noarch
Building for target noarch
setting SOURCE_DATE_EPOCH=1717804800
Wrote: /builddir/build/SRPMS/python-pysaml2-7.4.2-5.fc42.src.rpm
Child return code was: 0
ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -br --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'], chrootPath='/var/lib/mock/f42-build-58989463-6569521/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x3ffa33e1370>timeout=201600uid=1000gid=425user='mockbuild'unshare_net=TrueraiseExc=FalseprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11'])
Using nspawn with args ['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11']
Executing command: ['/usr/bin/systemd-nspawn', '-q', '-M', '7b69bc6c715c47939045247d4ad94384', '-D', '/var/lib/mock/f42-build-58989463-6569521/root', '-a', '-u', 'mockbuild', '--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11', '--console=pipe', '--setenv=TERM=vt100', '--setenv=SHELL=/bin/bash', '--setenv=HOME=/builddir', '--setenv=HOSTNAME=mock', '--setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin', '--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"', '--setenv=PS1=<mock-chroot> \\s-\\v\\$ ', '--setenv=LANG=C.UTF-8', '--resolv-conf=off', 'bash', '--login', '-c', '/usr/bin/rpmbuild -br --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8', 'SYSTEMD_NSPAWN_TMPFS_TMP': '0', 'SYSTEMD_SECCOMP': '0'} and shell False
Building target platforms: noarch
Building for target noarch
setting SOURCE_DATE_EPOCH=1717804800
Executing(%mkbuilddir): /bin/sh -e /var/tmp/rpm-tmp.q5342P
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.UAqRMl
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ rm -rf pysaml2-7.4.2
+ /usr/lib/rpm/rpmuncompress -x /builddir/build/SOURCES/pysaml2-7.4.2.tar.gz
+ STATUS=0
+ '[' 0 -ne 0 ']'
+ cd pysaml2-7.4.2
+ /usr/bin/chmod -Rf a+rX,u+w,g-w,o-w .
+ /usr/bin/git init -q
+ /usr/bin/git config user.name rpm-build
+ /usr/bin/git config user.email '<rpm-build>'
+ /usr/bin/git config gc.auto 0
+ /usr/bin/git add --force .
+ GIT_COMMITTER_DATE=@1717804800
+ GIT_AUTHOR_DATE=@1717804800
+ /usr/bin/git commit -q --allow-empty -a --author 'rpm-build <rpm-build>' -m 'python-pysaml2-7.4.2 base'
+ /usr/bin/git checkout --track -b rpm-build
Switched to a new branch 'rpm-build'
branch 'rpm-build' set up to track 'master'.
+ /usr/lib/rpm/rpmuncompress /builddir/build/SOURCES/0001-Remove-utility-from-packaging.patch
+ /usr/bin/git apply --index --reject -
Checking patch pyproject.toml...
Applied patch pyproject.toml cleanly.
+ GIT_COMMITTER_DATE=@1717804800
+ GIT_AUTHOR_DATE=@1717804800
+ /usr/bin/git commit -q -m 0001-Remove-utility-from-packaging.patch --author 'rpm-build <rpm-build>'
+ sed -i 's|f"""#!/usr/bin/env python|f"""|' src/saml2/tools/parse_xsd2.py
+ find src -name '*.py'
+ read source
+ head -n1 src/saml2/__init__.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/__init__.py src/saml2/__init__.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/__init__.py
+ touch --ref=src/saml2/__init__.py.ts src/saml2/__init__.py
+ rm src/saml2/__init__.py.ts
+ read source
+ head -n1 src/saml2/algsupport.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/argtree.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/assertion.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/assertion.py src/saml2/assertion.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/assertion.py
+ touch --ref=src/saml2/assertion.py.ts src/saml2/assertion.py
+ rm src/saml2/assertion.py.ts
+ read source
+ head -n1 src/saml2/attribute_converter.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/attribute_converter.py src/saml2/attribute_converter.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/attribute_converter.py
+ touch --ref=src/saml2/attribute_converter.py.ts src/saml2/attribute_converter.py
+ rm src/saml2/attribute_converter.py.ts
+ read source
+ head -n1 src/saml2/attribute_resolver.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/attribute_resolver.py src/saml2/attribute_resolver.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/attribute_resolver.py
+ touch --ref=src/saml2/attribute_resolver.py.ts src/saml2/attribute_resolver.py
+ rm src/saml2/attribute_resolver.py.ts
+ read source
+ head -n1 src/saml2/attributemaps/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/attributemaps/adfs_v1x.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/attributemaps/adfs_v20.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/attributemaps/basic.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/attributemaps/saml_uri.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/attributemaps/shibboleth_uri.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/authn.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/authn_context/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/authn_context/ippword.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/authn_context/ippword.py src/saml2/authn_context/ippword.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/authn_context/ippword.py
+ touch --ref=src/saml2/authn_context/ippword.py.ts src/saml2/authn_context/ippword.py
+ rm src/saml2/authn_context/ippword.py.ts
+ read source
+ head -n1 src/saml2/authn_context/mobiletwofactor.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/authn_context/mobiletwofactor.py src/saml2/authn_context/mobiletwofactor.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/authn_context/mobiletwofactor.py
+ touch --ref=src/saml2/authn_context/mobiletwofactor.py.ts src/saml2/authn_context/mobiletwofactor.py
+ rm src/saml2/authn_context/mobiletwofactor.py.ts
+ read source
+ head -n1 src/saml2/authn_context/ppt.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/authn_context/ppt.py src/saml2/authn_context/ppt.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/authn_context/ppt.py
+ touch --ref=src/saml2/authn_context/ppt.py.ts src/saml2/authn_context/ppt.py
+ rm src/saml2/authn_context/ppt.py.ts
+ read source
+ head -n1 src/saml2/authn_context/pword.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/authn_context/pword.py src/saml2/authn_context/pword.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/authn_context/pword.py
+ touch --ref=src/saml2/authn_context/pword.py.ts src/saml2/authn_context/pword.py
+ rm src/saml2/authn_context/pword.py.ts
+ read source
+ head -n1 src/saml2/authn_context/sslcert.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/authn_context/sslcert.py src/saml2/authn_context/sslcert.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/authn_context/sslcert.py
+ touch --ref=src/saml2/authn_context/sslcert.py.ts src/saml2/authn_context/sslcert.py
+ rm src/saml2/authn_context/sslcert.py.ts
+ read source
+ head -n1 src/saml2/authn_context/timesync.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/authn_context/timesync.py src/saml2/authn_context/timesync.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/authn_context/timesync.py
+ touch --ref=src/saml2/authn_context/timesync.py.ts src/saml2/authn_context/timesync.py
+ rm src/saml2/authn_context/timesync.py.ts
+ read source
+ head -n1 src/saml2/cache.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/cache.py src/saml2/cache.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/cache.py
+ touch --ref=src/saml2/cache.py.ts src/saml2/cache.py
+ rm src/saml2/cache.py.ts
+ read source
+ head -n1 src/saml2/cert.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/client.py
+ grep -F /usr/bin/env
# !/usr/bin/env python
+ touch --ref=src/saml2/client.py src/saml2/client.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/client.py
+ touch --ref=src/saml2/client.py.ts src/saml2/client.py
+ rm src/saml2/client.py.ts
+ read source
+ head -n1 src/saml2/client_base.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/client_base.py src/saml2/client_base.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/client_base.py
+ touch --ref=src/saml2/client_base.py.ts src/saml2/client_base.py
+ rm src/saml2/client_base.py.ts
+ read source
+ head -n1 src/saml2/config.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/country_codes.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/country_codes.py src/saml2/country_codes.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/country_codes.py
+ touch --ref=src/saml2/country_codes.py.ts src/saml2/country_codes.py
+ rm src/saml2/country_codes.py.ts
+ read source
+ head -n1 src/saml2/cryptography/__init__.py
+ grep -F /usr/bin/env
+ read source
+ grep -F /usr/bin/env
+ head -n1 src/saml2/cryptography/asymmetric.py
+ read source
+ head -n1 src/saml2/cryptography/errors.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/cryptography/pki.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/cryptography/symmetric.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/data/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/data/schemas/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/data/templates/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/discovery.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/ecp.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ecp.py src/saml2/ecp.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ecp.py
+ touch --ref=src/saml2/ecp.py.ts src/saml2/ecp.py
+ rm src/saml2/ecp.py.ts
+ read source
+ head -n1 src/saml2/ecp_client.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ecp_client.py src/saml2/ecp_client.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ecp_client.py
+ touch --ref=src/saml2/ecp_client.py.ts src/saml2/ecp_client.py
+ rm src/saml2/ecp_client.py.ts
+ read source
+ head -n1 src/saml2/entity.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/entity_category/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/entity_category/at_egov_pvp2.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/entity_category/edugain.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/entity_category/incommon.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/entity_category/refeds.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/entity_category/swamid.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/eptid.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/extension/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/extension/algsupport.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/algsupport.py src/saml2/extension/algsupport.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/algsupport.py
+ touch --ref=src/saml2/extension/algsupport.py.ts src/saml2/extension/algsupport.py
+ rm src/saml2/extension/algsupport.py.ts
+ read source
+ head -n1 src/saml2/extension/dri.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/dri.py src/saml2/extension/dri.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/dri.py
+ touch --ref=src/saml2/extension/dri.py.ts src/saml2/extension/dri.py
+ rm src/saml2/extension/dri.py.ts
+ read source
+ head -n1 src/saml2/extension/idpdisc.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/idpdisc.py src/saml2/extension/idpdisc.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/idpdisc.py
+ touch --ref=src/saml2/extension/idpdisc.py.ts src/saml2/extension/idpdisc.py
+ rm src/saml2/extension/idpdisc.py.ts
+ read source
+ head -n1 src/saml2/extension/mdattr.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/mdattr.py src/saml2/extension/mdattr.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/mdattr.py
+ touch --ref=src/saml2/extension/mdattr.py.ts src/saml2/extension/mdattr.py
+ rm src/saml2/extension/mdattr.py.ts
+ read source
+ head -n1 src/saml2/extension/mdrpi.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/mdrpi.py src/saml2/extension/mdrpi.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/mdrpi.py
+ touch --ref=src/saml2/extension/mdrpi.py.ts src/saml2/extension/mdrpi.py
+ rm src/saml2/extension/mdrpi.py.ts
+ read source
+ head -n1 src/saml2/extension/mdui.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/mdui.py src/saml2/extension/mdui.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/mdui.py
+ touch --ref=src/saml2/extension/mdui.py.ts src/saml2/extension/mdui.py
+ rm src/saml2/extension/mdui.py.ts
+ read source
+ head -n1 src/saml2/extension/pefim.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/pefim.py src/saml2/extension/pefim.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/pefim.py
+ touch --ref=src/saml2/extension/pefim.py.ts src/saml2/extension/pefim.py
+ rm src/saml2/extension/pefim.py.ts
+ read source
+ head -n1 src/saml2/extension/reqinit.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/reqinit.py src/saml2/extension/reqinit.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/reqinit.py
+ touch --ref=src/saml2/extension/reqinit.py.ts src/saml2/extension/reqinit.py
+ rm src/saml2/extension/reqinit.py.ts
+ read source
+ head -n1 src/saml2/extension/requested_attributes.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/requested_attributes.py src/saml2/extension/requested_attributes.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/requested_attributes.py
+ touch --ref=src/saml2/extension/requested_attributes.py.ts src/saml2/extension/requested_attributes.py
+ rm src/saml2/extension/requested_attributes.py.ts
+ read source
+ head -n1 src/saml2/extension/shibmd.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/shibmd.py src/saml2/extension/shibmd.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/shibmd.py
+ touch --ref=src/saml2/extension/shibmd.py.ts src/saml2/extension/shibmd.py
+ rm src/saml2/extension/shibmd.py.ts
+ read source
+ head -n1 src/saml2/extension/sp_type.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/extension/sp_type.py src/saml2/extension/sp_type.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/extension/sp_type.py
+ touch --ref=src/saml2/extension/sp_type.py.ts src/saml2/extension/sp_type.py
+ rm src/saml2/extension/sp_type.py.ts
+ read source
+ head -n1 src/saml2/filter.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/httpbase.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/httputil.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/ident.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/mcache.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/mcache.py src/saml2/mcache.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/mcache.py
+ touch --ref=src/saml2/mcache.py.ts src/saml2/mcache.py
+ rm src/saml2/mcache.py.ts
+ read source
+ head -n1 src/saml2/md.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/md.py src/saml2/md.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/md.py
+ touch --ref=src/saml2/md.py.ts src/saml2/md.py
+ rm src/saml2/md.py.ts
+ read source
+ head -n1 src/saml2/mdbcache.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/mdbcache.py src/saml2/mdbcache.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/mdbcache.py
+ touch --ref=src/saml2/mdbcache.py.ts src/saml2/mdbcache.py
+ rm src/saml2/mdbcache.py.ts
+ read source
+ head -n1 src/saml2/mdie.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/mdie.py src/saml2/mdie.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/mdie.py
+ touch --ref=src/saml2/mdie.py.ts src/saml2/mdie.py
+ rm src/saml2/mdie.py.ts
+ read source
+ head -n1 src/saml2/mdstore.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/metadata.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/metadata.py src/saml2/metadata.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/metadata.py
+ touch --ref=src/saml2/metadata.py.ts src/saml2/metadata.py
+ rm src/saml2/metadata.py.ts
+ read source
+ head -n1 src/saml2/mongo_store.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/pack.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/population.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/profile/__init__.py
+ grep -F /usr/bin/env
+ read source
+ grep -F /usr/bin/env
+ head -n1 src/saml2/profile/ecp.py
#!/usr/bin/env python
+ touch --ref=src/saml2/profile/ecp.py src/saml2/profile/ecp.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/profile/ecp.py
+ touch --ref=src/saml2/profile/ecp.py.ts src/saml2/profile/ecp.py
+ rm src/saml2/profile/ecp.py.ts
+ read source
+ head -n1 src/saml2/profile/paos.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/profile/paos.py src/saml2/profile/paos.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/profile/paos.py
+ touch --ref=src/saml2/profile/paos.py.ts src/saml2/profile/paos.py
+ rm src/saml2/profile/paos.py.ts
+ read source
+ head -n1 src/saml2/profile/samlec.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/request.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/response.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/response.py src/saml2/response.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/response.py
+ touch --ref=src/saml2/response.py.ts src/saml2/response.py
+ rm src/saml2/response.py.ts
+ read source
+ head -n1 src/saml2/s2repoze/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/s2repoze/plugins/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/s2repoze/plugins/challenge_decider.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/s2repoze/plugins/entitlement.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/s2repoze/plugins/entitlement.py src/saml2/s2repoze/plugins/entitlement.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/s2repoze/plugins/entitlement.py
+ touch --ref=src/saml2/s2repoze/plugins/entitlement.py.ts src/saml2/s2repoze/plugins/entitlement.py
+ rm src/saml2/s2repoze/plugins/entitlement.py.ts
+ read source
+ head -n1 src/saml2/s2repoze/plugins/formswithhidden.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/s2repoze/plugins/ini.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/s2repoze/plugins/sp.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/s_utils.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/s_utils.py src/saml2/s_utils.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/s_utils.py
+ touch --ref=src/saml2/s_utils.py.ts src/saml2/s_utils.py
+ rm src/saml2/s_utils.py.ts
+ read source
+ head -n1 src/saml2/saml.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/saml.py src/saml2/saml.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/saml.py
+ touch --ref=src/saml2/saml.py.ts src/saml2/saml.py
+ rm src/saml2/saml.py.ts
+ read source
+ head -n1 src/saml2/samlp.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/samlp.py src/saml2/samlp.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/samlp.py
+ touch --ref=src/saml2/samlp.py.ts src/saml2/samlp.py
+ rm src/saml2/samlp.py.ts
+ read source
+ head -n1 src/saml2/schema/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/schema/soap.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/schema/soap.py src/saml2/schema/soap.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/schema/soap.py
+ touch --ref=src/saml2/schema/soap.py.ts src/saml2/schema/soap.py
+ rm src/saml2/schema/soap.py.ts
+ read source
+ head -n1 src/saml2/schema/soapenv.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/schema/soapenv.py src/saml2/schema/soapenv.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/schema/soapenv.py
+ touch --ref=src/saml2/schema/soapenv.py.ts src/saml2/schema/soapenv.py
+ rm src/saml2/schema/soapenv.py.ts
+ read source
+ head -n1 src/saml2/schema/wsdl.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/schema/wsdl.py src/saml2/schema/wsdl.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/schema/wsdl.py
+ touch --ref=src/saml2/schema/wsdl.py.ts src/saml2/schema/wsdl.py
+ rm src/saml2/schema/wsdl.py.ts
+ read source
+ head -n1 src/saml2/sdb.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/server.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/server.py src/saml2/server.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/server.py
+ touch --ref=src/saml2/server.py.ts src/saml2/server.py
+ rm src/saml2/server.py.ts
+ read source
+ head -n1 src/saml2/sigver.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/soap.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/soap.py src/saml2/soap.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/soap.py
+ touch --ref=src/saml2/soap.py.ts src/saml2/soap.py
+ rm src/saml2/soap.py.ts
+ read source
+ head -n1 src/saml2/time_util.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/time_util.py src/saml2/time_util.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/time_util.py
+ touch --ref=src/saml2/time_util.py.ts src/saml2/time_util.py
+ rm src/saml2/time_util.py.ts
+ read source
+ head -n1 src/saml2/tools/make_metadata.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/make_metadata.py src/saml2/tools/make_metadata.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/make_metadata.py
+ touch --ref=src/saml2/tools/make_metadata.py.ts src/saml2/tools/make_metadata.py
+ rm src/saml2/tools/make_metadata.py.ts
+ read source
+ head -n1 src/saml2/tools/mdexport.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/mdexport.py src/saml2/tools/mdexport.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/mdexport.py
+ touch --ref=src/saml2/tools/mdexport.py.ts src/saml2/tools/mdexport.py
+ rm src/saml2/tools/mdexport.py.ts
+ read source
+ head -n1 src/saml2/tools/mdexport_test.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/mdexport_test.py src/saml2/tools/mdexport_test.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/mdexport_test.py
+ touch --ref=src/saml2/tools/mdexport_test.py.ts src/saml2/tools/mdexport_test.py
+ rm src/saml2/tools/mdexport_test.py.ts
+ read source
+ head -n1 src/saml2/tools/mdimport.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/mdimport.py src/saml2/tools/mdimport.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/mdimport.py
+ touch --ref=src/saml2/tools/mdimport.py.ts src/saml2/tools/mdimport.py
+ rm src/saml2/tools/mdimport.py.ts
+ read source
+ head -n1 src/saml2/tools/merge_metadata.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/merge_metadata.py src/saml2/tools/merge_metadata.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/merge_metadata.py
+ touch --ref=src/saml2/tools/merge_metadata.py.ts src/saml2/tools/merge_metadata.py
+ rm src/saml2/tools/merge_metadata.py.ts
+ read source
+ head -n1 src/saml2/tools/sync_attrmaps.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/sync_attrmaps.py src/saml2/tools/sync_attrmaps.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/sync_attrmaps.py
+ touch --ref=src/saml2/tools/sync_attrmaps.py.ts src/saml2/tools/sync_attrmaps.py
+ rm src/saml2/tools/sync_attrmaps.py.ts
+ read source
+ head -n1 src/saml2/tools/verify_metadata.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/verify_metadata.py src/saml2/tools/verify_metadata.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/verify_metadata.py
+ touch --ref=src/saml2/tools/verify_metadata.py.ts src/saml2/tools/verify_metadata.py
+ rm src/saml2/tools/verify_metadata.py.ts
+ read source
+ head -n1 src/saml2/tools/parse_xsd2.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/tools/parse_xsd2.py src/saml2/tools/parse_xsd2.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/tools/parse_xsd2.py
+ touch --ref=src/saml2/tools/parse_xsd2.py.ts src/saml2/tools/parse_xsd2.py
+ rm src/saml2/tools/parse_xsd2.py.ts
+ read source
+ head -n1 src/saml2/userinfo/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/userinfo/ldapinfo.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/validate.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/version.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/virtual_org.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/ws/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/ws/wsaddr.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ws/wsaddr.py src/saml2/ws/wsaddr.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ws/wsaddr.py
+ touch --ref=src/saml2/ws/wsaddr.py.ts src/saml2/ws/wsaddr.py
+ rm src/saml2/ws/wsaddr.py.ts
+ read source
+ head -n1 src/saml2/ws/wspol.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ws/wspol.py src/saml2/ws/wspol.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ws/wspol.py
+ touch --ref=src/saml2/ws/wspol.py.ts src/saml2/ws/wspol.py
+ rm src/saml2/ws/wspol.py.ts
+ read source
+ head -n1 src/saml2/ws/wssec.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ws/wssec.py src/saml2/ws/wssec.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ws/wssec.py
+ touch --ref=src/saml2/ws/wssec.py.ts src/saml2/ws/wssec.py
+ rm src/saml2/ws/wssec.py.ts
+ read source
+ head -n1 src/saml2/ws/wstrust.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ws/wstrust.py src/saml2/ws/wstrust.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ws/wstrust.py
+ touch --ref=src/saml2/ws/wstrust.py.ts src/saml2/ws/wstrust.py
+ rm src/saml2/ws/wstrust.py.ts
+ read source
+ head -n1 src/saml2/ws/wsutil.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/ws/wsutil.py src/saml2/ws/wsutil.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/ws/wsutil.py
+ touch --ref=src/saml2/ws/wsutil.py.ts src/saml2/ws/wsutil.py
+ rm src/saml2/ws/wsutil.py.ts
+ read source
+ head -n1 src/saml2/xml/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/xml/schema/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2/xmldsig/__init__.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/xmldsig/__init__.py src/saml2/xmldsig/__init__.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/xmldsig/__init__.py
+ touch --ref=src/saml2/xmldsig/__init__.py.ts src/saml2/xmldsig/__init__.py
+ rm src/saml2/xmldsig/__init__.py.ts
+ read source
+ head -n1 src/saml2/xmlenc/__init__.py
+ grep -F /usr/bin/env
#!/usr/bin/env python
+ touch --ref=src/saml2/xmlenc/__init__.py src/saml2/xmlenc/__init__.py.ts
+ sed -i '/\/usr\/bin\/env python/{d;q}' src/saml2/xmlenc/__init__.py
+ touch --ref=src/saml2/xmlenc/__init__.py.ts src/saml2/xmlenc/__init__.py
+ rm src/saml2/xmlenc/__init__.py.ts
+ read source
+ head -n1 src/saml2test/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2test/check.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2test/interaction.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2test/opfunc.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2test/status.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/saml2test/tool.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/utility/__init__.py
+ grep -F /usr/bin/env
+ read source
+ head -n1 src/utility/metadata.py
+ grep -F /usr/bin/env
+ read source
+ source=src/saml2/schema/wsdl.py
+ touch --ref=src/saml2/schema/wsdl.py src/saml2/schema/wsdl.py.ts
+ sed -i '1,3{d;q}' src/saml2/schema/wsdl.py
+ touch --ref=src/saml2/schema/wsdl.py.ts src/saml2/schema/wsdl.py
+ rm src/saml2/schema/wsdl.py.ts
+ RPM_EC=0
++ jobs -p
+ exit 0
Executing(%generate_buildrequires): /bin/sh -e /var/tmp/rpm-tmp.s0gsIN
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ cd pysaml2-7.4.2
+ echo pyproject-rpm-macros
+ echo python3-devel
+ echo 'python3dist(packaging)'
+ echo 'python3dist(pip) >= 19'
+ '[' -f pyproject.toml ']'
+ echo '(python3dist(tomli) if python3-devel < 3.11)'
+ rm -rfv '*.dist-info/'
+ '[' -f /usr/bin/python3 ']'
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ echo -n
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ VALAFLAGS=-g
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ CC=gcc
+ CXX=g++
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ RPM_TOXENV=py313
+ FEDORA=42
+ HOSTNAME=rpmbuild
+ /usr/bin/python3 -Bs /usr/lib/rpm/redhat/pyproject_buildrequires.py --generate-extras --python3_pkgversion 3 --wheeldir /builddir/build/BUILD/python-pysaml2-7.4.2-build/pyproject-wheeldir --output /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires -t
Handling poetry_core>=1.0.0 from build-system.requires
Requirement not satisfied: poetry_core>=1.0.0
Exiting dependency generation pass: build backend
+ cat /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires
+ rm -rfv '*.dist-info/'
+ RPM_EC=0
++ jobs -p
+ exit 0
Wrote: /builddir/build/SRPMS/python-pysaml2-7.4.2-5.fc42.buildreqs.nosrc.rpm
Child return code was: 11
Dynamic buildrequires detected
Going to install missing buildrequires. See root.log for details.
ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -br --noprep --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'], chrootPath='/var/lib/mock/f42-build-58989463-6569521/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x3ffa33e1370>timeout=201600uid=1000gid=425user='mockbuild'unshare_net=TrueraiseExc=FalseprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11'])
Using nspawn with args ['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11']
Executing command: ['/usr/bin/systemd-nspawn', '-q', '-M', 'e056ad8c0fa342b79ac46742eb584c71', '-D', '/var/lib/mock/f42-build-58989463-6569521/root', '-a', '-u', 'mockbuild', '--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11', '--console=pipe', '--setenv=TERM=vt100', '--setenv=SHELL=/bin/bash', '--setenv=HOME=/builddir', '--setenv=HOSTNAME=mock', '--setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin', '--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"', '--setenv=PS1=<mock-chroot> \\s-\\v\\$ ', '--setenv=LANG=C.UTF-8', '--resolv-conf=off', 'bash', '--login', '-c', '/usr/bin/rpmbuild -br --noprep --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8', 'SYSTEMD_NSPAWN_TMPFS_TMP': '0', 'SYSTEMD_SECCOMP': '0'} and shell False
Building target platforms: noarch
Building for target noarch
setting SOURCE_DATE_EPOCH=1717804800
Executing(%generate_buildrequires): /bin/sh -e /var/tmp/rpm-tmp.HSlvk1
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ cd pysaml2-7.4.2
+ echo pyproject-rpm-macros
+ echo python3-devel
+ echo 'python3dist(packaging)'
+ echo 'python3dist(pip) >= 19'
+ '[' -f pyproject.toml ']'
+ echo '(python3dist(tomli) if python3-devel < 3.11)'
+ rm -rfv '*.dist-info/'
+ '[' -f /usr/bin/python3 ']'
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ echo -n
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ VALAFLAGS=-g
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ CC=gcc
+ CXX=g++
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ RPM_TOXENV=py313
+ FEDORA=42
+ HOSTNAME=rpmbuild
+ /usr/bin/python3 -Bs /usr/lib/rpm/redhat/pyproject_buildrequires.py --generate-extras --python3_pkgversion 3 --wheeldir /builddir/build/BUILD/python-pysaml2-7.4.2-build/pyproject-wheeldir --output /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires -t
Handling poetry_core>=1.0.0 from build-system.requires
Requirement satisfied: poetry_core>=1.0.0
   (installed: poetry_core 1.9.1)
Handling tox-current-env >= 0.0.16 from tox itself
Requirement not satisfied: tox-current-env >= 0.0.16
Exiting dependency generation pass: tox itself
+ cat /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires
+ rm -rfv '*.dist-info/'
+ RPM_EC=0
++ jobs -p
+ exit 0
Wrote: /builddir/build/SRPMS/python-pysaml2-7.4.2-5.fc42.buildreqs.nosrc.rpm
Child return code was: 11
Dynamic buildrequires detected
Going to install missing buildrequires. See root.log for details.
ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -br --noprep --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'], chrootPath='/var/lib/mock/f42-build-58989463-6569521/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x3ffa33e1370>timeout=201600uid=1000gid=425user='mockbuild'unshare_net=TrueraiseExc=FalseprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11'])
Using nspawn with args ['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11']
Executing command: ['/usr/bin/systemd-nspawn', '-q', '-M', '39b30f39e0714d5283a3e2703f1622e1', '-D', '/var/lib/mock/f42-build-58989463-6569521/root', '-a', '-u', 'mockbuild', '--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11', '--console=pipe', '--setenv=TERM=vt100', '--setenv=SHELL=/bin/bash', '--setenv=HOME=/builddir', '--setenv=HOSTNAME=mock', '--setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin', '--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"', '--setenv=PS1=<mock-chroot> \\s-\\v\\$ ', '--setenv=LANG=C.UTF-8', '--resolv-conf=off', 'bash', '--login', '-c', '/usr/bin/rpmbuild -br --noprep --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8', 'SYSTEMD_NSPAWN_TMPFS_TMP': '0', 'SYSTEMD_SECCOMP': '0'} and shell False
Building target platforms: noarch
Building for target noarch
setting SOURCE_DATE_EPOCH=1717804800
Executing(%generate_buildrequires): /bin/sh -e /var/tmp/rpm-tmp.DLl9Wd
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ cd pysaml2-7.4.2
+ echo pyproject-rpm-macros
+ echo python3-devel
+ echo 'python3dist(packaging)'
+ echo 'python3dist(pip) >= 19'
+ '[' -f pyproject.toml ']'
+ echo '(python3dist(tomli) if python3-devel < 3.11)'
+ rm -rfv '*.dist-info/'
+ '[' -f /usr/bin/python3 ']'
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ echo -n
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ VALAFLAGS=-g
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ CC=gcc
+ CXX=g++
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ RPM_TOXENV=py313
+ FEDORA=42
+ HOSTNAME=rpmbuild
+ /usr/bin/python3 -Bs /usr/lib/rpm/redhat/pyproject_buildrequires.py --generate-extras --python3_pkgversion 3 --wheeldir /builddir/build/BUILD/python-pysaml2-7.4.2-build/pyproject-wheeldir --output /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires -t
Handling poetry_core>=1.0.0 from build-system.requires
Requirement satisfied: poetry_core>=1.0.0
   (installed: poetry_core 1.9.1)
Handling tox-current-env >= 0.0.16 from tox itself
Requirement satisfied: tox-current-env >= 0.0.16
   (installed: tox-current-env 0.0.16)
  py313: OK (0.00 seconds)
  congratulations :) (0.05 seconds)
Handling tox from tox --print-deps-only: py313
Requirement satisfied: tox
   (installed: tox 4.25.0)
  py313: OK (0.00 seconds)
  congratulations :) (0.05 seconds)
Handling cryptography (>=3.1) from hook generated metadata: Requires-Dist (pysaml2)
Requirement not satisfied: cryptography (>=3.1)
Handling defusedxml from hook generated metadata: Requires-Dist (pysaml2)
Requirement not satisfied: defusedxml
Handling importlib-metadata (>=1.7.0) ; python_version < "3.8" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: importlib-metadata (>=1.7.0) ; python_version < "3.8"
Handling importlib-resources ; python_version < "3.9" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: importlib-resources ; python_version < "3.9"
Handling paste ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: paste ; extra == "s2repoze"
Handling pyopenssl from hook generated metadata: Requires-Dist (pysaml2)
Requirement not satisfied: pyopenssl
Handling python-dateutil from hook generated metadata: Requires-Dist (pysaml2)
Requirement not satisfied: python-dateutil
Handling pytz from hook generated metadata: Requires-Dist (pysaml2)
Requirement not satisfied: pytz
Handling repoze.who ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: repoze.who ; extra == "s2repoze"
Handling requests (>=2,<3) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: requests (>=2,<3)
   (installed: requests 2.32.3)
Handling xmlschema (>=1.2.1) from hook generated metadata: Requires-Dist (pysaml2)
Requirement not satisfied: xmlschema (>=1.2.1)
Handling zope.interface ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: zope.interface ; extra == "s2repoze"
+ cat /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires
+ rm -rfv pysaml2-7.4.2.dist-info/
removed 'pysaml2-7.4.2.dist-info/entry_points.txt'
removed 'pysaml2-7.4.2.dist-info/WHEEL'
removed 'pysaml2-7.4.2.dist-info/METADATA'
removed 'pysaml2-7.4.2.dist-info/LICENSE'
removed directory 'pysaml2-7.4.2.dist-info/'
+ RPM_EC=0
++ jobs -p
+ exit 0
Wrote: /builddir/build/SRPMS/python-pysaml2-7.4.2-5.fc42.buildreqs.nosrc.rpm
Child return code was: 11
Dynamic buildrequires detected
Going to install missing buildrequires. See root.log for details.
ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -br --noprep --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'], chrootPath='/var/lib/mock/f42-build-58989463-6569521/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x3ffa33e1370>timeout=201600uid=1000gid=425user='mockbuild'unshare_net=TrueraiseExc=FalseprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11'])
Using nspawn with args ['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11']
Executing command: ['/usr/bin/systemd-nspawn', '-q', '-M', '2622831fd08343f5af7c1612504da950', '-D', '/var/lib/mock/f42-build-58989463-6569521/root', '-a', '-u', 'mockbuild', '--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11', '--console=pipe', '--setenv=TERM=vt100', '--setenv=SHELL=/bin/bash', '--setenv=HOME=/builddir', '--setenv=HOSTNAME=mock', '--setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin', '--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"', '--setenv=PS1=<mock-chroot> \\s-\\v\\$ ', '--setenv=LANG=C.UTF-8', '--resolv-conf=off', 'bash', '--login', '-c', '/usr/bin/rpmbuild -br --noprep --noclean --target noarch --nodeps /builddir/build/SPECS/python-pysaml2.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8', 'SYSTEMD_NSPAWN_TMPFS_TMP': '0', 'SYSTEMD_SECCOMP': '0'} and shell False
Building target platforms: noarch
Building for target noarch
setting SOURCE_DATE_EPOCH=1717804800
Executing(%generate_buildrequires): /bin/sh -e /var/tmp/rpm-tmp.8A8PP8
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ cd pysaml2-7.4.2
+ echo pyproject-rpm-macros
+ echo python3-devel
+ echo 'python3dist(packaging)'
+ echo 'python3dist(pip) >= 19'
+ '[' -f pyproject.toml ']'
+ echo '(python3dist(tomli) if python3-devel < 3.11)'
+ rm -rfv '*.dist-info/'
+ '[' -f /usr/bin/python3 ']'
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ echo -n
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ VALAFLAGS=-g
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ CC=gcc
+ CXX=g++
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ RPM_TOXENV=py313
+ FEDORA=42
+ HOSTNAME=rpmbuild
+ /usr/bin/python3 -Bs /usr/lib/rpm/redhat/pyproject_buildrequires.py --generate-extras --python3_pkgversion 3 --wheeldir /builddir/build/BUILD/python-pysaml2-7.4.2-build/pyproject-wheeldir --output /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires -t
Handling poetry_core>=1.0.0 from build-system.requires
Requirement satisfied: poetry_core>=1.0.0
   (installed: poetry_core 1.9.1)
Handling tox-current-env >= 0.0.16 from tox itself
Requirement satisfied: tox-current-env >= 0.0.16
   (installed: tox-current-env 0.0.16)
  py313: OK (0.01 seconds)
  congratulations :) (0.08 seconds)
Handling tox from tox --print-deps-only: py313
Requirement satisfied: tox
   (installed: tox 4.25.0)
  py313: OK (0.00 seconds)
  congratulations :) (0.08 seconds)
Handling cryptography (>=3.1) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: cryptography (>=3.1)
   (installed: cryptography 44.0.0)
Handling defusedxml from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: defusedxml
   (installed: defusedxml 0.7.1)
Handling importlib-metadata (>=1.7.0) ; python_version < "3.8" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: importlib-metadata (>=1.7.0) ; python_version < "3.8"
Handling importlib-resources ; python_version < "3.9" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: importlib-resources ; python_version < "3.9"
Handling paste ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: paste ; extra == "s2repoze"
Handling pyopenssl from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: pyopenssl
   (installed: pyopenssl 25.0.0)
Handling python-dateutil from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: python-dateutil
   (installed: python-dateutil 2.8.2)
Handling pytz from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: pytz
   (installed: pytz 2025.2)
Handling repoze.who ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: repoze.who ; extra == "s2repoze"
Handling requests (>=2,<3) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: requests (>=2,<3)
   (installed: requests 2.32.3)
Handling xmlschema (>=1.2.1) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: xmlschema (>=1.2.1)
   (installed: xmlschema 3.4.2)
Handling zope.interface ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: zope.interface ; extra == "s2repoze"
+ cat /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires
+ rm -rfv pysaml2-7.4.2.dist-info/
removed 'pysaml2-7.4.2.dist-info/entry_points.txt'
removed 'pysaml2-7.4.2.dist-info/WHEEL'
removed 'pysaml2-7.4.2.dist-info/METADATA'
removed 'pysaml2-7.4.2.dist-info/LICENSE'
removed directory 'pysaml2-7.4.2.dist-info/'
+ RPM_EC=0
++ jobs -p
+ exit 0
Wrote: /builddir/build/SRPMS/python-pysaml2-7.4.2-5.fc42.buildreqs.nosrc.rpm
Child return code was: 11
Dynamic buildrequires detected
Going to install missing buildrequires. See root.log for details.
ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -ba --noprep --noclean --target noarch /builddir/build/SPECS/python-pysaml2.spec'], chrootPath='/var/lib/mock/f42-build-58989463-6569521/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x3ffa33e1370>timeout=201600uid=1000gid=425user='mockbuild'unshare_net=TrueprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11'])
Using nspawn with args ['--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11']
Executing command: ['/usr/bin/systemd-nspawn', '-q', '-M', '15df3dc7ae3443a1afe6f08e0c8de190', '-D', '/var/lib/mock/f42-build-58989463-6569521/root', '-a', '-u', 'mockbuild', '--capability=cap_ipc_lock', '--bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf', '--bind=/dev/btrfs-control', '--bind=/dev/mapper/control', '--bind=/dev/fuse', '--bind=/dev/loop-control', '--bind=/dev/loop0', '--bind=/dev/loop1', '--bind=/dev/loop2', '--bind=/dev/loop3', '--bind=/dev/loop4', '--bind=/dev/loop5', '--bind=/dev/loop6', '--bind=/dev/loop7', '--bind=/dev/loop8', '--bind=/dev/loop9', '--bind=/dev/loop10', '--bind=/dev/loop11', '--console=pipe', '--setenv=TERM=vt100', '--setenv=SHELL=/bin/bash', '--setenv=HOME=/builddir', '--setenv=HOSTNAME=mock', '--setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin', '--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"', '--setenv=PS1=<mock-chroot> \\s-\\v\\$ ', '--setenv=LANG=C.UTF-8', '--resolv-conf=off', 'bash', '--login', '-c', '/usr/bin/rpmbuild -ba --noprep --noclean --target noarch /builddir/build/SPECS/python-pysaml2.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;<mock-chroot>\\007"', 'PS1': '<mock-chroot> \\s-\\v\\$ ', 'LANG': 'C.UTF-8', 'SYSTEMD_NSPAWN_TMPFS_TMP': '0', 'SYSTEMD_SECCOMP': '0'} and shell False
Building target platforms: noarch
Building for target noarch
setting SOURCE_DATE_EPOCH=1717804800
Executing(%generate_buildrequires): /bin/sh -e /var/tmp/rpm-tmp.NDdRvt
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ cd pysaml2-7.4.2
+ echo pyproject-rpm-macros
+ echo python3-devel
+ echo 'python3dist(packaging)'
+ echo 'python3dist(pip) >= 19'
+ '[' -f pyproject.toml ']'
+ echo '(python3dist(tomli) if python3-devel < 3.11)'
+ rm -rfv '*.dist-info/'
+ '[' -f /usr/bin/python3 ']'
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ echo -n
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ VALAFLAGS=-g
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ CC=gcc
+ CXX=g++
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/.pyproject-builddir
+ RPM_TOXENV=py313
+ FEDORA=42
+ HOSTNAME=rpmbuild
+ /usr/bin/python3 -Bs /usr/lib/rpm/redhat/pyproject_buildrequires.py --generate-extras --python3_pkgversion 3 --wheeldir /builddir/build/BUILD/python-pysaml2-7.4.2-build/pyproject-wheeldir --output /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires -t
Handling poetry_core>=1.0.0 from build-system.requires
Requirement satisfied: poetry_core>=1.0.0
   (installed: poetry_core 1.9.1)
Handling tox-current-env >= 0.0.16 from tox itself
Requirement satisfied: tox-current-env >= 0.0.16
   (installed: tox-current-env 0.0.16)
  py313: OK (0.00 seconds)
  congratulations :) (0.06 seconds)
Handling tox from tox --print-deps-only: py313
Requirement satisfied: tox
   (installed: tox 4.25.0)
  py313: OK (0.00 seconds)
  congratulations :) (0.05 seconds)
Handling cryptography (>=3.1) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: cryptography (>=3.1)
   (installed: cryptography 44.0.0)
Handling defusedxml from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: defusedxml
   (installed: defusedxml 0.7.1)
Handling importlib-metadata (>=1.7.0) ; python_version < "3.8" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: importlib-metadata (>=1.7.0) ; python_version < "3.8"
Handling importlib-resources ; python_version < "3.9" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: importlib-resources ; python_version < "3.9"
Handling paste ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: paste ; extra == "s2repoze"
Handling pyopenssl from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: pyopenssl
   (installed: pyopenssl 25.0.0)
Handling python-dateutil from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: python-dateutil
   (installed: python-dateutil 2.8.2)
Handling pytz from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: pytz
   (installed: pytz 2025.2)
Handling repoze.who ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: repoze.who ; extra == "s2repoze"
Handling requests (>=2,<3) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: requests (>=2,<3)
   (installed: requests 2.32.3)
Handling xmlschema (>=1.2.1) from hook generated metadata: Requires-Dist (pysaml2)
Requirement satisfied: xmlschema (>=1.2.1)
   (installed: xmlschema 3.4.2)
Handling zope.interface ; extra == "s2repoze" from hook generated metadata: Requires-Dist (pysaml2)
Ignoring alien requirement: zope.interface ; extra == "s2repoze"
+ cat /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-buildrequires
+ rm -rfv pysaml2-7.4.2.dist-info/
removed 'pysaml2-7.4.2.dist-info/entry_points.txt'
removed 'pysaml2-7.4.2.dist-info/WHEEL'
removed 'pysaml2-7.4.2.dist-info/METADATA'
removed 'pysaml2-7.4.2.dist-info/LICENSE'
removed directory 'pysaml2-7.4.2.dist-info/'
+ RPM_EC=0
++ jobs -p
+ exit 0
Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.2p9SVh
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ export CFLAGS
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ export CXXFLAGS
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ export FFLAGS
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ export FCFLAGS
+ VALAFLAGS=-g
+ export VALAFLAGS
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ export RUSTFLAGS
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ export LDFLAGS
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ export LT_SYS_LIBRARY_PATH
+ CC=gcc
+ export CC
+ CXX=g++
+ export CXX
+ cd pysaml2-7.4.2
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/.pyproject-builddir
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ VALAFLAGS=-g
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ CC=gcc
+ CXX=g++
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/.pyproject-builddir
+ /usr/bin/python3 -Bs /usr/lib/rpm/redhat/pyproject_wheel.py /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/pyproject-wheeldir
Processing /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2
  Preparing metadata (pyproject.toml): started
  Running command Preparing metadata (pyproject.toml)
  Preparing metadata (pyproject.toml): finished with status 'done'
Building wheels for collected packages: pysaml2
  Building wheel for pysaml2 (pyproject.toml): started
  Running command Building wheel for pysaml2 (pyproject.toml)
  Building wheel for pysaml2 (pyproject.toml): finished with status 'done'
  Created wheel for pysaml2: filename=pysaml2-7.4.2-py3-none-any.whl size=417769 sha256=26f0581a6616b6456df7be189b726e77db878073943cd5d0447219e295a6ea62
  Stored in directory: /builddir/.cache/pip/wheels/01/b9/eb/75f72f6a4448fdc07c5ffc8f00ad2896051c69eedccbfbb041
Successfully built pysaml2
+ RPM_EC=0
++ jobs -p
+ exit 0
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.Fc7xwr
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ '[' /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT '!=' / ']'
+ rm -rf /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT
++ dirname /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT
+ mkdir -p /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ mkdir /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ export CFLAGS
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ export CXXFLAGS
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ export FFLAGS
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ export FCFLAGS
+ VALAFLAGS=-g
+ export VALAFLAGS
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ export RUSTFLAGS
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ export LDFLAGS
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ export LT_SYS_LIBRARY_PATH
+ CC=gcc
+ export CC
+ CXX=g++
+ export CXX
+ cd pysaml2-7.4.2
++ ls /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/pyproject-wheeldir/pysaml2-7.4.2-py3-none-any.whl
++ xargs basename --multiple
++ sed -E 's/([^-]+)-([^-]+)-.+\.whl/\1==\2/'
+ specifier=pysaml2==7.4.2
+ '[' -z pysaml2==7.4.2 ']'
+ TMPDIR=/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/.pyproject-builddir
+ /usr/bin/python3 -m pip install --root /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT --prefix /usr --no-deps --disable-pip-version-check --progress-bar off --verbose --ignore-installed --no-warn-script-location --no-index --no-cache-dir --find-links /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/pyproject-wheeldir pysaml2==7.4.2
Using pip 24.3.1 from /usr/lib/python3.13/site-packages/pip (python 3.13)
Looking in links: /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/pyproject-wheeldir
Processing ./pyproject-wheeldir/pysaml2-7.4.2-py3-none-any.whl
Installing collected packages: pysaml2
  Creating /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin
  changing mode of /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/make_metadata to 755
  changing mode of /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/mdexport to 755
  changing mode of /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/merge_metadata to 755
  changing mode of /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/parse_xsd2 to 755
Successfully installed pysaml2-7.4.2
+ '[' -d /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin ']'
+ '[' -z sP ']'
+ shebang_flags=-kasP
+ /usr/bin/python3 -B /usr/lib/rpm/redhat/pathfix.py -pni /usr/bin/python3 -kasP /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/make_metadata /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/mdexport /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/merge_metadata /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/parse_xsd2
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/make_metadata: updating
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/mdexport: updating
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/merge_metadata: updating
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/parse_xsd2: updating
+ rm -rfv /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin/__pycache__
+ rm -f /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-ghost-distinfo
+ site_dirs=()
+ '[' -d /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages ']'
+ site_dirs+=("/usr/lib/python3.13/site-packages")
+ '[' /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib64/python3.13/site-packages '!=' /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages ']'
+ '[' -d /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib64/python3.13/site-packages ']'
+ for site_dir in ${site_dirs[@]}
+ for distinfo in /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT$site_dir/*.dist-info
+ echo '%ghost /usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info'
+ sed -i s/pip/rpm/ /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info/INSTALLER
+ PYTHONPATH=/usr/lib/rpm/redhat
+ /usr/bin/python3 -B /usr/lib/rpm/redhat/pyproject_preprocess_record.py --buildroot /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT --record /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info/RECORD --output /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-record
+ rm -fv /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info/RECORD
removed '/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info/RECORD'
+ rm -fv /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info/REQUESTED
removed '/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/pysaml2-7.4.2.dist-info/REQUESTED'
++ wc -l /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-ghost-distinfo
++ cut -f1 '-d '
+ lines=1
+ '[' 1 -ne 1 ']'
+ RPM_FILES_ESCAPE=4.19
+ /usr/bin/python3 /usr/lib/rpm/redhat/pyproject_save_files.py --output-files /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-files --output-modules /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-modules --buildroot /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT --sitelib /usr/lib/python3.13/site-packages --sitearch /usr/lib64/python3.13/site-packages --python-version 3.13 --pyproject-record /builddir/build/BUILD/python-pysaml2-7.4.2-build/python-pysaml2-7.4.2-5.fc42.noarch-pyproject-record --prefix /usr saml2 saml2test
+ for bin in parse_xsd2 make_metadata mdexport merge_metadata
+ ln -s parse_xsd2 /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT//usr/bin/parse_xsd2.py
+ for bin in parse_xsd2 make_metadata mdexport merge_metadata
+ ln -s make_metadata /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT//usr/bin/make_metadata.py
+ for bin in parse_xsd2 make_metadata mdexport merge_metadata
+ ln -s mdexport /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT//usr/bin/mdexport.py
+ for bin in parse_xsd2 make_metadata mdexport merge_metadata
+ ln -s merge_metadata /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT//usr/bin/merge_metadata.py
+ sed -i /alabaster/d docs/conf.py
+ export PYTHONPATH=/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT//usr/lib/python3.13/site-packages
+ PYTHONPATH=/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT//usr/lib/python3.13/site-packages
+ sphinx-build-3 docs html
Running Sphinx v8.1.3
loading translations [en]... done
making output directory... done
Converting `source_suffix = '.rst'` to `source_suffix = {'.rst': 'restructuredtext'}`.
building [mo]: targets for 0 po files that are out of date
writing output... 
building [html]: targets for 8 source files that are out of date
updating environment: [new config] 8 added, 0 changed, 0 removed
reading sources... [ 12%] examples/idp
reading sources... [ 25%] examples/index
reading sources... [ 38%] examples/sp
reading sources... [ 50%] howto/config
reading sources... [ 62%] howto/index
reading sources... [ 75%] index
reading sources... [ 88%] install
reading sources... [100%] sp_test/internal
looking for now-outdated files... none found
pickling environment... done
checking consistency... done
preparing documents... done
copying assets... 
copying static files... 
Writing evaluated template result to /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/html/_static/basic.css
Writing evaluated template result to /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/html/_static/documentation_options.js
Writing evaluated template result to /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/html/_static/language_data.js
Writing evaluated template result to /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/html/_static/alabaster.css
copying static files: done
copying extra files... 
copying extra files: done
copying assets: done
writing output... [ 12%] examples/idp
writing output... [ 25%] examples/index
writing output... [ 38%] examples/sp
writing output... [ 50%] howto/config
writing output... [ 62%] howto/index
writing output... [ 75%] index
writing output... [ 88%] install
writing output... [100%] sp_test/internal
generating indices... genindex done
writing additional pages... search done
dumping search index in English (code: en)... done
dumping object inventory... done
build succeeded.
The HTML pages are in html.
+ rm -rf html/.doctrees html/.buildinfo
+ /usr/lib/rpm/check-buildroot
+ /usr/lib/rpm/redhat/brp-ldconfig
+ /usr/lib/rpm/brp-compress
+ /usr/lib/rpm/brp-strip /usr/bin/strip
+ /usr/lib/rpm/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
+ /usr/lib/rpm/redhat/brp-strip-lto /usr/bin/strip
+ /usr/lib/rpm/brp-strip-static-archive /usr/bin/strip
+ /usr/lib/rpm/check-rpaths
+ /usr/lib/rpm/redhat/brp-mangle-shebangs
*** WARNING: ./usr/lib/python3.13/site-packages/saml2/authn_context/timesync.py is executable but has no shebang, removing executable bit
mangling shebang in /usr/lib/python3.13/site-packages/saml2/tools/update_metadata.sh from /bin/sh to #!/usr/bin/sh
+ /usr/lib/rpm/brp-remove-la-files
+ env /usr/lib/rpm/redhat/brp-python-bytecompile '' 1 0 -j3
Bytecompiling .py files below /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13 using python3.13
+ /usr/lib/rpm/redhat/brp-python-hardlink
+ /usr/bin/add-determinism --brp -j3 /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/attributemaps/__pycache__/adfs_v1x.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/attributemaps/__pycache__/adfs_v20.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/attributemaps/__pycache__/basic.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/attributemaps/__pycache__/shibboleth_uri.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/attributemaps/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/attributemaps/__pycache__/saml_uri.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/mobiletwofactor.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/timesync.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/ippword.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/ppt.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/pword.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/__pycache__/errors.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/__pycache__/asymmetric.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/__pycache__/pki.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/data/schemas/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/data/templates/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/data/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity_category/__pycache__/at_egov_pvp2.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity_category/__pycache__/swamid.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity_category/__pycache__/edugain.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity_category/__pycache__/incommon.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/authn_context/__pycache__/sslcert.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity_category/__pycache__/refeds.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity_category/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/algsupport.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/__pycache__/symmetric.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/dri.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/shibmd.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/sp_type.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/idpdisc.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/pefim.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/mdattr.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/reqinit.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/requested_attributes.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/mdrpi.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/extension/__pycache__/mdui.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/profile/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/profile/__pycache__/samlec.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/plugins/__pycache__/entitlement.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/profile/__pycache__/paos.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/profile/__pycache__/ecp.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/plugins/__pycache__/ini.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/plugins/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/plugins/__pycache__/formswithhidden.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/plugins/__pycache__/challenge_decider.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/s2repoze/plugins/__pycache__/sp.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/schema/__pycache__/soapenv.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/schema/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/make_metadata.cpython-313.pyc: replacing with normalized version
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/make_metadata.cpython-313.opt-1.pyc: replacing with normalized version
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/schema/__pycache__/soap.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/mdexport.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/mdexport_test.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/mdimport.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/merge_metadata.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/verify_metadata.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/sync_attrmaps.cpython-313.pyc: replacing with normalized version
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/sync_attrmaps.cpython-313.opt-1.pyc: replacing with normalized version
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/userinfo/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/userinfo/__pycache__/ldapinfo.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/ws/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/schema/__pycache__/wsdl.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/ws/__pycache__/wspol.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/ws/__pycache__/wssec.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/ws/__pycache__/wsaddr.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/ws/__pycache__/wsutil.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/xml/schema/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/xml/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/tools/__pycache__/parse_xsd2.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/ws/__pycache__/wstrust.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/xmlenc/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/xmldsig/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/algsupport.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/argtree.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/attribute_resolver.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/attribute_converter.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/assertion.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/authn.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/cache.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/cert.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/client_base.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/country_codes.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/config.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/client.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/discovery.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/ecp.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/ecp_client.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/eptid.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/filter.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/httpbase.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/entity.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/mdie.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/mdbcache.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/httputil.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/mcache.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/ident.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/pack.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/mongo_store.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/population.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/request.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/metadata.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/mdstore.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/md.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/response.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/sdb.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/s_utils.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/server.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/saml.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/sigver.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/soap.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/time_util.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/samlp.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/validate.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/version.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/__pycache__/virtual_org.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/__init__.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/check.cpython-313.pyc: replacing with normalized version
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/check.cpython-313.opt-1.pyc: replacing with normalized version
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/status.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/interaction.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/opfunc.cpython-313.pyc: rewriting with normalized contents
/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2test/__pycache__/tool.cpython-313.pyc: rewriting with normalized contents
Scanned 49 directories and 434 files,
               processed 127 inodes,
               127 modified (6 replaced + 121 rewritten),
               0 unsupported format, 0 errors
Executing(%check): /bin/sh -e /var/tmp/rpm-tmp.1H0O46
+ umask 022
+ cd /builddir/build/BUILD/python-pysaml2-7.4.2-build
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ export CFLAGS
+ CXXFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ export CXXFLAGS
+ FFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ export FFLAGS
+ FCFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib/gfortran/modules '
+ export FCFLAGS
+ VALAFLAGS=-g
+ export VALAFLAGS
+ RUSTFLAGS='-Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes --cap-lints=warn'
+ export RUSTFLAGS
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ export LDFLAGS
+ LT_SYS_LIBRARY_PATH=/usr/lib:
+ export LT_SYS_LIBRARY_PATH
+ CC=gcc
+ export CC
+ CXX=g++
+ export CXX
+ cd pysaml2-7.4.2
+ CFLAGS='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection '
+ LDFLAGS='-Wl,-z,relro -Wl,--as-needed   -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1  '
+ PATH=/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin
+ PYTHONPATH=/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib64/python3.13/site-packages:/builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages
+ PYTHONDONTWRITEBYTECODE=1
+ PYTEST_ADDOPTS=' --ignore=/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/.pyproject-builddir'
+ PYTEST_XDIST_AUTO_NUM_WORKERS=3
+ /usr/bin/pytest
============================= test session starts ==============================
platform linux -- Python 3.13.3, pytest-8.3.4, pluggy-1.5.0 -- /usr/bin/python3
cachedir: .pytest_cache
rootdir: /builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2
configfile: pyproject.toml
testpaths: tests
collecting ... collected 785 items
tests/test_00_xmldsig.py::TestObject::testAccessors PASSED               [  0%]
tests/test_00_xmldsig.py::TestObject::testUsingTestData PASSED           [  0%]
tests/test_00_xmldsig.py::TestMgmtData::testAccessors PASSED             [  0%]
tests/test_00_xmldsig.py::TestMgmtData::testUsingTestData PASSED         [  0%]
tests/test_00_xmldsig.py::TestSPKISexp::testAccessors PASSED             [  0%]
tests/test_00_xmldsig.py::TestSPKISexp::testUsingTestData PASSED         [  0%]
tests/test_00_xmldsig.py::TestSPKIData::testAccessors PASSED             [  0%]
tests/test_00_xmldsig.py::TestSPKIData::testUsingTestData PASSED         [  1%]
tests/test_00_xmldsig.py::TestPGPData::testAccessors PASSED              [  1%]
tests/test_00_xmldsig.py::TestPGPData::testUsingTestData PASSED          [  1%]
tests/test_00_xmldsig.py::TestX509IssuerSerial::testAccessors PASSED     [  1%]
tests/test_00_xmldsig.py::TestX509IssuerSerial::testUsingTestData PASSED [  1%]
tests/test_00_xmldsig.py::TestX509Data::testAccessors PASSED             [  1%]
tests/test_00_xmldsig.py::TestX509Data::testUsingTestData PASSED         [  1%]
tests/test_00_xmldsig.py::TestTransform::testAccessors PASSED            [  1%]
tests/test_00_xmldsig.py::TestTransform::testUsingTestData PASSED        [  2%]
tests/test_00_xmldsig.py::TestTransforms::testAccessors PASSED           [  2%]
tests/test_00_xmldsig.py::TestTransforms::testUsingTestData PASSED       [  2%]
tests/test_00_xmldsig.py::TestRetrievalMethod::testAccessors PASSED      [  2%]
tests/test_00_xmldsig.py::TestRetrievalMethod::testUsingTestData PASSED  [  2%]
tests/test_00_xmldsig.py::TestRSAKeyValue::testAccessors PASSED          [  2%]
tests/test_00_xmldsig.py::TestRSAKeyValue::testUsingTestData PASSED      [  2%]
tests/test_00_xmldsig.py::TestDSAKeyValue::testAccessors PASSED          [  2%]
tests/test_00_xmldsig.py::TestDSAKeyValue::testUsingTestData PASSED      [  3%]
tests/test_00_xmldsig.py::TestKeyValue::testAccessors PASSED             [  3%]
tests/test_00_xmldsig.py::TestKeyValue::testUsingTestData PASSED         [  3%]
tests/test_00_xmldsig.py::TestKeyName::testAccessors PASSED              [  3%]
tests/test_00_xmldsig.py::TestKeyName::testUsingTestData PASSED          [  3%]
tests/test_00_xmldsig.py::TestKeyInfo::testAccessors PASSED              [  3%]
tests/test_00_xmldsig.py::TestKeyInfo::testUsingTestData PASSED          [  3%]
tests/test_00_xmldsig.py::TestDigestValue::testAccessors PASSED          [  3%]
tests/test_00_xmldsig.py::TestDigestValue::testUsingTestData PASSED      [  4%]
tests/test_00_xmldsig.py::TestDigestMethod::testAccessors PASSED         [  4%]
tests/test_00_xmldsig.py::TestDigestMethod::testUsingTestData PASSED     [  4%]
tests/test_00_xmldsig.py::TestReference::testAccessors PASSED            [  4%]
tests/test_00_xmldsig.py::TestReference::testUsingTestData PASSED        [  4%]
tests/test_00_xmldsig.py::TestSignatureMethod::testAccessors PASSED      [  4%]
tests/test_00_xmldsig.py::TestSignatureMethod::testUsingTestData PASSED  [  4%]
tests/test_00_xmldsig.py::TestCanonicalizationMethod::testAccessors PASSED [  4%]
tests/test_00_xmldsig.py::TestCanonicalizationMethod::testUsingTestData PASSED [  5%]
tests/test_00_xmldsig.py::TestSignedInfo::testAccessors PASSED           [  5%]
tests/test_00_xmldsig.py::TestSignedInfo::testUsingTestData PASSED       [  5%]
tests/test_00_xmldsig.py::TestSignatureValue::testAccessors PASSED       [  5%]
tests/test_00_xmldsig.py::TestSignatureValue::testUsingTestData PASSED   [  5%]
tests/test_00_xmldsig.py::TestSignature::testAccessors PASSED            [  5%]
tests/test_00_xmldsig.py::TestSignature::testUsingTestData PASSED        [  5%]
tests/test_01_xmlenc.py::test_1 PASSED                                   [  5%]
tests/test_01_xmlenc.py::test_2 PASSED                                   [  6%]
tests/test_01_xmlenc.py::test_3 PASSED                                   [  6%]
tests/test_01_xmlenc.py::test_4 PASSED                                   [  6%]
tests/test_01_xmlenc.py::test_5 PASSED                                   [  6%]
tests/test_01_xmlenc.py::test_6 PASSED                                   [  6%]
tests/test_02_saml.py::TestExtensionElement::test_loadd PASSED           [  6%]
tests/test_02_saml.py::TestExtensionElement::test_find_children PASSED   [  6%]
tests/test_02_saml.py::TestExtensionContainer::test_find_extensions PASSED [  7%]
tests/test_02_saml.py::TestExtensionContainer::test_add_extension_elements PASSED [  7%]
tests/test_02_saml.py::TestExtensionContainer::test_add_extension_attribute PASSED [  7%]
tests/test_02_saml.py::TestSAMLBase::test_make_vals_dict PASSED          [  7%]
tests/test_02_saml.py::TestSAMLBase::test_make_vals_str PASSED           [  7%]
tests/test_02_saml.py::TestSAMLBase::test_make_vals_multi_dict PASSED    [  7%]
tests/test_02_saml.py::TestSAMLBase::test_to_string_nspair PASSED        [  7%]
tests/test_02_saml.py::TestSAMLBase::test_set_text_empty PASSED          [  7%]
tests/test_02_saml.py::TestSAMLBase::test_set_text_value PASSED          [  8%]
tests/test_02_saml.py::TestSAMLBase::test_set_text_update_same_type PASSED [  8%]
tests/test_02_saml.py::TestSAMLBase::test_set_text_cannot_change_value_type PASSED [  8%]
tests/test_02_saml.py::TestSAMLBase::test_set_xs_type_anytype_unchanged_value PASSED [  8%]
tests/test_02_saml.py::TestSAMLBase::test_set_xs_type_date PASSED        [  8%]
tests/test_02_saml.py::TestSAMLBase::test_treat_invalid_types_as_string PASSED [  8%]
tests/test_02_saml.py::TestSAMLBase::test_make_vals_div PASSED           [  8%]
tests/test_02_saml.py::TestNameID::testEmptyExtensionsList PASSED        [  8%]
tests/test_02_saml.py::TestNameID::testFormatAttribute PASSED            [  9%]
tests/test_02_saml.py::TestNameID::testNameIDText PASSED                 [  9%]
tests/test_02_saml.py::TestNameID::testSPProvidedID PASSED               [  9%]
tests/test_02_saml.py::TestNameID::testEmptyNameIDToAndFromStringMatch PASSED [  9%]
tests/test_02_saml.py::TestNameID::testNameIDToAndFromStringMatch PASSED [  9%]
tests/test_02_saml.py::TestNameID::testExtensionAttributes PASSED        [  9%]
tests/test_02_saml.py::TestNameID::testname_id_from_string PASSED        [  9%]
tests/test_02_saml.py::TestIssuer::testIssuerToAndFromString PASSED      [  9%]
tests/test_02_saml.py::TestIssuer::testUsingTestData PASSED              [ 10%]
tests/test_02_saml.py::TestSubjectLocality::testAccessors PASSED         [ 10%]
tests/test_02_saml.py::TestSubjectLocality::testUsingTestData PASSED     [ 10%]
tests/test_02_saml.py::TestAuthnContextClassRef::testAccessors PASSED    [ 10%]
tests/test_02_saml.py::TestAuthnContextClassRef::testUsingTestData PASSED [ 10%]
tests/test_02_saml.py::TestAuthnContextDeclRef::testAccessors PASSED     [ 10%]
tests/test_02_saml.py::TestAuthnContextDeclRef::testUsingTestData PASSED [ 10%]
tests/test_02_saml.py::TestAuthnContextDecl::testAccessors PASSED        [ 10%]
tests/test_02_saml.py::TestAuthnContextDecl::testUsingTestData PASSED    [ 11%]
tests/test_02_saml.py::TestAuthenticatingAuthority::testAccessors PASSED [ 11%]
tests/test_02_saml.py::TestAuthenticatingAuthority::testUsingTestData PASSED [ 11%]
tests/test_02_saml.py::TestAuthnContext::testAccessors PASSED            [ 11%]
tests/test_02_saml.py::TestAuthnContext::testUsingTestData PASSED        [ 11%]
tests/test_02_saml.py::TestAuthnStatement::testAccessors PASSED          [ 11%]
tests/test_02_saml.py::TestAuthnStatement::testUsingTestData PASSED      [ 11%]
tests/test_02_saml.py::TestAttributeValue::testAccessors PASSED          [ 11%]
tests/test_02_saml.py::TestAttributeValue::testUsingTestData PASSED      [ 12%]
tests/test_02_saml.py::TestAttribute::testAccessors PASSED               [ 12%]
tests/test_02_saml.py::TestAttribute::testUsingTestData PASSED           [ 12%]
tests/test_02_saml.py::TestAttribute::test_basic_str PASSED              [ 12%]
tests/test_02_saml.py::TestAttribute::test_basic_int PASSED              [ 12%]
tests/test_02_saml.py::TestAttribute::test_basic_base64 PASSED           [ 12%]
tests/test_02_saml.py::TestAttribute::test_basic_boolean_true PASSED     [ 12%]
tests/test_02_saml.py::TestAttribute::test_basic_boolean_false PASSED    [ 12%]
tests/test_02_saml.py::TestAttributeStatement::testAccessors PASSED      [ 13%]
tests/test_02_saml.py::TestAttributeStatement::testUsingTestData PASSED  [ 13%]
tests/test_02_saml.py::TestSubjectConfirmationData::testAccessors PASSED [ 13%]
tests/test_02_saml.py::TestSubjectConfirmationData::testUsingTestData PASSED [ 13%]
tests/test_02_saml.py::TestSubjectConfirmation::testAccessors PASSED     [ 13%]
tests/test_02_saml.py::TestSubjectConfirmation::testBearerUsingTestData PASSED [ 13%]
tests/test_02_saml.py::TestSubjectConfirmation::testHolderOfKeyUsingTestData PASSED [ 13%]
tests/test_02_saml.py::TestSubject::testAccessors PASSED                 [ 14%]
tests/test_02_saml.py::TestSubject::testUsingTestData PASSED             [ 14%]
tests/test_02_saml.py::TestCondition::testAccessors PASSED               [ 14%]
tests/test_02_saml.py::TestCondition::testUsingTestData PASSED           [ 14%]
tests/test_02_saml.py::TestAudience::testAccessors PASSED                [ 14%]
tests/test_02_saml.py::TestAudience::testUsingTestData PASSED            [ 14%]
tests/test_02_saml.py::TestAudienceRestriction::testAccessors PASSED     [ 14%]
tests/test_02_saml.py::TestAudienceRestriction::testUsingTestData PASSED [ 14%]
tests/test_02_saml.py::TestOneTimeUse::testAccessors PASSED              [ 15%]
tests/test_02_saml.py::TestOneTimeUse::testUsingTestData PASSED          [ 15%]
tests/test_02_saml.py::TestProxyRestriction::testAccessors PASSED        [ 15%]
tests/test_02_saml.py::TestProxyRestriction::testUsingTestData PASSED    [ 15%]
tests/test_02_saml.py::TestConditions::testAccessors PASSED              [ 15%]
tests/test_02_saml.py::TestConditions::testUsingTestData PASSED          [ 15%]
tests/test_02_saml.py::TestAssertionIDRef::testAccessors PASSED          [ 15%]
tests/test_02_saml.py::TestAssertionIDRef::testUsingTestData PASSED      [ 15%]
tests/test_02_saml.py::TestAssertionURIRef::testAccessors PASSED         [ 16%]
tests/test_02_saml.py::TestAssertionURIRef::testUsingTestData PASSED     [ 16%]
tests/test_02_saml.py::TestAction::testAccessors PASSED                  [ 16%]
tests/test_02_saml.py::TestAction::testUsingTestData PASSED              [ 16%]
tests/test_02_saml.py::TestEvidence::testAccessors PASSED                [ 16%]
tests/test_02_saml.py::TestEvidence::testUsingTestData PASSED            [ 16%]
tests/test_02_saml.py::TestAuthzDecisionStatement::testAccessors PASSED  [ 16%]
tests/test_02_saml.py::TestAuthzDecisionStatement::testUsingTestData PASSED [ 16%]
tests/test_02_saml.py::TestAdvice::testAccessors PASSED                  [ 17%]
tests/test_02_saml.py::TestAdvice::testUsingTestData PASSED              [ 17%]
tests/test_02_saml.py::TestAssertion::testAccessors PASSED               [ 17%]
tests/test_02_saml.py::TestAssertion::testUsingTestData PASSED           [ 17%]
tests/test_03_saml2.py::test_create_class_from_xml_string_nameid PASSED  [ 17%]
tests/test_03_saml2.py::test_create_class_from_xml_string_issuer PASSED  [ 17%]
tests/test_03_saml2.py::test_create_class_from_xml_string_subject_locality PASSED [ 17%]
tests/test_03_saml2.py::test_create_class_from_xml_string_subject_confirmation_data PASSED [ 17%]
tests/test_03_saml2.py::test_create_class_from_xml_string_subject_confirmation PASSED [ 18%]
tests/test_03_saml2.py::test_create_class_from_xml_string_wrong_class_spec PASSED [ 18%]
tests/test_03_saml2.py::test_create_class_from_xml_string_xxe PASSED     [ 18%]
tests/test_03_saml2.py::test_ee_1 PASSED                                 [ 18%]
tests/test_03_saml2.py::test_ee_2 PASSED                                 [ 18%]
tests/test_03_saml2.py::test_ee_3 PASSED                                 [ 18%]
tests/test_03_saml2.py::test_ee_4 PASSED                                 [ 18%]
tests/test_03_saml2.py::test_ee_5 PASSED                                 [ 18%]
tests/test_03_saml2.py::test_ee_6 PASSED                                 [ 19%]
tests/test_03_saml2.py::test_nameid_with_extension PASSED                [ 19%]
tests/test_03_saml2.py::test_subject_confirmation_with_extension PASSED  [ 19%]
tests/test_03_saml2.py::test_to_fro_string_1 PASSED                      [ 19%]
tests/test_03_saml2.py::test_make_vals_str PASSED                        [ 19%]
tests/test_03_saml2.py::test_make_vals_list_of_strs PASSED               [ 19%]
tests/test_03_saml2.py::test_attribute_element_to_extension_element PASSED [ 19%]
tests/test_03_saml2.py::test_ee_7 PASSED                                 [ 20%]
tests/test_03_saml2.py::test_ee_xxe PASSED                               [ 20%]
tests/test_03_saml2.py::test_extension_element_loadd PASSED              [ 20%]
tests/test_03_saml2.py::test_extensions_loadd PASSED                     [ 20%]
tests/test_04_samlp.py::TestStatusDetail::testAccessors PASSED           [ 20%]
tests/test_04_samlp.py::TestStatusMessage::testAccessors PASSED          [ 20%]
tests/test_04_samlp.py::TestStatusCode::testAccessors PASSED             [ 20%]
tests/test_04_samlp.py::TestStatusCode::testUsingTestData PASSED         [ 20%]
tests/test_04_samlp.py::TestStatus::testAccessors PASSED                 [ 21%]
tests/test_04_samlp.py::TestStatus::testUsingTestData PASSED             [ 21%]
tests/test_04_samlp.py::TestResponse::testAccessors PASSED               [ 21%]
tests/test_04_samlp.py::TestResponse::testUsingTestData PASSED           [ 21%]
tests/test_04_samlp.py::TestNameIDPolicy::testAccessors PASSED           [ 21%]
tests/test_04_samlp.py::TestNameIDPolicy::testUsingTestData PASSED       [ 21%]
tests/test_04_samlp.py::TestIDPEntry::testAccessors PASSED               [ 21%]
tests/test_04_samlp.py::TestIDPEntry::testUsingTestData PASSED           [ 21%]
tests/test_04_samlp.py::TestIDPList::testAccessors PASSED                [ 22%]
tests/test_04_samlp.py::TestIDPList::testUsingTestData PASSED            [ 22%]
tests/test_04_samlp.py::TestScoping::testAccessors PASSED                [ 22%]
tests/test_04_samlp.py::TestScoping::testUsingTestData PASSED            [ 22%]
tests/test_04_samlp.py::TestRequestedAuthnContext::testAccessors PASSED  [ 22%]
tests/test_04_samlp.py::TestRequestedAuthnContext::testUsingTestData PASSED [ 22%]
tests/test_04_samlp.py::TestAuthnRequest::testAccessors PASSED           [ 22%]
tests/test_04_samlp.py::TestAuthnRequest::testUsingTestData PASSED       [ 22%]
tests/test_04_samlp.py::TestLogoutRequest::testAccessors PASSED          [ 23%]
tests/test_04_samlp.py::TestLogoutRequest::testUsingTestData PASSED      [ 23%]
tests/test_04_samlp.py::TestLogoutResponse::testAccessors PASSED         [ 23%]
tests/test_04_samlp.py::TestLogoutResponse::testUsingTestData PASSED     [ 23%]
tests/test_05_md.py::TestEndpointType::testAccessors PASSED              [ 23%]
tests/test_05_md.py::TestEndpointType::testUsingTestData PASSED          [ 23%]
tests/test_05_md.py::TestIndexedEndpointType::testAccessors PASSED       [ 23%]
tests/test_05_md.py::TestIndexedEndpointType::testUsingTestData PASSED   [ 23%]
tests/test_05_md.py::TestExtensions::testAccessors PASSED                [ 24%]
tests/test_05_md.py::TestOrganizationName::testAccessors PASSED          [ 24%]
tests/test_05_md.py::TestOrganizationName::testUsingTestData PASSED      [ 24%]
tests/test_05_md.py::TestOrganizationDisplayName::testAccessors PASSED   [ 24%]
tests/test_05_md.py::TestOrganizationDisplayName::testUsingTestData PASSED [ 24%]
tests/test_05_md.py::TestOrganizationURL::testAccessors PASSED           [ 24%]
tests/test_05_md.py::TestOrganizationURL::testUsingTestData PASSED       [ 24%]
tests/test_05_md.py::TestOrganization::testAccessors PASSED              [ 24%]
tests/test_05_md.py::TestOrganization::testUsingTestData PASSED          [ 25%]
tests/test_05_md.py::TestContactPerson::testAccessors PASSED             [ 25%]
tests/test_05_md.py::TestContactPerson::testUsingTestData PASSED         [ 25%]
tests/test_05_md.py::TestAdditionalMetadataLocation::testAccessors PASSED [ 25%]
tests/test_05_md.py::TestAdditionalMetadataLocation::testUsingTestData PASSED [ 25%]
tests/test_05_md.py::TestEncryptionMethod::testAccessors PASSED          [ 25%]
tests/test_05_md.py::TestEncryptionMethod::testUsingTestData PASSED      [ 25%]
tests/test_05_md.py::TestKeyDescriptor::testAccessors PASSED             [ 25%]
tests/test_05_md.py::TestKeyDescriptor::testUsingTestData PASSED         [ 26%]
tests/test_05_md.py::TestRoleDescriptor::testAccessors PASSED            [ 26%]
tests/test_05_md.py::TestRoleDescriptor::testUsingTestData PASSED        [ 26%]
tests/test_05_md.py::TestArtifactResolutionService::testAccessors PASSED [ 26%]
tests/test_05_md.py::TestArtifactResolutionService::testUsingTestData PASSED [ 26%]
tests/test_05_md.py::TestSingleLogout::testAccessors PASSED              [ 26%]
tests/test_05_md.py::TestSingleLogout::testUsingTestData PASSED          [ 26%]
tests/test_05_md.py::TestManageNameIDService::testAccessors PASSED       [ 27%]
tests/test_05_md.py::TestManageNameIDService::testUsingTestData PASSED   [ 27%]
tests/test_05_md.py::TestNameIDFormat::testAccessors PASSED              [ 27%]
tests/test_05_md.py::TestNameIDFormat::testUsingTestData PASSED          [ 27%]
tests/test_05_md.py::TestSingleSignOnService::testAccessors PASSED       [ 27%]
tests/test_05_md.py::TestSingleSignOnService::testUsingTestData PASSED   [ 27%]
tests/test_05_md.py::TestNameIDMappingService::testAccessors PASSED      [ 27%]
tests/test_05_md.py::TestNameIDMappingService::testUsingTestData PASSED  [ 27%]
tests/test_05_md.py::TestAssertionIDRequestService::testAccessors PASSED [ 28%]
tests/test_05_md.py::TestAssertionIDRequestService::testUsingTestData PASSED [ 28%]
tests/test_05_md.py::TestAttributeProfile::testAccessors PASSED          [ 28%]
tests/test_05_md.py::TestAttributeProfile::testUsingTestData PASSED      [ 28%]
tests/test_05_md.py::TestIDPSSODescriptor::testAccessors PASSED          [ 28%]
tests/test_05_md.py::TestIDPSSODescriptor::testUsingTestData PASSED      [ 28%]
tests/test_05_md.py::TestIDPSSODescriptor::testUsingScope PASSED         [ 28%]
tests/test_05_md.py::TestAssertionConsumerService::testAccessors PASSED  [ 28%]
tests/test_05_md.py::TestAssertionConsumerService::testUsingTestData PASSED [ 29%]
tests/test_05_md.py::TestRequestedAttribute::testAccessors PASSED        [ 29%]
tests/test_05_md.py::TestRequestedAttribute::testUsingTestData PASSED    [ 29%]
tests/test_05_md.py::TestServiceName::testAccessors PASSED               [ 29%]
tests/test_05_md.py::TestServiceName::testUsingTestData PASSED           [ 29%]
tests/test_05_md.py::TestServiceDescription::testAccessors PASSED        [ 29%]
tests/test_05_md.py::TestServiceDescription::testUsingTestData PASSED    [ 29%]
tests/test_05_md.py::TestAttributeConsumingService::testAccessors PASSED [ 29%]
tests/test_05_md.py::TestAttributeConsumingService::testUsingTestData PASSED [ 30%]
tests/test_05_md.py::TestSPSSODescriptor::testAccessors PASSED           [ 30%]
tests/test_05_md.py::TestSPSSODescriptor::testUsingTestData PASSED       [ 30%]
tests/test_05_md.py::TestEntityDescriptor::testAccessors PASSED          [ 30%]
tests/test_05_md.py::TestEntityDescriptor::testUsingTestData PASSED      [ 30%]
tests/test_05_md.py::TestEntitiesDescriptor::testAccessors PASSED        [ 30%]
tests/test_05_md.py::TestEntitiesDescriptor::testUsingTestData PASSED    [ 30%]
tests/test_06_setarg.py::test_path PASSED                                [ 30%]
tests/test_06_setarg.py::test_set_arg PASSED                             [ 31%]
tests/test_06_setarg.py::test_multi PASSED                               [ 31%]
tests/test_06_setarg.py::test_is_set PASSED                              [ 31%]
tests/test_10_time_util.py::test_f_quotient PASSED                       [ 31%]
tests/test_10_time_util.py::test_modulo PASSED                           [ 31%]
tests/test_10_time_util.py::test_f_quotient_2 PASSED                     [ 31%]
tests/test_10_time_util.py::test_modulo_2 PASSED                         [ 31%]
tests/test_10_time_util.py::test_parse_duration PASSED                   [ 31%]
tests/test_10_time_util.py::test_parse_duration2 PASSED                  [ 32%]
tests/test_10_time_util.py::test_parse_duration_n PASSED                 [ 32%]
tests/test_10_time_util.py::test_add_duration_1 PASSED                   [ 32%]
tests/test_10_time_util.py::test_add_duration_2 PASSED                   [ 32%]
tests/test_10_time_util.py::test_str_to_time PASSED                      [ 32%]
tests/test_10_time_util.py::test_instant PASSED                          [ 32%]
tests/test_10_time_util.py::test_valid PASSED                            [ 32%]
tests/test_10_time_util.py::test_timeout PASSED                          [ 32%]
tests/test_10_time_util.py::test_before PASSED                           [ 33%]
tests/test_10_time_util.py::test_after PASSED                            [ 33%]
tests/test_10_time_util.py::test_not_before PASSED                       [ 33%]
tests/test_10_time_util.py::test_not_on_or_after PASSED                  [ 33%]
tests/test_12_s_utils.py::test_inflate_then_deflate PASSED               [ 33%]
tests/test_12_s_utils.py::test_status_success PASSED                     [ 33%]
tests/test_12_s_utils.py::test_error_status PASSED                       [ 33%]
tests/test_12_s_utils.py::test_status_from_exception PASSED              [ 34%]
tests/test_12_s_utils.py::test_status_from_tuple PASSED                  [ 34%]
tests/test_12_s_utils.py::test_status_from_tuple_empty_message PASSED    [ 34%]
tests/test_12_s_utils.py::test_attribute_sn PASSED                       [ 34%]
tests/test_12_s_utils.py::test_attribute_age PASSED                      [ 34%]
tests/test_12_s_utils.py::test_attribute_onoff PASSED                    [ 34%]
tests/test_12_s_utils.py::test_attribute_base64 PASSED                   [ 34%]
tests/test_12_s_utils.py::test_attribute_statement PASSED                [ 34%]
tests/test_12_s_utils.py::test_audience PASSED                           [ 35%]
tests/test_12_s_utils.py::test_conditions PASSED                         [ 35%]
tests/test_12_s_utils.py::test_value_1 PASSED                            [ 35%]
tests/test_12_s_utils.py::test_value_2 PASSED                            [ 35%]
tests/test_12_s_utils.py::test_value_3 PASSED                            [ 35%]
tests/test_12_s_utils.py::test_value_4 PASSED                            [ 35%]
tests/test_12_s_utils.py::test_do_attribute_statement_0 PASSED           [ 35%]
tests/test_12_s_utils.py::test_do_attribute_statement PASSED             [ 35%]
tests/test_12_s_utils.py::test_do_attribute_statement_multi PASSED       [ 36%]
tests/test_12_s_utils.py::test_subject PASSED                            [ 36%]
tests/test_12_s_utils.py::test_parse_attribute_map PASSED                [ 36%]
tests/test_12_s_utils.py::test_identity_attribute_0 PASSED               [ 36%]
tests/test_12_s_utils.py::test_identity_attribute_1 PASSED               [ 36%]
tests/test_12_s_utils.py::test_identity_attribute_2 PASSED               [ 36%]
tests/test_12_s_utils.py::test_identity_attribute_3 PASSED               [ 36%]
tests/test_12_s_utils.py::test_identity_attribute_4 PASSED               [ 36%]
tests/test_12_s_utils.py::test_nameformat_email PASSED                   [ 37%]
tests/test_12_s_utils.py::test_attribute PASSED                          [ 37%]
tests/test_12_s_utils.py::test_attribute_statement_2 PASSED              [ 37%]
tests/test_12_s_utils.py::test_subject_confirmation_data PASSED          [ 37%]
tests/test_12_s_utils.py::test_subject_confirmation PASSED               [ 37%]
tests/test_12_s_utils.py::test_authn_context_class_ref PASSED            [ 37%]
tests/test_12_s_utils.py::test_authn_context PASSED                      [ 37%]
tests/test_12_s_utils.py::test_authn_statement PASSED                    [ 37%]
tests/test_12_s_utils.py::test_signature PASSED                          [ 38%]
tests/test_12_s_utils.py::test_complex_factory PASSED                    [ 38%]
tests/test_13_validate.py::test_duration PASSED                          [ 38%]
tests/test_13_validate.py::test_unsigned_short PASSED                    [ 38%]
tests/test_13_validate.py::test_valid_non_negative_integer PASSED        [ 38%]
tests/test_13_validate.py::test_valid_string PASSED                      [ 38%]
tests/test_13_validate.py::test_valid_anyuri PASSED                      [ 38%]
tests/test_13_validate.py::test_valid_instance PASSED                    [ 38%]
tests/test_13_validate.py::test_valid_anytype PASSED                     [ 39%]
tests/test_13_validate.py::test_valid_address PASSED                     [ 39%]
tests/test_19_attribute_converter.py::test_default PASSED                [ 39%]
tests/test_19_attribute_converter.py::TestAC::test_setup PASSED          [ 39%]
tests/test_19_attribute_converter.py::TestAC::test_ava_fro_1 PASSED      [ 39%]
tests/test_19_attribute_converter.py::TestAC::test_ava_fro_2 PASSED      [ 39%]
tests/test_19_attribute_converter.py::TestAC::test_to_attrstat_1 PASSED  [ 39%]
tests/test_19_attribute_converter.py::TestAC::test_to_attrstat_2 PASSED  [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_to_local_name PASSED  [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_to_local_name_from_unspecified PASSED [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_to_local_name_from_basic PASSED [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_to_and_for PASSED     [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_unspecified_name_format PASSED [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_mixed_attributes_1 PASSED [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_adjust_with_only_from_defined PASSED [ 40%]
tests/test_19_attribute_converter.py::TestAC::test_adjust_with_only_to_defined PASSED [ 41%]
tests/test_19_attribute_converter.py::TestAC::test_adjust_with_no_mapping_defined PASSED [ 41%]
tests/test_19_attribute_converter.py::TestAC::test_from_local_nest_eduPersonTargetedID_in_NameID PASSED [ 41%]
tests/test_19_attribute_converter.py::TestAC::test_from_local_eduPersonTargetedID_with_qualifiers PASSED [ 41%]
tests/test_19_attribute_converter.py::test_noop_attribute_conversion PASSED [ 41%]
tests/test_19_attribute_converter.py::TestSchac::test PASSED             [ 41%]
tests/test_19_attribute_converter.py::TestEIDAS::test PASSED             [ 41%]
tests/test_20_assertion.py::test_filter_on_attributes_0 PASSED           [ 41%]
tests/test_20_assertion.py::test_filter_on_attributes_1 PASSED           [ 42%]
tests/test_20_assertion.py::test_filter_on_attributes_2 PASSED           [ 42%]
tests/test_20_assertion.py::test_filter_on_attributes_without_friendly_name PASSED [ 42%]
tests/test_20_assertion.py::test_filter_on_attributes_with_missing_required_attribute PASSED [ 42%]
tests/test_20_assertion.py::test_filter_on_attributes_with_missing_optional_attribute PASSED [ 42%]
tests/test_20_assertion.py::test_filter_on_attributes_with_missing_name_format PASSED [ 42%]
tests/test_20_assertion.py::test_lifetime_1 PASSED                       [ 42%]
tests/test_20_assertion.py::test_lifetime_2 PASSED                       [ 42%]
tests/test_20_assertion.py::test_ava_filter_1 PASSED                     [ 43%]
tests/test_20_assertion.py::test_ava_filter_2 PASSED                     [ 43%]
tests/test_20_assertion.py::test_ava_filter_dont_fail PASSED             [ 43%]
tests/test_20_assertion.py::test_filter_attribute_value_assertions_0 PASSED [ 43%]
tests/test_20_assertion.py::test_filter_attribute_value_assertions_1 PASSED [ 43%]
tests/test_20_assertion.py::test_filter_attribute_value_assertions_2 PASSED [ 43%]
tests/test_20_assertion.py::test_assertion_1 PASSED                      [ 43%]
tests/test_20_assertion.py::test_assertion_2 PASSED                      [ 43%]
tests/test_20_assertion.py::test_filter_values_req_2 PASSED              [ 44%]
tests/test_20_assertion.py::test_filter_values_req_3 PASSED              [ 44%]
tests/test_20_assertion.py::test_filter_values_req_4 PASSED              [ 44%]
tests/test_20_assertion.py::test_filter_values_req_5 PASSED              [ 44%]
tests/test_20_assertion.py::test_filter_values_req_6 PASSED              [ 44%]
tests/test_20_assertion.py::test_filter_values_req_opt_0 PASSED          [ 44%]
tests/test_20_assertion.py::test_filter_values_req_opt_1 PASSED          [ 44%]
tests/test_20_assertion.py::test_filter_values_req_opt_2 PASSED          [ 44%]
tests/test_20_assertion.py::test_filter_values_req_opt_4 PASSED          [ 45%]
tests/test_20_assertion.py::test_filter_ava_0 PASSED                     [ 45%]
tests/test_20_assertion.py::test_filter_ava_1 PASSED                     [ 45%]
tests/test_20_assertion.py::test_filter_ava_2 PASSED                     [ 45%]
tests/test_20_assertion.py::test_filter_ava_3 PASSED                     [ 45%]
tests/test_20_assertion.py::test_filter_ava_4 PASSED                     [ 45%]
tests/test_20_assertion.py::test_req_opt PASSED                          [ 45%]
tests/test_20_assertion.py::test_filter_on_wire_representation_1 PASSED  [ 45%]
tests/test_20_assertion.py::test_filter_on_wire_representation_2 PASSED  [ 46%]
tests/test_20_assertion.py::test_assertion_with_noop_attribute_conv PASSED [ 46%]
tests/test_20_assertion.py::test_filter_ava_5 PASSED                     [ 46%]
tests/test_20_assertion.py::test_filter_ava_registration_authority_1 PASSED [ 46%]
tests/test_20_assertion.py::test_assertion_with_zero_attributes PASSED   [ 46%]
tests/test_20_assertion.py::test_assertion_with_authn_instant PASSED     [ 46%]
tests/test_20_assertion.py::test_attribute_producer_should_default_to_uri PASSED [ 46%]
tests/test_20_assertion.py::test_attribute_consumer_should_default_to_unspecified PASSED [ 47%]
tests/test_22_mdie.py::test_construct_contact PASSED                     [ 47%]
tests/test_30_mdstore.py::test_invalid_metadata PASSED                   [ 47%]
tests/test_30_mdstore.py::test_empty_metadata PASSED                     [ 47%]
tests/test_30_mdstore.py::test_swami_1 PASSED                            [ 47%]
tests/test_30_mdstore.py::test_incommon_1 PASSED                         [ 47%]
tests/test_30_mdstore.py::test_ext_2 PASSED                              [ 47%]
tests/test_30_mdstore.py::test_example PASSED                            [ 47%]
tests/test_30_mdstore.py::test_switch_1 PASSED                           [ 48%]
tests/test_30_mdstore.py::test_metadata_file PASSED                      [ 48%]
tests/test_30_mdstore.py::test_mdx_service PASSED                        [ 48%]
tests/test_30_mdstore.py::test_mdx_service_request_timeout PASSED        [ 48%]
tests/test_30_mdstore.py::test_mdx_single_sign_on_service PASSED         [ 48%]
tests/test_30_mdstore.py::test_mdx_metadata_freshness_period_not_expired PASSED [ 48%]
tests/test_30_mdstore.py::test_mdx_metadata_freshness_period_expired PASSED [ 48%]
tests/test_30_mdstore.py::test_load_local_dir PASSED                     [ 48%]
tests/test_30_mdstore.py::test_load_extern_incommon PASSED               [ 49%]
tests/test_30_mdstore.py::test_load_local PASSED                         [ 49%]
tests/test_30_mdstore.py::test_load_remote_encoding PASSED               [ 49%]
tests/test_30_mdstore.py::test_load_string PASSED                        [ 49%]
tests/test_30_mdstore.py::test_get_certs_from_metadata PASSED            [ 49%]
tests/test_30_mdstore.py::test_get_unnamed_certs_from_metadata PASSED    [ 49%]
tests/test_30_mdstore.py::test_get_named_certs_from_metadata PASSED      [ 49%]
tests/test_30_mdstore.py::test_get_certs_from_metadata_without_keydescriptor PASSED [ 49%]
tests/test_30_mdstore.py::test_metadata_extension_algsupport PASSED      [ 50%]
tests/test_30_mdstore.py::test_supported_algorithms PASSED               [ 50%]
tests/test_30_mdstore.py::test_registration_info PASSED                  [ 50%]
tests/test_30_mdstore.py::test_registration_info_no_policy PASSED        [ 50%]
tests/test_30_mdstore.py::test_subject_id_requirement PASSED             [ 50%]
tests/test_30_mdstore.py::test_extension PASSED                          [ 50%]
tests/test_30_mdstore.py::test_shibmd_scope_no_regex_no_descriptor_type PASSED [ 50%]
tests/test_30_mdstore.py::test_shibmd_scope_no_regex_all_descriptors PASSED [ 50%]
tests/test_30_mdstore_old.py::test_swami_1 PASSED                        [ 51%]
tests/test_30_mdstore_old.py::test_incommon_1 PASSED                     [ 51%]
tests/test_30_mdstore_old.py::test_ext_2 PASSED                          [ 51%]
tests/test_30_mdstore_old.py::test_example PASSED                        [ 51%]
tests/test_30_mdstore_old.py::test_switch_1 PASSED                       [ 51%]
tests/test_30_mdstore_old.py::test_metadata_file PASSED                  [ 51%]
tests/test_30_mdstore_old.py::test_load_local_dir PASSED                 [ 51%]
tests/test_30_mdstore_old.py::test_load_external PASSED                  [ 51%]
tests/test_30_mdstore_old.py::test_load_string PASSED                    [ 52%]
tests/test_31_config.py::test_1 PASSED                                   [ 52%]
tests/test_31_config.py::test_2 PASSED                                   [ 52%]
tests/test_31_config.py::test_minimum PASSED                             [ 52%]
tests/test_31_config.py::test_idp_1 PASSED                               [ 52%]
tests/test_31_config.py::test_idp_2 PASSED                               [ 52%]
tests/test_31_config.py::test_wayf PASSED                                [ 52%]
tests/test_31_config.py::test_conf_syslog PASSED                         [ 52%]
tests/test_31_config.py::test_3 PASSED                                   [ 53%]
tests/test_31_config.py::test_sp PASSED                                  [ 53%]
tests/test_31_config.py::test_dual PASSED                                [ 53%]
tests/test_31_config.py::test_ecp PASSED                                 [ 53%]
tests/test_31_config.py::test_assertion_consumer_service PASSED          [ 53%]
tests/test_31_config.py::test_crypto_backend PASSED                      [ 53%]
tests/test_31_config.py::test_unset_force_authn PASSED                   [ 53%]
tests/test_31_config.py::test_set_force_authn PASSED                     [ 54%]
tests/test_32_cache.py::TestClass::test_set PASSED                       [ 54%]
tests/test_32_cache.py::TestClass::test_add_ava_info PASSED              [ 54%]
tests/test_32_cache.py::TestClass::test_from_one_target_source PASSED    [ 54%]
tests/test_32_cache.py::TestClass::test_entities PASSED                  [ 54%]
tests/test_32_cache.py::TestClass::test_remove_info PASSED               [ 54%]
tests/test_32_cache.py::TestClass::test_active PASSED                    [ 54%]
tests/test_32_cache.py::TestClass::test_subjects PASSED                  [ 54%]
tests/test_32_cache.py::TestClass::test_second_subject PASSED            [ 55%]
tests/test_32_cache.py::TestClass::test_receivers PASSED                 [ 55%]
tests/test_32_cache.py::TestClass::test_timeout PASSED                   [ 55%]
tests/test_33_identifier.py::TestIdentifier::test_persistent_1 PASSED    [ 55%]
tests/test_33_identifier.py::TestIdentifier::test_persistent_2 PASSED    [ 55%]
tests/test_33_identifier.py::TestIdentifier::test_transient_1 PASSED     [ 55%]
tests/test_33_identifier.py::TestIdentifier::test_vo_1 PASSED            [ 55%]
tests/test_33_identifier.py::TestIdentifier::test_vo_2 PASSED            [ 55%]
tests/test_33_identifier.py::TestIdentifier::test_persistent_nameid PASSED [ 56%]
tests/test_33_identifier.py::TestIdentifier::test_transient_nameid PASSED [ 56%]
tests/test_34_population.py::TestPopulationMemoryBased::test_add_person PASSED [ 56%]
tests/test_34_population.py::TestPopulationMemoryBased::test_extend_person PASSED [ 56%]
tests/test_34_population.py::TestPopulationMemoryBased::test_add_another_person PASSED [ 56%]
tests/test_34_population.py::TestPopulationMemoryBased::test_modify_person PASSED [ 56%]
tests/test_36_mdbcache.py::TestMongoDBCache::test_set_get_1 PASSED       [ 56%]
tests/test_36_mdbcache.py::TestMongoDBCache::test_set_get_2 PASSED       [ 56%]
tests/test_36_mdbcache.py::TestMongoDBCache::test_remove PASSED          [ 57%]
tests/test_36_mdbcache.py::TestMongoDBCache::test_subjects PASSED        [ 57%]
tests/test_36_mdbcache.py::TestMongoDBCache::test_identity PASSED        [ 57%]
tests/test_36_mdbcache.py::TestMongoDBCache::test_remove_2 PASSED        [ 57%]
tests/test_37_entity_categories.py::test_filter_ava PASSED               [ 57%]
tests/test_37_entity_categories.py::test_filter_ava2 PASSED              [ 57%]
tests/test_37_entity_categories.py::test_filter_ava3 PASSED              [ 57%]
tests/test_37_entity_categories.py::test_filter_ava4 PASSED              [ 57%]
tests/test_37_entity_categories.py::test_filter_ava5 PASSED              [ 58%]
tests/test_37_entity_categories.py::test_idp_policy_filter PASSED        [ 58%]
tests/test_37_entity_categories.py::test_entity_category_import_from_path PASSED [ 58%]
tests/test_37_entity_categories.py::test_filter_ava_required_attributes_with_no_friendly_name PASSED [ 58%]
tests/test_37_entity_categories.py::test_filter_ava_esi_coco PASSED      [ 58%]
tests/test_37_entity_categories.py::test_filter_ava_refeds_anonymous_access SKIPPED [ 58%]
tests/test_37_entity_categories.py::test_filter_ava_refeds_pseudonymous_access SKIPPED [ 58%]
tests/test_37_entity_categories.py::test_filter_ava_refeds_personalized_access SKIPPED [ 58%]
tests/test_38_metadata_filter.py::test_swamid_sp PASSED                  [ 59%]
tests/test_38_metadata_filter.py::test_swamid_idp PASSED                 [ 59%]
tests/test_39_metadata.py::test_requested_attribute_name_format PASSED   [ 59%]
tests/test_39_metadata.py::test_signed_metadata_proper_str_bytes_handling FAILED [ 59%]
tests/test_39_metadata.py::test_cert_trailing_newlines_ignored PASSED    [ 59%]
tests/test_39_metadata.py::test_invalid_cert_raises_error PASSED         [ 59%]
tests/test_40_sigver.py::test_cert_from_instance_1 PASSED                [ 59%]
tests/test_40_sigver.py::test_cert_from_instance_ssp SKIPPED (pyasn1 is
not installed)                                                           [ 60%]
tests/test_40_sigver.py::TestSecurity::test_verify_1 PASSED              [ 60%]
tests/test_40_sigver.py::TestSecurity::test_non_verify_1 PASSED          [ 60%]
tests/test_40_sigver.py::TestSecurity::test_sign_assertion FAILED        [ 60%]
tests/test_40_sigver.py::TestSecurity::test_multiple_signatures_assertion FAILED [ 60%]
tests/test_40_sigver.py::TestSecurity::test_multiple_signatures_response FAILED [ 60%]
tests/test_40_sigver.py::TestSecurity::test_sign_response FAILED         [ 60%]
tests/test_40_sigver.py::TestSecurity::test_sign_response_2 FAILED       [ 60%]
tests/test_40_sigver.py::TestSecurity::test_sign_verify FAILED           [ 61%]
tests/test_40_sigver.py::TestSecurity::test_sign_verify_with_cert_from_instance FAILED [ 61%]
tests/test_40_sigver.py::TestSecurity::test_sign_verify_assertion_with_cert_from_instance FAILED [ 61%]
tests/test_40_sigver.py::TestSecurity::test_exception_sign_verify_with_cert_from_instance FAILED [ 61%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_verify_1 PASSED   [ 61%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_non_verify_1 PASSED [ 61%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_assertion FAILED [ 61%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_multiple_signatures_assertion FAILED [ 61%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_multiple_signatures_response FAILED [ 62%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_response FAILED [ 62%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_response_2 FAILED [ 62%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_verify FAILED [ 62%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_verify_with_cert_from_instance FAILED [ 62%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_verify_assertion_with_cert_from_instance FAILED [ 62%]
tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_exception_sign_verify_with_cert_from_instance FAILED [ 62%]
tests/test_40_sigver.py::test_xbox FAILED                                [ 62%]
tests/test_40_sigver.py::test_xbox_non_ascii_ava FAILED                  [ 63%]
tests/test_40_sigver.py::test_okta PASSED                                [ 63%]
tests/test_40_sigver.py::test_xmlsec_err PASSED                          [ 63%]
tests/test_40_sigver.py::test_xmlsec_err_non_ascii_ava PASSED            [ 63%]
tests/test_40_sigver.py::test_sha256_signing PASSED                      [ 63%]
tests/test_40_sigver.py::test_sha256_signing_non_ascii_ava PASSED        [ 63%]
tests/test_40_sigver.py::test_xmlsec_output_line_parsing PASSED          [ 63%]
tests/test_40_sigver.py::test_xmlsec_v1_3_x_output_line_parsing PASSED   [ 63%]
tests/test_40_sigver.py::test_cert_trailing_newlines_ignored PASSED      [ 64%]
tests/test_40_sigver.py::test_invalid_cert_raises_error PASSED           [ 64%]
tests/test_40_sigver.py::test_der_certificate_loading PASSED             [ 64%]
tests/test_41_response.py::TestResponse::test_1 ERROR                    [ 64%]
tests/test_41_response.py::TestResponse::test_2 ERROR                    [ 64%]
tests/test_41_response.py::TestResponse::test_issuer_none ERROR          [ 64%]
tests/test_41_response.py::TestResponse::test_false_sign ERROR           [ 64%]
tests/test_41_response.py::TestResponse::test_other_response ERROR       [ 64%]
tests/test_42_enc.py::test_pre_enc_key_format PASSED                     [ 65%]
tests/test_42_enc.py::test_pre_enc_with_pregenerated_key PASSED          [ 65%]
tests/test_42_enc.py::test_pre_enc_with_generated_key PASSED             [ 65%]
tests/test_42_enc.py::test_pre_enc_with_named_key PASSED                 [ 65%]
tests/test_42_enc.py::test_reshuffle_response PASSED                     [ 65%]
tests/test_42_enc.py::test_enc1 PASSED                                   [ 65%]
tests/test_42_enc.py::test_enc2 PASSED                                   [ 65%]
tests/test_43_soap.py::test_parse_soap_envelope PASSED                   [ 65%]
tests/test_43_soap.py::test_make_soap_envelope PASSED                    [ 66%]
tests/test_43_soap.py::test_parse_soap_enveloped_saml_thingy_xxe PASSED  [ 66%]
tests/test_43_soap.py::test_class_instances_from_soap_enveloped_saml_thingies_xxe PASSED [ 66%]
tests/test_43_soap.py::test_open_soap_envelope_xxe PASSED                [ 66%]
tests/test_44_authnresp.py::TestAuthnResponse::test_verify_1 ERROR       [ 66%]
tests/test_44_authnresp.py::TestAuthnResponse::test_verify_signed_1 ERROR [ 66%]
tests/test_44_authnresp.py::TestAuthnResponse::test_parse_2 ERROR        [ 66%]
tests/test_44_authnresp.py::TestAuthnResponse::test_verify_w_authn ERROR [ 67%]
tests/test_44_authnresp.py::TestAuthnResponse::test_unpack_nested_eptid ERROR [ 67%]
tests/test_44_authnresp.py::TestAuthnResponse::test_multiple_attribute_statement ERROR [ 67%]
tests/test_50_server.py::TestServer1::test_issuer PASSED                 [ 67%]
tests/test_50_server.py::TestServer1::test_assertion PASSED              [ 67%]
tests/test_50_server.py::TestServer1::test_response PASSED               [ 67%]
tests/test_50_server.py::TestServer1::test_parse_faulty_request PASSED   [ 67%]
tests/test_50_server.py::TestServer1::test_parse_faulty_request_to_err_status PASSED [ 67%]
tests/test_50_server.py::TestServer1::test_parse_ok_request PASSED       [ 68%]
tests/test_50_server.py::TestServer1::test_sso_response_with_identity PASSED [ 68%]
tests/test_50_server.py::TestServer1::test_sso_response_without_identity PASSED [ 68%]
tests/test_50_server.py::TestServer1::test_sso_response_specific_instant PASSED [ 68%]
tests/test_50_server.py::TestServer1::test_sso_failure_response PASSED   [ 68%]
tests/test_50_server.py::TestServer1::test_authn_response_0 PASSED       [ 68%]
tests/test_50_server.py::TestServer1::test_signed_response FAILED        [ 68%]
tests/test_50_server.py::TestServer1::test_signed_response_1 FAILED      [ 68%]
tests/test_50_server.py::TestServer1::test_signed_response_2 FAILED      [ 69%]
tests/test_50_server.py::TestServer1::test_signed_response_3 FAILED      [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_signed_response_1 FAILED [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_signed_response_2 FAILED [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_signed_response_3 FAILED [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_signed_response_4 FAILED [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_response_1 PASSED   [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_response_2 PASSED   [ 69%]
tests/test_50_server.py::TestServer1::test_encrypted_response_3 PASSED   [ 70%]
tests/test_50_server.py::TestServer1::test_encrypted_response_4 PASSED   [ 70%]
tests/test_50_server.py::TestServer1::test_encrypted_response_5 PASSED   [ 70%]
tests/test_50_server.py::TestServer1::test_encrypted_response_6 FAILED   [ 70%]
tests/test_50_server.py::TestServer1::test_encrypted_response_7 PASSED   [ 70%]
tests/test_50_server.py::TestServer1::test_encrypted_response_8 PASSED   [ 70%]
tests/test_50_server.py::TestServer1::test_encrypted_response_9 PASSED   [ 70%]
tests/test_50_server.py::TestServer1::test_slo_http_post PASSED          [ 70%]
tests/test_50_server.py::TestServer1::test_slo_soap PASSED               [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_issuer PASSED      [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_assertion PASSED   [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_response PASSED    [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_parse_faulty_request PASSED [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_parse_faulty_request_to_err_status PASSED [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_parse_ok_request PASSED [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_sso_response_with_identity PASSED [ 71%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_sso_response_without_identity PASSED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_sso_response_specific_instant PASSED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_sso_failure_response PASSED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_authn_response_0 PASSED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response FAILED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response_1 FAILED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response_2 FAILED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response_3 FAILED [ 72%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_1 FAILED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_2 FAILED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_3 FAILED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_4 FAILED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_1 PASSED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_2 PASSED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_3 PASSED [ 73%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_4 PASSED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_5 PASSED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_6 FAILED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_7 PASSED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_8 PASSED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_9 PASSED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_slo_http_post PASSED [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_slo_soap PASSED    [ 74%]
tests/test_50_server.py::TestServer1NonAsciiAva::test_slo_soap_signed PASSED [ 75%]
tests/test_50_server.py::TestServer2::test_do_attribute_reponse PASSED   [ 75%]
tests/test_50_server.py::TestServerLogout::test_1 PASSED                 [ 75%]
tests/test_50_server.py::TestServerLogout::test_2 PASSED                 [ 75%]
tests/test_51_client.py::TestClient::test_create_attribute_query1 PASSED [ 75%]
tests/test_51_client.py::TestClient::test_create_attribute_query2 PASSED [ 75%]
tests/test_51_client.py::TestClient::test_create_attribute_query_3 PASSED [ 75%]
tests/test_51_client.py::TestClient::test_create_auth_request_0 PASSED   [ 75%]
tests/test_51_client.py::TestClient::test_create_auth_request_requested_attributes PASSED [ 76%]
tests/test_51_client.py::TestClient::test_create_auth_request_unset_force_authn_by_default PASSED [ 76%]
tests/test_51_client.py::TestClient::test_create_auth_request_set_force_authn_not_true_or_1 PASSED [ 76%]
tests/test_51_client.py::TestClient::test_create_auth_request_set_force_authn_true PASSED [ 76%]
tests/test_51_client.py::TestClient::test_create_auth_request_set_force_authn_1 PASSED [ 76%]
tests/test_51_client.py::TestClient::test_create_auth_request_nameid_policy_allow_create PASSED [ 76%]
tests/test_51_client.py::TestClient::test_create_auth_request_vo PASSED  [ 76%]
tests/test_51_client.py::TestClient::test_sign_auth_request_0 FAILED     [ 76%]
tests/test_51_client.py::TestClient::test_logout_response FAILED         [ 77%]
tests/test_51_client.py::TestClient::test_create_logout_request PASSED   [ 77%]
tests/test_51_client.py::TestClient::test_response_1 FAILED              [ 77%]
tests/test_51_client.py::TestClient::test_response_2 FAILED              [ 77%]
tests/test_51_client.py::TestClient::test_response_3 FAILED              [ 77%]
tests/test_51_client.py::TestClient::test_response_4 FAILED              [ 77%]
tests/test_51_client.py::TestClient::test_response_5 FAILED              [ 77%]
tests/test_51_client.py::TestClient::test_response_6 FAILED              [ 77%]
tests/test_51_client.py::TestClient::test_response_7 FAILED              [ 78%]
tests/test_51_client.py::TestClient::test_response_8 FAILED              [ 78%]
tests/test_51_client.py::TestClient::test_response_no_name_id PASSED     [ 78%]
tests/test_51_client.py::TestClient::test_init_values PASSED             [ 78%]
tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion FAILED [ 78%]
tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion2 FAILED [ 78%]
tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion_advice_1 FAILED [ 78%]
tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion_advice_2 FAILED [ 78%]
tests/test_51_client.py::TestClient::test_signed_with_default_algo_redirect FAILED [ 79%]
tests/test_51_client.py::TestClient::test_signed_redirect PASSED         [ 79%]
tests/test_51_client.py::TestClient::test_signed_redirect_passes_if_needs_signed_requests PASSED [ 79%]
tests/test_51_client.py::TestClient::test_signed_redirect_fail_if_needs_signed_request_but_received_unsigned PASSED [ 79%]
tests/test_51_client.py::TestClient::test_signed_redirect_fail_if_needs_signed_request_but_sigalg_not_matches PASSED [ 79%]
tests/test_51_client.py::TestClient::test_do_logout_signed_redirect FAILED [ 79%]
tests/test_51_client.py::TestClient::test_do_logout_signed_redirect_invalid FAILED [ 79%]
tests/test_51_client.py::TestClient::test_do_logout_post FAILED          [ 80%]
tests/test_51_client.py::TestClient::test_do_logout_redirect_no_cache PASSED [ 80%]
tests/test_51_client.py::TestClient::test_do_logout_session_expired FAILED [ 80%]
tests/test_51_client.py::TestClient::test_signature_wants FAILED         [ 80%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_attribute_query1 PASSED [ 80%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_attribute_query2 PASSED [ 80%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_attribute_query_3 PASSED [ 80%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_auth_request_0 PASSED [ 80%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_auth_request_unset_force_authn PASSED [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_auth_request_set_force_authn PASSED [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_auth_request_nameid_policy_allow_create PASSED [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_auth_request_vo PASSED [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_sign_auth_request_0 FAILED [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_create_logout_request PASSED [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_1 FAILED   [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_2 FAILED   [ 81%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_3 FAILED   [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_4 FAILED   [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_5 FAILED   [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_6 FAILED   [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_7 FAILED   [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_8 FAILED   [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_no_name_id PASSED [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_error_status PASSED [ 82%]
tests/test_51_client.py::TestClientNonAsciiAva::test_response_error_status_non_standard_status_code PASSED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_init_values PASSED  [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion FAILED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion2 FAILED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion_advice_1 FAILED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion_advice_2 FAILED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_signed_redirect PASSED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_do_logout_signed_redirect FAILED [ 83%]
tests/test_51_client.py::TestClientNonAsciiAva::test_do_logout_post FAILED [ 84%]
tests/test_51_client.py::TestClientNonAsciiAva::test_do_logout_session_expired FAILED [ 84%]
tests/test_51_client.py::TestClientWithDummy::test_do_authn PASSED       [ 84%]
tests/test_51_client.py::TestClientWithDummy::test_do_negotiated_authn PASSED [ 84%]
tests/test_51_client.py::TestClientWithDummy::test_do_attribute_query PASSED [ 84%]
tests/test_51_client.py::TestClientWithDummy::test_logout_1 PASSED       [ 84%]
tests/test_51_client.py::TestClientWithDummy::test_post_sso PASSED       [ 84%]
tests/test_51_client.py::TestClientWithDummy::test_negotiated_post_sso PASSED [ 84%]
tests/test_51_client.py::TestClientNoConfigContext::test_logout_1 PASSED [ 85%]
tests/test_51_client.py::test_parse_soap_enveloped_saml_xxe PASSED       [ 85%]
tests/test_52_default_sign_alg.py::TestSignedResponse::test_signed_response FAILED [ 85%]
tests/test_52_default_sign_alg.py::TestSignedResponse::test_signed_response_1 FAILED [ 85%]
tests/test_52_default_sign_alg.py::TestSignedResponse::test_signed_response_2 PASSED [ 85%]
tests/test_60_sp.py::TestSP::test_setup SKIPPED (s2repoze dependencies
not installed)                                                           [ 85%]
tests/test_60_sp.py::TestSP::test_identify SKIPPED (s2repoze
dependencies not installed)                                              [ 85%]
tests/test_62_vo.py::TestVirtualOrg::test_mta PASSED                     [ 85%]
tests/test_62_vo.py::TestVirtualOrg::test_unknown_subject PASSED         [ 86%]
tests/test_62_vo.py::TestVirtualOrg::test_id PASSED                      [ 86%]
tests/test_62_vo.py::TestVirtualOrg::test_id_unknown PASSED              [ 86%]
tests/test_62_vo.py::TestVirtualOrg_2::test_mta PASSED                   [ 86%]
tests/test_62_vo.py::TestVirtualOrg_2::test_unknown_subject PASSED       [ 86%]
tests/test_62_vo.py::TestVirtualOrg_2::test_id PASSED                    [ 86%]
tests/test_62_vo.py::TestVirtualOrg_2::test_id_unknown PASSED            [ 86%]
tests/test_63_ecp.py::test_complete_flow PASSED                          [ 87%]
tests/test_64_artifact.py::test_create_artifact PASSED                   [ 87%]
tests/test_64_artifact.py::test_create_artifact_resolve PASSED           [ 87%]
tests/test_64_artifact.py::test_artifact_flow PASSED                     [ 87%]
tests/test_65_authn_query.py::test_basic PASSED                          [ 87%]
tests/test_65_authn_query.py::test_flow PASSED                           [ 87%]
tests/test_66_name_id_mapping.py::test_base_request PASSED               [ 87%]
tests/test_66_name_id_mapping.py::test_request_response PASSED           [ 87%]
tests/test_67_manage_name_id.py::test_basic PASSED                       [ 88%]
tests/test_67_manage_name_id.py::test_flow PASSED                        [ 88%]
tests/test_68_assertion_id.py::test_basic_flow PASSED                    [ 88%]
tests/test_69_discovery.py::test_verify PASSED                           [ 88%]
tests/test_69_discovery.py::test_construct_0 PASSED                      [ 88%]
tests/test_69_discovery.py::test_construct_1 PASSED                      [ 88%]
tests/test_69_discovery.py::test_construct_deconstruct_request PASSED    [ 88%]
tests/test_69_discovery.py::test_construct_deconstruct_response PASSED   [ 88%]
tests/test_70_redirect_signing.py::test FAILED                           [ 89%]
tests/test_71_authn_request.py::test_authn_request_with_acs_by_index PASSED [ 89%]
tests/test_72_eptid.py::test_eptid PASSED                                [ 89%]
tests/test_72_eptid.py::test_eptid_shelve PASSED                         [ 89%]
tests/test_75_mongodb.py::test_flow PASSED                               [ 89%]
tests/test_75_mongodb.py::test_eptid_mongo_db PASSED                     [ 89%]
tests/test_76_metadata_in_mdb.py::test_metadata PASSED                   [ 89%]
tests/test_77_authn_context.py::test_passwd PASSED                       [ 89%]
tests/test_77_authn_context.py::test_factory PASSED                      [ 90%]
tests/test_77_authn_context.py::test_authn_decl_in_authn_context PASSED  [ 90%]
tests/test_77_authn_context.py::test_authn_1 PASSED                      [ 90%]
tests/test_77_authn_context.py::test_authn_2 PASSED                      [ 90%]
tests/test_77_authn_context.py::test_authn_3 PASSED                      [ 90%]
tests/test_81_certificates.py::TestGenerateCertificates::test_validate_cert_chains FAILED [ 90%]
tests/test_81_certificates.py::TestGenerateCertificates::test_validate_expire PASSED [ 90%]
tests/test_81_certificates.py::TestGenerateCertificates::test_validate_passphrase PASSED [ 90%]
tests/test_81_certificates.py::TestGenerateCertificates::test_validate_with_root_cert FAILED [ 91%]
tests/test_83_md_extensions.py::TestMDExt::test_sp_type_true PASSED      [ 91%]
tests/test_83_md_extensions.py::TestMDExt::test_sp_type_false PASSED     [ 91%]
tests/test_83_md_extensions.py::TestMDExt::test_entity_attributes PASSED [ 91%]
tests/test_88_nsprefix.py::test_nsprefix PASSED                          [ 91%]
tests/test_88_nsprefix.py::test_nsprefix2 PASSED                         [ 91%]
tests/test_89_http_post_relay_state.py::test_relay_state PASSED          [ 91%]
tests/test_92_aes.py::TestAES::test_aes_defaults PASSED                  [ 91%]
tests/test_92_aes.py::TestAES::test_aes_128_cbc PASSED                   [ 92%]
tests/test_92_aes.py::TestAES::test_aes_128_cfb PASSED                   [ 92%]
tests/test_92_aes.py::TestAES::test_aes_192_cbc PASSED                   [ 92%]
tests/test_92_aes.py::TestAES::test_aes_192_cfb PASSED                   [ 92%]
tests/test_92_aes.py::TestAES::test_aes_256_cbc PASSED                   [ 92%]
tests/test_92_aes.py::TestAES::test_aes_256_cfb PASSED                   [ 92%]
tests/test_93_hok.py::TestHolderOfKeyResponse::test_valid_hok_response_is_parsed PASSED [ 92%]
tests/test_93_hok.py::TestHolderOfKeyResponse::test_invalid_hok_response_fails_verification PASSED [ 92%]
tests/test_94_read_cert.py::test_read_single_cert PASSED                 [ 93%]
tests/test_94_read_cert.py::test_read_cert_chain PASSED                  [ 93%]
tests/test_94_read_cert.py::test_read_cert_chain_with_linebreaks PASSED  [ 93%]
tests/test_schema_validator.py::test_invalid_saml_metadata_doc[invalid_metadata_file.xml] PASSED [ 93%]
tests/test_schema_validator.py::test_invalid_saml_metadata_doc[empty_metadata_file.xml] PASSED [ 93%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[InCommon-metadata.xml] PASSED [ 93%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp.xml] PASSED [ 93%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_2.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_aa.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_all.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_example.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_soap.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[entity_cat_re.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[entity_cat_re_nren.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[entity_cat_rs.xml] PASSED [ 94%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[entity_cat_sfs_hei.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[entity_esi_and_coco_sp.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[entity_no_friendly_name_sp.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[extended.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_slo_redirect.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[idp_uiinfo.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata.aaitest.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata.xml] PASSED [ 95%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata_cert.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata_example.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata_sp_1.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata_sp_1_no_encryption.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metadata_sp_2.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[metasp.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[pdp_meta.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[servera.xml] PASSED [ 96%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[sp.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[sp_slo_redirect.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[urn-mace-swami.se-swamid-test-1.0-metadata.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[uu.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_metadata_doc[vo_metadata.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_response_doc[attribute_response.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_response_doc[okta_response.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_response_doc[simplesamlphp_authnresponse.xml] PASSED [ 97%]
tests/test_schema_validator.py::test_valid_saml_response_doc[saml2_response.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_saml_response_doc[saml_false_signed.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_saml_response_doc[saml_hok.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_saml_response_doc[saml_hok_invalid.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_saml_response_doc[saml_signed.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_saml_response_doc[saml_unsigned.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_saml_partial_doc[encrypted_attribute_statement.xml] PASSED [ 98%]
tests/test_schema_validator.py::test_valid_eidas_saml_response_doc[eidas_response.xml] PASSED [ 98%]
tests/test_xmlsec1_key_data.py::TestAuthnResponse::test_signed_response_with_hmac_should_fail PASSED [ 99%]
tests/test_xmlsec1_key_data.py::TestAuthnResponse::test_signed_assertion_with_hmac_should_fail PASSED [ 99%]
tests/test_xmlsec1_key_data.py::TestAuthnResponse::test_signed_assertion_with_random_embedded_cert_should_be_ignored FAILED [ 99%]
tests/test_xsw.py::TestXSW::test_signed_xsw_assertion_wrapper_should_fail PASSED [ 99%]
tests/test_xsw.py::TestXSW::test_signed_xsw_assertion_extensions_should_fail PASSED [ 99%]
tests/test_xsw.py::TestXSW::test_signed_xsw_assertion_assertion_should_fail PASSED [ 99%]
tests/test_xsw.py::TestInvalidDepthFirstSig::test_signed_assertion_first_sig_should_fail PASSED [ 99%]
tests/test_xsw.py::TestInvalidDepthFirstSig::test_signed_response_first_sig_should_fail PASSED [100%]
==================================== ERRORS ====================================
____________________ ERROR at setup of TestResponse.test_1 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqczslhql.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqczslhql.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_41_response.TestResponse'>
    def setup_class(self):
        with closing(Server("idp_conf")) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
                sign_assertion=True,
            )
tests/test_41_response.py:53: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log setup ------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpqczslhql.xml"
output=
____________________ ERROR at setup of TestResponse.test_2 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqczslhql.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqczslhql.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_41_response.TestResponse'>
    def setup_class(self):
        with closing(Server("idp_conf")) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
                sign_assertion=True,
            )
tests/test_41_response.py:53: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
_______________ ERROR at setup of TestResponse.test_issuer_none ________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqczslhql.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqczslhql.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_41_response.TestResponse'>
    def setup_class(self):
        with closing(Server("idp_conf")) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
                sign_assertion=True,
            )
tests/test_41_response.py:53: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
________________ ERROR at setup of TestResponse.test_false_sign ________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqczslhql.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqczslhql.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_41_response.TestResponse'>
    def setup_class(self):
        with closing(Server("idp_conf")) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
                sign_assertion=True,
            )
tests/test_41_response.py:53: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
______________ ERROR at setup of TestResponse.test_other_response ______________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqczslhql.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqczslhql.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_41_response.TestResponse'>
    def setup_class(self):
        with closing(Server("idp_conf")) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                in_response_to="id12",
                destination="http://lingon.catalogix.se:8087/",
                sp_entity_id="urn:mace:example.com:saml:roland:sp",
                name_id=name_id,
                sign_assertion=True,
            )
tests/test_41_response.py:53: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa3b0dc70>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-qoitXH65Pg6JtV63x" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:40Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7oNuXh947nGzsezY3" IssueInstant="2025-04-21T14:10:40Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7oNuXh947nGzsezY3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">1bdb05b26e9d4d0254f8c54b4c6140036d8024a2e740dc32fee7ad3d6226874a</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:40Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:40Z" NotOnOrAfter="2025-04-21T14:15:40Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7oNuXh947nGzsezY3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
______________ ERROR at setup of TestAuthnResponse.test_verify_1 _______________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp7aelbbbm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_44_authnresp.TestAuthnResponse'>
    def setup_class(self):
        with closing(Server(dotname("idp_conf"))) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                authn=AUTHN,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                sign_assertion=True,
                authn=AUTHN,
            )
tests/test_44_authnresp.py:48: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log setup ------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
output=
___________ ERROR at setup of TestAuthnResponse.test_verify_signed_1 ___________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp7aelbbbm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_44_authnresp.TestAuthnResponse'>
    def setup_class(self):
        with closing(Server(dotname("idp_conf"))) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                authn=AUTHN,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                sign_assertion=True,
                authn=AUTHN,
            )
tests/test_44_authnresp.py:48: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
_______________ ERROR at setup of TestAuthnResponse.test_parse_2 _______________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp7aelbbbm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_44_authnresp.TestAuthnResponse'>
    def setup_class(self):
        with closing(Server(dotname("idp_conf"))) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                authn=AUTHN,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                sign_assertion=True,
                authn=AUTHN,
            )
tests/test_44_authnresp.py:48: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
___________ ERROR at setup of TestAuthnResponse.test_verify_w_authn ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp7aelbbbm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_44_authnresp.TestAuthnResponse'>
    def setup_class(self):
        with closing(Server(dotname("idp_conf"))) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                authn=AUTHN,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                sign_assertion=True,
                authn=AUTHN,
            )
tests/test_44_authnresp.py:48: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
_________ ERROR at setup of TestAuthnResponse.test_unpack_nested_eptid _________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp7aelbbbm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_44_authnresp.TestAuthnResponse'>
    def setup_class(self):
        with closing(Server(dotname("idp_conf"))) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                authn=AUTHN,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                sign_assertion=True,
                authn=AUTHN,
            )
tests/test_44_authnresp.py:48: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
____ ERROR at setup of TestAuthnResponse.test_multiple_attribute_statement _____
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp7aelbbbm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp7aelbbbm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <class 'test_44_authnresp.TestAuthnResponse'>
    def setup_class(self):
        with closing(Server(dotname("idp_conf"))) as server:
            name_id = server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
    
            self._resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                authn=AUTHN,
            )
    
>           self._sign_resp_ = server.create_authn_response(
                IDENTITY,
                "id12",  # in_response_to
                "http://lingon.catalogix.se:8087/",  # consumer_url
                "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
                name_id=name_id,
                sign_assertion=True,
                authn=AUTHN,
            )
tests/test_44_authnresp.py:48: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5be9d90>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-tVLYXaK6KFRGbopFo" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-mKsbO4xzoBv6YP3hA" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-mKsbO4xzoBv6YP3hA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b6bc76b174ff794b6ec9f679d925a0d27c7827089686383a050793faded526e8</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:41Z" SessionIndex="id-xDcVp6qwKd3NWesSQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAffiliation"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">staff</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">member</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">foo@gmail.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">shortstop</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-mKsbO4xzoBv6YP3hA'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
=================================== FAILURES ===================================
________________ test_signed_metadata_proper_str_bytes_handling ________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5753170>
statement = '<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:ns2="urn:oasis:names:tc:SAML:metadata:algsupport" entityID="urn:mace:umu.se:saml:roland:sp" ID="id-iLkQZ2MzRKXDu9Mjg"><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-iLkQZ2MzRKXDu9Mjg"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIIDgTCCAmmgAwIBAgIJAJRJzvdpkmNaMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMRUwEwYDVQQKDAxJbkNvbW1vbiBMTEMxMTAvBgNVBAMMKEluQ29tbW9uIEZlZGVyYXRpb24gTWV0YWRhdGEgU2lnbmluZyBLZXkwHhcNMTMxMjE2MTkzNDU1WhcNMzcxMjE4MTkzNDU1WjBXMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMSW5Db21tb24gTExDMTEwLwYDVQQDDChJbkNvbW1vbiBGZWRlcmF0aW9uIE1ldGFkYXRhIFNpZ25pbmcgS2V5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Chdkrn+dG5Zj5L3UIw+xeWgNzm8ajw7/FyqRQ1SjD4Lfg2WCdlfjOrYGNnVZMCTfItoXTSpg4rXxHQsykeNiYRu2+02uMS+1pnBqWjzdPJE0od+q8EbdvE6ShimjyNn0yQfGyQKCNdYuc+75MIHsaIOAEtDZUST9Sd4oeU1zRjV2sGvUd+JFHveUAhRc0b+JEZfIEuq/LIU9qxm/+gFaawlmojZPyOWZ1JlswbrrJYYyn10qgnJvjh9gZWXKjmPxqvHKJcATPhAh2gWGabWTXBJCckMe1hrHCl/vbDLCmz0/oYuoaSDzP6zE9YSA/xCplaHA0moC1Vs2H5MOQGlewIDAQABo1AwTjAdBgNVHQ4EFgQU5ij9YLU5zQ6K75kPgVpyQ2N/lPswHwYDVR0jBBgwFoAU5ij9YLU5zQ6K75kPgVpyQ2N/lPswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAaQkEx9xvaLUt0PNLvHMtxXQPedCPw5xQBd2VWOsWPYspRAOSNbU1VloY+xUkUKorYTogKUY1q+uh2gDIEazW0uZZaQvWPp8xdxWqDh96n5US06lszEc+Lj3dqdxWkXRRqEbjhBFh/utXaeyeSOtaX65GwD5svDHnJBclAGkzeRIXqxmYG+I2zMm/JYGzEnbwToyC7yF6Q8cQxOr37hEpqz+WN/x3qM2qyBLECQFjmlJrvRLkSL15PCZiu+xFNFd/zx6btDun5DBlfDS9DG+SHCNH6Nq+NfP+ZQ8CGzP/3TaZPzMlKPDCjp0XOQfyQqFIXdwjPFTWjEusDBlm4qJAlQ==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><ns0:Extensions><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#ripemd160" /><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512" /><ns2:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" /><ns2:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160" /><ns2:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" /></ns0:Extensions><ns0:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true"><ns0:KeyDescriptor use="signing"><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIIDgTCCAmmgAwIBAgIJAJRJzvdpkmNaMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMRUwEwYDVQQKDAxJbkNvbW1vbiBMTEMxMTAvBgNVBAMMKEluQ29tbW9uIEZlZGVyYXRpb24gTWV0YWRhdGEgU2lnbmluZyBLZXkwHhcNMTMxMjE2MTkzNDU1WhcNMzcxMjE4MTkzNDU1WjBXMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMSW5Db21tb24gTExDMTEwLwYDVQQDDChJbkNvbW1vbiBGZWRlcmF0aW9uIE1ldGFkYXRhIFNpZ25pbmcgS2V5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Chdkrn+dG5Zj5L3UIw+xeWgNzm8ajw7/FyqRQ1SjD4Lfg2WCdlfjOrYGNnVZMCTfItoXTSpg4rXxHQsykeNiYRu2+02uMS+1pnBqWjzdPJE0od+q8EbdvE6ShimjyNn0yQfGyQKCNdYuc+75MIHsaIOAEtDZUST9Sd4oeU1zRjV2sGvUd+JFHveUAhRc0b+JEZfIEuq/LIU9qxm/+gFaawlmojZPyOWZ1JlswbrrJYYyn10qgnJvjh9gZWXKjmPxqvHKJcATPhAh2gWGabWTXBJCckMe1hrHCl/vbDLCmz0/oYuoaSDzP6zE9YSA/xCplaHA0moC1Vs2H5MOQGlewIDAQABo1AwTjAdBgNVHQ4EFgQU5ij9YLU5zQ6K75kPgVpyQ2N/lPswHwYDVR0jBBgwFoAU5ij9YLU5zQ6K75kPgVpyQ2N/lPswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAaQkEx9xvaLUt0PNLvHMtxXQPedCPw5xQBd2VWOsWPYspRAOSNbU1VloY+xUkUKorYTogKUY1q+uh2gDIEazW0uZZaQvWPp8xdxWqDh96n5US06lszEc+Lj3dqdxWkXRRqEbjhBFh/utXaeyeSOtaX65GwD5svDHnJBclAGkzeRIXqxmYG+I2zMm/JYGzEnbwToyC7yF6Q8cQxOr37hEpqz+WN/x3qM2qyBLECQFjmlJrvRLkSL15PCZiu+xFNFd/zx6btDun5DBlfDS9DG+SHCNH6Nq+NfP+ZQ8CGzP/3TaZPzMlKPDCjp0XOQfyQqFIXdwjPFTWjEusDBlm4qJAlQ==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns0:KeyDescriptor><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/" index="1" /><ns0:AttributeConsumingService index="1"><ns0:ServiceName xml:lang="en">Rolands SP</ns0:ServiceName><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="surName" isRequired="true" /><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:givenName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="givenName" isRequired="true" /><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="mail" isRequired="true" /><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:title" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="title" isRequired="false" /></ns0:AttributeConsumingService></ns0:SPSSODescriptor></ns0:EntityDescriptor>'
node_name = 'urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = None
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5753170>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor', ...]
extra_args = ['/tmp/tmp38nmsy_n.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; issuer=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; issuer=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp38nmsy_n.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
    def test_signed_metadata_proper_str_bytes_handling():
        sp_conf_2 = sp_conf.copy()
        sp_conf_2["key_file"] = full_path("test.key")
        sp_conf_2["cert_file"] = full_path("inc-md-cert.pem")
        # requires xmlsec binaries per https://pysaml2.readthedocs.io/en/latest/examples/sp.html
        sp_conf_2["xmlsec_binary"] = sigver.get_xmlsec_binary(["/opt/local/bin"])
        cnf = SPConfig().load(sp_conf_2)
    
        # This will raise TypeError if string/bytes handling is not correct
>       sp_metadata = create_metadata_string("", config=cnf, sign=True)
tests/test_39_metadata.py:66: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/metadata.py:118: in create_metadata_string
    eid, xmldoc = sign_entity_descriptor(eid, mid, secc, sign_alg, digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/metadata.py:851: in sign_entity_descriptor
    xmldoc = secc.sign_statement(f"{edesc}", class_name(edesc))
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5753170>
statement = '<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:ns2="urn:oasis:names:tc:SAML:metadata:algsupport" entityID="urn:mace:umu.se:saml:roland:sp" ID="id-iLkQZ2MzRKXDu9Mjg"><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-iLkQZ2MzRKXDu9Mjg"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIIDgTCCAmmgAwIBAgIJAJRJzvdpkmNaMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMRUwEwYDVQQKDAxJbkNvbW1vbiBMTEMxMTAvBgNVBAMMKEluQ29tbW9uIEZlZGVyYXRpb24gTWV0YWRhdGEgU2lnbmluZyBLZXkwHhcNMTMxMjE2MTkzNDU1WhcNMzcxMjE4MTkzNDU1WjBXMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMSW5Db21tb24gTExDMTEwLwYDVQQDDChJbkNvbW1vbiBGZWRlcmF0aW9uIE1ldGFkYXRhIFNpZ25pbmcgS2V5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Chdkrn+dG5Zj5L3UIw+xeWgNzm8ajw7/FyqRQ1SjD4Lfg2WCdlfjOrYGNnVZMCTfItoXTSpg4rXxHQsykeNiYRu2+02uMS+1pnBqWjzdPJE0od+q8EbdvE6ShimjyNn0yQfGyQKCNdYuc+75MIHsaIOAEtDZUST9Sd4oeU1zRjV2sGvUd+JFHveUAhRc0b+JEZfIEuq/LIU9qxm/+gFaawlmojZPyOWZ1JlswbrrJYYyn10qgnJvjh9gZWXKjmPxqvHKJcATPhAh2gWGabWTXBJCckMe1hrHCl/vbDLCmz0/oYuoaSDzP6zE9YSA/xCplaHA0moC1Vs2H5MOQGlewIDAQABo1AwTjAdBgNVHQ4EFgQU5ij9YLU5zQ6K75kPgVpyQ2N/lPswHwYDVR0jBBgwFoAU5ij9YLU5zQ6K75kPgVpyQ2N/lPswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAaQkEx9xvaLUt0PNLvHMtxXQPedCPw5xQBd2VWOsWPYspRAOSNbU1VloY+xUkUKorYTogKUY1q+uh2gDIEazW0uZZaQvWPp8xdxWqDh96n5US06lszEc+Lj3dqdxWkXRRqEbjhBFh/utXaeyeSOtaX65GwD5svDHnJBclAGkzeRIXqxmYG+I2zMm/JYGzEnbwToyC7yF6Q8cQxOr37hEpqz+WN/x3qM2qyBLECQFjmlJrvRLkSL15PCZiu+xFNFd/zx6btDun5DBlfDS9DG+SHCNH6Nq+NfP+ZQ8CGzP/3TaZPzMlKPDCjp0XOQfyQqFIXdwjPFTWjEusDBlm4qJAlQ==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><ns0:Extensions><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#ripemd160" /><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384" /><ns2:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512" /><ns2:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" /><ns2:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160" /><ns2:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha224" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" /><ns2:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" /></ns0:Extensions><ns0:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true"><ns0:KeyDescriptor use="signing"><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIIDgTCCAmmgAwIBAgIJAJRJzvdpkmNaMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMRUwEwYDVQQKDAxJbkNvbW1vbiBMTEMxMTAvBgNVBAMMKEluQ29tbW9uIEZlZGVyYXRpb24gTWV0YWRhdGEgU2lnbmluZyBLZXkwHhcNMTMxMjE2MTkzNDU1WhcNMzcxMjE4MTkzNDU1WjBXMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMSW5Db21tb24gTExDMTEwLwYDVQQDDChJbkNvbW1vbiBGZWRlcmF0aW9uIE1ldGFkYXRhIFNpZ25pbmcgS2V5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Chdkrn+dG5Zj5L3UIw+xeWgNzm8ajw7/FyqRQ1SjD4Lfg2WCdlfjOrYGNnVZMCTfItoXTSpg4rXxHQsykeNiYRu2+02uMS+1pnBqWjzdPJE0od+q8EbdvE6ShimjyNn0yQfGyQKCNdYuc+75MIHsaIOAEtDZUST9Sd4oeU1zRjV2sGvUd+JFHveUAhRc0b+JEZfIEuq/LIU9qxm/+gFaawlmojZPyOWZ1JlswbrrJYYyn10qgnJvjh9gZWXKjmPxqvHKJcATPhAh2gWGabWTXBJCckMe1hrHCl/vbDLCmz0/oYuoaSDzP6zE9YSA/xCplaHA0moC1Vs2H5MOQGlewIDAQABo1AwTjAdBgNVHQ4EFgQU5ij9YLU5zQ6K75kPgVpyQ2N/lPswHwYDVR0jBBgwFoAU5ij9YLU5zQ6K75kPgVpyQ2N/lPswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAaQkEx9xvaLUt0PNLvHMtxXQPedCPw5xQBd2VWOsWPYspRAOSNbU1VloY+xUkUKorYTogKUY1q+uh2gDIEazW0uZZaQvWPp8xdxWqDh96n5US06lszEc+Lj3dqdxWkXRRqEbjhBFh/utXaeyeSOtaX65GwD5svDHnJBclAGkzeRIXqxmYG+I2zMm/JYGzEnbwToyC7yF6Q8cQxOr37hEpqz+WN/x3qM2qyBLECQFjmlJrvRLkSL15PCZiu+xFNFd/zx6btDun5DBlfDS9DG+SHCNH6Nq+NfP+ZQ8CGzP/3TaZPzMlKPDCjp0XOQfyQqFIXdwjPFTWjEusDBlm4qJAlQ==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns0:KeyDescriptor><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/" index="1" /><ns0:AttributeConsumingService index="1"><ns0:ServiceName xml:lang="en">Rolands SP</ns0:ServiceName><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="surName" isRequired="true" /><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:givenName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="givenName" isRequired="true" /><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="mail" isRequired="true" /><ns0:RequestedAttribute Name="urn:mace:dir:attribute-def:title" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="title" isRequired="false" /></ns0:AttributeConsumingService></ns0:SPSSODescriptor></ns0:EntityDescriptor>'
node_name = 'urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = None
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor', '--output', '/tmp/tmpx3roizbu.xml', '/tmp/tmp38nmsy_n.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; issuer=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; issuer=/C=US/O=InCommon LLC/CN=InCommon Federation Metadata Signing Key; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp38nmsy_n.xml"
output=
_______________________ TestSecurity.test_sign_assertion _______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmptus3uzrh.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmptus3uzrh.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa641d940>
    def test_sign_assertion(self):
        ass = self._assertion
        print(ass)
>       sign_ass = self.sec.sign_assertion(f"{ass}", node_id=ass.id)
tests/test_40_sigver.py:186: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1710: in sign_assertion
    return self.sign_statement(statement, class_name(saml.Assertion()), **kwargs)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpodsr56n3.xml', '/tmp/tmptus3uzrh.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
----------------------------- Captured stdout call -----------------------------
<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmptus3uzrh.xml"
output=
_______________ TestSecurity.test_multiple_signatures_assertion ________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp8hdrzc0j.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp8hdrzc0j.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa641d6e0>
    def test_multiple_signatures_assertion(self):
        ass = self._assertion
        # basic test with two of the same
        to_sign = [(ass, ass.id), (ass, ass.id)]
>       sign_ass = self.sec.multiple_signatures(str(ass), to_sign)
tests/test_40_sigver.py:205: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1751: in multiple_signatures
    statement = self.sign_statement(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpajdbvogl.xml', '/tmp/tmp8hdrzc0j.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp8hdrzc0j.xml"
output=
________________ TestSecurity.test_multiple_signatures_response ________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp3cm4cb2t.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp3cm4cb2t.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa51c67b0>
    def test_multiple_signatures_response(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        # order is important, we can't validate if the signatures are made
        # in the reverse order
        to_sign = [(self._assertion, self._assertion.id), (response, response.id)]
>       s_response = self.sec.multiple_signatures(str(response), to_sign)
tests/test_40_sigver.py:233: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1751: in multiple_signatures
    statement = self.sign_statement(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpn4f567x5.xml', '/tmp/tmp3cm4cb2t.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp3cm4cb2t.xml"
output=
_______________________ TestSecurity.test_sign_response ________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp_98x9ml2.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp_98x9ml2.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa6d657b0>
    def test_sign_response(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        to_sign = [(class_name(self._assertion), self._assertion.id), (class_name(response), response.id)]
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:270: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmp878ryu_e.xml', '/tmp/tmp_98x9ml2.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp_98x9ml2.xml"
output=
______________________ TestSecurity.test_sign_response_2 _______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser-2</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22233"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11122" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer-2</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11122"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Fox</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bear</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11122'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp3w7q26nh.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp3w7q26nh.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa64f1bf0>
    def test_sign_response_2(self):
        assertion2 = factory(
            saml.Assertion,
            version="2.0",
            id="id-11122",
            issuer=saml.Issuer(text="the-issuer-2"),
            issue_instant="2009-10-30T13:20:28Z",
            signature=sigver.pre_signature_part("id-11122", self.sec.my_cert),
            attribute_statement=do_attribute_statement(
                {
                    ("name:surName", "nameformat", "surName"): ("Fox", ""),
                    ("name:givenName", "nameformat", "givenName"): ("Bear", ""),
                }
            ),
        )
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser-2"),
            status=success_status_factory(),
            assertion=assertion2,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22233",
            signature=sigver.pre_signature_part("id-22233", self.sec.my_cert),
        )
    
        to_sign = [(class_name(assertion2), assertion2.id), (class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:314: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser-2</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22233"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11122" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer-2</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11122"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Fox</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bear</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11122'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11122', '--output', '/tmp/tmpt6cq311b.xml', '/tmp/tmp3w7q26nh.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp3w7q26nh.xml"
output=
________________________ TestSecurity.test_sign_verify _________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233"><ns1:Signature><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-22233"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpdn11wpo0.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpdn11wpo0.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa64c6650>
    def test_sign_verify(self):
        response = factory(
            samlp.Response,
            assertion=self._assertion,
            id="id-22233",
            signature=sigver.pre_signature_part("id-22233", self.sec.my_cert),
        )
    
        to_sign = [(class_name(self._assertion), self._assertion.id), (class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:341: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233"><ns1:Signature><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-22233"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpbgeajy8d.xml', '/tmp/tmpdn11wpo0.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpdn11wpo0.xml"
output=
____________ TestSecurity.test_sign_verify_with_cert_from_instance _____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpsn9752n7.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpsn9752n7.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa64c6e50>
    def test_sign_verify_with_cert_from_instance(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        to_sign = [(class_name(self._assertion), self._assertion.id), (class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:363: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmp3pqnwt43.xml', '/tmp/tmpsn9752n7.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpsn9752n7.xml"
output=
_______ TestSecurity.test_sign_verify_assertion_with_cert_from_instance ________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11100"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Fox</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bear</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11100'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp5uad15xn.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp5uad15xn.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa66e37a0>
    def test_sign_verify_assertion_with_cert_from_instance(self):
        assertion = factory(
            saml.Assertion,
            version="2.0",
            id="id-11100",
            issuer=saml.Issuer(text="the-issuer"),
            issue_instant="2009-10-30T13:20:28Z",
            signature=sigver.pre_signature_part("id-11100", self.sec.my_cert),
            attribute_statement=do_attribute_statement(
                {
                    ("name:surName", "nameformat", "surName"): ("Fox", ""),
                    ("name:givenName", "nameformat", "givenName"): ("Bear", ""),
                }
            ),
        )
    
        to_sign = [(class_name(assertion), assertion.id)]
>       s_assertion = sigver.signed_instance_factory(assertion, self.sec, to_sign)
tests/test_40_sigver.py:395: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11100"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Fox</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bear</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11100'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11100', '--output', '/tmp/tmp8f1z57va.xml', '/tmp/tmp5uad15xn.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp5uad15xn.xml"
output=
_______ TestSecurity.test_exception_sign_verify_with_cert_from_instance ________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer-2</saml:Issuer><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-22222'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmpgt0wczsc.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpgt0wczsc.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurity object at 0x3ffa66e3890>
    def test_exception_sign_verify_with_cert_from_instance(self):
        assertion = factory(
            saml.Assertion,
            version="2.0",
            id="id-11100",
            issuer=saml.Issuer(text="the-issuer-2"),
            issue_instant="2009-10-30T13:20:28Z",
            attribute_statement=do_attribute_statement(
                {
                    ("name:surName", "nameformat", "surName"): ("Foo", ""),
                    ("name:givenName", "nameformat", "givenName"): ("Bar", ""),
                }
            ),
        )
    
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        to_sign = [(class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:436: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4ea57f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer-2</saml:Issuer><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-22222'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-22222', '--output', '/tmp/tmpm2va5ufd.xml', '/tmp/tmpgt0wczsc.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpgt0wczsc.xml"
output=
_________________ TestSecurityNonAsciiAva.test_sign_assertion __________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpcpipng6m.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpcpipng6m.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa641da70>
    def test_sign_assertion(self):
        ass = self._assertion
        print(ass)
>       sign_ass = self.sec.sign_assertion(f"{ass}", node_id=ass.id)
tests/test_40_sigver.py:491: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1710: in sign_assertion
    return self.sign_statement(statement, class_name(saml.Assertion()), **kwargs)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpsmrskww7.xml', '/tmp/tmpcpipng6m.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
----------------------------- Captured stdout call -----------------------------
<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpcpipng6m.xml"
output=
__________ TestSecurityNonAsciiAva.test_multiple_signatures_assertion __________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpcr9buzod.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpcr9buzod.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa641de00>
    def test_multiple_signatures_assertion(self):
        ass = self._assertion
        # basic test with two of the same
        to_sign = [(ass, ass.id), (ass, ass.id)]
>       sign_ass = self.sec.multiple_signatures(str(ass), to_sign)
tests/test_40_sigver.py:511: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1751: in multiple_signatures
    statement = self.sign_statement(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpuxqdebnm.xml', '/tmp/tmpcr9buzod.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpcr9buzod.xml"
output=
__________ TestSecurityNonAsciiAva.test_multiple_signatures_response ___________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmprg4fk7yq.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmprg4fk7yq.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa51e0290>
    def test_multiple_signatures_response(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        # order is important, we can't validate if the signatures are made
        # in the reverse order
        to_sign = [(self._assertion, self._assertion.id), (response, response.id)]
>       s_response = self.sec.multiple_signatures(str(response), to_sign)
tests/test_40_sigver.py:539: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1751: in multiple_signatures
    statement = self.sign_statement(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpc635y7s5.xml', '/tmp/tmprg4fk7yq.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmprg4fk7yq.xml"
output=
__________________ TestSecurityNonAsciiAva.test_sign_response __________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmppvg_55xp.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmppvg_55xp.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa64f18c0>
    def test_sign_response(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        to_sign = [(class_name(self._assertion), self._assertion.id), (class_name(response), response.id)]
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:576: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpszj9042f.xml', '/tmp/tmppvg_55xp.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmppvg_55xp.xml"
output=
_________________ TestSecurityNonAsciiAva.test_sign_response_2 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22233"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11122" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer-2</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11122"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">R\xc3\xa4v</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bj\xc3\xb6rn</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11122'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpdo9pah9u.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpdo9pah9u.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa64f1d00>
    def test_sign_response_2(self):
        assertion2 = factory(
            saml.Assertion,
            version="2.0",
            id="id-11122",
            issuer=saml.Issuer(text="the-issuer-2"),
            issue_instant="2009-10-30T13:20:28Z",
            signature=sigver.pre_signature_part("id-11122", self.sec.my_cert),
            attribute_statement=do_attribute_statement(
                {
                    ("name:surName", "nameformat", "surName"): ("Räv", ""),
                    ("name:givenName", "nameformat", "givenName"): ("Björn", ""),
                }
            ),
        )
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=assertion2,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22233",
            signature=sigver.pre_signature_part("id-22233", self.sec.my_cert),
        )
    
        to_sign = [(class_name(assertion2), assertion2.id), (class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:620: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22233"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11122" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer-2</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11122"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">R\xc3\xa4v</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bj\xc3\xb6rn</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11122'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11122', '--output', '/tmp/tmpbub0yrwr.xml', '/tmp/tmpdo9pah9u.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpdo9pah9u.xml"
output=
___________________ TestSecurityNonAsciiAva.test_sign_verify ___________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22233"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp_y6rxezv.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp_y6rxezv.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa64c6c50>
    def test_sign_verify(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22233",
            signature=sigver.pre_signature_part("id-22233", self.sec.my_cert),
        )
    
        to_sign = [(class_name(self._assertion), self._assertion.id), (class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:648: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22233" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22233"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpcyspr4ld.xml', '/tmp/tmp_y6rxezv.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp_y6rxezv.xml"
output=
_______ TestSecurityNonAsciiAva.test_sign_verify_with_cert_from_instance _______
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp_2ud5w1b.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp_2ud5w1b.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa64c6a50>
    def test_sign_verify_with_cert_from_instance(self):
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=self._assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        to_sign = [(class_name(self._assertion), self._assertion.id), (class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:670: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-11111"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmphdkndw6s.xml', '/tmp/tmp_2ud5w1b.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp_2ud5w1b.xml"
output=
__ TestSecurityNonAsciiAva.test_sign_verify_assertion_with_cert_from_instance __
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11100"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">R\xc3\xa4v</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bj\xc3\xb6rn</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11100'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpwu45_sf0.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpwu45_sf0.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa66e36b0>
    def test_sign_verify_assertion_with_cert_from_instance(self):
        assertion = factory(
            saml.Assertion,
            version="2.0",
            id="id-11100",
            issuer=saml.Issuer(text="the-issuer"),
            issue_instant="2009-10-30T13:20:28Z",
            signature=sigver.pre_signature_part("id-11100", self.sec.my_cert, 1),
            attribute_statement=do_attribute_statement(
                {
                    ("name:surName", "nameformat", "surName"): ("Räv", ""),
                    ("name:givenName", "nameformat", "givenName"): ("Björn", ""),
                }
            ),
        )
    
        to_sign = [(class_name(assertion), assertion.id)]
>       s_assertion = sigver.signed_instance_factory(assertion, self.sec, to_sign)
tests/test_40_sigver.py:702: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11100"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">R\xc3\xa4v</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bj\xc3\xb6rn</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11100'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11100', '--output', '/tmp/tmpwvnlz61z.xml', '/tmp/tmpwu45_sf0.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpwu45_sf0.xml"
output=
__ TestSecurityNonAsciiAva.test_exception_sign_verify_with_cert_from_instance __
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-22222'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmp990jqimd.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp990jqimd.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_40_sigver.TestSecurityNonAsciiAva object at 0x3ffa66e34d0>
    def test_exception_sign_verify_with_cert_from_instance(self):
        assertion = factory(
            saml.Assertion,
            version="2.0",
            id="id-11100",
            issuer=saml.Issuer(text="the-issuer"),
            issue_instant="2009-10-30T13:20:28Z",
            attribute_statement=do_attribute_statement(
                {
                    ("name:surName", "nameformat", "surName"): ("Föö", ""),
                    ("name:givenName", "nameformat", "givenName"): ("Bär", ""),
                }
            ),
        )
    
        response = factory(
            samlp.Response,
            issuer=saml.Issuer(text="the-isser"),
            status=success_status_factory(),
            assertion=assertion,
            version="2.0",
            issue_instant="2099-10-30T13:20:28Z",
            id="id-22222",
            signature=sigver.pre_signature_part("id-22222", self.sec.my_cert),
        )
    
        to_sign = [(class_name(response), response.id)]
    
>       s_response = sigver.signed_instance_factory(response, self.sec, to_sign)
tests/test_40_sigver.py:743: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5738590>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-22222" Version="2.0" IssueInstant="2099-10-30T13:20:28Z"><saml:Issuer>the-isser</saml:Issuer><ns2:Signature><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-22222"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-11100" IssueInstant="2009-10-30T13:20:28Z"><saml:Issuer>the-issuer</saml:Issuer><saml:AttributeStatement><saml:Attribute Name="name:surName" NameFormat="nameformat" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">F\xc3\xb6\xc3\xb6</saml:AttributeValue></saml:Attribute><saml:Attribute Name="name:givenName" NameFormat="nameformat" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">B\xc3\xa4r</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-22222'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-22222', '--output', '/tmp/tmp6muxxpno.xml', '/tmp/tmp990jqimd.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp990jqimd.xml"
output=
__________________________________ test_xbox ___________________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5614ad0>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5614ad0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp68k3w4mh.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp68k3w4mh.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
    def test_xbox():
        conf = config.SPConfig()
        conf.load_file("server_conf")
        md = MetadataStore([saml, samlp], None, conf)
        md.load("local", IDP_EXAMPLE)
    
        conf.metadata = md
        conf.only_use_keys_in_metadata = False
        sec = sigver.security_context(conf)
    
        assertion = factory(
            saml.Assertion,
            version="2.0",
            id="id-11111",
            issue_instant="2009-10-30T13:20:28Z",
            signature=sigver.pre_signature_part("id-11111", sec.my_cert, 1),
            attribute_statement=do_attribute_statement(
                {
                    ("", "", "surName"): ("Foo", ""),
                    ("", "", "givenName"): ("Bar", ""),
                }
            ),
        )
    
>       sigass = sec.sign_statement(
            assertion,
            class_name(assertion),
            key_file=PRIV_KEY,
            node_id=assertion.id,
        )
tests/test_40_sigver.py:843: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5614ad0>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Foo</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bar</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpd3ict2e1.xml', '/tmp/tmp68k3w4mh.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp68k3w4mh.xml"
output=
___________________________ test_xbox_non_ascii_ava ____________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa591f650>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa591f650>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqs29desm.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqs29desm.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
    def test_xbox_non_ascii_ava():
        conf = config.SPConfig()
        conf.load_file("server_conf")
        md = MetadataStore([saml, samlp], None, conf)
        md.load("local", IDP_EXAMPLE)
    
        conf.metadata = md
        conf.only_use_keys_in_metadata = False
        sec = sigver.security_context(conf)
    
        assertion = factory(
            saml.Assertion,
            version="2.0",
            id="id-11111",
            issue_instant="2009-10-30T13:20:28Z",
            signature=sigver.pre_signature_part("id-11111", sec.my_cert, 1),
            attribute_statement=do_attribute_statement(
                {
                    ("", "", "surName"): ("Föö", ""),
                    ("", "", "givenName"): ("Bär", ""),
                }
            ),
        )
    
>       sigass = sec.sign_statement(
            assertion,
            class_name(assertion),
            key_file=PRIV_KEY,
            node_id=assertion.id,
        )
tests/test_40_sigver.py:901: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa591f650>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-11111" IssueInstant="2009-10-30T13:20:28Z"><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-11111"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Föö</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Bär</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-11111'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmp0iznxov8.xml', '/tmp/tmpqs29desm.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpqs29desm.xml"
output=
_______________________ TestServer1.test_signed_response _______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-OsDzMVnH3V41ixe5a" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-8pbbbugJQ2tJbdOBU" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-8pbbbugJQ2tJbdOBU"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">a30b63ea4ff544eb0fa729570d874294531e6e77266cec591e8e78ebfe7e976f</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-8pbbbugJQ2tJbdOBU'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp50uwwgdn.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp50uwwgdn.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa4d2d9b0>
    def test_signed_response(self):
        name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
        ava = {"givenName": ["Derek"], "sn": ["Jeter"], "mail": ["derek@nyy.mlb.com"], "title": "The man"}
    
>       signed_resp = self.server.create_authn_response(
            ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=name_id,
            sign_assertion=True,
        )
tests/test_50_server.py:441: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-OsDzMVnH3V41ixe5a" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-8pbbbugJQ2tJbdOBU" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-8pbbbugJQ2tJbdOBU"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">a30b63ea4ff544eb0fa729570d874294531e6e77266cec591e8e78ebfe7e976f</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-8pbbbugJQ2tJbdOBU'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-8pbbbugJQ2tJbdOBU', '--output', '/tmp/tmpb_ir03pc.xml', '/tmp/tmp50uwwgdn.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp50uwwgdn.xml"
output=
______________________ TestServer1.test_signed_response_1 ______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-jmzajZ78f0j8IYzVm" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-jmzajZ78f0j8IYzVm"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7EYH8P23TOwvImHM6" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7EYH8P23TOwvImHM6"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7EYH8P23TOwvImHM6'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp_i6_130e.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp_i6_130e.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa4d2dc50>
    def test_signed_response_1(self):
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
        )
tests/test_50_server.py:464: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-jmzajZ78f0j8IYzVm" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:41Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-jmzajZ78f0j8IYzVm"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-7EYH8P23TOwvImHM6" IssueInstant="2025-04-21T14:10:41Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7EYH8P23TOwvImHM6"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:41Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:41Z" NotOnOrAfter="2025-04-21T14:15:41Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7EYH8P23TOwvImHM6'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7EYH8P23TOwvImHM6', '--output', '/tmp/tmp8wwkfoal.xml', '/tmp/tmp_i6_130e.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp_i6_130e.xml"
output=
______________________ TestServer1.test_signed_response_2 ______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-7bLTco5BZ8cGXKuID" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7bLTco5BZ8cGXKuID"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-1w4aaKRNTQk41d9rs" IssueInstant="2025-04-21T14:10:42Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:42Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:42Z" NotOnOrAfter="2025-04-21T14:15:42Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7bLTco5BZ8cGXKuID'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmpdusaypvt.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpdusaypvt.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa512fad0>
    def test_signed_response_2(self):
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=False,
        )
tests/test_50_server.py:495: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-7bLTco5BZ8cGXKuID" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7bLTco5BZ8cGXKuID"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-1w4aaKRNTQk41d9rs" IssueInstant="2025-04-21T14:10:42Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:42Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:42Z" NotOnOrAfter="2025-04-21T14:15:42Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-7bLTco5BZ8cGXKuID'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-7bLTco5BZ8cGXKuID', '--output', '/tmp/tmp13rhu1j2.xml', '/tmp/tmpdusaypvt.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpdusaypvt.xml"
output=
______________________ TestServer1.test_signed_response_3 ______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-85qzCD0kkVlOtptZ7" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-1t0aqPNa4kbvvcURP" IssueInstant="2025-04-21T14:10:42Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-1t0aqPNa4kbvvcURP"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:42Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:42Z" NotOnOrAfter="2025-04-21T14:15:42Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-1t0aqPNa4kbvvcURP'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmppdpuwcd1.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmppdpuwcd1.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa5105b50>
    def test_signed_response_3(self):
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=False,
            sign_assertion=True,
        )
tests/test_50_server.py:519: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-85qzCD0kkVlOtptZ7" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-1t0aqPNa4kbvvcURP" IssueInstant="2025-04-21T14:10:42Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-1t0aqPNa4kbvvcURP"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:42Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:42Z" NotOnOrAfter="2025-04-21T14:15:42Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-1t0aqPNa4kbvvcURP'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-1t0aqPNa4kbvvcURP', '--output', '/tmp/tmpxn560629.xml', '/tmp/tmppdpuwcd1.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmppdpuwcd1.xml"
output=
_________________ TestServer1.test_encrypted_signed_response_1 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-JmrITtfuMA3xgD9Fr" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-JmrITtfuMA3xgD9Fr"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-KhaqbkgaAnL3SckFR" IssueInstant="2025-04-21T14:10:42Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-KhaqbkgaAnL3SckFR"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:42Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:42Z" NotOnOrAfter="2025-04-21T14:15:42Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_53370fb3-4e42-4e4e-8555-33f1701b41b3" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_96951a36-23e4-406a-8830-21d654a3a53c"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQyWhcNMzUwNDE5MTQxMDQyWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAlA7OFZW72VVIL7UawODGOqQcvPMB9xTUPEg/fj8rI5SS+u/6f1W+iCLw\nMnEdGAj1s2GRSfFvG4dbicgIugw5194b92OJ0YwoFUSXgsR7XeLlG+lw/wiDA4J5\nlpN7n/S7eulXOtvaYlhcSTr3SOtPBQY1Kz3o2GBggzOCikUhsFz51SOOx+9As9eF\nq6I6KtqBbFvKZaOQZwa7fl+t+paVd+KpnChfaX742CP9oQtclIbBNjM35Ckzn5YE\nEQeaqcS1cZlG64W1aZfv6JiY1hR/sw8g8o/+vjlgR1nLuFiQyF8mEOmWEYyKqRrI\nVGOmSgAC9g6d7opAzJiqdeMnLx9ARQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGvo\ngdQm9GYVMucjAxMEqnWHdFAwABbhoHAVy4/VhfH5dcaKd4LLeapRhobBJ+LvkLaD\nu5aAn+62tEF0JaMLxYDoxc7+grHAtrOKNBhZJ20X1vv29U9NlAb22rwHve8M8ty5\nHOZ9NsNSVOr45bDVZ3CDtNTjihTkiHl31nCopKEu</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>fMxawxnKnnuA/E0kGafKS0v99WoL+4l8FYb08r3gI8kkAtKvJw2Evkwn4/iV9ppi\n010CDCk9oiXo1SXMv7U5WbKmRT8PBhx5uIbb7M1/Ue5PeaikpfoOvl+7JxPXhtdd\nYhPsM/3frkxjtMp/7ka5aZesJHh0u0nRfTXLwwZcNCYQ4sTeNUOa+ji0b3+54mSJ\n3f0s8Vn13hzfL1V3h3oqImttuC6IH25ThYSauR8hNOUNE2n8vIVXu+lB7yZh3ys4\ncEul88yBKFF4kwLDty4bZZ21OcSxMQ6DMJYHOdobiGV1ax82sEheO5sxjnDCVPnl\nRUbqh3W8rGy9YK+4MHQ+EA==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>rxqumW50k6QbD4lfUQRKk1a5+fFba/1m5dbT4WBqcas7xF7t9BnFk0jBGzGetgKG\nsSWiTl9MNNrTzMb6Af2oGsMCtESjOLJHdmZRJ+TLLRJlc3Bjxl1grdS7oquWZ9Iv\nlT9SGNyVQpIkNImywlC8LNRfWrur0Y+ULOhbgCjNZdca362HQdiUYNIocXwKFlXp\n4a23zE2gruCFLeGgwFOUPyvoWAmBZADZY/K+s0xZLgXThgZodg8YUwC8zgzxdCbG\ncbbZ1k6kQMC7nOHj8j1rZdM/2NOs06Kmn999Ud/XMnhrzQuwVKXdF54OZ44/CzlT\nYvMW4kdjKIwJfxxYxSVkS7QHPAol9idEMCm9XQL0iA2j/qDqZCaL2xUN3DAN5fhf\nohfQ9SWwN/7pqZ/3g8JNkllka82EuBFrgMzvUn/+sO//A+mdshddqOLKjlZ4SW8q\nbx4BcfqbwAt0OmywZRBt8uRTWFCGLrSBjy7hjUFnU+6SaFQS18x5zPT4hV+QdcS4\nMxwltpI0Rnr4GcgowMTprTtVp7WWhZM28GPZNM4KDSUQpjGGN8EHvx2Nb6oNygAq\na+rHzxwycaP3K72J9xZL89ttr6ZOIIdC1/8vjxtEOdP6SoD9KO502f70vKU5UyV7\nq0PCLfMaWGk+OxntqQTlBMVF2G93jUmLobPHjvRh+g/1YAKSW7lHznFJQKYg2nkT\n2ik4zckj4Xqr1UAmX43FmAv4611fqwtdFQgDCqKiNfv2QgJXBOdyPbO5r3UucTwg\nCeHNsDE1DyKYPXmOn/wKFPnUQ3q9+kixykvc5/a3LhPsA9pezCck0NUOV3GQNiui\nQeZDhahMi1bZ24XUq6/Y7jVX34Tp1H7EL79Z+x71p+EI+IrtREfJFfCB5UFalpof\nW8nXbKfwTdI053kbfCAFrvAOsHN8Zh1gD9QZx1Pbx+kOGf3gk+pljEMk8hlwT9sl\nLsWop744SJ8hKWCBFO48kL/3+6bSfaeCpV5gvctjfiXbZ0DYo4P1TZgFLaShETUS\nKFSHZo0qew5WdaB2znBH46zysR4GK1STkolerSwYPZSwx2U+tAc1WXDvWVuVN77Y\nFdoUN7oqRtmzRTgvDnh3FyZWtj1cFzAkaiZ0yIxHfd0fOMmKr97KVk8jsdvUaM7W\nDzNfjAZ7t9MX8VBAOwiiZEDevo7bGQHilG3JeVQf8sF04r6DltSqtMSdcM0FknAg\n1Ud6JgCftF60W4gH73gM/agUk+VOo3WLc8oMFQFXxuJgQ7PwEFiIHaK+ETMrXXfI\nZ6nlN+LlAHdmYj/9F0VpP7qKI8g5a6ro0W2Jyq2L98mHgvBC0wMSY6mfvBO4cm/e\nFePzpqKINSmnn9QVDyX7s1GeuuIndH6PYYOQXspevZf7XWC+BKxsk7SFAWN9K3C/\nPrskD0P6/kPdAcXXTg/4rZHIt22I7nf8GAtu9DbB+rGZKr6ZqZ3Xva4O0IqbgEgQ\nl7G+jPszedkzn4uTI2raOUoXQ6ensT1jDU0STKTGpB/+/ccKigT78l8U7uEAJUjK\n8e0PHiwyYoNPnutroU8q04vUlAxNGM2DRpHU4w4lHXmNUBun79XGiGDcAKAEDIvu\nS99SAB0WB3K2JaogCiMYNg8k/ZDI0j5jgP4jfKSq4bwA5AHiGQ9sDFrjrDNGMo1R\nfaQePZ/R/J69YSje2NQ1BVfv8XezvFpjvZEYM4bS8jge1jwq7Zp7NSTGj7dQxi5L\n8s3kAjRSxLEp5w8XlJyjcTYRl2ziORWyoTKREN2Aas15uMwjDpjE5nVZ4g5UTYPC\nqHsY7p7iMi50bDCz6rM+ugQUCkLN4w9Kt8YRHJwOI69H2zrhGlwqi/UPjs6hQer2\nb8pdoTYFwNxOpspyE3hwRyT5Gtoaics8rvLw2biC9BMwNyTO6cXLGbtbl305AVI4\nMCwQe+f+CHTq4dG5gtr5PSW52EwBcZSNbBFmXfhEvW8PF8IfSK2a6ejMsWon68IG\nxKiuAGNMkIRxRssUGUid+Mh3nzGtL/FkCUY3NCL/Pfp5X4EwNxAJK8g0rwPTdiSz\nq9su4fhuEDkTHnudlZCQUdak8G5Xt6jBC3izXgvqvZ29nyAJeqPXmYuJSqtFZvyj\ndmaQYfybLUb5be2TGkEoitBlU8nFkBzNmsro9VS8lyykyqHTqJLR8ATQbVEbUt8N\nc0KPqdmjqEaPclSac22aCrAqgn7pevI54jjvoJsgfhxHxNStwhBNKde9p/VeY3LD\nz95z2sucXTJTiVB5uMm4hfZigksj2DDjlKyJ2G+ns+TwMFzQLO2DXbCvQMXR82cl\nAD63Zs6s4fmUNJ2N7Bex1j+Re1UcDMUsPgvGL5/0XdoAsPXsPOsG/R1OhC9Qi8Nk\n+LxpgERONAeU4ZB2imG79f/IktPda5K+m4NrcqTyKv2LhGuQF5vG3g==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-KhaqbkgaAnL3SckFR'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpxpewlv77.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpxpewlv77.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa5105e50>
    def test_encrypted_signed_response_1(self):
    
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=False,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str,
        )
tests/test_50_server.py:547: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:907: in _response
    response = signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-JmrITtfuMA3xgD9Fr" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-JmrITtfuMA3xgD9Fr"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-KhaqbkgaAnL3SckFR" IssueInstant="2025-04-21T14:10:42Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-KhaqbkgaAnL3SckFR"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:42Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:42Z" NotOnOrAfter="2025-04-21T14:15:42Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_53370fb3-4e42-4e4e-8555-33f1701b41b3" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_96951a36-23e4-406a-8830-21d654a3a53c"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQyWhcNMzUwNDE5MTQxMDQyWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAlA7OFZW72VVIL7UawODGOqQcvPMB9xTUPEg/fj8rI5SS+u/6f1W+iCLw\nMnEdGAj1s2GRSfFvG4dbicgIugw5194b92OJ0YwoFUSXgsR7XeLlG+lw/wiDA4J5\nlpN7n/S7eulXOtvaYlhcSTr3SOtPBQY1Kz3o2GBggzOCikUhsFz51SOOx+9As9eF\nq6I6KtqBbFvKZaOQZwa7fl+t+paVd+KpnChfaX742CP9oQtclIbBNjM35Ckzn5YE\nEQeaqcS1cZlG64W1aZfv6JiY1hR/sw8g8o/+vjlgR1nLuFiQyF8mEOmWEYyKqRrI\nVGOmSgAC9g6d7opAzJiqdeMnLx9ARQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGvo\ngdQm9GYVMucjAxMEqnWHdFAwABbhoHAVy4/VhfH5dcaKd4LLeapRhobBJ+LvkLaD\nu5aAn+62tEF0JaMLxYDoxc7+grHAtrOKNBhZJ20X1vv29U9NlAb22rwHve8M8ty5\nHOZ9NsNSVOr45bDVZ3CDtNTjihTkiHl31nCopKEu</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>fMxawxnKnnuA/E0kGafKS0v99WoL+4l8FYb08r3gI8kkAtKvJw2Evkwn4/iV9ppi\n010CDCk9oiXo1SXMv7U5WbKmRT8PBhx5uIbb7M1/Ue5PeaikpfoOvl+7JxPXhtdd\nYhPsM/3frkxjtMp/7ka5aZesJHh0u0nRfTXLwwZcNCYQ4sTeNUOa+ji0b3+54mSJ\n3f0s8Vn13hzfL1V3h3oqImttuC6IH25ThYSauR8hNOUNE2n8vIVXu+lB7yZh3ys4\ncEul88yBKFF4kwLDty4bZZ21OcSxMQ6DMJYHOdobiGV1ax82sEheO5sxjnDCVPnl\nRUbqh3W8rGy9YK+4MHQ+EA==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>rxqumW50k6QbD4lfUQRKk1a5+fFba/1m5dbT4WBqcas7xF7t9BnFk0jBGzGetgKG\nsSWiTl9MNNrTzMb6Af2oGsMCtESjOLJHdmZRJ+TLLRJlc3Bjxl1grdS7oquWZ9Iv\nlT9SGNyVQpIkNImywlC8LNRfWrur0Y+ULOhbgCjNZdca362HQdiUYNIocXwKFlXp\n4a23zE2gruCFLeGgwFOUPyvoWAmBZADZY/K+s0xZLgXThgZodg8YUwC8zgzxdCbG\ncbbZ1k6kQMC7nOHj8j1rZdM/2NOs06Kmn999Ud/XMnhrzQuwVKXdF54OZ44/CzlT\nYvMW4kdjKIwJfxxYxSVkS7QHPAol9idEMCm9XQL0iA2j/qDqZCaL2xUN3DAN5fhf\nohfQ9SWwN/7pqZ/3g8JNkllka82EuBFrgMzvUn/+sO//A+mdshddqOLKjlZ4SW8q\nbx4BcfqbwAt0OmywZRBt8uRTWFCGLrSBjy7hjUFnU+6SaFQS18x5zPT4hV+QdcS4\nMxwltpI0Rnr4GcgowMTprTtVp7WWhZM28GPZNM4KDSUQpjGGN8EHvx2Nb6oNygAq\na+rHzxwycaP3K72J9xZL89ttr6ZOIIdC1/8vjxtEOdP6SoD9KO502f70vKU5UyV7\nq0PCLfMaWGk+OxntqQTlBMVF2G93jUmLobPHjvRh+g/1YAKSW7lHznFJQKYg2nkT\n2ik4zckj4Xqr1UAmX43FmAv4611fqwtdFQgDCqKiNfv2QgJXBOdyPbO5r3UucTwg\nCeHNsDE1DyKYPXmOn/wKFPnUQ3q9+kixykvc5/a3LhPsA9pezCck0NUOV3GQNiui\nQeZDhahMi1bZ24XUq6/Y7jVX34Tp1H7EL79Z+x71p+EI+IrtREfJFfCB5UFalpof\nW8nXbKfwTdI053kbfCAFrvAOsHN8Zh1gD9QZx1Pbx+kOGf3gk+pljEMk8hlwT9sl\nLsWop744SJ8hKWCBFO48kL/3+6bSfaeCpV5gvctjfiXbZ0DYo4P1TZgFLaShETUS\nKFSHZo0qew5WdaB2znBH46zysR4GK1STkolerSwYPZSwx2U+tAc1WXDvWVuVN77Y\nFdoUN7oqRtmzRTgvDnh3FyZWtj1cFzAkaiZ0yIxHfd0fOMmKr97KVk8jsdvUaM7W\nDzNfjAZ7t9MX8VBAOwiiZEDevo7bGQHilG3JeVQf8sF04r6DltSqtMSdcM0FknAg\n1Ud6JgCftF60W4gH73gM/agUk+VOo3WLc8oMFQFXxuJgQ7PwEFiIHaK+ETMrXXfI\nZ6nlN+LlAHdmYj/9F0VpP7qKI8g5a6ro0W2Jyq2L98mHgvBC0wMSY6mfvBO4cm/e\nFePzpqKINSmnn9QVDyX7s1GeuuIndH6PYYOQXspevZf7XWC+BKxsk7SFAWN9K3C/\nPrskD0P6/kPdAcXXTg/4rZHIt22I7nf8GAtu9DbB+rGZKr6ZqZ3Xva4O0IqbgEgQ\nl7G+jPszedkzn4uTI2raOUoXQ6ensT1jDU0STKTGpB/+/ccKigT78l8U7uEAJUjK\n8e0PHiwyYoNPnutroU8q04vUlAxNGM2DRpHU4w4lHXmNUBun79XGiGDcAKAEDIvu\nS99SAB0WB3K2JaogCiMYNg8k/ZDI0j5jgP4jfKSq4bwA5AHiGQ9sDFrjrDNGMo1R\nfaQePZ/R/J69YSje2NQ1BVfv8XezvFpjvZEYM4bS8jge1jwq7Zp7NSTGj7dQxi5L\n8s3kAjRSxLEp5w8XlJyjcTYRl2ziORWyoTKREN2Aas15uMwjDpjE5nVZ4g5UTYPC\nqHsY7p7iMi50bDCz6rM+ugQUCkLN4w9Kt8YRHJwOI69H2zrhGlwqi/UPjs6hQer2\nb8pdoTYFwNxOpspyE3hwRyT5Gtoaics8rvLw2biC9BMwNyTO6cXLGbtbl305AVI4\nMCwQe+f+CHTq4dG5gtr5PSW52EwBcZSNbBFmXfhEvW8PF8IfSK2a6ejMsWon68IG\nxKiuAGNMkIRxRssUGUid+Mh3nzGtL/FkCUY3NCL/Pfp5X4EwNxAJK8g0rwPTdiSz\nq9su4fhuEDkTHnudlZCQUdak8G5Xt6jBC3izXgvqvZ29nyAJeqPXmYuJSqtFZvyj\ndmaQYfybLUb5be2TGkEoitBlU8nFkBzNmsro9VS8lyykyqHTqJLR8ATQbVEbUt8N\nc0KPqdmjqEaPclSac22aCrAqgn7pevI54jjvoJsgfhxHxNStwhBNKde9p/VeY3LD\nz95z2sucXTJTiVB5uMm4hfZigksj2DDjlKyJ2G+ns+TwMFzQLO2DXbCvQMXR82cl\nAD63Zs6s4fmUNJ2N7Bex1j+Re1UcDMUsPgvGL5/0XdoAsPXsPOsG/R1OhC9Qi8Nk\n+LxpgERONAeU4ZB2imG79f/IktPda5K+m4NrcqTyKv2LhGuQF5vG3g==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-KhaqbkgaAnL3SckFR'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-KhaqbkgaAnL3SckFR', '--output', '/tmp/tmpybn02myr.xml', '/tmp/tmpxpewlv77.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpxpewlv77.xml"
output=
_________________ TestServer1.test_encrypted_signed_response_2 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = '<?xml version="1.0"?>\n<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-47n6Gd3HY7FY2HuZs" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ns2:Reference URI="#id-47n6Gd3HY7FY2HuZs"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ns2:DigestValue/></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue/><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></ns0:Status><saml:EncryptedAssertion><ns0:EncryptedData xmlns:ns0="http://www.w3.org/2001/04/xmlenc#" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" Id="ED_10a98528-560e-4748-8240-15673993fc75" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/><ns1:KeyInfo><ns0:EncryptedKey Id="EK_3c1126d4-1c88-4012-b900-ca4e7bc962cf"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>f8ELltt1w1BGTvDIaP3/nVd9KyyjV31KtWdriy2yT+S7ZZh1DMfzkw9z8E2to4Dv\nwfJeSbpyzQZDCLFvYToIK7RVqUj9li0cmS1jsIjU2b2vSK5xAcmcHJ7c8kOdhpT8\nJziKlZaVBW+Z+9wCGkj5ZhDl/vz7p3wpIUvV9wp+yqQ=</ns0:CipherValue></ns0:CipherData></ns0:EncryptedKey></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>glF5cjBdnidC8Zd0WUyAL0gR5ixXC7NJIgZZH2G/CJ4bSYvumUgFN4RUNFZLHADq\nBv8C6qBMLW0xQTPdXUy0Izs4bcn2OK2pJlQAmHyi9vqmnI6HpOdN3TrjvMQh9sQz\n+RQawLkoMiC4/lsgl+ITRQyNHRVMfXbQZG6JNVFBhPTBhWupJfP8WP89hyi3lGNP\nxWXASWlOzdp1QQhVmHQOwpAhWgf3+kSp5s9ywFKFSa294FXZh95K7WotfGRH4eUp\njPt+FZXKlBc99orQ1G60SLhUNUi1KFLPdzNdpM8xvreC2+/1/XiLbBb8WLatbh1R\nOGC1OXEY1dQo88sNXuj96jl3OK8LvcK8HuRS0KGRrIV9kkMoQlOSyP5fhEsNcCbz\ndgEuTsIRKGym9ykLO9DikPEONMqAzwEcPFsasWF7fgzU20YRZXBSsPdjiKhZBhsq\nQjIhPgTCO5QDAxF8QY8cCJSu7JNmYfmqZa+hPtveCG64Cy1IYZYU+JaS9vn772bl\nshsRaSEFvmgzb1nMCQ52v82/uSSG1j0IQU/XA2HKUNFp+2vLPX9ds6fxQGXxMsfc\nhtTFlPb0qOq7L1r9gXxnEYFRqaUwAvYOwLh3oS4eFfUmcIxgGbSZO6pe3bVmQKe7\nus605F1etuK0M71UtU3BAH78CZsDnv/Mkkwug2R9kECOW9GAHZ7kQCv7i1QqOsd1\n2emsiWVMF6OfgHZ6nOyaVU0Yx0awYCWWu3UeAFCdw3BODFCCzll/yCYY5jg6GG3H\nocxa4N62eL83Oku+xBFFEEp0QMnI68wX2sfQ2gWmXPyN07DOqEtlm0etZQdMb0e7\nKyeqM/5gA5uG15/EHbnaghPWlKkpILjW9QRiSAxL3ZmMYxu5c59eIhapJFf+uFRI\n0faQ8/kyExASK5grWd6M0UgiGOED9Zhud8f3PF28fF1JB85FM5RjJEuGaKmeRm5G\nOybEs9bGkuTMX7DF8zyJ68awTNdWFCu9nCJxpLnQbtLE7R63QJ7bp6t9zahKonuA\nBcC9Ym9ofilH/75+htdN+NE+jJmDOYV4Z5tlFM5saTZfDFPUGxqpAqt3eFWTMC2F\ney6uZuqX3+9PUdR1a4GSpvg4Z+e/Kz79jnDkKQRUz5YQUwAm2e5bhUtaATHZOCaB\nju/O0yJ6xSj3BVoBTTQAY+6q+VTZBTXlLWQk8BwBVHifLHounZhPir2+lSLwouEi\nSB47nlBy29q+l/g6p/LipziCrjmVM5PcmsvJnkRWldG4ha1tkEKRLn1yllRMz1hn\nTHaLNraMBd0WQSjjT6mnIE6emfY9LukbJLJyI+P+9mFV/0Ia4NKNRYawrtjOkUpe\naVds1TaFjJyQjLfzeIPVSM6iP32phTsqWbBLe6VJSySg5HxmRTp67tFmchVkjyPH\njedUvwMCbo2W5DbkW9sdlf1XKMal3H2rars6L/+1x0FQNSMyjRBy6vsqh2lAVRxJ\nAl+hFTOjfTcGXg/ZRgWmiXPiqpo08gWs4enJt+46b2ZWZ0rfhccRJVrEt8Ob+kmd\nA37tbIctcRrbG84zS5GrHNuNU+qTD+OKXkTNTRrEKHBUx/RIgpI+YqPI7m2RrBw2\nSEf8gwKFN6IB9JqA5Z/ZYtPl/63ZHWE/wg2uyWDYS9Itd/D0GAC6SfUK57jg1frQ\nnI1zHMSECJDYrroYoCbXDoX8WgIx08mntoo9enh59C1x+P2hMg0qj+PQlGRGF0vz\nKpZQ7HTDQzv2IRAoDR+RCuTQle1rAff3ekww+Pm0DkcmtQh9QwX3j/JoYVH883WB\nSwUNHRXgh3TMqm/yg1uVXzgQ5hkUfwU4atCWjQZD2EGnffszof5E53dK/RCYNgoY\nUt6AQSvH/5DOthLrzypkk+2w14oukTbsttbeczQ3LgiwncboxR3XXoN1Ui8P86yK\nGWaMTjcinPTJYvc8/2O2Q8KDmhsXgzKYDBkEmnJvpyvZlHZvPzTtUUQkSselhYYV\nRvBFVwW1bY6HFVBtw+fsPczJmJU+u2lkTcVJgpiEJLucRX+uney6BZhbgRU3Ki2U\nb9fgsOwT5qPezA/iw/j67B4eFo2H4gsdAZi6H2kaWT9gXZPoY6WhDrPrYMcPwTa3\ns734CLilY4ep7UindPYFGzxn74feSq60ErKDQJM69G+hnydFE2Ev5k1oUfp1unIf\nZsvp/1WhDzPmI673xR4rXJAG4W2n4io5zdNYgLGmEbLSLa508UZ/g0z6gllOlN3i\nC3soxo+6AyfCriVYKyvjhLkgRfP3tqRoNH2B9orO+MntbDbKJHi/ytFK7/+r+z9s\noXv/5ol/LUxdtUgStdKs3PrOBQBBp+1JmaLkIBV6DUNbGs5bIIlgkDWqBUhLlUkb\n3ShU3zWuMOXLDNCeLe337HNh6QGXh0jkTNBcN/IAFP0XbniAJ9mVm8IYDeHS+4FK\nIk+ZlzFdUnfh39dgHR/nPwIakw5PaBjls/RuevFTCLLu3MDhSIVd381DGQMy2mW4\nAg/3gfoQIKyty+y9kA4lBosqA7bSTx0IqZT81R+sOK3mLj15OIkGHzLGqn9aaTEo\nQms+4JXFvVWnRAqAX28fyCZqSBUAQIa2rEfYmVcTnCY9ZPdIDgSh8GcibZXwmnjL\nvTCIM1jsKaGU1sasnUFsEpGVSz511p5kT18g+JCtpUC/WRQaU0G9IRb4jGckpY1k\nMAL7aTiicxtr789fajNuYmYRPJiI1OIE8K7MGs6yhWSBYsgwM1i0TE2kM1oiqac3\ns/N01q9K/xmWauBg71JlqafMKGPYsWSDxXG6yw98wGarAhhpTV6DvcupqMhZn/Jt\nZTdjklzjfXgRjes3TVrmWuVeRlKXld8RsDYMCav8zDtMN0MZ+8HHaladQZwyn9qK\npMFnS/RZ4AmN01oe5DD7U1EXVulaH4S8vZmWwJuOCtrEiKtcGm/FFQ==</ns0:CipherValue></ns0:CipherData></ns0:EncryptedData></saml:EncryptedAssertion></ns0:Response>\n'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-47n6Gd3HY7FY2HuZs'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmpp5r8j1xi.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpp5r8j1xi.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa5c4dbd0>
    def test_encrypted_signed_response_2(self):
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=False,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
        )
tests/test_50_server.py:605: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:912: in _response
    return signed_instance_factory(response, self.sec, sign_class)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = '<?xml version="1.0"?>\n<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-47n6Gd3HY7FY2HuZs" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:42Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ns2:Reference URI="#id-47n6Gd3HY7FY2HuZs"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ns2:DigestValue/></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue/><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></ns0:Status><saml:EncryptedAssertion><ns0:EncryptedData xmlns:ns0="http://www.w3.org/2001/04/xmlenc#" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" Id="ED_10a98528-560e-4748-8240-15673993fc75" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/><ns1:KeyInfo><ns0:EncryptedKey Id="EK_3c1126d4-1c88-4012-b900-ca4e7bc962cf"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>f8ELltt1w1BGTvDIaP3/nVd9KyyjV31KtWdriy2yT+S7ZZh1DMfzkw9z8E2to4Dv\nwfJeSbpyzQZDCLFvYToIK7RVqUj9li0cmS1jsIjU2b2vSK5xAcmcHJ7c8kOdhpT8\nJziKlZaVBW+Z+9wCGkj5ZhDl/vz7p3wpIUvV9wp+yqQ=</ns0:CipherValue></ns0:CipherData></ns0:EncryptedKey></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>glF5cjBdnidC8Zd0WUyAL0gR5ixXC7NJIgZZH2G/CJ4bSYvumUgFN4RUNFZLHADq\nBv8C6qBMLW0xQTPdXUy0Izs4bcn2OK2pJlQAmHyi9vqmnI6HpOdN3TrjvMQh9sQz\n+RQawLkoMiC4/lsgl+ITRQyNHRVMfXbQZG6JNVFBhPTBhWupJfP8WP89hyi3lGNP\nxWXASWlOzdp1QQhVmHQOwpAhWgf3+kSp5s9ywFKFSa294FXZh95K7WotfGRH4eUp\njPt+FZXKlBc99orQ1G60SLhUNUi1KFLPdzNdpM8xvreC2+/1/XiLbBb8WLatbh1R\nOGC1OXEY1dQo88sNXuj96jl3OK8LvcK8HuRS0KGRrIV9kkMoQlOSyP5fhEsNcCbz\ndgEuTsIRKGym9ykLO9DikPEONMqAzwEcPFsasWF7fgzU20YRZXBSsPdjiKhZBhsq\nQjIhPgTCO5QDAxF8QY8cCJSu7JNmYfmqZa+hPtveCG64Cy1IYZYU+JaS9vn772bl\nshsRaSEFvmgzb1nMCQ52v82/uSSG1j0IQU/XA2HKUNFp+2vLPX9ds6fxQGXxMsfc\nhtTFlPb0qOq7L1r9gXxnEYFRqaUwAvYOwLh3oS4eFfUmcIxgGbSZO6pe3bVmQKe7\nus605F1etuK0M71UtU3BAH78CZsDnv/Mkkwug2R9kECOW9GAHZ7kQCv7i1QqOsd1\n2emsiWVMF6OfgHZ6nOyaVU0Yx0awYCWWu3UeAFCdw3BODFCCzll/yCYY5jg6GG3H\nocxa4N62eL83Oku+xBFFEEp0QMnI68wX2sfQ2gWmXPyN07DOqEtlm0etZQdMb0e7\nKyeqM/5gA5uG15/EHbnaghPWlKkpILjW9QRiSAxL3ZmMYxu5c59eIhapJFf+uFRI\n0faQ8/kyExASK5grWd6M0UgiGOED9Zhud8f3PF28fF1JB85FM5RjJEuGaKmeRm5G\nOybEs9bGkuTMX7DF8zyJ68awTNdWFCu9nCJxpLnQbtLE7R63QJ7bp6t9zahKonuA\nBcC9Ym9ofilH/75+htdN+NE+jJmDOYV4Z5tlFM5saTZfDFPUGxqpAqt3eFWTMC2F\ney6uZuqX3+9PUdR1a4GSpvg4Z+e/Kz79jnDkKQRUz5YQUwAm2e5bhUtaATHZOCaB\nju/O0yJ6xSj3BVoBTTQAY+6q+VTZBTXlLWQk8BwBVHifLHounZhPir2+lSLwouEi\nSB47nlBy29q+l/g6p/LipziCrjmVM5PcmsvJnkRWldG4ha1tkEKRLn1yllRMz1hn\nTHaLNraMBd0WQSjjT6mnIE6emfY9LukbJLJyI+P+9mFV/0Ia4NKNRYawrtjOkUpe\naVds1TaFjJyQjLfzeIPVSM6iP32phTsqWbBLe6VJSySg5HxmRTp67tFmchVkjyPH\njedUvwMCbo2W5DbkW9sdlf1XKMal3H2rars6L/+1x0FQNSMyjRBy6vsqh2lAVRxJ\nAl+hFTOjfTcGXg/ZRgWmiXPiqpo08gWs4enJt+46b2ZWZ0rfhccRJVrEt8Ob+kmd\nA37tbIctcRrbG84zS5GrHNuNU+qTD+OKXkTNTRrEKHBUx/RIgpI+YqPI7m2RrBw2\nSEf8gwKFN6IB9JqA5Z/ZYtPl/63ZHWE/wg2uyWDYS9Itd/D0GAC6SfUK57jg1frQ\nnI1zHMSECJDYrroYoCbXDoX8WgIx08mntoo9enh59C1x+P2hMg0qj+PQlGRGF0vz\nKpZQ7HTDQzv2IRAoDR+RCuTQle1rAff3ekww+Pm0DkcmtQh9QwX3j/JoYVH883WB\nSwUNHRXgh3TMqm/yg1uVXzgQ5hkUfwU4atCWjQZD2EGnffszof5E53dK/RCYNgoY\nUt6AQSvH/5DOthLrzypkk+2w14oukTbsttbeczQ3LgiwncboxR3XXoN1Ui8P86yK\nGWaMTjcinPTJYvc8/2O2Q8KDmhsXgzKYDBkEmnJvpyvZlHZvPzTtUUQkSselhYYV\nRvBFVwW1bY6HFVBtw+fsPczJmJU+u2lkTcVJgpiEJLucRX+uney6BZhbgRU3Ki2U\nb9fgsOwT5qPezA/iw/j67B4eFo2H4gsdAZi6H2kaWT9gXZPoY6WhDrPrYMcPwTa3\ns734CLilY4ep7UindPYFGzxn74feSq60ErKDQJM69G+hnydFE2Ev5k1oUfp1unIf\nZsvp/1WhDzPmI673xR4rXJAG4W2n4io5zdNYgLGmEbLSLa508UZ/g0z6gllOlN3i\nC3soxo+6AyfCriVYKyvjhLkgRfP3tqRoNH2B9orO+MntbDbKJHi/ytFK7/+r+z9s\noXv/5ol/LUxdtUgStdKs3PrOBQBBp+1JmaLkIBV6DUNbGs5bIIlgkDWqBUhLlUkb\n3ShU3zWuMOXLDNCeLe337HNh6QGXh0jkTNBcN/IAFP0XbniAJ9mVm8IYDeHS+4FK\nIk+ZlzFdUnfh39dgHR/nPwIakw5PaBjls/RuevFTCLLu3MDhSIVd381DGQMy2mW4\nAg/3gfoQIKyty+y9kA4lBosqA7bSTx0IqZT81R+sOK3mLj15OIkGHzLGqn9aaTEo\nQms+4JXFvVWnRAqAX28fyCZqSBUAQIa2rEfYmVcTnCY9ZPdIDgSh8GcibZXwmnjL\nvTCIM1jsKaGU1sasnUFsEpGVSz511p5kT18g+JCtpUC/WRQaU0G9IRb4jGckpY1k\nMAL7aTiicxtr789fajNuYmYRPJiI1OIE8K7MGs6yhWSBYsgwM1i0TE2kM1oiqac3\ns/N01q9K/xmWauBg71JlqafMKGPYsWSDxXG6yw98wGarAhhpTV6DvcupqMhZn/Jt\nZTdjklzjfXgRjes3TVrmWuVeRlKXld8RsDYMCav8zDtMN0MZ+8HHaladQZwyn9qK\npMFnS/RZ4AmN01oe5DD7U1EXVulaH4S8vZmWwJuOCtrEiKtcGm/FFQ==</ns0:CipherValue></ns0:CipherData></ns0:EncryptedData></saml:EncryptedAssertion></ns0:Response>\n'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-47n6Gd3HY7FY2HuZs'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-47n6Gd3HY7FY2HuZs', '--output', '/tmp/tmp8_r6p1a0.xml', '/tmp/tmpp5r8j1xi.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpp5r8j1xi.xml"
output=
_________________ TestServer1.test_encrypted_signed_response_3 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-unz7tV3M9HdUj0g6i" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:43Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-unz7tV3M9HdUj0g6i"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-LmBB71Ab9cpgjsVyH" IssueInstant="2025-04-21T14:10:43Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-LmBB71Ab9cpgjsVyH"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:43Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:43Z" NotOnOrAfter="2025-04-21T14:15:43Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-LmBB71Ab9cpgjsVyH'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpyhepof_7.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpyhepof_7.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa5c4e830>
    def test_encrypted_signed_response_3(self):
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=False,
            encrypt_cert_assertion=cert_str,
        )
tests/test_50_server.py:650: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-unz7tV3M9HdUj0g6i" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:43Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-unz7tV3M9HdUj0g6i"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-LmBB71Ab9cpgjsVyH" IssueInstant="2025-04-21T14:10:43Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-LmBB71Ab9cpgjsVyH"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:43Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:43Z" NotOnOrAfter="2025-04-21T14:15:43Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-LmBB71Ab9cpgjsVyH'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-LmBB71Ab9cpgjsVyH', '--output', '/tmp/tmponogz__2.xml', '/tmp/tmpyhepof_7.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpyhepof_7.xml"
output=
_________________ TestServer1.test_encrypted_signed_response_4 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-HIU1nPmJfl8WbbqYC" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:43Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-HIU1nPmJfl8WbbqYC"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-UeWVZhDCn5FXf7T45" IssueInstant="2025-04-21T14:10:43Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-UeWVZhDCn5FXf7T45"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:43Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:43Z" NotOnOrAfter="2025-04-21T14:15:43Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_2852963f-d9ef-442f-8519-5102c66ad446" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_9097afb9-7e09-496f-9049-6de812902c50"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQzWhcNMzUwNDE5MTQxMDQzWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEApXumjLbXia9bxifQZTewIKw4T0UdhtW1Gj1P7drN78l4DysaBhJyD8FP\nfWtaHQQi2iB5k6o+chyXlfxLaq3/TdSxBfE+LQFkBOEuJbA3VMRHXpfMP0hQSTFd\nZSVvOvktBUts8nah9BZT3M+Re5+jGAqTS0rMnsB6JY7t9wyyUMnpQGv75zmchztC\n1cUC8mLjXuPH43lYg2Jw5ZVFU0HUVK54Dyui861iFsKrfYDMOw+AATEalcT5OA0q\nRJs4bROcbyQJkNyeD9eDqI4JCjv1JdicSTkg6GKQrm08w5B1emK+5GKN//lXSG+3\nVdmeCV0OIPfuRQEGWa3lyAeNJwVi1wIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAH5R\n65mBaaNdsF/F4p1+QDYCuECk/onqZOLZK9/3Tka0XfxEoATnGzn2E+ZC/dlqGOJ9\n+Oy5DAaBTEVBAGajxsjbkjIyCU4jljrBFLqKSbBWZCK1eerbTqWtuEDEbqKN4brd\nngM5E5l94xJw5uEcelUlBpKyS4d7ZuUZ3JGFfueo</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>gnii3EnH5ySoqZmwLZkhJSErgF25vkANalDFm9jJVCwiGN4F9ui4VYYfOeGb4XxG\nKlvZKCyOWtBFiYX/8Ja6TDa9uyQD4LnGMLDyvDHeS/e1FKVQRhYtQNWwyGHuHY12\nj+BM2Dao+sFDqZG4nWyTAAcymwpCbNlvJyLFOd3+NErF9ZAPesAA6Z6wagHxtZb4\n48FFF77aioTHk7CDe5in8qziKbLRYCZkB8YE47vt+Srlp9l9PGXr5YvMV5ZG/M+R\nnuIxnqFKaqDF10a8tBptcvGlsgz//afDAqIa+ch1okE6d+pcYuMjFsAIIawATYv/\nucrP+OduiHAAfV2anKGX3A==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>6JFQhKB5EVrj8cBj8gntXl78Zo3Emmn1LS4B+3C4iyv71xe00mVX1N0WtWQme5wz\nenQX76Q8+5PRD928mQRycxR6YJHvEfP0ZrcNOGR0a6QU1boOVxyVbYdgVGqsL6yr\nRZt5oJgj65Slj/KTYtE79FZJ9d6gz/QZWgPXMC9AU0eWUmBKrElrGeEbV3/Qts/W\n1bvMb1ALCoiBHmsn02rukey/qZw5EcWw2N4Uy7kSQx2q4bX+bEUohXDL0JVOE0Rg\nrCdCCgfN+9qYJoTAbySpcpjGOQOmed0Bu8GbEQURS50zEDd+j+zUjAqpHOpmBH3m\nLwm5VPg8JqKEswDFk6S8sagr4yenlr+ZVlOeTba5YydgQPdYLCzIlq0Nl8yk3T4d\nihLjvA3NZpKcjKC7u8zDZDLbWWxKzgKpaEV65ijsb2cKdgH8qD8rbq0rGHELTOd5\nFxRP+UP4PLsyB+quvZCUaXiHJyddxZagyxjKjSHRD+jB+8mhN1p2YHYQM7ip11Up\nJbPx+44q///HhLYVBD9QY5D/2VW30mRz/myWE3A0WwXH0seWKELk4rz4xXbqA9Dd\n+mWZdiulkpDIMjsJkEVqzRC2O0pWEFge3PZaTVwU66vADwKRuLrVG7OiD4RBYr3K\nln7r4azCAkGw1vtiAjkDH8Z0At7LRd7LkW8Nrt34oiTMGH9owOQqUK3tPHcy9qeq\n4cJCyDVOoNzLDbKsgHjZMMn0NMLOBIg8d0twPB3tsD+yVTTNpAMv2nTOHAdMsXKj\nqqAvjVuAAHRugeHg1C/To59cIDlJBOwM/ESCGuAcAgnUmALM8V+ZR/c/6YOJEHME\nlxeDWnk1M8xAJOzp1OY+ZQLuSNIHrtk6OyXLbn5Mcoixe8GVlvWVtAWGkqYu+8FD\n/aSIsPQWVL8h+9HKE8dz3xxTgPuAKjf8jsS4EpAFeJhx2GPwmw/X8S7Q7BsfP0gv\nqDfRtoAvm9zStySfCIpMuQ6pEGS7R27nEfCHmygLlETaUAURMPAs58NNXXmOWtqP\nJ7sgPsbZt7MV5kJj9pMazw7jhOHV/fqqsxjfoqfwmkKdbTPEagh9f73ZhJR7LDfz\n2r13hjzSUYOv7coKk+jugb3FBVdKYLH0wT4Jl4nl5eF7Ep+yMUpdzq0ws7epziOf\ne8N3rVZVlS+CZWjvj7EzT81u+ccdMdFSeZjbK99GCIwjRG5K76rNaiyXb+K5eJH2\nOO1EVyePQnPakb8qxDQY5ROjWzu60Pj+RodTSYDSVy1GeZ6lDupJMeRFDV9l5XPQ\nI3IgZOKPGlLRt1VtHRREtKIikkcUR+QR7bGhwuApmz6ZK6M1GifNflwn6KH4maG8\nhfVTUVJJ4cPWteFayip+zauzllMvB/JTjiLrlSuek8pIqkulr8a/ch0XE9V1LC1b\nIVfVbi9RMdX84TPJyyKd0L4jfW9droRUiC5SC47dMf1vhU/aO8c69zyrh5CfzRDE\nBU6tbqDy0jXLX5YvWjQmqE9OPIc+YpNvpNJstdXAEgkDYwp6giwYDCY4oHCCZNz9\nkonOAH0bpP0rV1PZbKjFdppZGsCHbQokUW+BaNbSn+8eo39BNRAbD1bY1S06aK2j\niQENq8z5U134jQDiHuUqAK+Xn5OL9cNZMSkITIfqtb79wp+Z3uNyPYlMJq0nheKH\nsDN8+hhIh5XU3jkJLAcEaDEGytDz5k07eH42v8g8fdbKAhxbUCHKsh0v9+vg516/\nWJEZwayWqqIMyZIFD4HwpSi9rhTXY0+cTdG7KOBQuO7lxUrZBLT93DUGkEUzNa04\n7rioEnZqcKkayJpjPXNPd1iem+gmbHTK3ZEY2jCt6dU4qumeJHNmvIQV6Y1VX+IJ\nZ5VrpqTefU42gM8yEUwDItjD2kWu5wgeA7VfrDDMS0V9oWpOh+5XNYhwYHO02yLM\n4DOdYpfX1Wvg0snfipjkWnjyUGXoUVqy36eEkvqA7O71wh+aSXy+fgX7odZMVnBX\ntrZ8wH4Bv4hqH6VMjqMpFrenN/ETpxZLQyAvcD8Gb5ofbYvHoW0vs8jcrTRKr81L\nGzWcUm+7apNsIE4TgIq69QYl4N5RVQpva6OYGEGQdiFQ6zQAcj42fsxMHQpeg4kg\nFJIY0iKoQMsv8yfLm0vtTTZaiEbP9edrUd8JEMLcv/0gWRPggLzECr6qkNWGp45/\nEBYes4fcVDUp+Hq/BkGFHfJ0S2uKa2oEkwuStGggkL6DpFmLD6CEO4kGExdu+Cfs\nzmsFSJN3UtIrLncSSMmyj5FQqokEKi3vLXfkRAZAdzs/qaRJ8+YOdX+SxeBt0IM/\nqzesjpOtXKSgknWqHirc9bLN4PSPGl8xBhfvHuihlVvc7nmZAB2KbyU3ImQVe2R4\nt/xZA0Q6sgyb9eoCfh5IRNTk7HXtClXhscha4nwqnTxlX3RNIvgk4A==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-UeWVZhDCn5FXf7T45'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpik6z8ju4.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpik6z8ju4.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1 object at 0x3ffa585edf0>
    def test_encrypted_signed_response_4(self):
    
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str,
        )
tests/test_50_server.py:697: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa2f712b0>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-HIU1nPmJfl8WbbqYC" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:43Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-HIU1nPmJfl8WbbqYC"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-UeWVZhDCn5FXf7T45" IssueInstant="2025-04-21T14:10:43Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-UeWVZhDCn5FXf7T45"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">d53394fcb8ca601c2ee3ee776d66e477000194b9c122713280d42e81d2c07e38</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:43Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:43Z" NotOnOrAfter="2025-04-21T14:15:43Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_2852963f-d9ef-442f-8519-5102c66ad446" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_9097afb9-7e09-496f-9049-6de812902c50"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQzWhcNMzUwNDE5MTQxMDQzWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEApXumjLbXia9bxifQZTewIKw4T0UdhtW1Gj1P7drN78l4DysaBhJyD8FP\nfWtaHQQi2iB5k6o+chyXlfxLaq3/TdSxBfE+LQFkBOEuJbA3VMRHXpfMP0hQSTFd\nZSVvOvktBUts8nah9BZT3M+Re5+jGAqTS0rMnsB6JY7t9wyyUMnpQGv75zmchztC\n1cUC8mLjXuPH43lYg2Jw5ZVFU0HUVK54Dyui861iFsKrfYDMOw+AATEalcT5OA0q\nRJs4bROcbyQJkNyeD9eDqI4JCjv1JdicSTkg6GKQrm08w5B1emK+5GKN//lXSG+3\nVdmeCV0OIPfuRQEGWa3lyAeNJwVi1wIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAH5R\n65mBaaNdsF/F4p1+QDYCuECk/onqZOLZK9/3Tka0XfxEoATnGzn2E+ZC/dlqGOJ9\n+Oy5DAaBTEVBAGajxsjbkjIyCU4jljrBFLqKSbBWZCK1eerbTqWtuEDEbqKN4brd\nngM5E5l94xJw5uEcelUlBpKyS4d7ZuUZ3JGFfueo</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>gnii3EnH5ySoqZmwLZkhJSErgF25vkANalDFm9jJVCwiGN4F9ui4VYYfOeGb4XxG\nKlvZKCyOWtBFiYX/8Ja6TDa9uyQD4LnGMLDyvDHeS/e1FKVQRhYtQNWwyGHuHY12\nj+BM2Dao+sFDqZG4nWyTAAcymwpCbNlvJyLFOd3+NErF9ZAPesAA6Z6wagHxtZb4\n48FFF77aioTHk7CDe5in8qziKbLRYCZkB8YE47vt+Srlp9l9PGXr5YvMV5ZG/M+R\nnuIxnqFKaqDF10a8tBptcvGlsgz//afDAqIa+ch1okE6d+pcYuMjFsAIIawATYv/\nucrP+OduiHAAfV2anKGX3A==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>6JFQhKB5EVrj8cBj8gntXl78Zo3Emmn1LS4B+3C4iyv71xe00mVX1N0WtWQme5wz\nenQX76Q8+5PRD928mQRycxR6YJHvEfP0ZrcNOGR0a6QU1boOVxyVbYdgVGqsL6yr\nRZt5oJgj65Slj/KTYtE79FZJ9d6gz/QZWgPXMC9AU0eWUmBKrElrGeEbV3/Qts/W\n1bvMb1ALCoiBHmsn02rukey/qZw5EcWw2N4Uy7kSQx2q4bX+bEUohXDL0JVOE0Rg\nrCdCCgfN+9qYJoTAbySpcpjGOQOmed0Bu8GbEQURS50zEDd+j+zUjAqpHOpmBH3m\nLwm5VPg8JqKEswDFk6S8sagr4yenlr+ZVlOeTba5YydgQPdYLCzIlq0Nl8yk3T4d\nihLjvA3NZpKcjKC7u8zDZDLbWWxKzgKpaEV65ijsb2cKdgH8qD8rbq0rGHELTOd5\nFxRP+UP4PLsyB+quvZCUaXiHJyddxZagyxjKjSHRD+jB+8mhN1p2YHYQM7ip11Up\nJbPx+44q///HhLYVBD9QY5D/2VW30mRz/myWE3A0WwXH0seWKELk4rz4xXbqA9Dd\n+mWZdiulkpDIMjsJkEVqzRC2O0pWEFge3PZaTVwU66vADwKRuLrVG7OiD4RBYr3K\nln7r4azCAkGw1vtiAjkDH8Z0At7LRd7LkW8Nrt34oiTMGH9owOQqUK3tPHcy9qeq\n4cJCyDVOoNzLDbKsgHjZMMn0NMLOBIg8d0twPB3tsD+yVTTNpAMv2nTOHAdMsXKj\nqqAvjVuAAHRugeHg1C/To59cIDlJBOwM/ESCGuAcAgnUmALM8V+ZR/c/6YOJEHME\nlxeDWnk1M8xAJOzp1OY+ZQLuSNIHrtk6OyXLbn5Mcoixe8GVlvWVtAWGkqYu+8FD\n/aSIsPQWVL8h+9HKE8dz3xxTgPuAKjf8jsS4EpAFeJhx2GPwmw/X8S7Q7BsfP0gv\nqDfRtoAvm9zStySfCIpMuQ6pEGS7R27nEfCHmygLlETaUAURMPAs58NNXXmOWtqP\nJ7sgPsbZt7MV5kJj9pMazw7jhOHV/fqqsxjfoqfwmkKdbTPEagh9f73ZhJR7LDfz\n2r13hjzSUYOv7coKk+jugb3FBVdKYLH0wT4Jl4nl5eF7Ep+yMUpdzq0ws7epziOf\ne8N3rVZVlS+CZWjvj7EzT81u+ccdMdFSeZjbK99GCIwjRG5K76rNaiyXb+K5eJH2\nOO1EVyePQnPakb8qxDQY5ROjWzu60Pj+RodTSYDSVy1GeZ6lDupJMeRFDV9l5XPQ\nI3IgZOKPGlLRt1VtHRREtKIikkcUR+QR7bGhwuApmz6ZK6M1GifNflwn6KH4maG8\nhfVTUVJJ4cPWteFayip+zauzllMvB/JTjiLrlSuek8pIqkulr8a/ch0XE9V1LC1b\nIVfVbi9RMdX84TPJyyKd0L4jfW9droRUiC5SC47dMf1vhU/aO8c69zyrh5CfzRDE\nBU6tbqDy0jXLX5YvWjQmqE9OPIc+YpNvpNJstdXAEgkDYwp6giwYDCY4oHCCZNz9\nkonOAH0bpP0rV1PZbKjFdppZGsCHbQokUW+BaNbSn+8eo39BNRAbD1bY1S06aK2j\niQENq8z5U134jQDiHuUqAK+Xn5OL9cNZMSkITIfqtb79wp+Z3uNyPYlMJq0nheKH\nsDN8+hhIh5XU3jkJLAcEaDEGytDz5k07eH42v8g8fdbKAhxbUCHKsh0v9+vg516/\nWJEZwayWqqIMyZIFD4HwpSi9rhTXY0+cTdG7KOBQuO7lxUrZBLT93DUGkEUzNa04\n7rioEnZqcKkayJpjPXNPd1iem+gmbHTK3ZEY2jCt6dU4qumeJHNmvIQV6Y1VX+IJ\nZ5VrpqTefU42gM8yEUwDItjD2kWu5wgeA7VfrDDMS0V9oWpOh+5XNYhwYHO02yLM\n4DOdYpfX1Wvg0snfipjkWnjyUGXoUVqy36eEkvqA7O71wh+aSXy+fgX7odZMVnBX\ntrZ8wH4Bv4hqH6VMjqMpFrenN/ETpxZLQyAvcD8Gb5ofbYvHoW0vs8jcrTRKr81L\nGzWcUm+7apNsIE4TgIq69QYl4N5RVQpva6OYGEGQdiFQ6zQAcj42fsxMHQpeg4kg\nFJIY0iKoQMsv8yfLm0vtTTZaiEbP9edrUd8JEMLcv/0gWRPggLzECr6qkNWGp45/\nEBYes4fcVDUp+Hq/BkGFHfJ0S2uKa2oEkwuStGggkL6DpFmLD6CEO4kGExdu+Cfs\nzmsFSJN3UtIrLncSSMmyj5FQqokEKi3vLXfkRAZAdzs/qaRJ8+YOdX+SxeBt0IM/\nqzesjpOtXKSgknWqHirc9bLN4PSPGl8xBhfvHuihlVvc7nmZAB2KbyU3ImQVe2R4\nt/xZA0Q6sgyb9eoCfh5IRNTk7HXtClXhscha4nwqnTxlX3RNIvgk4A==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-UeWVZhDCn5FXf7T45'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-UeWVZhDCn5FXf7T45', '--output', '/tmp/tmpj_q9_u_8.xml', '/tmp/tmpik6z8ju4.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpik6z8ju4.xml"
output=
____________________ TestServer1.test_encrypted_response_6 _____________________
self = <test_50_server.TestServer1 object at 0x3ffa58a7540>
    def test_encrypted_response_6(self):
        _server = Server("idp_conf_verify_cert")
    
        cert_str_advice, cert_key_str_advice = generate_cert()
    
        cert_str_assertion, cert_key_str_assertion = generate_cert()
    
>       _resp = _server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=False,
            sign_assertion=False,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str_advice,
            encrypt_cert_assertion=cert_str_assertion,
        )
tests/test_50_server.py:911: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:832: in create_authn_response
    args = self.gather_authn_response_args(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.server.Server object at 0x3ffa4e8a8b0>
sp_entity_id = 'urn:mace:example.com:saml:roland:sp', name_id_policy = None
userid = None
kwargs = {'encrypt_assertion': True, 'encrypt_assertion_self_contained': True, 'encrypt_cert_advice': '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ0WhcNMzUwNDE5MTQxMDQ0WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAv/HibD4udXRWoU42IHAX01EsosAQXmfzZIEj5rZhit7uCBsXSs6V05Ob\nD4lwpP0dAwK5VuHFhpNRtTGOZba7wzKSI6zStVo9lzYRPdqvZGUgo8ar7y79QYch\nOmZO1px0+CHWJSkfu9/0rxG2ZseX1YFm/XusJHCBI+L5W+XysSYe7Wbfhlec332m\nyfRVEsN7XlbH0hwkVQE2CuLWJbe/6GSS1cea2an+xbyBBr4vYyo7eKbLjqnxQZ2+\nDAusxXJ7XsHOPG0I7wsdKTYIO9fRrxBiyLifZx+yLXPloS4z9pzbp4g4KbC4uRZc\nozQlde2skOI3rU0qsDOguB2XAXtUywIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAASB\nm137auqO3nvlTrf7Nqg9TykIdaj7Hes0I7xuK7gp89ZaTLmdQS+ogZPDmXVnzHv4\nNKD0jPi0nZEHoGHZ+nbA1BWOnm3PdVI/cUaSHLGdaF2RDbNxcaxatXBEgUoUtqro\nBQGDJIXfrpCOaymBrhY+URYNkk7m87v4NOKffx0J\n-----END CERTIFICATE-----\n', 'encrypt_cert_assertion': '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ0WhcNMzUwNDE5MTQxMDQ0WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAqHBuS2n4kYjvAJwm4+fj2xKwAGRx17orcG8uqSxk77QIW+ey5K7iSUo8\nrt5QZy9K/vBQXG00HS99cMZ15vL8ojHSJZrpUC1xMKGD99bmXuso/fLIo4mATP2w\nZ5/qrREWZUWGT4eOSMIjjTGDGDnGqZJai1mrxfjew3x+g2NZkIItMIU+gK902J2s\n/mPT7i8T7NvcNFk8Hh5cA9bAi9p5Y9iFgIkSS8uaz/3wypLY9OiU89NTpd0UDSa0\n2N8OsWdswpd739lOerMJ1+cfz5uc/sVbXDQOm+JWL94sqEgA8dkfSchHaVV0yC5Q\naNTh0/4+YxWzdGL78woGnbB/XzBY1wIDAQABMA0GCSqGSIb3DQEBCwUAA4GBALK7\nOm4eQJGafMwLNZSvlwUQ1bUfGVzdHGP3UJThE2VLiS3UB4BwbRYKZNpMhPtuEzvM\nkLweEEnD7dg6guU58jGvJ0zdCclwFuHPcbn5p8aKfavn1vfCZs8dU/jgiSHgSOhB\nrRpOfGxTlZCwr1ExkUZgVzBybbeaoDcynESjqxY+\n-----END CERTIFICATE-----\n', ...}
args = {'best_effort': False, 'encrypt_assertion': True, 'encrypt_assertion_self_contained': True, 'encrypt_cert_advice': '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ0WhcNMzUwNDE5MTQxMDQ0WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAv/HibD4udXRWoU42IHAX01EsosAQXmfzZIEj5rZhit7uCBsXSs6V05Ob\nD4lwpP0dAwK5VuHFhpNRtTGOZba7wzKSI6zStVo9lzYRPdqvZGUgo8ar7y79QYch\nOmZO1px0+CHWJSkfu9/0rxG2ZseX1YFm/XusJHCBI+L5W+XysSYe7Wbfhlec332m\nyfRVEsN7XlbH0hwkVQE2CuLWJbe/6GSS1cea2an+xbyBBr4vYyo7eKbLjqnxQZ2+\nDAusxXJ7XsHOPG0I7wsdKTYIO9fRrxBiyLifZx+yLXPloS4z9pzbp4g4KbC4uRZc\nozQlde2skOI3rU0qsDOguB2XAXtUywIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAASB\nm137auqO3nvlTrf7Nqg9TykIdaj7Hes0I7xuK7gp89ZaTLmdQS+ogZPDmXVnzHv4\nNKD0jPi0nZEHoGHZ+nbA1BWOnm3PdVI/cUaSHLGdaF2RDbNxcaxatXBEgUoUtqro\nBQGDJIXfrpCOaymBrhY+URYNkk7m87v4NOKffx0J\n-----END CERTIFICATE-----\n', ...}
param_defaults = {'best_effort': False, 'encrypt_assertion': False, 'encrypt_assertion_self_contained': True, 'encrypt_cert_advice': None, ...}
param = 'encrypt_cert_assertion', val_default = None
val_kw = '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ0WhcNMzUwNDE5MTQxMDQ0WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAqHBuS2n4kYjvAJwm4+fj2xKwAGRx17orcG8uqSxk77QIW+ey5K7iSUo8\nrt5QZy9K/vBQXG00HS99cMZ15vL8ojHSJZrpUC1xMKGD99bmXuso/fLIo4mATP2w\nZ5/qrREWZUWGT4eOSMIjjTGDGDnGqZJai1mrxfjew3x+g2NZkIItMIU+gK902J2s\n/mPT7i8T7NvcNFk8Hh5cA9bAi9p5Y9iFgIkSS8uaz/3wypLY9OiU89NTpd0UDSa0\n2N8OsWdswpd739lOerMJ1+cfz5uc/sVbXDQOm+JWL94sqEgA8dkfSchHaVV0yC5Q\naNTh0/4+YxWzdGL78woGnbB/XzBY1wIDAQABMA0GCSqGSIb3DQEBCwUAA4GBALK7\nOm4eQJGafMwLNZSvlwUQ1bUfGVzdHGP3UJThE2VLiS3UB4BwbRYKZNpMhPtuEzvM\nkLweEEnD7dg6guU58jGvJ0zdCclwFuHPcbn5p8aKfavn1vfCZs8dU/jgiSHgSOhB\nrRpOfGxTlZCwr1ExkUZgVzBybbeaoDcynESjqxY+\n-----END CERTIFICATE-----\n'
val_config = None, arg = 'encrypted_advice_attributes'
    def gather_authn_response_args(self, sp_entity_id, name_id_policy, userid, **kwargs):
        kwargs["policy"] = kwargs.get("release_policy")
    
        # collect args and return them
        args = {}
    
        # XXX will be passed to _authn_response
        param_defaults = {
            "policy": None,
            "best_effort": False,
            "sign_assertion": False,
            "sign_response": False,
            "encrypt_assertion": False,
            "encrypt_assertion_self_contained": True,
            "encrypted_advice_attributes": False,
            "encrypt_cert_advice": None,
            "encrypt_cert_assertion": None,
            # need to be named sign_alg and digest_alg
        }
        for param, val_default in param_defaults.items():
            val_kw = kwargs.get(param)
            val_config = self.config.getattr(param, "idp")
            args[param] = val_kw if val_kw is not None else val_config if val_config is not None else val_default
    
        for arg, attr, eca, pefim in [
            ("encrypted_advice_attributes", "verify_encrypt_cert_advice", "encrypt_cert_advice", kwargs["pefim"]),
            ("encrypt_assertion", "verify_encrypt_cert_assertion", "encrypt_cert_assertion", False),
        ]:
    
            if args[arg] or pefim:
                _enc_cert = self.config.getattr(attr, "idp")
    
                if _enc_cert is not None:
                    if kwargs[eca] is None:
                        raise CertificateError(
                            "No SPCertEncType certificate for encryption " "contained in authentication " "request."
                        )
                    if not _enc_cert(kwargs[eca]):
>                       raise CertificateError("Invalid certificate for encryption!")
E                       saml2.cert.CertificateError: Invalid certificate for encryption!
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:736: CertificateError
_________________ TestServer1NonAsciiAva.test_signed_response __________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-q403wYqsw2J7A7DLM" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:45Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-TJm2FOPJpTQFRujvl" IssueInstant="2025-04-21T14:10:45Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-TJm2FOPJpTQFRujvl"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">cc0734c62189f211ee4bd8259829f707e4bffe76f55e97f7c81ab80369249cec</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:45Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:45Z" NotOnOrAfter="2025-04-21T14:15:45Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-TJm2FOPJpTQFRujvl'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp0_gg_j5y.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp0_gg_j5y.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa58d1390>
    def test_signed_response(self):
        name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
        ava = {"givenName": ["Derek"], "sn": ["Jeter"], "mail": ["derek@nyy.mlb.com"], "title": "The man"}
    
>       signed_resp = self.server.create_authn_response(
            ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=name_id,
            sign_assertion=True,
        )
tests/test_50_server.py:1517: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-q403wYqsw2J7A7DLM" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:45Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-TJm2FOPJpTQFRujvl" IssueInstant="2025-04-21T14:10:45Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-TJm2FOPJpTQFRujvl"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">cc0734c62189f211ee4bd8259829f707e4bffe76f55e97f7c81ab80369249cec</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:45Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:45Z" NotOnOrAfter="2025-04-21T14:15:45Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-TJm2FOPJpTQFRujvl'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-TJm2FOPJpTQFRujvl', '--output', '/tmp/tmp67uc0vkj.xml', '/tmp/tmp0_gg_j5y.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp0_gg_j5y.xml"
output=
________________ TestServer1NonAsciiAva.test_signed_response_1 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-7tGgsEHaYRtHe4R0g" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:45Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7tGgsEHaYRtHe4R0g"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-syq0E67NJuzLWbzqz" IssueInstant="2025-04-21T14:10:45Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-syq0E67NJuzLWbzqz"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:45Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:45Z" NotOnOrAfter="2025-04-21T14:15:45Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-syq0E67NJuzLWbzqz'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmppiorobsv.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmppiorobsv.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa58d1630>
    def test_signed_response_1(self):
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
        )
tests/test_50_server.py:1540: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-7tGgsEHaYRtHe4R0g" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:45Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-7tGgsEHaYRtHe4R0g"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-syq0E67NJuzLWbzqz" IssueInstant="2025-04-21T14:10:45Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-syq0E67NJuzLWbzqz"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:45Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:45Z" NotOnOrAfter="2025-04-21T14:15:45Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-syq0E67NJuzLWbzqz'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-syq0E67NJuzLWbzqz', '--output', '/tmp/tmpzcxegqel.xml', '/tmp/tmppiorobsv.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmppiorobsv.xml"
output=
________________ TestServer1NonAsciiAva.test_signed_response_2 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-0ostGSuBJZzyLGaYS" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:45Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-0ostGSuBJZzyLGaYS"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-bnyEi2bQ8EspgyT7K" IssueInstant="2025-04-21T14:10:45Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:45Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:45Z" NotOnOrAfter="2025-04-21T14:15:45Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-0ostGSuBJZzyLGaYS'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmp1gta2jyz.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp1gta2jyz.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa512fee0>
    def test_signed_response_2(self):
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=False,
        )
tests/test_50_server.py:1571: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-0ostGSuBJZzyLGaYS" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:45Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-0ostGSuBJZzyLGaYS"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-bnyEi2bQ8EspgyT7K" IssueInstant="2025-04-21T14:10:45Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:45Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:45Z" NotOnOrAfter="2025-04-21T14:15:45Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-0ostGSuBJZzyLGaYS'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-0ostGSuBJZzyLGaYS', '--output', '/tmp/tmpc77hwp17.xml', '/tmp/tmp1gta2jyz.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp1gta2jyz.xml"
output=
________________ TestServer1NonAsciiAva.test_signed_response_3 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-9m2482Q1ZKJ6JwN4G" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:46Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-v84ACvkCkQC7v2pFN" IssueInstant="2025-04-21T14:10:46Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-v84ACvkCkQC7v2pFN"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:46Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:46Z" NotOnOrAfter="2025-04-21T14:15:46Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-v84ACvkCkQC7v2pFN'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp545t9a5d.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp545t9a5d.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa51059d0>
    def test_signed_response_3(self):
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=False,
            sign_assertion=True,
        )
tests/test_50_server.py:1595: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-9m2482Q1ZKJ6JwN4G" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:46Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-v84ACvkCkQC7v2pFN" IssueInstant="2025-04-21T14:10:46Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-v84ACvkCkQC7v2pFN"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:46Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:46Z" NotOnOrAfter="2025-04-21T14:15:46Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-v84ACvkCkQC7v2pFN'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-v84ACvkCkQC7v2pFN', '--output', '/tmp/tmpc600_jry.xml', '/tmp/tmp545t9a5d.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp545t9a5d.xml"
output=
___________ TestServer1NonAsciiAva.test_encrypted_signed_response_1 ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-N97EvkZ7DkBl5EPfM" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:46Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-N97EvkZ7DkBl5EPfM"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-5KV5mjqwdzeDe1sjG" IssueInstant="2025-04-21T14:10:46Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-5KV5mjqwdzeDe1sjG"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:46Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:46Z" NotOnOrAfter="2025-04-21T14:15:46Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_05f3c7aa-f030-4c56-a1a7-1faa382ff56d" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_eb0352ec-b819-4add-a5b3-e2edf2fd4ce1"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ2WhcNMzUwNDE5MTQxMDQ2WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAt9putF2oE24Cu0fGRHnAjVIBsN+uRaZOUWIYCufSJDnXgu57DipzAW/H\n9yJaxWahAFUicnOMcb9qvxHD+ACwC1DN8BUWOkNTuFtaGUMEjtrZPgYrFQVfoEZp\nRNC1MTkNAb06q10lxdZy1+2+nCHo7+3xjmjs1ZEjcNGd3hgtnDL1tnmQOJo+lXN2\nP3IQXFNVwYQGKQ+YfELXHP461F+XrLdXwbN5dtDyR8zhvTTytnU5SU6x5btDpOs2\n95MSkgHOPmfCmw7BnMFVcu01Wr8W0QtZ8V344taUjRC1TKVWjLgiqHZBYYyZrPlz\n8yftDGbEi/mM122MiVm/GMZvbB8ShQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAKIe\nq8vJN5YkSw9db/+2ltbF0cCNIwD9FJsjpQdbAqeibmqNRAltzOZvgrPL4ns6AbMp\neTLsCxZFod9MAV0+gRHhuOERec8klJ43rDocS9aOwo/YFEzKyE1tZM5+41ONtIlu\nIX4wJGYq5fLifoyVQOGAwWC/UGtehLrww0GxkAh0</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>VxuLRH573VEfe6ucLdToKnJNInQ3iN9G3Batd1CEriIPjWAHVhMWyGEa1GG3d7nl\nmWsnrLF2EW3XJ/pN9u5n92SWUTMn3mMCMytWgXgY9uY1zclggfftimS00CBe1N/Y\nhNvajNX60ibY9nfGsWvoUtQTWLuuzpiOHPNTkE7jiZDzkevdlbx6OjQLiNXVH5hU\nshHyY1htLbYntX/map8sx8TECS6GRg1utVzaqsBD6mDNlOqJA3IzSnNpvq8TejLo\nT+rMUmoeAGNtSnc5Dy0FiL1oH8rLUPLCFNlu8zW2L49I3obtQO6W3Ag3QsNV82M5\npNxnmCawrlXxU95HXKHD/g==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>w72uLEWVaAbev+FuDrj/YzEtUfSa0yQEJPwpoKLVa3eH76ivvMidJF4Z9cH+ecQs\nB8KG5+1Q8011t+sSUTYTIUlFeAAR8BgWIdmNiOQKyW08xJvTvM3auj/WiF9izD0j\n0RGGia8KLYKpYXte/On4nXApFOOnLKRGgQJKJ9d2Z7yYFOOTKhxT0hP7aTv9pKLV\ntQaFwNEXg3PAn2V5uCpyIeonSUxflT+4LKQDIYiAMKaYRTTBE5hJhwTFCTfEV4VZ\nqbokP4/6aLZWZgHqqkuM5PVa4NAao5eSJVpLp+M9E7RacyLEXd/N0J+Vhb2xwLIL\nK0TC1DvaWv3H1xpd5Od5cqymAEQiC+CI9zYl5N8bsLh5jys3KjLWqVi4qmfnlR/c\nq3MuGAR26NwA+KU5187C+YSImfGwTQ+3YhXIstl9eEeQx/MMOZLO0KrBQHMgR/nq\n8bXbjEdt63Dvi5X6TMd+WncebkipaOJIZfSWvT8biJVO6Kqw4GmcNXA9OG3WSYIx\n6HCf4/NZw5cqYU34IzZD8eT1FWIwC9oxz01fdz3gXGIz01075t8wl5Y5Azcc3CyL\nqjQyVeOs3obuap7gjBb/g3cJgF4WS/sE+XfbtwQXoKAFZOc8BOKX5SvEkj4iuzvX\nwDGgIIXmPCMXNeqJPyKzcP4cBUhIa6OuU4s4fVEG/3krAM2dQSjHXNAGCZ7J1uZ4\nmcGT/CE9MgjzR12CFxadk/JMEy58FlkyEPhmaoapfuhYZkmKMH0nK6Ljk8E2VoEX\nD5GMmN4LF+dVSp3dNnHkGA9RaQd0YVTkjDsme+zHf6Py/KqdfIxGZcUNhsToCFxf\nlPyk+uQXwp1h8e8tn3Zjd+H/fFvIprgVBHfgUIdXPyr/Y1pZ/LBWS+ai2bQ+fAR6\nDg1nOtxUlwKjXvxVfpM//evaIIRqa7id8cM18ItC+8kv4BJ6kZkuDwDr+hQAS4TV\n/35Y+SifCrlv/8yHb/vDyihO6l6NrhIaSEhnuvr1fQ+DpygsxEHvtgyC5rrjABix\nLiVltaRe+ri8pZbii0jWRRVz9+JHbhbJCsro4oRICyY4e7UYDVNwsk1hEdHHzigY\n+82DO8N/RgIlVRD7JrrhQxDfDwO/3FYmf1VjA9Q8zxE/heCTv22uvcJgUdRbi1Bq\nUOAMC5OJ5vjE7z30TPk8rtubtUbnkr9rXOSHnd6pwqx4aX9WmTz0Cz2271T2HfO9\n9EWTy3FMs7gccTUTgrLHMaDgsrtRs2ZRu2jM2qQaQ57g3uXPNtcjOC22t6zeeTOk\noAWsrX+7VvYAvWkI3t9PRQfEwpWOFlLji9g9XvrOsMY63SrJmjs8HcgRbcF4X931\nRWnmae2Z4AIdE0R++LWzZylVtVKJfUvexET4/fxWDGPLuLxwI5bO03dEfFI17C39\nLMCZtGQ1iTgJ4OadjL0WTcAcPAiXlYPzocEK91+hifWyGxFK+fOkM3v7qqEQpmXx\nuvjjYkMehbRn4X9+X0VBdtD3Fp+rSZgMPzA0DLBC4cHNg4FYIdla6upElbkV3qZw\nJUFJBkD8m63pIJZzDjOvf20AyNskBmD3YoDswh06RkX7mrrv/hNYVjZdqSK3Fkdf\nkVcxr/C7x5MWZewTpROeC6evRrXp2peS3FhfXsjTaU6YOZ9jng0X829gHlbICYsB\nuI1k9YKwOjIjI+EQ8P//CRbKW9NmlDq5MEH3AAnnJjvwIDfL2JLZu8/GcGt2/G0Z\n4UwfM85p+6yeEKQ5Hx9Ss72506KES091U7AJtGAeSAuxUehVs/J4bOafCzDnC8YS\nSJEU0XebeT9iAhgl+Ktchs3UVUyLC6jAEfrs/C01lN4WX7YR1TxlPBG8DIsl5K7X\nWOF+jZ8PA1N6cNvkXZGI6wbjC8M4wCw8AFWgfH7R2SdppeV/e0w9Lk5tNGfnRjBO\nYdvXGV78Fr5vGM8mzO7DHlDtSIv4NzQL/z6a9L7Cv0p+y9jcL2Fiw1OEMBCu9VD7\n3spxwm5C3tZjVbYPk+Xi5vqYc2HHTqr1jqP0AQACrwj6m8cK9esN8v0JkluJ1ook\niVVWwaEfJPZ9rHIf9Ozh3ztPZyz/YHW9YEYkzEvYGg3DdjywwczaP5sgPMjSSEVX\n1hvOjgqv4Mxp3afR5vxWNKghmwNnQSApN+lR3rDQcWubkjta88YkEyoDUsBUVHYg\nlRZOrJlk4q8oNBVTSnRj0wJYj/y2Ta6Jtjv/e2kv0I2WqGUKN39qkEyPuaSTqKP2\n4I9u4tg7lu475fSU+DNdtBPd7JNPE0MArGigwGFVsLFpD8V9t8pk/N/O0U//A9sL\n7uEMGQmZEpHGRDaz59897UJizbrREbPaaqzvJmnVJ9g8zLJm4tKcvB66Wf/0eAQD\nB0PtILrpDqElPPKMo8vigvx8Bb7AvFW8D41SpQBDNRf70BCwiE/gOg==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-5KV5mjqwdzeDe1sjG'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpbabwmha7.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpbabwmha7.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa5105910>
    def test_encrypted_signed_response_1(self):
    
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=False,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str,
        )
tests/test_50_server.py:1623: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:907: in _response
    response = signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-N97EvkZ7DkBl5EPfM" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:46Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-N97EvkZ7DkBl5EPfM"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-5KV5mjqwdzeDe1sjG" IssueInstant="2025-04-21T14:10:46Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-5KV5mjqwdzeDe1sjG"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:46Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:46Z" NotOnOrAfter="2025-04-21T14:15:46Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_05f3c7aa-f030-4c56-a1a7-1faa382ff56d" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_eb0352ec-b819-4add-a5b3-e2edf2fd4ce1"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ2WhcNMzUwNDE5MTQxMDQ2WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAt9putF2oE24Cu0fGRHnAjVIBsN+uRaZOUWIYCufSJDnXgu57DipzAW/H\n9yJaxWahAFUicnOMcb9qvxHD+ACwC1DN8BUWOkNTuFtaGUMEjtrZPgYrFQVfoEZp\nRNC1MTkNAb06q10lxdZy1+2+nCHo7+3xjmjs1ZEjcNGd3hgtnDL1tnmQOJo+lXN2\nP3IQXFNVwYQGKQ+YfELXHP461F+XrLdXwbN5dtDyR8zhvTTytnU5SU6x5btDpOs2\n95MSkgHOPmfCmw7BnMFVcu01Wr8W0QtZ8V344taUjRC1TKVWjLgiqHZBYYyZrPlz\n8yftDGbEi/mM122MiVm/GMZvbB8ShQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAKIe\nq8vJN5YkSw9db/+2ltbF0cCNIwD9FJsjpQdbAqeibmqNRAltzOZvgrPL4ns6AbMp\neTLsCxZFod9MAV0+gRHhuOERec8klJ43rDocS9aOwo/YFEzKyE1tZM5+41ONtIlu\nIX4wJGYq5fLifoyVQOGAwWC/UGtehLrww0GxkAh0</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>VxuLRH573VEfe6ucLdToKnJNInQ3iN9G3Batd1CEriIPjWAHVhMWyGEa1GG3d7nl\nmWsnrLF2EW3XJ/pN9u5n92SWUTMn3mMCMytWgXgY9uY1zclggfftimS00CBe1N/Y\nhNvajNX60ibY9nfGsWvoUtQTWLuuzpiOHPNTkE7jiZDzkevdlbx6OjQLiNXVH5hU\nshHyY1htLbYntX/map8sx8TECS6GRg1utVzaqsBD6mDNlOqJA3IzSnNpvq8TejLo\nT+rMUmoeAGNtSnc5Dy0FiL1oH8rLUPLCFNlu8zW2L49I3obtQO6W3Ag3QsNV82M5\npNxnmCawrlXxU95HXKHD/g==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>w72uLEWVaAbev+FuDrj/YzEtUfSa0yQEJPwpoKLVa3eH76ivvMidJF4Z9cH+ecQs\nB8KG5+1Q8011t+sSUTYTIUlFeAAR8BgWIdmNiOQKyW08xJvTvM3auj/WiF9izD0j\n0RGGia8KLYKpYXte/On4nXApFOOnLKRGgQJKJ9d2Z7yYFOOTKhxT0hP7aTv9pKLV\ntQaFwNEXg3PAn2V5uCpyIeonSUxflT+4LKQDIYiAMKaYRTTBE5hJhwTFCTfEV4VZ\nqbokP4/6aLZWZgHqqkuM5PVa4NAao5eSJVpLp+M9E7RacyLEXd/N0J+Vhb2xwLIL\nK0TC1DvaWv3H1xpd5Od5cqymAEQiC+CI9zYl5N8bsLh5jys3KjLWqVi4qmfnlR/c\nq3MuGAR26NwA+KU5187C+YSImfGwTQ+3YhXIstl9eEeQx/MMOZLO0KrBQHMgR/nq\n8bXbjEdt63Dvi5X6TMd+WncebkipaOJIZfSWvT8biJVO6Kqw4GmcNXA9OG3WSYIx\n6HCf4/NZw5cqYU34IzZD8eT1FWIwC9oxz01fdz3gXGIz01075t8wl5Y5Azcc3CyL\nqjQyVeOs3obuap7gjBb/g3cJgF4WS/sE+XfbtwQXoKAFZOc8BOKX5SvEkj4iuzvX\nwDGgIIXmPCMXNeqJPyKzcP4cBUhIa6OuU4s4fVEG/3krAM2dQSjHXNAGCZ7J1uZ4\nmcGT/CE9MgjzR12CFxadk/JMEy58FlkyEPhmaoapfuhYZkmKMH0nK6Ljk8E2VoEX\nD5GMmN4LF+dVSp3dNnHkGA9RaQd0YVTkjDsme+zHf6Py/KqdfIxGZcUNhsToCFxf\nlPyk+uQXwp1h8e8tn3Zjd+H/fFvIprgVBHfgUIdXPyr/Y1pZ/LBWS+ai2bQ+fAR6\nDg1nOtxUlwKjXvxVfpM//evaIIRqa7id8cM18ItC+8kv4BJ6kZkuDwDr+hQAS4TV\n/35Y+SifCrlv/8yHb/vDyihO6l6NrhIaSEhnuvr1fQ+DpygsxEHvtgyC5rrjABix\nLiVltaRe+ri8pZbii0jWRRVz9+JHbhbJCsro4oRICyY4e7UYDVNwsk1hEdHHzigY\n+82DO8N/RgIlVRD7JrrhQxDfDwO/3FYmf1VjA9Q8zxE/heCTv22uvcJgUdRbi1Bq\nUOAMC5OJ5vjE7z30TPk8rtubtUbnkr9rXOSHnd6pwqx4aX9WmTz0Cz2271T2HfO9\n9EWTy3FMs7gccTUTgrLHMaDgsrtRs2ZRu2jM2qQaQ57g3uXPNtcjOC22t6zeeTOk\noAWsrX+7VvYAvWkI3t9PRQfEwpWOFlLji9g9XvrOsMY63SrJmjs8HcgRbcF4X931\nRWnmae2Z4AIdE0R++LWzZylVtVKJfUvexET4/fxWDGPLuLxwI5bO03dEfFI17C39\nLMCZtGQ1iTgJ4OadjL0WTcAcPAiXlYPzocEK91+hifWyGxFK+fOkM3v7qqEQpmXx\nuvjjYkMehbRn4X9+X0VBdtD3Fp+rSZgMPzA0DLBC4cHNg4FYIdla6upElbkV3qZw\nJUFJBkD8m63pIJZzDjOvf20AyNskBmD3YoDswh06RkX7mrrv/hNYVjZdqSK3Fkdf\nkVcxr/C7x5MWZewTpROeC6evRrXp2peS3FhfXsjTaU6YOZ9jng0X829gHlbICYsB\nuI1k9YKwOjIjI+EQ8P//CRbKW9NmlDq5MEH3AAnnJjvwIDfL2JLZu8/GcGt2/G0Z\n4UwfM85p+6yeEKQ5Hx9Ss72506KES091U7AJtGAeSAuxUehVs/J4bOafCzDnC8YS\nSJEU0XebeT9iAhgl+Ktchs3UVUyLC6jAEfrs/C01lN4WX7YR1TxlPBG8DIsl5K7X\nWOF+jZ8PA1N6cNvkXZGI6wbjC8M4wCw8AFWgfH7R2SdppeV/e0w9Lk5tNGfnRjBO\nYdvXGV78Fr5vGM8mzO7DHlDtSIv4NzQL/z6a9L7Cv0p+y9jcL2Fiw1OEMBCu9VD7\n3spxwm5C3tZjVbYPk+Xi5vqYc2HHTqr1jqP0AQACrwj6m8cK9esN8v0JkluJ1ook\niVVWwaEfJPZ9rHIf9Ozh3ztPZyz/YHW9YEYkzEvYGg3DdjywwczaP5sgPMjSSEVX\n1hvOjgqv4Mxp3afR5vxWNKghmwNnQSApN+lR3rDQcWubkjta88YkEyoDUsBUVHYg\nlRZOrJlk4q8oNBVTSnRj0wJYj/y2Ta6Jtjv/e2kv0I2WqGUKN39qkEyPuaSTqKP2\n4I9u4tg7lu475fSU+DNdtBPd7JNPE0MArGigwGFVsLFpD8V9t8pk/N/O0U//A9sL\n7uEMGQmZEpHGRDaz59897UJizbrREbPaaqzvJmnVJ9g8zLJm4tKcvB66Wf/0eAQD\nB0PtILrpDqElPPKMo8vigvx8Bb7AvFW8D41SpQBDNRf70BCwiE/gOg==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-5KV5mjqwdzeDe1sjG'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-5KV5mjqwdzeDe1sjG', '--output', '/tmp/tmpd0uo96li.xml', '/tmp/tmpbabwmha7.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpbabwmha7.xml"
output=
___________ TestServer1NonAsciiAva.test_encrypted_signed_response_2 ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = '<?xml version="1.0"?>\n<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-TKV28iyJFCPo2s8Dq" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:46Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ns2:Reference URI="#id-TKV28iyJFCPo2s8Dq"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ns2:DigestValue/></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue/><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></ns0:Status><saml:EncryptedAssertion><ns0:EncryptedData xmlns:ns0="http://www.w3.org/2001/04/xmlenc#" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" Id="ED_0668ce02-c313-4db0-ad34-e9907518eada" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/><ns1:KeyInfo><ns0:EncryptedKey Id="EK_bfd92013-0aaf-487e-a3f3-663660e4d33c"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>Tal1uG1Z65OFjqSB9sZzQaZkf7BlaUDAqz2pXcWmHLousNAhUyw5bAZXwmUNMks2\ntz0a8KNVk1P6ZPrdIHymPdUk2L8ip8wGFTPl6miL8BcuxzLHIUiy4Rejq7h91sgo\nHM/sigU+69Ptl2Ugzos3z3eHk5BtFLZ/kV3kJzrfU+M=</ns0:CipherValue></ns0:CipherData></ns0:EncryptedKey></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>D25hDdq1TJLb7XIsz+d3DLR+Frx2CgUXTOzMV+9W1B5y48u8eDVYgXU1kWeUauCy\no9zqGseSO6l7M3w/ZdvTtLTMHCwgRJhV9e2FG2WWt4RG7zXSk7V/5DnVByDGNQe4\n+Qe23qucjGCDCpplUN1JgKdAXM4q/hlu8hu9Hs16NOLxSYbtsWSokgT58gMa3fjL\n2Tb7/D7wVcDL0e56Z5AiyPtv0wTke86vRKFi1d1CtrvL35dDcjRbaRePvh9FENSQ\n5UPoF2Cp2bLC+Cs8N+TUnASejbwbzdRw7E1BUV9XN6TQNc61ZkyTpRj3XcNoKwcu\nKcuTCYVpf1WHjRf8Bf5hM5U3YyzyMk5BB1eAKdffWoxcfkavbBYMRAamgyBXcleE\nnEP8Ph1Y8IVvD7/GYgoenSgy+bNXWaW7nLSwY8vKkKiQ6mz26NfLjZXZWfRkwZEl\nkVUxmkO78vlaAe5TiaXE9QZlF+VISDYywKAE/o1IgvicorgbIn52fTvdZ5Yz8SWW\neFY5/DmX3yxwbD21IELlrjy8z0sk54nUuOmjbroCMEb2CZVANa2R2m2I7hdvQx5K\nG/4PaOpYcHfyYdtExvm+JjtBvwL8K5Gf6htFnXnEGcosdwRMGU499z4NzPajGosf\nRK9QgFa3jhvSjLn955bnquFRtRQ36650YErtylexHB7dcfvBYQBojEgxv8Q3HMn5\nseTno63z/Phqc++Wb3J5Eph4YA0yUA/8EknK2XX/GUulMZykwskz51UgM3pHkCiu\nOpw+f8qAZiPQz7eiQjBbW2Vhu/H6+6xPUpHjJBbp4Dh+x9NBWjxzKbynfQJr+Vru\nCu9Ka3Cdtu/DXKVIXdNXPk56XZ+/H/ezny4feilIF5V1auEBSrNMfJZAMH2Xey1V\nGpy+x71lWBQQTqHNiU+1Du+AFa+xYJe9YlN4Pq/VN7mhIz7fS8N+1zpsPunyS3sV\nt+kC8atz0GLPE7lJhULvw/n9IziesHFSGgMoc+hGD0sIn5TSbCOhX6PJ32ukVEtY\nKbbQOOwJ+ZHzpQ2I8Bk0madQw6l193ulpB8yTG6rRU7oTsamdJOiO185bwdt7mrt\nNVT8cr2NQVc1qK7Ri7eXAVSpBvfv8yiakmnmkLNGoi9U3ChqiL5rMl/ONhc+Q0Yd\nVE3zac23FVtOJOj6YPr3z8b/i4U6oggRWlzLw/s7Wi7cLqagSBt6gZcAUujwe4Uk\n7HV/10+WFe6bbgw+mwknElkWREiO7O5OSeVLLyKLIznFy69H7lzhnvqi1DB2BSna\ngb09cWMeGK/aqUzkBjtFUUBPbvYEKM1hqjsZyAF6GZgdf6m4s9VdMs3uqcQcQJhu\nVYZX+Xe3D++VyuIvHbaCa5apCROLctdxYVYHwhPoJhTWUNYYOzZZrKhOUyAuf6mp\nRB1fZ1QEoYva1R9SPtQmhnjefASwUGzXg7BiU2AZ3kEuQZjtpNxma/sIbC661+Od\npp/ilctJc09Q05D/eBKluwXpNl98Vvcbv5cyuikKbUtynBHRtSLPHLtD8079/JA+\nQX2r77eaPdb5RfvSsMc4wLYbUSTr4oqQ7BYaQuX6iuHhdQSPWKgVfpnJ2C+hMCDS\nUEnn+MJyh8q+0U3lRHBaVgOX2wRH9Liyj/OChYQ4k9KMeKGdTVhJI9VzPxND8In1\n8BFQ5Dzeaza4ds0EMTSRsKtQG0bHSC2xp6NhllLCqoYaxB889a/Y5wh4MlwAQGkf\nCL6Q8r9nQ5J8kdpoWiQSbeUgzDoPB5ccLQeeBnUJqzf/g3Zj5nLv4qyVB8LNBf9Q\n7xHxXEYcMaF78MqA8PPgZ86OZpAYV3iPC4eFI2auzTco6dGyMvXe/R6aoGCj8hWE\n1ESFvcXWWjZd7mXrhJEZLXrWDOW99fd+LEwjZFDTa0apFJuNcMkUQSscpk8H2S1p\nK8RSvjCA6kTY7yu2Swl65ocbd65OvIS6NWrXfq8d8GDEw/+uY9R1GASwfLuIgMXo\n7YbJAC/S9u98cvNd+c3ieOOBIEbxlhHD9yI/WEG0dpOJmxOBYiko9OvUUnoGcwrA\ntnlrrpSwrcSctbajZEzFpqz4ON63aiI8ExOOMlSNEWXQJanVTOdD3SHiyHRRLtkt\neCPm5VzjhMpurPIXSfm3Y1iJIaUAP68iXwS70CQRhsTsm19Mrzv7z06B+jabSxyG\nAaJhqaIiNHMs6JU5LMHBiWPOeZ3Peb+lSNtX6t3sC1Tng78HrYHybBrWC5u6F04+\n1A/+WO+mB+CiKnSkB8A6+RCAexDL978+7c7ZqM7GfoqO5S0rG79n32svck1pyjgd\nAkhNgzjSeQA0EE+iTAn3LDPSD0CGsDaoRgebLCxhWjNSl4QJzq18GtHYOTH2Md2+\n9Qv12vMdtvldbbhFjFBJASH6/c7C45ZEG2VECk09rCT0/TNddIOz8RBVeB9Y8mN5\nIR2+85vrGoT1Jg5MpWJR/lvXgE5nj3BZkiaDGywM0evDVGoYQlZyFxaAxlP/Dp75\nrH5o3jpFOGmYO77sxKRvacGr23KH1fd4z+Kqs5NPpKzEWid3aeUTmtNirAZB2NyD\noe/VwL77Z50Bbzdsm/KjIkpquvMhz7fHAK7lc8mb/A1juRSWwrAduH54hFYvLC+9\nvm8rpVKrr9YSrG8SORcTNNMC/6+4DJ+OcnPgMB4ZrtNj6e91tZHLCtpT6Ad4al8o\n7dAtD7uzbAdgHg7HdkvacMQhVpFGyHa9uhv1HshlvsfQWGvKVusrehyX6DMfJoAW\nvI3WuvF0pkHCL6J2ilh96od7lHH1l4bBfg9lZK+e4KL689PdvJvEkqf9d99rkpGq\n+M5/k4QLvWGjXaKlTeBU8+CnDVzEihjsqyfYd2+YvEJE1BPt32InygUO9cf1Ft5A\nOkAGCa53hJKSr5L/X52rM9NyXDoVdfS4cKh+IHY8pcDHkVqhbP9O1A==</ns0:CipherValue></ns0:CipherData></ns0:EncryptedData></saml:EncryptedAssertion></ns0:Response>\n'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-TKV28iyJFCPo2s8Dq'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmpedhpnthd.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpedhpnthd.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa58ac050>
    def test_encrypted_signed_response_2(self):
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=False,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
        )
tests/test_50_server.py:1681: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:912: in _response
    return signed_instance_factory(response, self.sec, sign_class)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = '<?xml version="1.0"?>\n<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-TKV28iyJFCPo2s8Dq" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:46Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ns2:Reference URI="#id-TKV28iyJFCPo2s8Dq"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ns2:DigestValue/></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue/><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></ns0:Status><saml:EncryptedAssertion><ns0:EncryptedData xmlns:ns0="http://www.w3.org/2001/04/xmlenc#" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" Id="ED_0668ce02-c313-4db0-ad34-e9907518eada" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/><ns1:KeyInfo><ns0:EncryptedKey Id="EK_bfd92013-0aaf-487e-a3f3-663660e4d33c"><ns0:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>Tal1uG1Z65OFjqSB9sZzQaZkf7BlaUDAqz2pXcWmHLousNAhUyw5bAZXwmUNMks2\ntz0a8KNVk1P6ZPrdIHymPdUk2L8ip8wGFTPl6miL8BcuxzLHIUiy4Rejq7h91sgo\nHM/sigU+69Ptl2Ugzos3z3eHk5BtFLZ/kV3kJzrfU+M=</ns0:CipherValue></ns0:CipherData></ns0:EncryptedKey></ns1:KeyInfo><ns0:CipherData><ns0:CipherValue>D25hDdq1TJLb7XIsz+d3DLR+Frx2CgUXTOzMV+9W1B5y48u8eDVYgXU1kWeUauCy\no9zqGseSO6l7M3w/ZdvTtLTMHCwgRJhV9e2FG2WWt4RG7zXSk7V/5DnVByDGNQe4\n+Qe23qucjGCDCpplUN1JgKdAXM4q/hlu8hu9Hs16NOLxSYbtsWSokgT58gMa3fjL\n2Tb7/D7wVcDL0e56Z5AiyPtv0wTke86vRKFi1d1CtrvL35dDcjRbaRePvh9FENSQ\n5UPoF2Cp2bLC+Cs8N+TUnASejbwbzdRw7E1BUV9XN6TQNc61ZkyTpRj3XcNoKwcu\nKcuTCYVpf1WHjRf8Bf5hM5U3YyzyMk5BB1eAKdffWoxcfkavbBYMRAamgyBXcleE\nnEP8Ph1Y8IVvD7/GYgoenSgy+bNXWaW7nLSwY8vKkKiQ6mz26NfLjZXZWfRkwZEl\nkVUxmkO78vlaAe5TiaXE9QZlF+VISDYywKAE/o1IgvicorgbIn52fTvdZ5Yz8SWW\neFY5/DmX3yxwbD21IELlrjy8z0sk54nUuOmjbroCMEb2CZVANa2R2m2I7hdvQx5K\nG/4PaOpYcHfyYdtExvm+JjtBvwL8K5Gf6htFnXnEGcosdwRMGU499z4NzPajGosf\nRK9QgFa3jhvSjLn955bnquFRtRQ36650YErtylexHB7dcfvBYQBojEgxv8Q3HMn5\nseTno63z/Phqc++Wb3J5Eph4YA0yUA/8EknK2XX/GUulMZykwskz51UgM3pHkCiu\nOpw+f8qAZiPQz7eiQjBbW2Vhu/H6+6xPUpHjJBbp4Dh+x9NBWjxzKbynfQJr+Vru\nCu9Ka3Cdtu/DXKVIXdNXPk56XZ+/H/ezny4feilIF5V1auEBSrNMfJZAMH2Xey1V\nGpy+x71lWBQQTqHNiU+1Du+AFa+xYJe9YlN4Pq/VN7mhIz7fS8N+1zpsPunyS3sV\nt+kC8atz0GLPE7lJhULvw/n9IziesHFSGgMoc+hGD0sIn5TSbCOhX6PJ32ukVEtY\nKbbQOOwJ+ZHzpQ2I8Bk0madQw6l193ulpB8yTG6rRU7oTsamdJOiO185bwdt7mrt\nNVT8cr2NQVc1qK7Ri7eXAVSpBvfv8yiakmnmkLNGoi9U3ChqiL5rMl/ONhc+Q0Yd\nVE3zac23FVtOJOj6YPr3z8b/i4U6oggRWlzLw/s7Wi7cLqagSBt6gZcAUujwe4Uk\n7HV/10+WFe6bbgw+mwknElkWREiO7O5OSeVLLyKLIznFy69H7lzhnvqi1DB2BSna\ngb09cWMeGK/aqUzkBjtFUUBPbvYEKM1hqjsZyAF6GZgdf6m4s9VdMs3uqcQcQJhu\nVYZX+Xe3D++VyuIvHbaCa5apCROLctdxYVYHwhPoJhTWUNYYOzZZrKhOUyAuf6mp\nRB1fZ1QEoYva1R9SPtQmhnjefASwUGzXg7BiU2AZ3kEuQZjtpNxma/sIbC661+Od\npp/ilctJc09Q05D/eBKluwXpNl98Vvcbv5cyuikKbUtynBHRtSLPHLtD8079/JA+\nQX2r77eaPdb5RfvSsMc4wLYbUSTr4oqQ7BYaQuX6iuHhdQSPWKgVfpnJ2C+hMCDS\nUEnn+MJyh8q+0U3lRHBaVgOX2wRH9Liyj/OChYQ4k9KMeKGdTVhJI9VzPxND8In1\n8BFQ5Dzeaza4ds0EMTSRsKtQG0bHSC2xp6NhllLCqoYaxB889a/Y5wh4MlwAQGkf\nCL6Q8r9nQ5J8kdpoWiQSbeUgzDoPB5ccLQeeBnUJqzf/g3Zj5nLv4qyVB8LNBf9Q\n7xHxXEYcMaF78MqA8PPgZ86OZpAYV3iPC4eFI2auzTco6dGyMvXe/R6aoGCj8hWE\n1ESFvcXWWjZd7mXrhJEZLXrWDOW99fd+LEwjZFDTa0apFJuNcMkUQSscpk8H2S1p\nK8RSvjCA6kTY7yu2Swl65ocbd65OvIS6NWrXfq8d8GDEw/+uY9R1GASwfLuIgMXo\n7YbJAC/S9u98cvNd+c3ieOOBIEbxlhHD9yI/WEG0dpOJmxOBYiko9OvUUnoGcwrA\ntnlrrpSwrcSctbajZEzFpqz4ON63aiI8ExOOMlSNEWXQJanVTOdD3SHiyHRRLtkt\neCPm5VzjhMpurPIXSfm3Y1iJIaUAP68iXwS70CQRhsTsm19Mrzv7z06B+jabSxyG\nAaJhqaIiNHMs6JU5LMHBiWPOeZ3Peb+lSNtX6t3sC1Tng78HrYHybBrWC5u6F04+\n1A/+WO+mB+CiKnSkB8A6+RCAexDL978+7c7ZqM7GfoqO5S0rG79n32svck1pyjgd\nAkhNgzjSeQA0EE+iTAn3LDPSD0CGsDaoRgebLCxhWjNSl4QJzq18GtHYOTH2Md2+\n9Qv12vMdtvldbbhFjFBJASH6/c7C45ZEG2VECk09rCT0/TNddIOz8RBVeB9Y8mN5\nIR2+85vrGoT1Jg5MpWJR/lvXgE5nj3BZkiaDGywM0evDVGoYQlZyFxaAxlP/Dp75\nrH5o3jpFOGmYO77sxKRvacGr23KH1fd4z+Kqs5NPpKzEWid3aeUTmtNirAZB2NyD\noe/VwL77Z50Bbzdsm/KjIkpquvMhz7fHAK7lc8mb/A1juRSWwrAduH54hFYvLC+9\nvm8rpVKrr9YSrG8SORcTNNMC/6+4DJ+OcnPgMB4ZrtNj6e91tZHLCtpT6Ad4al8o\n7dAtD7uzbAdgHg7HdkvacMQhVpFGyHa9uhv1HshlvsfQWGvKVusrehyX6DMfJoAW\nvI3WuvF0pkHCL6J2ilh96od7lHH1l4bBfg9lZK+e4KL689PdvJvEkqf9d99rkpGq\n+M5/k4QLvWGjXaKlTeBU8+CnDVzEihjsqyfYd2+YvEJE1BPt32InygUO9cf1Ft5A\nOkAGCa53hJKSr5L/X52rM9NyXDoVdfS4cKh+IHY8pcDHkVqhbP9O1A==</ns0:CipherValue></ns0:CipherData></ns0:EncryptedData></saml:EncryptedAssertion></ns0:Response>\n'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-TKV28iyJFCPo2s8Dq'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-TKV28iyJFCPo2s8Dq', '--output', '/tmp/tmp4_8qy8yo.xml', '/tmp/tmpedhpnthd.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpedhpnthd.xml"
output=
___________ TestServer1NonAsciiAva.test_encrypted_signed_response_3 ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-yMifEfWXsUHnsxbYw" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:47Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-yMifEfWXsUHnsxbYw"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-RNw5YdPKjDIwKzqxm" IssueInstant="2025-04-21T14:10:47Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-RNw5YdPKjDIwKzqxm"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:47Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:47Z" NotOnOrAfter="2025-04-21T14:15:47Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-RNw5YdPKjDIwKzqxm'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpkakn6jer.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpkakn6jer.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa58ac100>
    def test_encrypted_signed_response_3(self):
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=False,
            encrypt_cert_assertion=cert_str,
        )
tests/test_50_server.py:1726: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-yMifEfWXsUHnsxbYw" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:47Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-yMifEfWXsUHnsxbYw"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-RNw5YdPKjDIwKzqxm" IssueInstant="2025-04-21T14:10:47Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-RNw5YdPKjDIwKzqxm"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:47Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:47Z" NotOnOrAfter="2025-04-21T14:15:47Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-RNw5YdPKjDIwKzqxm'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-RNw5YdPKjDIwKzqxm', '--output', '/tmp/tmpngb70g4a.xml', '/tmp/tmpkakn6jer.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpkakn6jer.xml"
output=
___________ TestServer1NonAsciiAva.test_encrypted_signed_response_4 ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-gGGwGhqcbCKmSEtnm" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:47Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-gGGwGhqcbCKmSEtnm"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-fEhawwyVqYT7gXjf6" IssueInstant="2025-04-21T14:10:47Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-fEhawwyVqYT7gXjf6"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:47Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:47Z" NotOnOrAfter="2025-04-21T14:15:47Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_b7e2472a-423a-4973-b431-10c76cf013f5" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_842a5184-feba-417b-8aa1-464f803970b3"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ3WhcNMzUwNDE5MTQxMDQ3WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA2KMUpX7T4YDjecm+nAOTNFEQ+UEmf0v16IM3CBKMY4GTXcVK2kJ/Rn/e\n65fL9Da3Mdnszyx2DLj/I0agoEH2a1VsyfcI8zendEteN8RiA8kIE5KBM6bMwKOb\nHuSZIo4Pozy8+O0ymWH2DSSdYIxoezjtrc7lSTpr+TQC8mhTHBRgYtNhPecMhru+\n2e7ff5/o2OTJP9GnEl1OVWSGQ1aAYQDKabF12oXnmMn+BONL/m2bsWh7RchWVt0s\nDn+9jXfTsm+rZbSmo8ZaECJ14l92DLBk7V4ni2T3PRa47prUOUY3iFv99hdTvpgy\nN8LHIhTd9CnlKs4lA1//F96avCBYjQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAAUo\n2UL4GxBm2aaGuFFhlAtujKBgyLbEvtqxtA5t2bnWBwZHswMphVI75f5mdQhw05k6\npTuOrmfWCRREj4hzVIVMyxg1Q3scqAtjyKfyGkTnJD8KDU20ncPeozphYtg51ZI5\nf++76NACKcfbTrEvAPUjzHX6BeQJ+M/CdmzWaX4r</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>S/Tox4add9nkjKZXAhJbpjKQ3xXBdHLraJ9aA+8L8DHXAcvzkXFg2qMqCpJM/MQj\nz3dA7Pt0HomZqx8UcfSo5eIBWXIwnu30l+G7OFWSvLD1C8LJST/TRoAGtRcUkwJ6\nlQ6jI0dK5FI2Ow/UJBgEVW6cucMPONLeoT3O2P4PxSYrgfqLYqexpuMz49CD8wa+\nXd/GB/Adsc72qPyui/z9WhNagMnw5PjfvjX93k+KzxPCRMOM0sKZhDXzbd3hEjox\noB7dGaj1aS1uMRz9g56Aa2Jt3m47b1x5k46SLPGPg21VGVuQXQYIgfObeWkz8SEW\nADnHetcbBtoLKeCgbf10jA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>mvahro8yyadlW+ZrSq9GGVeleS5qy1s2+lKHT6rJ0/TF4BDF6lBjpx3RzNtSh4gh\nBf7aTnl4dcZaYPZJDWFwYjV93G7VgWznrHM0hhq3X/gSW0Slj2tcTfkx06WGW3Ki\nwq9xTQxKGoXYP2CI4hY/iFkacSrEyUzuH+ka/qBwX4674lRLEYgMnBXNp2fIb/c4\npAIYtqNym2L6Yk/MphUq7fbgvW7j5PK0HQsy1O++O7qYCFun5JA1usJOQRMlWJLo\niVtbeT8uZKT2hVvw5NeyXt8LkvVjqTYs1oHSIf+6k3LdxF6v17LWgisl6WFHyFvw\nqEGI5c5z6x1dVEUMRrEfal6y3wdDC72OPl9ou9AibeOKRftR/AMFW5Jsx1Psjt2o\njtgKFfpXBi7hKYDT4dCBfRS8YLUzFFktq7cdATs82eC1R2Jcuej+b/duN0O4SMMA\nobkqHe+6EUogJgWg28wG7LnoHPs+wUdNmyKwXsgc8AMiaTpG7rMys3VTpvG0TJLE\nGjNC7tzoZ3/dEHzD94pLfb/X0IkOndp3p1zpSySB9rnLlP9x23nBqLo83nKd9fA2\nA0LA5aCbFZStbKbTdxn97zRRdNTpokmOYPjwMxIwzvSFOZKmfPVfoNV0i1n7bf6k\nZ2TZOXr7hhOLfR7A3OfsOTgfkoaKXdDdfAd/wy1XDLEeDs4YZnDzxEHLXQam9S0p\n+rmKzXFO9vftEXY6PPtx4fhRaACaTwoAF8kHtiQb1AWjU32nnSs51JKPhqKY/7VY\ngb9S3uzrfhBop6v07tCeWDdrZR8cafFUpu2KBQNWzbQV1xo2HeZTDIeuL2fetsmv\ntECNXoMUwa9doxslAkcYOHe8wNYJH3Xo99VYKuT81K4uofrAYGYQvCXYRvd347Mm\np6ezUrwvcpeQOrPxEHNj1J0d/BQoxhpjK7tlu/GvS+xXepeBKllGVmt0tiIwIROr\nH1dsmbZ/q62beOYNwTwk14dZ/Cadd0BP6B9sk0/Dn3TcPfmwu8PUu/fzkLb78BQw\nSEV9IngGcPhYLiHeZwqf0EsT23iARKiaOu4rLdDOFL1m2N7Hbk3LhynJimdtDaI/\n0KDX8AqN9vxFu3Sh9qxovPxyOCUgF8l7CHM2yQNWM8NEe1CBBErqlUAngjq/R1hj\nsjSGueyJyi2XeDS08I+vNPz4Lu6CznWHK7ej9q+lyrbBbf4oEXeTxZno9sw8jqxc\naVW25AX/lhvGQC1xZILOf4z6jtuG83msw21MAhwczbf0wZMDzbIsIrBRQgDuq93L\ntySnxAgFI9hPgBZGgPoDlH4aWKGlx8u/KLpOKEkdCgz6BryV2V8SP7VzSWFMq6N6\nUa12PFhTcseDEZoKF6ZygKzVoyrXnno27UzkLr+OLlkdbQ7El2wYiNTZaiTPLw6f\ngBvPxbn3EORJoL0ylGXzDUtTqJKNIO+6vPHOjwTcMN/7hzpu+D8VFPwdVRiGFOj1\n8Do4I4meQgV7Tg+cORnqj2BSJLUNvgN051DOGJrIuksceZULw5/3s9p2PkZfbt34\n6VxHhgiBwsNy4eixu5VJ6NFbKIS02LUX1H4B0+pWeSmxa714Mf2+qOlhXGAqIQ5F\nFr/buqUz+nOy532EfnODJF2JuHRk35tiRRPfVa7BAEFYxBxyjor9r+xfUr87vYXQ\nEyqgSyPCXFv+WayFq81I7WR1zDOtJZPo/2zTMelw55Kv5ckAETRsrfzftumPE+9k\nitNmcNBurOb2KjMHfo32Do3wBL06Ri+l/dfogOWZmv4ORnzggs3Bz/fyVbfO0aD0\nNWWJMKUfODjwd6d5eYzuGd9FWf7MVHCHZxdNHCry9NuAv/pFI2Q9HM13UIwkAwnt\nK0CaSjCxi+cVWcu7Gpe+piIt5sbt1pnyUpB5SwXGDN/fVtKw9U6Cuvfw1NeIvkkC\n9lsE7UabEYQRp7OwyRW9AwI5brluJp2vC7uIPJOGOF9Tx6pJCX8ln172bFUx1zxL\nCe9Y8RFuV27uM0KW+aBu8HAlvDNBXOjKEvybQz0E1p9kVPLaorWYNUsBHH0ydTSi\nM54IhkNhzDAUfqf14o62VIMuaa2QSp33sAlwia7o1RDVmtSm/8ErHMO9cN2D0e5H\nsfHZhieZTrLGLZZh9J8pABN8ohlA0aqhoWSgc6bGActqjRoNzqPU+z+4HHV6ytAj\nTKfk1JIHxOpwedn59JgRfc6LI48WwEWa2xgQ57j8W3broPBxdSNbn443xFQ8H9qy\n8ZIaxK77jjEQEj1NXyFRq2X66d/D2M5nLM21Ctv7FScpyg8Hw3l/er3g94KRr5Mo\n6vfqi8mXBobxxqvghZGjdQlKZqR5kaTvyumwHyg2EsabFyCF2zjIwSQSd6XUPeJN\n5WJdaQsGCkTTLUS9z2n0KgdsQotVujEYMwj3ZpNLmxTriaF8YMbFXg==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-fEhawwyVqYT7gXjf6'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpqu576vtq.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpqu576vtq.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa585f1b0>
    def test_encrypted_signed_response_4(self):
    
        cert_str, cert_key_str = generate_cert()
    
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str,
        )
tests/test_50_server.py:1773: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa0f34770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-gGGwGhqcbCKmSEtnm" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:10:47Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-gGGwGhqcbCKmSEtnm"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-fEhawwyVqYT7gXjf6" IssueInstant="2025-04-21T14:10:47Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-fEhawwyVqYT7gXjf6"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">36216b447636c3b16906ae589c1ac8223a858bb9f3eba8b63ecf015ad87f0ba2</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:47Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:47Z" NotOnOrAfter="2025-04-21T14:15:47Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_b7e2472a-423a-4973-b431-10c76cf013f5" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_842a5184-feba-417b-8aa1-464f803970b3"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ3WhcNMzUwNDE5MTQxMDQ3WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA2KMUpX7T4YDjecm+nAOTNFEQ+UEmf0v16IM3CBKMY4GTXcVK2kJ/Rn/e\n65fL9Da3Mdnszyx2DLj/I0agoEH2a1VsyfcI8zendEteN8RiA8kIE5KBM6bMwKOb\nHuSZIo4Pozy8+O0ymWH2DSSdYIxoezjtrc7lSTpr+TQC8mhTHBRgYtNhPecMhru+\n2e7ff5/o2OTJP9GnEl1OVWSGQ1aAYQDKabF12oXnmMn+BONL/m2bsWh7RchWVt0s\nDn+9jXfTsm+rZbSmo8ZaECJ14l92DLBk7V4ni2T3PRa47prUOUY3iFv99hdTvpgy\nN8LHIhTd9CnlKs4lA1//F96avCBYjQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAAUo\n2UL4GxBm2aaGuFFhlAtujKBgyLbEvtqxtA5t2bnWBwZHswMphVI75f5mdQhw05k6\npTuOrmfWCRREj4hzVIVMyxg1Q3scqAtjyKfyGkTnJD8KDU20ncPeozphYtg51ZI5\nf++76NACKcfbTrEvAPUjzHX6BeQJ+M/CdmzWaX4r</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>S/Tox4add9nkjKZXAhJbpjKQ3xXBdHLraJ9aA+8L8DHXAcvzkXFg2qMqCpJM/MQj\nz3dA7Pt0HomZqx8UcfSo5eIBWXIwnu30l+G7OFWSvLD1C8LJST/TRoAGtRcUkwJ6\nlQ6jI0dK5FI2Ow/UJBgEVW6cucMPONLeoT3O2P4PxSYrgfqLYqexpuMz49CD8wa+\nXd/GB/Adsc72qPyui/z9WhNagMnw5PjfvjX93k+KzxPCRMOM0sKZhDXzbd3hEjox\noB7dGaj1aS1uMRz9g56Aa2Jt3m47b1x5k46SLPGPg21VGVuQXQYIgfObeWkz8SEW\nADnHetcbBtoLKeCgbf10jA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>mvahro8yyadlW+ZrSq9GGVeleS5qy1s2+lKHT6rJ0/TF4BDF6lBjpx3RzNtSh4gh\nBf7aTnl4dcZaYPZJDWFwYjV93G7VgWznrHM0hhq3X/gSW0Slj2tcTfkx06WGW3Ki\nwq9xTQxKGoXYP2CI4hY/iFkacSrEyUzuH+ka/qBwX4674lRLEYgMnBXNp2fIb/c4\npAIYtqNym2L6Yk/MphUq7fbgvW7j5PK0HQsy1O++O7qYCFun5JA1usJOQRMlWJLo\niVtbeT8uZKT2hVvw5NeyXt8LkvVjqTYs1oHSIf+6k3LdxF6v17LWgisl6WFHyFvw\nqEGI5c5z6x1dVEUMRrEfal6y3wdDC72OPl9ou9AibeOKRftR/AMFW5Jsx1Psjt2o\njtgKFfpXBi7hKYDT4dCBfRS8YLUzFFktq7cdATs82eC1R2Jcuej+b/duN0O4SMMA\nobkqHe+6EUogJgWg28wG7LnoHPs+wUdNmyKwXsgc8AMiaTpG7rMys3VTpvG0TJLE\nGjNC7tzoZ3/dEHzD94pLfb/X0IkOndp3p1zpSySB9rnLlP9x23nBqLo83nKd9fA2\nA0LA5aCbFZStbKbTdxn97zRRdNTpokmOYPjwMxIwzvSFOZKmfPVfoNV0i1n7bf6k\nZ2TZOXr7hhOLfR7A3OfsOTgfkoaKXdDdfAd/wy1XDLEeDs4YZnDzxEHLXQam9S0p\n+rmKzXFO9vftEXY6PPtx4fhRaACaTwoAF8kHtiQb1AWjU32nnSs51JKPhqKY/7VY\ngb9S3uzrfhBop6v07tCeWDdrZR8cafFUpu2KBQNWzbQV1xo2HeZTDIeuL2fetsmv\ntECNXoMUwa9doxslAkcYOHe8wNYJH3Xo99VYKuT81K4uofrAYGYQvCXYRvd347Mm\np6ezUrwvcpeQOrPxEHNj1J0d/BQoxhpjK7tlu/GvS+xXepeBKllGVmt0tiIwIROr\nH1dsmbZ/q62beOYNwTwk14dZ/Cadd0BP6B9sk0/Dn3TcPfmwu8PUu/fzkLb78BQw\nSEV9IngGcPhYLiHeZwqf0EsT23iARKiaOu4rLdDOFL1m2N7Hbk3LhynJimdtDaI/\n0KDX8AqN9vxFu3Sh9qxovPxyOCUgF8l7CHM2yQNWM8NEe1CBBErqlUAngjq/R1hj\nsjSGueyJyi2XeDS08I+vNPz4Lu6CznWHK7ej9q+lyrbBbf4oEXeTxZno9sw8jqxc\naVW25AX/lhvGQC1xZILOf4z6jtuG83msw21MAhwczbf0wZMDzbIsIrBRQgDuq93L\ntySnxAgFI9hPgBZGgPoDlH4aWKGlx8u/KLpOKEkdCgz6BryV2V8SP7VzSWFMq6N6\nUa12PFhTcseDEZoKF6ZygKzVoyrXnno27UzkLr+OLlkdbQ7El2wYiNTZaiTPLw6f\ngBvPxbn3EORJoL0ylGXzDUtTqJKNIO+6vPHOjwTcMN/7hzpu+D8VFPwdVRiGFOj1\n8Do4I4meQgV7Tg+cORnqj2BSJLUNvgN051DOGJrIuksceZULw5/3s9p2PkZfbt34\n6VxHhgiBwsNy4eixu5VJ6NFbKIS02LUX1H4B0+pWeSmxa714Mf2+qOlhXGAqIQ5F\nFr/buqUz+nOy532EfnODJF2JuHRk35tiRRPfVa7BAEFYxBxyjor9r+xfUr87vYXQ\nEyqgSyPCXFv+WayFq81I7WR1zDOtJZPo/2zTMelw55Kv5ckAETRsrfzftumPE+9k\nitNmcNBurOb2KjMHfo32Do3wBL06Ri+l/dfogOWZmv4ORnzggs3Bz/fyVbfO0aD0\nNWWJMKUfODjwd6d5eYzuGd9FWf7MVHCHZxdNHCry9NuAv/pFI2Q9HM13UIwkAwnt\nK0CaSjCxi+cVWcu7Gpe+piIt5sbt1pnyUpB5SwXGDN/fVtKw9U6Cuvfw1NeIvkkC\n9lsE7UabEYQRp7OwyRW9AwI5brluJp2vC7uIPJOGOF9Tx6pJCX8ln172bFUx1zxL\nCe9Y8RFuV27uM0KW+aBu8HAlvDNBXOjKEvybQz0E1p9kVPLaorWYNUsBHH0ydTSi\nM54IhkNhzDAUfqf14o62VIMuaa2QSp33sAlwia7o1RDVmtSm/8ErHMO9cN2D0e5H\nsfHZhieZTrLGLZZh9J8pABN8ohlA0aqhoWSgc6bGActqjRoNzqPU+z+4HHV6ytAj\nTKfk1JIHxOpwedn59JgRfc6LI48WwEWa2xgQ57j8W3broPBxdSNbn443xFQ8H9qy\n8ZIaxK77jjEQEj1NXyFRq2X66d/D2M5nLM21Ctv7FScpyg8Hw3l/er3g94KRr5Mo\n6vfqi8mXBobxxqvghZGjdQlKZqR5kaTvyumwHyg2EsabFyCF2zjIwSQSd6XUPeJN\n5WJdaQsGCkTTLUS9z2n0KgdsQotVujEYMwj3ZpNLmxTriaF8YMbFXg==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-fEhawwyVqYT7gXjf6'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-fEhawwyVqYT7gXjf6', '--output', '/tmp/tmpxa0f38q9.xml', '/tmp/tmpqu576vtq.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpqu576vtq.xml"
output=
_______________ TestServer1NonAsciiAva.test_encrypted_response_6 _______________
self = <test_50_server.TestServer1NonAsciiAva object at 0x3ffa58a6b30>
    def test_encrypted_response_6(self):
        _server = Server("idp_conf_verify_cert")
    
        cert_str_advice, cert_key_str_advice = generate_cert()
    
        cert_str_assertion, cert_key_str_assertion = generate_cert()
    
>       _resp = _server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=False,
            sign_assertion=False,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str_advice,
            encrypt_cert_assertion=cert_str_assertion,
        )
tests/test_50_server.py:1987: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:832: in create_authn_response
    args = self.gather_authn_response_args(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.server.Server object at 0x3ffa4e8ac40>
sp_entity_id = 'urn:mace:example.com:saml:roland:sp', name_id_policy = None
userid = None
kwargs = {'encrypt_assertion': True, 'encrypt_assertion_self_contained': True, 'encrypt_cert_advice': '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ4WhcNMzUwNDE5MTQxMDQ4WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA0wxONDtA15VsC95oq60Y3MImfHsXjto0+/luKWUK/TOIb1Ve0Mn4n83I\n5bD0oBIGDn2pk5m4iqX+uMqjodbyamIIKUm10dalugm0m57OubhxW/lZ6DhUeWh0\nGfA6iIvI9n+1oxd2ZCA1KsuRf567E2ekHkzQJDoxKBHU7eBWHRUBeOJpBku6mlGk\nVdCUuPtRqcWFlfGaEY8vIgifBZX+1wvmlYQn/Iz2VeU0pY95GRWNwBiAzXQCbZ5c\n0lcZJ4MFpGFVjouL9BjLUSXwrsO1IqZEyMHtZEs212p8f8zzMxTkTObUv2gYKP4a\nwSvQM0PoJTmyzutYzukIINWXM9L8pwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAMFL\np7pRmyIg8igZrf1pCQD80WUeIfCPARKKNuveU9bufxrKNqI2v4BScJHbSyNQYKzW\nainySxCiRp8zwjNlX5C/Iwi6sDBVXsFX4ueLYJhHi7iZFF24bSAINXZkX0iaeo2o\ndoA51MIB3oQahoR4rs7YHCSsCqzlegfhiRKyNuQ0\n-----END CERTIFICATE-----\n', 'encrypt_cert_assertion': '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ4WhcNMzUwNDE5MTQxMDQ4WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAqkstnIMvLCi4/9MGp/GWd8OXX/yuk8awOtVkXC1fiMQjVuiiAsi89bGo\nw7dLaYsOTmq8EaZM+VxFNfQa94YOZ898+Kp2rseGnNdm59n5Zox0pA+BRjY4spBM\n6H6U+fRg8EEY7HSJqyDHxcg4+ZTSyS6+j9tqMR6G8pzBPhkf2R1TiYPSCYVVRD9A\nPj9ADIe/31QGFyndryeWJTGMn1GzxIiQonp6gNKx75pvFuck+UZKTm2APWEZrBjO\nB60+3uYIJ7GiUz66ouhoFSDwVrCiD3ft15SzWHCHF/RhG3yDwoHlFiVPVI770boO\nOES8OiEVeSsrBdHmvJAxXdlCGQZRGQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAMTK\n+aI3zUVnei3LBelMadePQlluYPD5iCjkLDxnVcqaDgcFwTEq6W3xe6HNG/TQOjhW\nCzRunXNfZ4e5cJqEy2dwwN/KUi6KqX8tD8zhAXBcoqM9XTZ8OjQOwcB4b//xl15z\nyr/6xgNF4rGJ+52Ys54J27CuXSv0sKOpi0Av8vDy\n-----END CERTIFICATE-----\n', ...}
args = {'best_effort': False, 'encrypt_assertion': True, 'encrypt_assertion_self_contained': True, 'encrypt_cert_advice': '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ4WhcNMzUwNDE5MTQxMDQ4WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA0wxONDtA15VsC95oq60Y3MImfHsXjto0+/luKWUK/TOIb1Ve0Mn4n83I\n5bD0oBIGDn2pk5m4iqX+uMqjodbyamIIKUm10dalugm0m57OubhxW/lZ6DhUeWh0\nGfA6iIvI9n+1oxd2ZCA1KsuRf567E2ekHkzQJDoxKBHU7eBWHRUBeOJpBku6mlGk\nVdCUuPtRqcWFlfGaEY8vIgifBZX+1wvmlYQn/Iz2VeU0pY95GRWNwBiAzXQCbZ5c\n0lcZJ4MFpGFVjouL9BjLUSXwrsO1IqZEyMHtZEs212p8f8zzMxTkTObUv2gYKP4a\nwSvQM0PoJTmyzutYzukIINWXM9L8pwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAMFL\np7pRmyIg8igZrf1pCQD80WUeIfCPARKKNuveU9bufxrKNqI2v4BScJHbSyNQYKzW\nainySxCiRp8zwjNlX5C/Iwi6sDBVXsFX4ueLYJhHi7iZFF24bSAINXZkX0iaeo2o\ndoA51MIB3oQahoR4rs7YHCSsCqzlegfhiRKyNuQ0\n-----END CERTIFICATE-----\n', ...}
param_defaults = {'best_effort': False, 'encrypt_assertion': False, 'encrypt_assertion_self_contained': True, 'encrypt_cert_advice': None, ...}
param = 'encrypt_cert_assertion', val_default = None
val_kw = '-----BEGIN CERTIFICATE-----\nMIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDQ4WhcNMzUwNDE5MTQxMDQ4WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAqkstnIMvLCi4/9MGp/GWd8OXX/yuk8awOtVkXC1fiMQjVuiiAsi89bGo\nw7dLaYsOTmq8EaZM+VxFNfQa94YOZ898+Kp2rseGnNdm59n5Zox0pA+BRjY4spBM\n6H6U+fRg8EEY7HSJqyDHxcg4+ZTSyS6+j9tqMR6G8pzBPhkf2R1TiYPSCYVVRD9A\nPj9ADIe/31QGFyndryeWJTGMn1GzxIiQonp6gNKx75pvFuck+UZKTm2APWEZrBjO\nB60+3uYIJ7GiUz66ouhoFSDwVrCiD3ft15SzWHCHF/RhG3yDwoHlFiVPVI770boO\nOES8OiEVeSsrBdHmvJAxXdlCGQZRGQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAMTK\n+aI3zUVnei3LBelMadePQlluYPD5iCjkLDxnVcqaDgcFwTEq6W3xe6HNG/TQOjhW\nCzRunXNfZ4e5cJqEy2dwwN/KUi6KqX8tD8zhAXBcoqM9XTZ8OjQOwcB4b//xl15z\nyr/6xgNF4rGJ+52Ys54J27CuXSv0sKOpi0Av8vDy\n-----END CERTIFICATE-----\n'
val_config = None, arg = 'encrypted_advice_attributes'
    def gather_authn_response_args(self, sp_entity_id, name_id_policy, userid, **kwargs):
        kwargs["policy"] = kwargs.get("release_policy")
    
        # collect args and return them
        args = {}
    
        # XXX will be passed to _authn_response
        param_defaults = {
            "policy": None,
            "best_effort": False,
            "sign_assertion": False,
            "sign_response": False,
            "encrypt_assertion": False,
            "encrypt_assertion_self_contained": True,
            "encrypted_advice_attributes": False,
            "encrypt_cert_advice": None,
            "encrypt_cert_assertion": None,
            # need to be named sign_alg and digest_alg
        }
        for param, val_default in param_defaults.items():
            val_kw = kwargs.get(param)
            val_config = self.config.getattr(param, "idp")
            args[param] = val_kw if val_kw is not None else val_config if val_config is not None else val_default
    
        for arg, attr, eca, pefim in [
            ("encrypted_advice_attributes", "verify_encrypt_cert_advice", "encrypt_cert_advice", kwargs["pefim"]),
            ("encrypt_assertion", "verify_encrypt_cert_assertion", "encrypt_cert_assertion", False),
        ]:
    
            if args[arg] or pefim:
                _enc_cert = self.config.getattr(attr, "idp")
    
                if _enc_cert is not None:
                    if kwargs[eca] is None:
                        raise CertificateError(
                            "No SPCertEncType certificate for encryption " "contained in authentication " "request."
                        )
                    if not _enc_cert(kwargs[eca]):
>                       raise CertificateError("Invalid certificate for encryption!")
E                       saml2.cert.CertificateError: Invalid certificate for encryption!
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:736: CertificateError
_____________________ TestClient.test_sign_auth_request_0 ______________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
statement = b'<ns0:AuthnRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://eidas.europa.eu/saml-extensions" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id1" Version="2.0" IssueInstant="2025-04-21T14:10:50Z" Destination="http://www.example.com/sso" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://lingon.catalogix.se:8087/" ProviderName="urn:mace:example.com:saml:roland:sp"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id1"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Extensions><ns3:RequestedAttributes><ns3:RequestedAttribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonNickname" isRequired="false" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonNickname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonNickname" isRequired="true" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonScopedAffiliation" isRequired="false" /></ns3:RequestedAttributes></ns0:Extensions></ns0:AuthnRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id1'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', ...]
extra_args = ['/tmp/tmp_alihmdq.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp_alihmdq.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa58d2cf0>
    def test_sign_auth_request_0(self):
>       req_id, areq = self.client.create_authn_request("http://www.example.com/sso", sign=True, message_id="id1")
tests/test_51_client.py:396: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client_base.py:445: in create_authn_request
    msg = self._message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:588: in _message
    signed_req = self.sign(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
statement = b'<ns0:AuthnRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://eidas.europa.eu/saml-extensions" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id1" Version="2.0" IssueInstant="2025-04-21T14:10:50Z" Destination="http://www.example.com/sso" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://lingon.catalogix.se:8087/" ProviderName="urn:mace:example.com:saml:roland:sp"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id1"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Extensions><ns3:RequestedAttributes><ns3:RequestedAttribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonNickname" isRequired="false" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonNickname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonNickname" isRequired="true" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonScopedAffiliation" isRequired="false" /></ns3:RequestedAttributes></ns0:Extensions></ns0:AuthnRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id1'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', '--node-id', 'id1', '--output', '/tmp/tmpjmn_iw_w.xml', '/tmp/tmp_alihmdq.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp_alihmdq.xml"
output=
_______________________ TestClient.test_logout_response ________________________
self = <test_51_client.TestClient object at 0x3ffa58d2f90>
    def test_logout_response(self):
        req_id, req = self.server.create_logout_request(
            "http://localhost:8088/slo",
            "urn:mace:example.com:saml:roland:sp",
            name_id=nid,
            reason="Tired",
            expire=in_a_while(minutes=15),
            session_indexes=["_foo"],
        )
    
        info = self.client.apply_binding(BINDING_HTTP_POST, req, destination="", relay_state="relay2")
        _dic_info = unpack_form(info["data"], "SAMLRequest")
        samlreq = _dic_info["SAMLRequest"]
    
>       resphttp = self.client.handle_logout_request(samlreq, nid, BINDING_HTTP_POST)
tests/test_51_client.py:429: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.client.Saml2Client object at 0x3ffa42de850>
request = 'PG5zMDpMb2dvdXRSZXF1ZXN0IHhtbG5zOm5zMD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iaWQtU1Q5ZmtoMW9CSlB2QzJxWE8iIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDI1LTA0LTIxVDE0OjEwOjUwWiIgRGVzdGluYXRpb249Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4OC9zbG8iIFJlYXNvbj0iVGlyZWQiIE5vdE9uT3JBZnRlcj0iMjAyNS0wNC0yMVQxNDoyNTo1MFoiPjxzYW1sOklzc3VlciBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+dXJuOm1hY2U6ZXhhbXBsZS5jb206c2FtbDpyb2xhbmQ6aWRwPC9zYW1sOklzc3Vlcj48c2FtbDpOYW1lSUQgTmFtZVF1YWxpZmllcj0iZm9vIiBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OnRyYW5zaWVudCI+MTIzNDU2PC9zYW1sOk5hbWVJRD48bnMwOlNlc3Npb25JbmRleD5fZm9vPC9uczA6U2Vzc2lvbkluZGV4PjwvbnMwOkxvZ291dFJlcXVlc3Q+'
name_id = <saml2.saml.NameID object at 0x3ffa64f39b0>
binding = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST', sign = True
sign_alg = None, digest_alg = None, relay_state = None, sigalg = None
signature = None
    def handle_logout_request(
        self,
        request,
        name_id,
        binding,
        sign=None,
        sign_alg=None,
        digest_alg=None,
        relay_state=None,
        sigalg=None,
        signature=None,
    ):
        """
        Deal with a LogoutRequest
    
        :param request: The request as text string
        :param name_id: The id of the current user
        :param binding: Which binding the message came in over
        :param sign: Whether the response will be signed or not
        :param sign_alg: The signing algorithm for the response
        :param digest_alg: The digest algorithm for the the response
        :param relay_state: The relay state of the request
        :param sigalg: The SigAlg query param of the request
        :param signature: The Signature query param of the request
        :return: Keyword arguments which can be used to send the response
            what's returned follow different patterns for different bindings.
            If the binding is BINDIND_SOAP, what is returned looks like this::
    
                {
                    "data": <the SOAP enveloped response>
                    "url": "",
                    'headers': [('content-type', 'application/soap+xml')]
                    'method': "POST
                }
        """
        logger.debug("logout request: %s", request)
    
        _req = self.parse_logout_request(
            xmlstr=request,
            binding=binding,
            relay_state=relay_state,
            sigalg=sigalg,
            signature=signature,
        )
    
        if _req.message.name_id == name_id:
            try:
                if self.local_logout(name_id):
                    status = success_status_factory()
                else:
                    status = status_message_factory("Server error", STATUS_REQUEST_DENIED)
            except KeyError:
                status = status_message_factory("Server error", STATUS_REQUEST_DENIED)
        else:
            status = status_message_factory("Wrong user", STATUS_UNKNOWN_PRINCIPAL)
    
        response_bindings = {
            BINDING_SOAP: [BINDING_SOAP],
            BINDING_HTTP_POST: [BINDING_HTTP_POST, BINDING_HTTP_REDIRECT],
            BINDING_HTTP_REDIRECT: [BINDING_HTTP_REDIRECT, BINDING_HTTP_POST],
        }.get(binding, [])
    
        for response_binding in response_bindings:
            sign = sign if sign is not None else self.logout_responses_signed
            sign_redirect = sign and response_binding == BINDING_HTTP_REDIRECT
            sign_post = sign and not sign_redirect
    
            try:
                response = self.create_logout_response(
                    _req.message,
                    bindings=[response_binding],
                    status=status,
                    sign=sign_post,
                    sign_alg=sign_alg,
                    digest_alg=digest_alg,
                )
                rinfo = self.response_args(_req.message, [response_binding])
    
                return self.apply_binding(
                    rinfo["binding"],
                    response,
                    rinfo["destination"],
                    relay_state,
                    response=True,
                    sign=sign_redirect,
                    sigalg=sign_alg,
                )
            except Exception:
                continue
    
        log_ctx = {
            "message": "No supported bindings found to create LogoutResponse",
            "issuer": _req.issuer.text,
            "response_bindings": response_bindings,
        }
>       raise SAMLError(log_ctx)
E       saml2.SAMLError: {'message': 'No supported bindings found to create LogoutResponse', 'issuer': 'urn:mace:example.com:saml:roland:idp', 'response_bindings': ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST', 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect']}
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:733: SAMLError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmprlyktq4m.xml"
output=
ERROR    saml2.mdstore:mdstore.py:1184 Unsupported binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect (urn:mace:example.com:saml:roland:idp)
ERROR    saml2.entity:entity.py:352 Failed to find consumer URL: urn:mace:example.com:saml:roland:idp, ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'], idpsso
__________________________ TestClient.test_response_1 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-lsIrpDunHPgudyMXq" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:50Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-lsIrpDunHPgudyMXq"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-dyyIROGgg9NERa5bL" IssueInstant="2025-04-21T14:10:50Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="urn:mace:example.com:saml:roland:idp" SPNameQualifier="urn:mace:example.com:saml:roland:sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">975f16566cbd2bda349e7e5592bc44595e3e1f2ea51ae9aac18e09d55e710e81</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:50Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:50Z" NotOnOrAfter="2025-04-21T14:15:50Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:50Z" SessionIndex="id-g1Gnw1rQli5YjU1Ut"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-lsIrpDunHPgudyMXq'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmp_9mky568.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp_9mky568.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5107050>
    def test_response_1(self):
        IDP = "urn:mace:example.com:saml:roland:idp"
    
        ava = {"givenName": ["Derek"], "sn": ["Jeter"], "mail": ["derek@nyy.mlb.com"], "title": ["The man"]}
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id_policy=nameid_policy,
            sign_response=True,
            userid="foba0001@example.com",
            authn=AUTHN,
        )
tests/test_51_client.py:469: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-lsIrpDunHPgudyMXq" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:50Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-lsIrpDunHPgudyMXq"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-dyyIROGgg9NERa5bL" IssueInstant="2025-04-21T14:10:50Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="urn:mace:example.com:saml:roland:idp" SPNameQualifier="urn:mace:example.com:saml:roland:sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">975f16566cbd2bda349e7e5592bc44595e3e1f2ea51ae9aac18e09d55e710e81</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:50Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:50Z" NotOnOrAfter="2025-04-21T14:15:50Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:50Z" SessionIndex="id-g1Gnw1rQli5YjU1Ut"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-lsIrpDunHPgudyMXq'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-lsIrpDunHPgudyMXq', '--output', '/tmp/tmp7yoq6nhu.xml', '/tmp/tmp_9mky568.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp_9mky568.xml"
output=
__________________________ TestClient.test_response_2 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-lFEWWKWkiNUJtnlY1" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:50Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-lFEWWKWkiNUJtnlY1"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-JLtHgxi2AccfsDbLx" IssueInstant="2025-04-21T14:10:50Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-JLtHgxi2AccfsDbLx"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b4637243d0b8d7947b8a0f98d48102ded7e89dfe2f9bfdee9de927790b8f25a2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:50Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:50Z" NotOnOrAfter="2025-04-21T14:15:50Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_9b82fcd9-8801-4631-8826-d2df2b03d6e6" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_e8353672-24d6-4315-ab7c-a0ba5a0954ee"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDUwWhcNMzUwNDE5MTQxMDUwWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA3865K/H8UEOYe24k+oH/FIXhZz3yHImsFaGLcrRhm6uuhr5dC+XhotO8\nI5HIgTK5X1m/ggH05+pZTO7owB8OFd8Us3Nq90UtiF6UloMK5IWN9J4onop1innb\nv0Fb8c+3fU5LmIH0oaSO4B37TRbzn4fhuZ1jt7CYKbEvACxao1K9G6Nf8epqbi30\nix0WcY42Msbe+mV9S20/t1uvB2Pp5BspjhGv0+wA4cbA6r4JT6cEw73zSkgs+P9m\nmt2RFkB16XUWeeLGuHzgoGXwyzzuTeZiej9YKDiXtGVJwgbTrHhe3Ro742rZCyLE\nEnIIU2Cc7SkliyE/um7XaK/iCIGpuQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAG38\nxuzvzdlF4CX1vduYChMODVyzPB7kJKfToh7DmK4hkvNW9zWEdFFc5FAuDBw62iAm\nnW5cdiF9io35zuHijCC5spbDgBx0swbgd2dk48VIl/HLNuPt5CNcfcBfjgJ+ZzvL\nkW1Az95yV0mYk97MHW69sX9eQidhsE9oIyGv+/6A</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>HWjUl40mzVSwfewqqzR8dxFcdz3HzmNaWkPoCYYXHOtC9ahhV/FQYgS0me4ERR6s\npOqxwvcbYxvDglwLHDmJVraYGlmxQvOoVnhMp8+VDIxbLEGxl/8TX3PVkTyKztj3\n6by2nXNckzo9CmlishL7Znt0ntEKphuGJgrIwCFSccsdZMPxfB+peH1qAuoLY9Cd\n0M9XArH19nvqDnkc1ZfnZrjjygcj+W0UBHCjzMYQerQZEggG738oW2mMecsp+mVk\naNLiUlP1doTzsQpxqXh2qDlJF2Y/F7WrPoBwGbFjWYSQyLmtOBW7izjnV37n4S6o\nxn+FBIko4EzQvVE9Wd/S5w==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>tps0O161pCFR8YZZiJsp1I8GgoiPpQV98k3AZgKB+tfC7EOguyJlM05UYH/ENGdH\nyQYuHxXhAL7MSo5TslR/sC4ELVL9bYo/MFNRLdf7tgDakwGDBfIcXdiLR6An3LJQ\nk9Bz+RN2yMX2Q/XUrarjb4ajiXNHXN93h4dMGVwvM6hAykBM/WBzcI7CmNaAzTwx\nZH+EjcVZBQJl48cfUYh6tNlr8SXMA5VfKx6rzvq8D3JoIBF7wSMhulaLbfMmULYC\n4EERZNZSAwu2VOH7TMWQQuALmGaz478LEQoq1+rLHqVjEAWlc6kTLerwftdonRzD\nudSza7/i0XMl5mJE5GWvo1ppo6Cq/U16lbdhUKB/T612iYOAoMQ2evz41mCf959q\n6tB45aGqkbntKqxQOIdcCtfubnAESxZ6Y5AqANf250eK53T6XI0tEMOV3KRvQYAd\nlbMm83dqJfQHbrvWk/17NtYGyg7RK/pgzShF/N7rkKbYljiAeJgFs18RB0UAc0Up\nLnVh+y5zIehpGYX79Xf+RKowNcP3k7D1KB+Xgeg1BZAuw4x766eRfPcFBH8IXqGb\nb1Oqs9ZX8Ses7NUh+TWUzBaXkcF6Bt8mAmUygGvZy0wBzs73gbOfvw7N2SeIo549\nTU0Y9jJpooFjkvsV0b4c5zTCQLR6/63CcKr9fIHm5Y2qLr0Teg0nS4mu6URtqbgf\nGPXcpaSUmEeUhLUHIuT+Vy7m+Zc6ZaEoVfoNsF0rI0cq7NAKeEETgLbuJexl/RcK\nPOjNlv5xzKDynJECpj9jappm6mt7i+BHSk9SdNLQlXw93wELQGHwPnpxovg24o0U\npofDcFrbRT4nHdfG7Xi1dzM2km0ubvXjH09Y4AWxwrKICzkEGSP4ljtE1rBbQfMf\nrZGPHwIhsD9du136pV2hEP9ttW9B2c//SJOjkp1nmLkw25qoInEUPGloo2sohBeg\nTOb8ySPZqh1DWZuyNVzD4qnv+GxL9yvIsSKAGyM70F1baOgNyn5qGqSpt90Z5CDJ\nSDygsur9OF/T2inpoRM1klWzz17E9cuPysIXTzGtTAbRzxTbQbuU1foGJlVPqVJC\nyTdZb9gfJ0JsOKFk0SGHMqSwb4n8hec9V/LFGyoPTnbEV6AfzSNwKJuzLGs8LbpA\nPlbnTeovbwCj44l/qdEMx+qmcV6NOkYMzysFLnzYef9xonhovtMVAqV2+Nd6a2hW\n9+ymUOGvk9oqfxQZ9Rci/5bV7L2CuU0ND8j+sxBoZm0aflqQp0vJVyupS7Js6LY+\nPFe7V7Ezag/StWl86mmVctfdys16nj9YosOlo5o0rYYWYZqlev5YbTpSd+jxI/Lj\nrBq6UStizb4FfpIymvA4e+JPEwgppqqXsxz4vAlQ3MWDgo+M8x36hEJ0L++5WCr2\nOhGJzT5LkylC0ouTEqI+YQTFoW7Qik56FA7UAzHcYaVQPS+OJo7JI+AfuSqFvn+4\neAS5MKEJhr+m6f7reNYWPvxgNtcSdb1mZmHflhqPAgvDHf2Zw4FaJtmIcYdWIu0R\nJb1i0z3asf3FhHFPlVMElvVMNIaTkgQbJgoGR+w5w/4VncG3rNtmnky3o0YB9Nol\nE9+I4b9flb1ZezZvy9CM5PMYNv5xYvR1w9TXS7bErEebOE9W6x9hLc3zoGy0SwGt\nJb8XdEod3igWqfv54OSKkuk+pp3Ivc50TZHXaqmHesu7YWHzoCfpducCn9R9JBLW\nMRxxcnvadvXejCxw0GIwCpG4LoCFrwoV4YRNjM30SY8JtJpr/SI3dAMMDRDmOvrn\nM4L8qFgTYA3LC91bdciIHKzb58Z5NLlLAzh8fVXndktwnveKAAtxVcIKEoomPdVS\n0ZJQyWtYb6LHchzuWZaZloutP+a2jYorKGu3AiOLxJJX5u0XTjQEu71rd/pTSY6v\naQzSKfJ0wCGomCu7NzhlQfP5PeZTW0JJVzxMBUZbQ/JBINpTOJ7UEh/YSI7ycc2q\njjQyf/NNzBIzenutwO7cXhIX8DRJarhyMc1Smj1BtTj9yo6b0LQ28N4q/S6HtbWk\nJDw9c0pLgzEi5v1wDUc3KI2otkS3l4wDxb6HYMPXCceYQbSjiDc0BIYKbv2pYDej\nl9zo8Pcqf3H64GZj98phYgz6FwOWIl+2pJBk/7ek94myk0bzkVI7cPPLVKadLaW2\nQGg5rAQkcnBG9in9J0Om/iux3l0RPd8r8d/if7VL3/nMAIBot6KR3cb5TXWdjq34\nvrDcMTFoZGGwy+7Ci+o6T3P33x0j1UIj0/Uc5oZrM13bW5khMSlbvFVkiLPZPzep\nzTXzyh5on3HcfLtC+vVIiiecEe3zjGueEdjPoNMHCtWXiIxsL8Iii/CuKBI13by6\nDx/x7gJJ0xv31AoLJsR4rFmb6Y8gflcVhIOFMH3hPAo3a20k3h3rnQ==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:50Z" SessionIndex="id-ClwYw8nCVfoVP4EHQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-JLtHgxi2AccfsDbLx'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpm1pfxm7c.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpm1pfxm7c.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5105550>
    def test_response_2(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        cert_str, cert_key_str = generate_cert()
    
        cert = {"cert": cert_str, "key": cert_key_str}
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=False,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str,
        )
tests/test_51_client.py:549: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:907: in _response
    response = signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-lFEWWKWkiNUJtnlY1" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:50Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-lFEWWKWkiNUJtnlY1"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-JLtHgxi2AccfsDbLx" IssueInstant="2025-04-21T14:10:50Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-JLtHgxi2AccfsDbLx"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">b4637243d0b8d7947b8a0f98d48102ded7e89dfe2f9bfdee9de927790b8f25a2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:50Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:50Z" NotOnOrAfter="2025-04-21T14:15:50Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_9b82fcd9-8801-4631-8826-d2df2b03d6e6" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_e8353672-24d6-4315-ab7c-a0ba5a0954ee"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDUwWhcNMzUwNDE5MTQxMDUwWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEA3865K/H8UEOYe24k+oH/FIXhZz3yHImsFaGLcrRhm6uuhr5dC+XhotO8\nI5HIgTK5X1m/ggH05+pZTO7owB8OFd8Us3Nq90UtiF6UloMK5IWN9J4onop1innb\nv0Fb8c+3fU5LmIH0oaSO4B37TRbzn4fhuZ1jt7CYKbEvACxao1K9G6Nf8epqbi30\nix0WcY42Msbe+mV9S20/t1uvB2Pp5BspjhGv0+wA4cbA6r4JT6cEw73zSkgs+P9m\nmt2RFkB16XUWeeLGuHzgoGXwyzzuTeZiej9YKDiXtGVJwgbTrHhe3Ro742rZCyLE\nEnIIU2Cc7SkliyE/um7XaK/iCIGpuQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAG38\nxuzvzdlF4CX1vduYChMODVyzPB7kJKfToh7DmK4hkvNW9zWEdFFc5FAuDBw62iAm\nnW5cdiF9io35zuHijCC5spbDgBx0swbgd2dk48VIl/HLNuPt5CNcfcBfjgJ+ZzvL\nkW1Az95yV0mYk97MHW69sX9eQidhsE9oIyGv+/6A</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>HWjUl40mzVSwfewqqzR8dxFcdz3HzmNaWkPoCYYXHOtC9ahhV/FQYgS0me4ERR6s\npOqxwvcbYxvDglwLHDmJVraYGlmxQvOoVnhMp8+VDIxbLEGxl/8TX3PVkTyKztj3\n6by2nXNckzo9CmlishL7Znt0ntEKphuGJgrIwCFSccsdZMPxfB+peH1qAuoLY9Cd\n0M9XArH19nvqDnkc1ZfnZrjjygcj+W0UBHCjzMYQerQZEggG738oW2mMecsp+mVk\naNLiUlP1doTzsQpxqXh2qDlJF2Y/F7WrPoBwGbFjWYSQyLmtOBW7izjnV37n4S6o\nxn+FBIko4EzQvVE9Wd/S5w==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>tps0O161pCFR8YZZiJsp1I8GgoiPpQV98k3AZgKB+tfC7EOguyJlM05UYH/ENGdH\nyQYuHxXhAL7MSo5TslR/sC4ELVL9bYo/MFNRLdf7tgDakwGDBfIcXdiLR6An3LJQ\nk9Bz+RN2yMX2Q/XUrarjb4ajiXNHXN93h4dMGVwvM6hAykBM/WBzcI7CmNaAzTwx\nZH+EjcVZBQJl48cfUYh6tNlr8SXMA5VfKx6rzvq8D3JoIBF7wSMhulaLbfMmULYC\n4EERZNZSAwu2VOH7TMWQQuALmGaz478LEQoq1+rLHqVjEAWlc6kTLerwftdonRzD\nudSza7/i0XMl5mJE5GWvo1ppo6Cq/U16lbdhUKB/T612iYOAoMQ2evz41mCf959q\n6tB45aGqkbntKqxQOIdcCtfubnAESxZ6Y5AqANf250eK53T6XI0tEMOV3KRvQYAd\nlbMm83dqJfQHbrvWk/17NtYGyg7RK/pgzShF/N7rkKbYljiAeJgFs18RB0UAc0Up\nLnVh+y5zIehpGYX79Xf+RKowNcP3k7D1KB+Xgeg1BZAuw4x766eRfPcFBH8IXqGb\nb1Oqs9ZX8Ses7NUh+TWUzBaXkcF6Bt8mAmUygGvZy0wBzs73gbOfvw7N2SeIo549\nTU0Y9jJpooFjkvsV0b4c5zTCQLR6/63CcKr9fIHm5Y2qLr0Teg0nS4mu6URtqbgf\nGPXcpaSUmEeUhLUHIuT+Vy7m+Zc6ZaEoVfoNsF0rI0cq7NAKeEETgLbuJexl/RcK\nPOjNlv5xzKDynJECpj9jappm6mt7i+BHSk9SdNLQlXw93wELQGHwPnpxovg24o0U\npofDcFrbRT4nHdfG7Xi1dzM2km0ubvXjH09Y4AWxwrKICzkEGSP4ljtE1rBbQfMf\nrZGPHwIhsD9du136pV2hEP9ttW9B2c//SJOjkp1nmLkw25qoInEUPGloo2sohBeg\nTOb8ySPZqh1DWZuyNVzD4qnv+GxL9yvIsSKAGyM70F1baOgNyn5qGqSpt90Z5CDJ\nSDygsur9OF/T2inpoRM1klWzz17E9cuPysIXTzGtTAbRzxTbQbuU1foGJlVPqVJC\nyTdZb9gfJ0JsOKFk0SGHMqSwb4n8hec9V/LFGyoPTnbEV6AfzSNwKJuzLGs8LbpA\nPlbnTeovbwCj44l/qdEMx+qmcV6NOkYMzysFLnzYef9xonhovtMVAqV2+Nd6a2hW\n9+ymUOGvk9oqfxQZ9Rci/5bV7L2CuU0ND8j+sxBoZm0aflqQp0vJVyupS7Js6LY+\nPFe7V7Ezag/StWl86mmVctfdys16nj9YosOlo5o0rYYWYZqlev5YbTpSd+jxI/Lj\nrBq6UStizb4FfpIymvA4e+JPEwgppqqXsxz4vAlQ3MWDgo+M8x36hEJ0L++5WCr2\nOhGJzT5LkylC0ouTEqI+YQTFoW7Qik56FA7UAzHcYaVQPS+OJo7JI+AfuSqFvn+4\neAS5MKEJhr+m6f7reNYWPvxgNtcSdb1mZmHflhqPAgvDHf2Zw4FaJtmIcYdWIu0R\nJb1i0z3asf3FhHFPlVMElvVMNIaTkgQbJgoGR+w5w/4VncG3rNtmnky3o0YB9Nol\nE9+I4b9flb1ZezZvy9CM5PMYNv5xYvR1w9TXS7bErEebOE9W6x9hLc3zoGy0SwGt\nJb8XdEod3igWqfv54OSKkuk+pp3Ivc50TZHXaqmHesu7YWHzoCfpducCn9R9JBLW\nMRxxcnvadvXejCxw0GIwCpG4LoCFrwoV4YRNjM30SY8JtJpr/SI3dAMMDRDmOvrn\nM4L8qFgTYA3LC91bdciIHKzb58Z5NLlLAzh8fVXndktwnveKAAtxVcIKEoomPdVS\n0ZJQyWtYb6LHchzuWZaZloutP+a2jYorKGu3AiOLxJJX5u0XTjQEu71rd/pTSY6v\naQzSKfJ0wCGomCu7NzhlQfP5PeZTW0JJVzxMBUZbQ/JBINpTOJ7UEh/YSI7ycc2q\njjQyf/NNzBIzenutwO7cXhIX8DRJarhyMc1Smj1BtTj9yo6b0LQ28N4q/S6HtbWk\nJDw9c0pLgzEi5v1wDUc3KI2otkS3l4wDxb6HYMPXCceYQbSjiDc0BIYKbv2pYDej\nl9zo8Pcqf3H64GZj98phYgz6FwOWIl+2pJBk/7ek94myk0bzkVI7cPPLVKadLaW2\nQGg5rAQkcnBG9in9J0Om/iux3l0RPd8r8d/if7VL3/nMAIBot6KR3cb5TXWdjq34\nvrDcMTFoZGGwy+7Ci+o6T3P33x0j1UIj0/Uc5oZrM13bW5khMSlbvFVkiLPZPzep\nzTXzyh5on3HcfLtC+vVIiiecEe3zjGueEdjPoNMHCtWXiIxsL8Iii/CuKBI13by6\nDx/x7gJJ0xv31AoLJsR4rFmb6Y8gflcVhIOFMH3hPAo3a20k3h3rnQ==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:50Z" SessionIndex="id-ClwYw8nCVfoVP4EHQ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-JLtHgxi2AccfsDbLx'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-JLtHgxi2AccfsDbLx', '--output', '/tmp/tmp4_oy96re.xml', '/tmp/tmpm1pfxm7c.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpm1pfxm7c.xml"
output=
__________________________ TestClient.test_response_3 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-foXbIqKMigEzh3Fuj" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:51Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-foXbIqKMigEzh3Fuj"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-j64rfS7S4n8lvxXrs" IssueInstant="2025-04-21T14:10:51Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-j64rfS7S4n8lvxXrs"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">9c91ce301d9135b8977443c942ad6b7f07a68f4c1ae31b23a61856746f43d9b2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:51Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:51Z" NotOnOrAfter="2025-04-21T14:15:51Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_b010c697-34a3-408b-80af-81bd6bc79662" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_9f8f4697-7887-4129-ab69-2648360a96b4"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>EtODB6TWTyeeUHO50/zGZ6eHNePNmXcG1glMwfU9BA3yDgYXan23pv2VfqPqXIyx\nw6IiUbT077ucJuQe6IMK7MD8OAXmg3Wr45iuxIaIa90yLmzuzZV6XbG1Xh/DxGYX\nTC3Lux0dAAXmdp9VzUuO1ONt1VTJGwt/M2PCaQ188IA=</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>xStb7v2EOLeI/7w9s/Wyv+C9/3ht2yItPkVLUVjBzihL8cwsRzPqXK4/x3yjYWeB\nwuIUSZYvLIG/zxFLPnXu5qSZ4+IzweUvaOrzgEg0g4xDuu7NgUFNRtqRjO1/VAmy\nafEsp0zXw4va8jUNzwgGflv8CtJbLq924AkAxT8NrVH8I4HrGnX13pFWrBCM8olY\npUbCSChfcnIboOlmFW9Qo4r4L6E50tr2loKCCfAZ5ZE6FYeb9wWDlvwcIp9NyAvL\nUrDWCZKiu/9ttkHLC79IFNBp3pRGKAFN/n3Zz0r0fjcS8sFFrvT/Sh0MlTyVIitQ\nymqaiAs345hruUvfaIFMuf30roRSXGgV/cnRfTs29IsUiO2CHuYko9+Ja5I/Lvt2\n8KTKuo4+0lV9KzvQ9A6GxH1yr7im4KfGueW+UP2HSw4dEwWDg+RMn+DQpBcBwzM2\nn8DqCwOOSIKVuhh8xWSo9T4NRYApQdKLM/p2a0LiZpcS4xTFBcmMHt3gNQLyGMio\nIDSPS5XLXEEdcOOMvYCta1PXs0B1DFIKI3+q/ZLBFNr8eJ/oS8pY+3fyychIXL/A\ncO/eRM2jewk0ZE7mgCrsxbshX5Vz9CkkjlikeHlsZamFH1Kt7GWVcBPwZjAmbiy9\nk2GAForGhadVjSATH5XKHl8js+vOahh/QmhmfC63FV/IddZPHOhvq7S/5HNd8pDV\nr0s/pqZvAdG/9fJwhSsaWLq4Gyxzx498Iyyq1jTlTCTFuRag7+Sfa7TXvPglOfrw\nY017P867seGrOrnK8+1xiQzkGoBO/uZlTEJHs2NObib69RARzLsxZCQBqIwiowvT\nbIFkKeid8f/LNWa0viKMgg2D+4hjazUBnf+KhPu9UpDsBzKrftF4IOr0F4mXQL4d\ncdUcrLoVQ/Sn/Ht/LVIpL5T5nn/lwz4zZrcjdjbip7wS1oeaaT9NOJuEPoDRt8dV\nuv6nFU46vAGP3TxQwqAt73Z212jWvP1TkySZSjKmGVhKXO0UPk/o3ylHvH9mqh/9\nc9fdeF4ws9V8YWfxphR5iNlWw0H12MmkFJSGR9gWtaBp5UCjsCyVGP74YhVPw0VI\nmtxcE6+UVnnTnYp/SDgdpLn9IpOwBskE2TqsjItcDNVGjlp/xr8A5zpG9h7gwQ0d\nXE0FosQlY2Ni4gbYgfHBYspDYwQLWxT3FsKNvER5BuAgo9WbMET7+kg8q8AV7mBs\nlqVzhaiNoRd0cO2w10K5fy+dhiqEoF8hO2cXjy6sGC1jXyvYDMIAWKLwhxSAlVmJ\nkFL1c4Dmqj2PNXrpjZxboxZ664D4prSyEysn5T315xvBXpdP+E8FsqjFgexLN8Uk\nF0wHq++3hLSzCFxcbrFyVepLmY8//l0qzZR3auKKbm9nUmOvrkS4mfKx+exZM3tr\ndEuGL7HA7KAcWYd727+X3WuE+VLkZhRn3sN9dDO4Qf/wjreCRK8qVfvm1WEzM11y\n+fk9KYc/M62iECuKWUKOUX8hWRXFQuH/m+TXnzSDH7QKzbXV1qDmCmJ5L9NV7dWD\nkQWNfj357pt1ZVoK1POTQdhLIKCaavLY125ER1dpKRnDWLSzQKUtALwBkOhqjSF4\nXuZgLedkqxUk9o+maLIHEmiJ0CNS/Hp6mHWiuKWEyTBoGgmjc+BwWFA87lUjTAnK\nlP0w3xv17VT1ST+MJsR7owJyKaCjMZIt182yq1WGe0/CQUTwNT08EwJNJ3KLY8E7\nZDo83IXF6XnGXri2OxymrzaQPKfiwII3G12+QntJAcGLNj16wiO8r/SldPNYFzBx\nPpCoT2iFLYXZEnRJ52slydiFRGVYsNKEWiDatvenUx7j3WsmPr/4XVsfQjhQKnwD\nbvwkTGQavDCIJo+JaypwfOgIi+iufrMu6Sz+RkLEZyT8QGT1VlYZjt/i6ENZrCYG\njToJ7GCBIHL8iltd94t52i4Ifpy+NRcU7b5q7hmhtvlrnt3qD6oamezadbQls1ph\n8uSY7RVFTKyFLLJa3UygN5Jk766+Ltkvfoo1zwu8E/lSenzkbUW226zWXp6UZhYQ\nxl5BMAIHzUBN/ulLhm4hGEZYWYrjk/koYvwmwWpfZnWPuQD2IPKlKhvwhzgTScar\nQg8avO3QbOc/8TS8dPG9C1L1tOL618IhxinnRkBQpSKYWLdm+hXnGbwjtCNNCI9w\nG0Q/yIJmgvHrMXl8ufOo/9zP9kUXkc/Wev/y9g9CnVjGSYMNZ9lsKpKd2nYqHtuZ\nxoLsQ2fXFm0NWFWQeD9Yhik5ga25lXGNfrMDlwX1Fuj15PxKbeg6UYVYwPhTB8cK\nqkHVT6kA2R0JqYavLlY7YeGKoGJGaH3pB0TikbMQ7kFArv1HdjG0Aakhzx3HQ3t5\naMk3hnUS7GqcdkhDuoK0lOuq8dxpwAZpVE366RGLjEmwDY/TvUbXqw==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:51Z" SessionIndex="id-UeSc5lg0aJkMcUtJu"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-j64rfS7S4n8lvxXrs'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpadbyocfc.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpadbyocfc.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa58ac1b0>
    def test_response_3(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=False,
            encrypt_assertion_self_contained=True,
            pefim=True,
        )
tests/test_51_client.py:584: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:907: in _response
    response = signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-foXbIqKMigEzh3Fuj" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:51Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-foXbIqKMigEzh3Fuj"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-j64rfS7S4n8lvxXrs" IssueInstant="2025-04-21T14:10:51Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-j64rfS7S4n8lvxXrs"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">9c91ce301d9135b8977443c942ad6b7f07a68f4c1ae31b23a61856746f43d9b2</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:51Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:51Z" NotOnOrAfter="2025-04-21T14:15:51Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_b010c697-34a3-408b-80af-81bd6bc79662" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_9f8f4697-7887-4129-ab69-2648360a96b4"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>EtODB6TWTyeeUHO50/zGZ6eHNePNmXcG1glMwfU9BA3yDgYXan23pv2VfqPqXIyx\nw6IiUbT077ucJuQe6IMK7MD8OAXmg3Wr45iuxIaIa90yLmzuzZV6XbG1Xh/DxGYX\nTC3Lux0dAAXmdp9VzUuO1ONt1VTJGwt/M2PCaQ188IA=</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>xStb7v2EOLeI/7w9s/Wyv+C9/3ht2yItPkVLUVjBzihL8cwsRzPqXK4/x3yjYWeB\nwuIUSZYvLIG/zxFLPnXu5qSZ4+IzweUvaOrzgEg0g4xDuu7NgUFNRtqRjO1/VAmy\nafEsp0zXw4va8jUNzwgGflv8CtJbLq924AkAxT8NrVH8I4HrGnX13pFWrBCM8olY\npUbCSChfcnIboOlmFW9Qo4r4L6E50tr2loKCCfAZ5ZE6FYeb9wWDlvwcIp9NyAvL\nUrDWCZKiu/9ttkHLC79IFNBp3pRGKAFN/n3Zz0r0fjcS8sFFrvT/Sh0MlTyVIitQ\nymqaiAs345hruUvfaIFMuf30roRSXGgV/cnRfTs29IsUiO2CHuYko9+Ja5I/Lvt2\n8KTKuo4+0lV9KzvQ9A6GxH1yr7im4KfGueW+UP2HSw4dEwWDg+RMn+DQpBcBwzM2\nn8DqCwOOSIKVuhh8xWSo9T4NRYApQdKLM/p2a0LiZpcS4xTFBcmMHt3gNQLyGMio\nIDSPS5XLXEEdcOOMvYCta1PXs0B1DFIKI3+q/ZLBFNr8eJ/oS8pY+3fyychIXL/A\ncO/eRM2jewk0ZE7mgCrsxbshX5Vz9CkkjlikeHlsZamFH1Kt7GWVcBPwZjAmbiy9\nk2GAForGhadVjSATH5XKHl8js+vOahh/QmhmfC63FV/IddZPHOhvq7S/5HNd8pDV\nr0s/pqZvAdG/9fJwhSsaWLq4Gyxzx498Iyyq1jTlTCTFuRag7+Sfa7TXvPglOfrw\nY017P867seGrOrnK8+1xiQzkGoBO/uZlTEJHs2NObib69RARzLsxZCQBqIwiowvT\nbIFkKeid8f/LNWa0viKMgg2D+4hjazUBnf+KhPu9UpDsBzKrftF4IOr0F4mXQL4d\ncdUcrLoVQ/Sn/Ht/LVIpL5T5nn/lwz4zZrcjdjbip7wS1oeaaT9NOJuEPoDRt8dV\nuv6nFU46vAGP3TxQwqAt73Z212jWvP1TkySZSjKmGVhKXO0UPk/o3ylHvH9mqh/9\nc9fdeF4ws9V8YWfxphR5iNlWw0H12MmkFJSGR9gWtaBp5UCjsCyVGP74YhVPw0VI\nmtxcE6+UVnnTnYp/SDgdpLn9IpOwBskE2TqsjItcDNVGjlp/xr8A5zpG9h7gwQ0d\nXE0FosQlY2Ni4gbYgfHBYspDYwQLWxT3FsKNvER5BuAgo9WbMET7+kg8q8AV7mBs\nlqVzhaiNoRd0cO2w10K5fy+dhiqEoF8hO2cXjy6sGC1jXyvYDMIAWKLwhxSAlVmJ\nkFL1c4Dmqj2PNXrpjZxboxZ664D4prSyEysn5T315xvBXpdP+E8FsqjFgexLN8Uk\nF0wHq++3hLSzCFxcbrFyVepLmY8//l0qzZR3auKKbm9nUmOvrkS4mfKx+exZM3tr\ndEuGL7HA7KAcWYd727+X3WuE+VLkZhRn3sN9dDO4Qf/wjreCRK8qVfvm1WEzM11y\n+fk9KYc/M62iECuKWUKOUX8hWRXFQuH/m+TXnzSDH7QKzbXV1qDmCmJ5L9NV7dWD\nkQWNfj357pt1ZVoK1POTQdhLIKCaavLY125ER1dpKRnDWLSzQKUtALwBkOhqjSF4\nXuZgLedkqxUk9o+maLIHEmiJ0CNS/Hp6mHWiuKWEyTBoGgmjc+BwWFA87lUjTAnK\nlP0w3xv17VT1ST+MJsR7owJyKaCjMZIt182yq1WGe0/CQUTwNT08EwJNJ3KLY8E7\nZDo83IXF6XnGXri2OxymrzaQPKfiwII3G12+QntJAcGLNj16wiO8r/SldPNYFzBx\nPpCoT2iFLYXZEnRJ52slydiFRGVYsNKEWiDatvenUx7j3WsmPr/4XVsfQjhQKnwD\nbvwkTGQavDCIJo+JaypwfOgIi+iufrMu6Sz+RkLEZyT8QGT1VlYZjt/i6ENZrCYG\njToJ7GCBIHL8iltd94t52i4Ifpy+NRcU7b5q7hmhtvlrnt3qD6oamezadbQls1ph\n8uSY7RVFTKyFLLJa3UygN5Jk766+Ltkvfoo1zwu8E/lSenzkbUW226zWXp6UZhYQ\nxl5BMAIHzUBN/ulLhm4hGEZYWYrjk/koYvwmwWpfZnWPuQD2IPKlKhvwhzgTScar\nQg8avO3QbOc/8TS8dPG9C1L1tOL618IhxinnRkBQpSKYWLdm+hXnGbwjtCNNCI9w\nG0Q/yIJmgvHrMXl8ufOo/9zP9kUXkc/Wev/y9g9CnVjGSYMNZ9lsKpKd2nYqHtuZ\nxoLsQ2fXFm0NWFWQeD9Yhik5ga25lXGNfrMDlwX1Fuj15PxKbeg6UYVYwPhTB8cK\nqkHVT6kA2R0JqYavLlY7YeGKoGJGaH3pB0TikbMQ7kFArv1HdjG0Aakhzx3HQ3t5\naMk3hnUS7GqcdkhDuoK0lOuq8dxpwAZpVE366RGLjEmwDY/TvUbXqw==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:51Z" SessionIndex="id-UeSc5lg0aJkMcUtJu"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-j64rfS7S4n8lvxXrs'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-j64rfS7S4n8lvxXrs', '--output', '/tmp/tmpb0ias8ja.xml', '/tmp/tmpadbyocfc.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpadbyocfc.xml"
output=
__________________________ TestClient.test_response_4 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-MGMKOn79Vc6eYxwX4" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:51Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-MGMKOn79Vc6eYxwX4"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-VxXKxNJg4EmQ2mdCh" IssueInstant="2025-04-21T14:10:51Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-VxXKxNJg4EmQ2mdCh"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">4c1f3597c055fd372cf97f0334be7476013c6f609f7e463e5fb5dc7a31362ac0</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:51Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:51Z" NotOnOrAfter="2025-04-21T14:15:51Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_43035dae-b6d3-48e1-b7da-88779066b655" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_3cc99a63-6db7-484c-ad58-d12c8ffe465a"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>kqRclVrK0GWfIxSNHL/Vde66zjFckP52Wmhu928/fg4UGA5bg0HBZBXmctWyjqlF\np35BHVifNDWMXZUZPY60BtdJvj3AV1flVZ9kB+ZK7tvXjyCN9Cu5YIjwBEXREr0x\n91QIZJbMOYU3b2sh6Ke+ZHbxvoNHOSzQANUkhUFeiFU=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>5xBXOzVKVkDImty1A/LWw8Yxdqi/wpEDlP75DK1jl53n3LgPCMK7V8i+THe5XSKR\nfigRp/k8Xwo59np/Canor3AVBUATMjLgfnJjCo5FZx4XYEWX/N4tHqz5Iu8jc6QF\nvcIVEWiP3a6CQ1nKys6Ze2hOLFCW0jsn8O6SblXf57DzeQrvFCY22OKujyGzy501\na5kFSwSJWrEy76DT5AX9nrZsPZLR42/dXIi3SjGfrss7OswcmySqnY/AMb0vCOH0\nuVQasHh3+wpZpjZM59/Lq7FH40SgbdV2PPID/K1tAQElHwxBGISWKAwBunGYLwQ8\nLi01mTkIlt+1LQmjCbD0U0Km2U9Kd6cko07x9kmsdy2y8VygSouhLqHMzzVz+6jk\nKsCMnX7J8K+KRUEwfmHCYT8u5DID8LTVam9dpoLan0LxzZTpehtIOk0VinIASPqx\nnOM9jIuKZ4IW8d+nCkq5sCpYHPzymjMZQw8cctpoQ8hiN+0yrVhI3STrBMQ5AEJJ\npwGr7gZnE/08L7Ke3FLKPi7DTMdqWVgw5t4SLGPEolRkFNHZssMNv8yZ0mu9w/xm\nbzc+hcGlCezOdObecG19soXk0lmcT4DPi293r/43a38BStijFazKzk6tXAvDWOvE\n/wCJigV/0B4ZBk1+X4+k+JznOEqio41PZXBGtkd7DroQBjxyommVZvgUIThobpjX\ntWDu+8kS4GfQeqwPf+6GSMoNrvHy5eYeK00WAyf6SCb2xNm0GDyI42dMmRaU1CO+\nDNr3W64s8sTnq4p3REgV9JkhG6p+noXYkp4Dk0aJO4q7zaXV5W5RuTB8sbfNUiij\ntLmyjws8T1CoWogOlikrmv9eXQMiUkqzzFq6EeCrFGPlxyXfcA6icZ406OcPzKgu\nSpkdumx4wGhMKdGeTrlbRdHfiO3Su0b9tmIB+OaeKzgtJBa1lcTKB1gK4zUsarnW\nY04qZTUAAv2ypsd05JPh05I0K4yOpGGieEG2OYjqvozYcxl4LD6Ku5Z5Zu28l7xO\nswhd5ZZ0LDqjvxGEXaY5ldryVTDF29l/Lm6oYamiGSjvHbspF5AR/IG1lmI57I+y\nJhDAaQJXs4923SUq7o+LqbPZOSyuNvfdlCmEDpBcvcPeC01QgbDK8jGi6CQNRx4d\nc24TzCWAQQfwg9D2i6PTTwXUOUzK8Gqtb0jsi7wFevtoQwYx+tDABq4HJutPpLW3\nMsID8R7z6pxUIk4MYTULfEVTeG+cKe9V7ZWTbwQXtMHt/qQFeulLAndi5zh8tMxc\neJOhe1TAuPZSB1rcLMlSJXdd4HeTr7muubXG1X1jZRdM1jzRwSPlfxJGYlchK77f\nDNi10imPizPwVF5kqLVvEDGXz0AhswhvMcThWd75UdVfILrCyWe7J5J08h+RA/zZ\n2CvQRSEDYdBTCLBOG4o1Cbl0J97cL8zfK4jyZg09IVql1UFL6zL4dqqzSUR2gdRX\n7Ats3OLyTBAydIMHf7sxXG4fda2ulWnXq4vXMFX3srl1Yi0qdL9mJIhdqOhtEbN4\nxvXvnJ5fr/q4IQ5DdwfRiwOFBPPQLKyIhK7thTDhNE3udaB4Unsnd3oe0bp7fPfH\nKt7n/bE8u3uBT0ydd8MFhbhhu3aToHTXbuCxFclpb/3mSjNVfFjTWo+i8rTqcxvd\nlVR8i9SeFfx3glyPNDid6xcH/D9WJSG6hfeNHgmHq0zpODLKfqsz+XtQNp2eu7N3\njYX8ueF70hSZERrHdmaqKWdQAeVZB/LtcfT0pOVX6hjq0nHqoeLAczeK8LraoXpx\nsqSXWqaPSm7vB6M06ZDcw+ZqA9nVlzCUg5lHzVC69WYv402tVaPzMjsoaU/Frmvu\nQ9z2w9MK1bby3Slx9AhiZwZmgxREBw3vnFo/COCfTuDyDrtc/cG4Oq2JENQilPOy\n02fCpA2ualIVwmeXBHMPfr7X322W3U9lnFse/rfgcmiX1HyGFBL7T0mK6gbp/8wQ\nr0uY9Ycg/PGqkadCtRs99RIiL27lHxWw0537xXIPZ+oa8zS9VmBNonzsRHuxow67\n2qJR1zIv+rYg45uCLVGk5OTn2DVw7xadg5N4vuFCwihNOS1F0g5pWLDvwOrrTH9o\nab8nIiXeaUyrln8u8NByQFxy5Hh5fdOTQROrMRuRdj3klGhNz1eJRMjVYRyIOLpQ\nx7A9Ryj2ygtGiissLUIYIKFsXzab9+yaTbTBygc8zfWO8VBtnRT7z9udh9ANlBkI\nPl2aQzSscRrrRDREs5A/R53Mplmg2mE6JWX2BP4u3PjN2BnWHNAtYPSxWQeD2Fun\n34EBU7Ct7pebo3K8lE+xCKcFWHRBSDUhkb8P+YBEEaF+owN5NW9LAdJKgbh3pnUD\njLwOjGf67JtkaVbHTsR0QfrIh5Moe+gcqgjO2cD75QLlnJxKyyJwxA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:51Z" SessionIndex="id-uTM5MCNkPX1kw9OMT"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-VxXKxNJg4EmQ2mdCh'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpsflxk14o.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpsflxk14o.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa58ac310>
    def test_response_4(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
        )
tests/test_51_client.py:618: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-MGMKOn79Vc6eYxwX4" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:51Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-MGMKOn79Vc6eYxwX4"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-VxXKxNJg4EmQ2mdCh" IssueInstant="2025-04-21T14:10:51Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-VxXKxNJg4EmQ2mdCh"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">4c1f3597c055fd372cf97f0334be7476013c6f609f7e463e5fb5dc7a31362ac0</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:51Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:51Z" NotOnOrAfter="2025-04-21T14:15:51Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_43035dae-b6d3-48e1-b7da-88779066b655" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_3cc99a63-6db7-484c-ad58-d12c8ffe465a"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>kqRclVrK0GWfIxSNHL/Vde66zjFckP52Wmhu928/fg4UGA5bg0HBZBXmctWyjqlF\np35BHVifNDWMXZUZPY60BtdJvj3AV1flVZ9kB+ZK7tvXjyCN9Cu5YIjwBEXREr0x\n91QIZJbMOYU3b2sh6Ke+ZHbxvoNHOSzQANUkhUFeiFU=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>5xBXOzVKVkDImty1A/LWw8Yxdqi/wpEDlP75DK1jl53n3LgPCMK7V8i+THe5XSKR\nfigRp/k8Xwo59np/Canor3AVBUATMjLgfnJjCo5FZx4XYEWX/N4tHqz5Iu8jc6QF\nvcIVEWiP3a6CQ1nKys6Ze2hOLFCW0jsn8O6SblXf57DzeQrvFCY22OKujyGzy501\na5kFSwSJWrEy76DT5AX9nrZsPZLR42/dXIi3SjGfrss7OswcmySqnY/AMb0vCOH0\nuVQasHh3+wpZpjZM59/Lq7FH40SgbdV2PPID/K1tAQElHwxBGISWKAwBunGYLwQ8\nLi01mTkIlt+1LQmjCbD0U0Km2U9Kd6cko07x9kmsdy2y8VygSouhLqHMzzVz+6jk\nKsCMnX7J8K+KRUEwfmHCYT8u5DID8LTVam9dpoLan0LxzZTpehtIOk0VinIASPqx\nnOM9jIuKZ4IW8d+nCkq5sCpYHPzymjMZQw8cctpoQ8hiN+0yrVhI3STrBMQ5AEJJ\npwGr7gZnE/08L7Ke3FLKPi7DTMdqWVgw5t4SLGPEolRkFNHZssMNv8yZ0mu9w/xm\nbzc+hcGlCezOdObecG19soXk0lmcT4DPi293r/43a38BStijFazKzk6tXAvDWOvE\n/wCJigV/0B4ZBk1+X4+k+JznOEqio41PZXBGtkd7DroQBjxyommVZvgUIThobpjX\ntWDu+8kS4GfQeqwPf+6GSMoNrvHy5eYeK00WAyf6SCb2xNm0GDyI42dMmRaU1CO+\nDNr3W64s8sTnq4p3REgV9JkhG6p+noXYkp4Dk0aJO4q7zaXV5W5RuTB8sbfNUiij\ntLmyjws8T1CoWogOlikrmv9eXQMiUkqzzFq6EeCrFGPlxyXfcA6icZ406OcPzKgu\nSpkdumx4wGhMKdGeTrlbRdHfiO3Su0b9tmIB+OaeKzgtJBa1lcTKB1gK4zUsarnW\nY04qZTUAAv2ypsd05JPh05I0K4yOpGGieEG2OYjqvozYcxl4LD6Ku5Z5Zu28l7xO\nswhd5ZZ0LDqjvxGEXaY5ldryVTDF29l/Lm6oYamiGSjvHbspF5AR/IG1lmI57I+y\nJhDAaQJXs4923SUq7o+LqbPZOSyuNvfdlCmEDpBcvcPeC01QgbDK8jGi6CQNRx4d\nc24TzCWAQQfwg9D2i6PTTwXUOUzK8Gqtb0jsi7wFevtoQwYx+tDABq4HJutPpLW3\nMsID8R7z6pxUIk4MYTULfEVTeG+cKe9V7ZWTbwQXtMHt/qQFeulLAndi5zh8tMxc\neJOhe1TAuPZSB1rcLMlSJXdd4HeTr7muubXG1X1jZRdM1jzRwSPlfxJGYlchK77f\nDNi10imPizPwVF5kqLVvEDGXz0AhswhvMcThWd75UdVfILrCyWe7J5J08h+RA/zZ\n2CvQRSEDYdBTCLBOG4o1Cbl0J97cL8zfK4jyZg09IVql1UFL6zL4dqqzSUR2gdRX\n7Ats3OLyTBAydIMHf7sxXG4fda2ulWnXq4vXMFX3srl1Yi0qdL9mJIhdqOhtEbN4\nxvXvnJ5fr/q4IQ5DdwfRiwOFBPPQLKyIhK7thTDhNE3udaB4Unsnd3oe0bp7fPfH\nKt7n/bE8u3uBT0ydd8MFhbhhu3aToHTXbuCxFclpb/3mSjNVfFjTWo+i8rTqcxvd\nlVR8i9SeFfx3glyPNDid6xcH/D9WJSG6hfeNHgmHq0zpODLKfqsz+XtQNp2eu7N3\njYX8ueF70hSZERrHdmaqKWdQAeVZB/LtcfT0pOVX6hjq0nHqoeLAczeK8LraoXpx\nsqSXWqaPSm7vB6M06ZDcw+ZqA9nVlzCUg5lHzVC69WYv402tVaPzMjsoaU/Frmvu\nQ9z2w9MK1bby3Slx9AhiZwZmgxREBw3vnFo/COCfTuDyDrtc/cG4Oq2JENQilPOy\n02fCpA2ualIVwmeXBHMPfr7X322W3U9lnFse/rfgcmiX1HyGFBL7T0mK6gbp/8wQ\nr0uY9Ycg/PGqkadCtRs99RIiL27lHxWw0537xXIPZ+oa8zS9VmBNonzsRHuxow67\n2qJR1zIv+rYg45uCLVGk5OTn2DVw7xadg5N4vuFCwihNOS1F0g5pWLDvwOrrTH9o\nab8nIiXeaUyrln8u8NByQFxy5Hh5fdOTQROrMRuRdj3klGhNz1eJRMjVYRyIOLpQ\nx7A9Ryj2ygtGiissLUIYIKFsXzab9+yaTbTBygc8zfWO8VBtnRT7z9udh9ANlBkI\nPl2aQzSscRrrRDREs5A/R53Mplmg2mE6JWX2BP4u3PjN2BnWHNAtYPSxWQeD2Fun\n34EBU7Ct7pebo3K8lE+xCKcFWHRBSDUhkb8P+YBEEaF+owN5NW9LAdJKgbh3pnUD\njLwOjGf67JtkaVbHTsR0QfrIh5Moe+gcqgjO2cD75QLlnJxKyyJwxA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:51Z" SessionIndex="id-uTM5MCNkPX1kw9OMT"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-VxXKxNJg4EmQ2mdCh'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-VxXKxNJg4EmQ2mdCh', '--output', '/tmp/tmp3wjnr5xg.xml', '/tmp/tmpsflxk14o.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpsflxk14o.xml"
output=
__________________________ TestClient.test_response_5 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-IQXanD1hKU1nE1dPI" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:51Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-IQXanD1hKU1nE1dPI"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-JdBTieTV7dK2S2F4B" IssueInstant="2025-04-21T14:10:51Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-JdBTieTV7dK2S2F4B"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ae8f4d83f415a0429c23c715d5687e2c4a4ce7b708ec4c687f347589c1a7ced4</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:51Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:51Z" NotOnOrAfter="2025-04-21T14:15:51Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_839db37f-02fb-40f1-8231-afd069bcc532" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_014abf39-d764-4ac2-a079-7344ba2382f0"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>GelO0yPw/yTjxcnip5O11Srcwrytu4nUDI4+MJrCzgR/xIZbsumU7oCph/L8Spgc\n/k2txsUyhrxs5qCorX3d4h1BHvbEm7PBS7XML7HEPTD1y6JZE/Wztn1fTKKVLkw7\noHBTutethkSMbpoe0mzDOhu6fyBJfAUer4SD/lluIXA=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>Gv5hlVhSz6JL+ukjK+1eBEox8itPgKH6+fMkxCcau2ngPu+xJDf8e0qfI0XFvUse\n384RbuKAJwBoUsTm2VRb2ayFI1suHa327Q9XNjgGApZnByrKV3sPSZqXNWjFwzvm\nfQYXkgSeeHZJc/C6TmHD7nSYNnlH1tEWWn0pIjFgcEZc5u73yo+H5NYK7sPUa7V4\nE8nsE9+ib4XhYnWtbyB8EGU8NCkpZUue6SS/9tCOS1swU9JbOYUVbG18yEaay6SK\n0fTdyYFdowObRmR3SbVBpAXealHwRd6xCFq3EmIRqpilYWusM4j3VLFRPqnZ0frj\nHgbLF64xI2Fb26MbSM+kIizzg+NioiKgItqN+jz1mWD0bL7W71nr8nsSPejDx/vn\nAIqaEevLHDlqGvMQDldR5mAQb3Z+XI3ekNBzZuaHof2wRwHTE6AR514y9NKFLA00\naanQdmpCKaUMjaotnx/6JaBBu28ge0zKFLCAoEuqb77ofwrOXqrWtiufa72lcawi\nup79+uM/5FWBR9iyZNMcaUnnHG4GxZy1yxl6dMTHVUeV5n7N7v6snir3tRQtUQNX\nIH7z+y6Iw1I5RT2xZ45Nnjdl3tqdqiMWhRCqqzPw1FB4HiCXmXsb0ftUvd8+nb58\nUhnDqh5eQyRnocPeQuvQHM9IX5FcrsA4+68qZuQ2T7xf50uwNkr+eWe5Xkw12LPE\npP2U3b7aKccfCxyXCENc/5sz+IhbQxNMDMfP9g4k7bGJp0WB81X6eG4rEUZKwTgF\nTgnY3oD8fPzR/c0uKTHHwpKEVPjTbsmwHqDtjgbVnj7PZaiJcHb9IeMIjx7vAsK+\nCCthFJsMqRFA54foN21saKqnJ/yOBKQjdKhcE2VxSD15t4ubrjmvcTesuH0hXUDv\n1wDIMFatGGyIPgiYTa+Jrz+LKQVANgt1FIJPbhn3viZrS5zWd6unhfRTSQ/7GPPp\ncGJes55z7HSi6p0YJf1s+u2VOQ7KJjo9VmXQELmosPLUzMXZV6rDPVLDMw9nWir+\n0tgWkIQCprO6SwNLXShqvJtbmWCvSHPFcdz6OHcJqk7P17trcl0G1cS9QkyWBdI5\nPdhX7EMm/cRDBDfoXxDPwzQwJoTv8Fc0xC3Qdh5MfLgWiuMVFwb+SRmHxAFuiEpU\nMFQVsTD4IIngYzdB9OkotJygiDjEhJdOg6k6XNi6MhzqThlOMOSExPKKVoTca475\nyTgEF60y3HItsyw0hYpgmH8zdcPklHFLyUCwtz6Wn4HGhCeLbG4baJmAg00kWbzY\nsOEH3gcYjemerO3kmfoxcXL6Mrk1qlsfmSb+o94opuiFMH0pczcxL9vduQWcb/Kq\n5aQkcxto/FoIV++9uYAxCzACIKBCIcKfOTcbO5mrKw/TCiwkLCC/cpUfnov9FLrZ\n6cUR344XFW/16sEvXcToVBp0Z1tPh6QaryVxzNoqNvf6iglxHIP7HMyrzD1WGJtd\nWgRl6Xp0p3595vpk8IKKfjvuakPEX8U3m56ofNvEWbBPOJwRpF4x/04dGCn6aH7p\njnLmFccXxKGzNISW24U6kWTORffD//5IUi8L5pYn7pTrhrhxrfdnwnooMfyVnruO\nlcRZoTMKb0nr1QTMJXPPyhtki43Ea4VDvwVJWxfaLY6bJsVZ0ICxNR8rdcNEX55N\n1R9bqvVNdRGRgRbeC4iMq7iClAdZWQIZVglwsfFo4gFT6nAVaEn9jkhivdk0FcwK\nq3b4cjnoFT+ZFioYVfrIbux0mxxNJaSUvI7qOpjEYxqoWGQmz+hxj8b9S8szo/pZ\nnFRRgTx7+xzvSHyMmxG4lBQuciHKOwt9QUom9JZ+6i/01fu9+y80Cna4XCTvFlm+\nFt3F66THrxKkCWo6e2aZLR1dWiiDs2PsRqReH+HGVpFn+DseI4F3POdrq6VDU7I4\naTI/GZBkNtK1mNhDwmNoW7Ver/5/3rSAIZRMLuVYtg0xqobESWFzV3B2EvnNeFrs\nLDJB/JZFAntYmlB4bNP4E3uSYpyW9rCUHYpMRhWvPgNyPH3hU85mE96JTry41TfM\nWFFjvkGjSi5F0mxmsletgbSBypyQnvVYzTBsVM9ILfslsZu20RcrLjyZAeds04HZ\nXG8LVdB2jj0jRsV8K9F0wP/it5jQ1L/X+ubxlfolvtzl6vRYPTXK4MFLoKlCegU/\n/QzbZzY73BY+O/qz2WBIBSiy+rbxWTKZeA91HA0eLC7hTa8HYlUL4UDygW96RKQY\nj2fUzxWuQdHucVXPY7jXtwyWQaSv+kn5Kv0DRscjl4wLP5nTKWaGCtYEBtwehEx3\nII1jGV/GvX6Rn8NYlHApzykJh43UEi++naYYeCNrDA4io3U1K65xjOZ4TzmV2YNC\npEoBHpDXfkJLvaW203eOsv4N0U6W4s10giBWty8E5H/kuwLcB4KLPA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:51Z" SessionIndex="id-Pe4qig3j5mnL9sP9T"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-JdBTieTV7dK2S2F4B'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp11s4boon.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp11s4boon.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5864a50>
    def test_response_5(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
        cert_str, cert_key_str = generate_cert()
    
        cert = {"cert": cert_str, "key": cert_key_str}
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_assertion=cert_str,
        )
tests/test_51_client.py:656: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-IQXanD1hKU1nE1dPI" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:51Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-IQXanD1hKU1nE1dPI"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-JdBTieTV7dK2S2F4B" IssueInstant="2025-04-21T14:10:51Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-JdBTieTV7dK2S2F4B"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">ae8f4d83f415a0429c23c715d5687e2c4a4ce7b708ec4c687f347589c1a7ced4</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:51Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:51Z" NotOnOrAfter="2025-04-21T14:15:51Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_839db37f-02fb-40f1-8231-afd069bcc532" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_014abf39-d764-4ac2-a079-7344ba2382f0"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>GelO0yPw/yTjxcnip5O11Srcwrytu4nUDI4+MJrCzgR/xIZbsumU7oCph/L8Spgc\n/k2txsUyhrxs5qCorX3d4h1BHvbEm7PBS7XML7HEPTD1y6JZE/Wztn1fTKKVLkw7\noHBTutethkSMbpoe0mzDOhu6fyBJfAUer4SD/lluIXA=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>Gv5hlVhSz6JL+ukjK+1eBEox8itPgKH6+fMkxCcau2ngPu+xJDf8e0qfI0XFvUse\n384RbuKAJwBoUsTm2VRb2ayFI1suHa327Q9XNjgGApZnByrKV3sPSZqXNWjFwzvm\nfQYXkgSeeHZJc/C6TmHD7nSYNnlH1tEWWn0pIjFgcEZc5u73yo+H5NYK7sPUa7V4\nE8nsE9+ib4XhYnWtbyB8EGU8NCkpZUue6SS/9tCOS1swU9JbOYUVbG18yEaay6SK\n0fTdyYFdowObRmR3SbVBpAXealHwRd6xCFq3EmIRqpilYWusM4j3VLFRPqnZ0frj\nHgbLF64xI2Fb26MbSM+kIizzg+NioiKgItqN+jz1mWD0bL7W71nr8nsSPejDx/vn\nAIqaEevLHDlqGvMQDldR5mAQb3Z+XI3ekNBzZuaHof2wRwHTE6AR514y9NKFLA00\naanQdmpCKaUMjaotnx/6JaBBu28ge0zKFLCAoEuqb77ofwrOXqrWtiufa72lcawi\nup79+uM/5FWBR9iyZNMcaUnnHG4GxZy1yxl6dMTHVUeV5n7N7v6snir3tRQtUQNX\nIH7z+y6Iw1I5RT2xZ45Nnjdl3tqdqiMWhRCqqzPw1FB4HiCXmXsb0ftUvd8+nb58\nUhnDqh5eQyRnocPeQuvQHM9IX5FcrsA4+68qZuQ2T7xf50uwNkr+eWe5Xkw12LPE\npP2U3b7aKccfCxyXCENc/5sz+IhbQxNMDMfP9g4k7bGJp0WB81X6eG4rEUZKwTgF\nTgnY3oD8fPzR/c0uKTHHwpKEVPjTbsmwHqDtjgbVnj7PZaiJcHb9IeMIjx7vAsK+\nCCthFJsMqRFA54foN21saKqnJ/yOBKQjdKhcE2VxSD15t4ubrjmvcTesuH0hXUDv\n1wDIMFatGGyIPgiYTa+Jrz+LKQVANgt1FIJPbhn3viZrS5zWd6unhfRTSQ/7GPPp\ncGJes55z7HSi6p0YJf1s+u2VOQ7KJjo9VmXQELmosPLUzMXZV6rDPVLDMw9nWir+\n0tgWkIQCprO6SwNLXShqvJtbmWCvSHPFcdz6OHcJqk7P17trcl0G1cS9QkyWBdI5\nPdhX7EMm/cRDBDfoXxDPwzQwJoTv8Fc0xC3Qdh5MfLgWiuMVFwb+SRmHxAFuiEpU\nMFQVsTD4IIngYzdB9OkotJygiDjEhJdOg6k6XNi6MhzqThlOMOSExPKKVoTca475\nyTgEF60y3HItsyw0hYpgmH8zdcPklHFLyUCwtz6Wn4HGhCeLbG4baJmAg00kWbzY\nsOEH3gcYjemerO3kmfoxcXL6Mrk1qlsfmSb+o94opuiFMH0pczcxL9vduQWcb/Kq\n5aQkcxto/FoIV++9uYAxCzACIKBCIcKfOTcbO5mrKw/TCiwkLCC/cpUfnov9FLrZ\n6cUR344XFW/16sEvXcToVBp0Z1tPh6QaryVxzNoqNvf6iglxHIP7HMyrzD1WGJtd\nWgRl6Xp0p3595vpk8IKKfjvuakPEX8U3m56ofNvEWbBPOJwRpF4x/04dGCn6aH7p\njnLmFccXxKGzNISW24U6kWTORffD//5IUi8L5pYn7pTrhrhxrfdnwnooMfyVnruO\nlcRZoTMKb0nr1QTMJXPPyhtki43Ea4VDvwVJWxfaLY6bJsVZ0ICxNR8rdcNEX55N\n1R9bqvVNdRGRgRbeC4iMq7iClAdZWQIZVglwsfFo4gFT6nAVaEn9jkhivdk0FcwK\nq3b4cjnoFT+ZFioYVfrIbux0mxxNJaSUvI7qOpjEYxqoWGQmz+hxj8b9S8szo/pZ\nnFRRgTx7+xzvSHyMmxG4lBQuciHKOwt9QUom9JZ+6i/01fu9+y80Cna4XCTvFlm+\nFt3F66THrxKkCWo6e2aZLR1dWiiDs2PsRqReH+HGVpFn+DseI4F3POdrq6VDU7I4\naTI/GZBkNtK1mNhDwmNoW7Ver/5/3rSAIZRMLuVYtg0xqobESWFzV3B2EvnNeFrs\nLDJB/JZFAntYmlB4bNP4E3uSYpyW9rCUHYpMRhWvPgNyPH3hU85mE96JTry41TfM\nWFFjvkGjSi5F0mxmsletgbSBypyQnvVYzTBsVM9ILfslsZu20RcrLjyZAeds04HZ\nXG8LVdB2jj0jRsV8K9F0wP/it5jQ1L/X+ubxlfolvtzl6vRYPTXK4MFLoKlCegU/\n/QzbZzY73BY+O/qz2WBIBSiy+rbxWTKZeA91HA0eLC7hTa8HYlUL4UDygW96RKQY\nj2fUzxWuQdHucVXPY7jXtwyWQaSv+kn5Kv0DRscjl4wLP5nTKWaGCtYEBtwehEx3\nII1jGV/GvX6Rn8NYlHApzykJh43UEi++naYYeCNrDA4io3U1K65xjOZ4TzmV2YNC\npEoBHpDXfkJLvaW203eOsv4N0U6W4s10giBWty8E5H/kuwLcB4KLPA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:51Z" SessionIndex="id-Pe4qig3j5mnL9sP9T"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-JdBTieTV7dK2S2F4B'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-JdBTieTV7dK2S2F4B', '--output', '/tmp/tmpb10cb459.xml', '/tmp/tmp11s4boon.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp11s4boon.xml"
output=
__________________________ TestClient.test_response_6 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-UG7UKd1tsOOv7xtUI" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:52Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-UG7UKd1tsOOv7xtUI"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-nFGSNoS1SAE421Lw3" IssueInstant="2025-04-21T14:10:52Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-nFGSNoS1SAE421Lw3"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">f635b2e492de6867c8b52356f18ed5c9d1372d9465b2e9443a5cbdd83a5c4fd4</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:52Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:52Z" NotOnOrAfter="2025-04-21T14:15:52Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_4d9b7704-4216-448e-88f6-393a5f3277a6" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_e160f2be-8376-41a9-8a75-7371891f2fc7"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDUyWhcNMzUwNDE5MTQxMDUyWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAsdwZ5f+rEjY8D74COpIWgn3c+JRGSmhkrYIrhVpg2G3cdCzvDynSC4L1\nO8BWSGgy7dPCKJJc1uFtMlZp8ogwAbv1OtXh8OJ6wKVmcUCl3mNnwkUqb+4JMGtu\nX7he1UUz797bOWlioH/tQGxAs2oJmv7hplnen0MtM5B5IbFBEV1oMi6AosijDrtN\nZ5OHgYVvTmrdQ0wCS94RDUAwDRIvulW3HuGacLHC0MyCJLJ2GS0C1dBrexr4np8+\n1MepmS3S2K941HOXmwDkwu0yR9iyBYJz3cGVG/HG6JSb5vb+0oOPlRHH2Ksd+Ms4\nUPkVrZI+Hzi3sTT33tPyX0Cp1G3yywIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAD8c\npgQW44amqGFZwB6Vp0RHd8M9EVdWu2HQE1IS75XEEIHeKbnXtw456kJCXNVmVUrE\niBuRRXCsmTJsMBcsppX3lTw1UnaHhYsTyc/uUf0Zv5H1ylENKcbt3yU0mGEfyWzP\nEULlJmz+OBQY2ain4uxlkeH1YjyLlqGJVkJGrSkY</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>Dm7atelj2BpJzYotR2MeHFvPnLEyRBuhN3jtLjXSLFlYs3VzoifanXF0L2iKfiUr\n8z5xHyLnTByzLYiLFdM1XfHGz6qzvVvC9W1t+bG7oZSyojAyhLWKJvwpIUNuzyX4\nR46YnhMWYUZafxyaEYBml4ShIFa43LmfbZBl5Om6QGLKndP3USOkRu1P+F5+44KY\nn25v9xsio/USbIDtWdB0Bb7gbvRx0Yo7HWX80CE7aAcR337SSfGzcg+Y4OFSLW7r\n8PInNuYltcE8kxotxacj3OFTdXBMJsHfBQtnSRDc3t+4fHjHTjCTqIE7de2x7lE+\nnrnLEzytuyL15nHDI6CtqA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>pN+FvTvMqA9dHeHcUYLgiWqUqbVdeslubNU+StmOcRyLNpDcaC+ZorXrj/K+T/4D\ny0J+yrdpgt9pchSwu1lFNxJhfW5sInuSqCEnmTBhnx/wAvs7CNPxazOilDxQDRAd\ne90NRxWtIPLrKfeMVPW94ia9OIeQMei8UA8doAHMpbr2i4VUTZmWb3wrm647QqPE\n0zUmXPFvAcFvEedoinozPNvhLu/lv+qPzM7hDS/WUPTA2UpBU3aXVmTTF6l0lubR\n7EVFxmHG9+t/3FDD6ZARmn0pAfuN5es1PGohK/rLy6qTNggMG8QoLDPGvhJBvQ/d\nPHLCGCJfC0d52cHAKYz37WThV4K5fDhuRrn1VYMgAab/+aCeNgpRDTPNSV/94OVh\nNSmhR9OGKzA1+czwY/2HZAYsdaFymnPDnGG237zvO2tN/OvGLLTlnK47/naHFB8B\nn6Lu9yIFb3ZOjXC6UvP0b8uYFr5QjnHCE7od1HV/bFPQFoSEFQK7NdL2/od0z7iM\nqq3MlsEnH6rTED3r9cOvQGef+36S7Fnx2O50WFfm5notGPQeVeVltoEQI26bWBkj\nncxilixWyZHgFwBlV8ppYogamZ9AQ0um+QBoH7+iDKbKMIRg3aThdO9FpFoZ7FHs\ndqvMFnYedx0uZd8uG+jT9RCNWs/M1QejpG+6SoqbPsurgIPljsx3hdXTcHD43lUH\n3Zh4vsLel+LxC8u2yWnaFMv3WtXnr0KdR5PPkWMoppnMLJQ6ScFBilp0nJ1Z7CZu\nQXEAxdkFy+LDLV5u+QW7KY5X7ZKvts+DQE02KYb6liCivg5uJwA7Phl5hg/kZkAF\nG9X/b7MXhD98wZzFVCSPu3ZPSrC4nz7wTRMWgdDNUMfozMFDncR1PzZtqMZlp8MT\nBaYGFhl2LZrgA3DkgbFRdsLhTZxE0bgXNBbSrb/W6vzuuhvEGV0zinMdYjbciVdk\nq8PB7Ya7OFhHyikLx7HeTj1aClGfxRbFndtNMzLKeMwwRYHYj+DkSQPOgOah+LEJ\n4cJlXVMo6q6EhCCsZDSvmYqp7WZNcnj/O92qFqPvQpNHM3yOLbvLUVrqg7IhhnsI\n5r96W6PeaC2b0JcfjCGF+GTZ7uXZJJL9BKBg3waWPirLY0JinrJd/vzlfHfnFAcJ\nMvLtimzf8Nej5Z3jw50+W8UWxtT7lMJLBNJSQwKnhJihvJUDD38NXqcmQB/llaUU\nCRdRmaGIyVNhswQ3UPcpQMy76JOPidgZGHzJIWWXkLTHudFBqpsYeLikFfw9zSKp\nDKT7k+VMNAK8av1g/sNZ2/LZ/D8iBYiHrwHZ8X0/RY31jSoPMTmACWo33IQfp8jF\nwHXxdRR4/bOZGGlvOrVW7bngxtqxcGEyIPtHbrZ4lCo8/Rx0VXN1VOQRGPBFMO8y\n3mzNB0bfNSkelUcnYoZBFildoDgZkbKBpe1MeZvorctrGOsbwzFF3qiewGAAc4Dr\nLqqgFTxerwgw/xdLxiHpyDDVUGz7MK6QO1Fay69Okpg8BU2nfxaL99lGeLSEaf66\n+/YWNNxmgrIfHkPgiWdqskStIk+4iFA1XrAQBv2ldcnOsDFDv3pw2xk6THplnYIg\n6KDCj9x19y5xlGNOQrfWjTqWspBKxIjovpFK4DB4eQDx9RsFw49raqCu6bhr/6Vz\nzQFrVk3OgrEr9WpOy9jdHCGoO2X4uL1uhF5F1s4nOYxsUQeDuWgnl/6iD+acWkqD\nCm4xBufNDCDKSDpbFcSUOgnH5s4RQDjP6aDi1EvsW70gx+VsMVHGo1v4rB0+Fe5N\n7R2A/E+02aRQx56IRygodBB7C/V7blSR+yQCrDf/gSw+0FQyo5U0dhcIZfWp92l4\nqX6fRN3kT9SFMTB8hDxpM7xmcycbFKDBEwRdAshY4SDLne5fIASDgfBIXsHzjJfp\nCLQ8HnHdg86thY0ztIDbScVTbaGQawzQpE7M3V3rfKa6RCLNt3Q/yjd884tT0QQJ\njv/jY/mx0ZgDkfvXbWgAoKlziXutLsC/Mky98X70Nsqg5ba03NaXY84acYEKGJ/6\nI+mUpB66u/gIv38Rd9T+hs5WnmbEUPC0KAPcjZS0ZvPzJPhxgV+dqffqFiZ0b7JN\nxhraFdrZ1qI8qdNrxyRBP76wuBM6SUMVbRMDkiOTIGo03H8bCs3IEXELGg/pIMat\nR/6Jn+ZoMVCIv6J+HvFxIHzH8+oWmCCXkoZ7Nxfc+HaAVoqjtvLgAtHhoFl+W5SO\ncMBpmMADlTse6tmpk/TmSlSYQFxKnCi4xMvM4ZQQxyCj0R0JTq8Ro3dFUWDd9s1T\n/lkv16HCqzOmtfdX3BzS/yOow4Qz8mKgeGAptuWVLE2yJm9RfHstis72Axpz6JM8\npgz9p4eBlrh5bXNhv1vLB9EAixp66cA1g2yix1IBimJP8RL6an4Qgg==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:52Z" SessionIndex="id-qpEnRdkVh7TDyAxXN"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nFGSNoS1SAE421Lw3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpfjnbivfz.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpfjnbivfz.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5864b90>
    def test_response_6(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
        cert_assertion_str, cert_key_assertion_str = generate_cert()
    
        cert_assertion = {"cert": cert_assertion_str, "key": cert_key_assertion_str}
    
        cert_advice_str, cert_key_advice_str = generate_cert()
    
        cert_advice = {"cert": cert_advice_str, "key": cert_key_advice_str}
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_assertion=cert_assertion_str,
            encrypt_cert_advice=cert_advice_str,
        )
tests/test_51_client.py:699: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-UG7UKd1tsOOv7xtUI" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:52Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-UG7UKd1tsOOv7xtUI"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-nFGSNoS1SAE421Lw3" IssueInstant="2025-04-21T14:10:52Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-nFGSNoS1SAE421Lw3"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">f635b2e492de6867c8b52356f18ed5c9d1372d9465b2e9443a5cbdd83a5c4fd4</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:52Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:52Z" NotOnOrAfter="2025-04-21T14:15:52Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_4d9b7704-4216-448e-88f6-393a5f3277a6" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_e160f2be-8376-41a9-8a75-7371891f2fc7"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDUyWhcNMzUwNDE5MTQxMDUyWjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAsdwZ5f+rEjY8D74COpIWgn3c+JRGSmhkrYIrhVpg2G3cdCzvDynSC4L1\nO8BWSGgy7dPCKJJc1uFtMlZp8ogwAbv1OtXh8OJ6wKVmcUCl3mNnwkUqb+4JMGtu\nX7he1UUz797bOWlioH/tQGxAs2oJmv7hplnen0MtM5B5IbFBEV1oMi6AosijDrtN\nZ5OHgYVvTmrdQ0wCS94RDUAwDRIvulW3HuGacLHC0MyCJLJ2GS0C1dBrexr4np8+\n1MepmS3S2K941HOXmwDkwu0yR9iyBYJz3cGVG/HG6JSb5vb+0oOPlRHH2Ksd+Ms4\nUPkVrZI+Hzi3sTT33tPyX0Cp1G3yywIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAD8c\npgQW44amqGFZwB6Vp0RHd8M9EVdWu2HQE1IS75XEEIHeKbnXtw456kJCXNVmVUrE\niBuRRXCsmTJsMBcsppX3lTw1UnaHhYsTyc/uUf0Zv5H1ylENKcbt3yU0mGEfyWzP\nEULlJmz+OBQY2ain4uxlkeH1YjyLlqGJVkJGrSkY</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>Dm7atelj2BpJzYotR2MeHFvPnLEyRBuhN3jtLjXSLFlYs3VzoifanXF0L2iKfiUr\n8z5xHyLnTByzLYiLFdM1XfHGz6qzvVvC9W1t+bG7oZSyojAyhLWKJvwpIUNuzyX4\nR46YnhMWYUZafxyaEYBml4ShIFa43LmfbZBl5Om6QGLKndP3USOkRu1P+F5+44KY\nn25v9xsio/USbIDtWdB0Bb7gbvRx0Yo7HWX80CE7aAcR337SSfGzcg+Y4OFSLW7r\n8PInNuYltcE8kxotxacj3OFTdXBMJsHfBQtnSRDc3t+4fHjHTjCTqIE7de2x7lE+\nnrnLEzytuyL15nHDI6CtqA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>pN+FvTvMqA9dHeHcUYLgiWqUqbVdeslubNU+StmOcRyLNpDcaC+ZorXrj/K+T/4D\ny0J+yrdpgt9pchSwu1lFNxJhfW5sInuSqCEnmTBhnx/wAvs7CNPxazOilDxQDRAd\ne90NRxWtIPLrKfeMVPW94ia9OIeQMei8UA8doAHMpbr2i4VUTZmWb3wrm647QqPE\n0zUmXPFvAcFvEedoinozPNvhLu/lv+qPzM7hDS/WUPTA2UpBU3aXVmTTF6l0lubR\n7EVFxmHG9+t/3FDD6ZARmn0pAfuN5es1PGohK/rLy6qTNggMG8QoLDPGvhJBvQ/d\nPHLCGCJfC0d52cHAKYz37WThV4K5fDhuRrn1VYMgAab/+aCeNgpRDTPNSV/94OVh\nNSmhR9OGKzA1+czwY/2HZAYsdaFymnPDnGG237zvO2tN/OvGLLTlnK47/naHFB8B\nn6Lu9yIFb3ZOjXC6UvP0b8uYFr5QjnHCE7od1HV/bFPQFoSEFQK7NdL2/od0z7iM\nqq3MlsEnH6rTED3r9cOvQGef+36S7Fnx2O50WFfm5notGPQeVeVltoEQI26bWBkj\nncxilixWyZHgFwBlV8ppYogamZ9AQ0um+QBoH7+iDKbKMIRg3aThdO9FpFoZ7FHs\ndqvMFnYedx0uZd8uG+jT9RCNWs/M1QejpG+6SoqbPsurgIPljsx3hdXTcHD43lUH\n3Zh4vsLel+LxC8u2yWnaFMv3WtXnr0KdR5PPkWMoppnMLJQ6ScFBilp0nJ1Z7CZu\nQXEAxdkFy+LDLV5u+QW7KY5X7ZKvts+DQE02KYb6liCivg5uJwA7Phl5hg/kZkAF\nG9X/b7MXhD98wZzFVCSPu3ZPSrC4nz7wTRMWgdDNUMfozMFDncR1PzZtqMZlp8MT\nBaYGFhl2LZrgA3DkgbFRdsLhTZxE0bgXNBbSrb/W6vzuuhvEGV0zinMdYjbciVdk\nq8PB7Ya7OFhHyikLx7HeTj1aClGfxRbFndtNMzLKeMwwRYHYj+DkSQPOgOah+LEJ\n4cJlXVMo6q6EhCCsZDSvmYqp7WZNcnj/O92qFqPvQpNHM3yOLbvLUVrqg7IhhnsI\n5r96W6PeaC2b0JcfjCGF+GTZ7uXZJJL9BKBg3waWPirLY0JinrJd/vzlfHfnFAcJ\nMvLtimzf8Nej5Z3jw50+W8UWxtT7lMJLBNJSQwKnhJihvJUDD38NXqcmQB/llaUU\nCRdRmaGIyVNhswQ3UPcpQMy76JOPidgZGHzJIWWXkLTHudFBqpsYeLikFfw9zSKp\nDKT7k+VMNAK8av1g/sNZ2/LZ/D8iBYiHrwHZ8X0/RY31jSoPMTmACWo33IQfp8jF\nwHXxdRR4/bOZGGlvOrVW7bngxtqxcGEyIPtHbrZ4lCo8/Rx0VXN1VOQRGPBFMO8y\n3mzNB0bfNSkelUcnYoZBFildoDgZkbKBpe1MeZvorctrGOsbwzFF3qiewGAAc4Dr\nLqqgFTxerwgw/xdLxiHpyDDVUGz7MK6QO1Fay69Okpg8BU2nfxaL99lGeLSEaf66\n+/YWNNxmgrIfHkPgiWdqskStIk+4iFA1XrAQBv2ldcnOsDFDv3pw2xk6THplnYIg\n6KDCj9x19y5xlGNOQrfWjTqWspBKxIjovpFK4DB4eQDx9RsFw49raqCu6bhr/6Vz\nzQFrVk3OgrEr9WpOy9jdHCGoO2X4uL1uhF5F1s4nOYxsUQeDuWgnl/6iD+acWkqD\nCm4xBufNDCDKSDpbFcSUOgnH5s4RQDjP6aDi1EvsW70gx+VsMVHGo1v4rB0+Fe5N\n7R2A/E+02aRQx56IRygodBB7C/V7blSR+yQCrDf/gSw+0FQyo5U0dhcIZfWp92l4\nqX6fRN3kT9SFMTB8hDxpM7xmcycbFKDBEwRdAshY4SDLne5fIASDgfBIXsHzjJfp\nCLQ8HnHdg86thY0ztIDbScVTbaGQawzQpE7M3V3rfKa6RCLNt3Q/yjd884tT0QQJ\njv/jY/mx0ZgDkfvXbWgAoKlziXutLsC/Mky98X70Nsqg5ba03NaXY84acYEKGJ/6\nI+mUpB66u/gIv38Rd9T+hs5WnmbEUPC0KAPcjZS0ZvPzJPhxgV+dqffqFiZ0b7JN\nxhraFdrZ1qI8qdNrxyRBP76wuBM6SUMVbRMDkiOTIGo03H8bCs3IEXELGg/pIMat\nR/6Jn+ZoMVCIv6J+HvFxIHzH8+oWmCCXkoZ7Nxfc+HaAVoqjtvLgAtHhoFl+W5SO\ncMBpmMADlTse6tmpk/TmSlSYQFxKnCi4xMvM4ZQQxyCj0R0JTq8Ro3dFUWDd9s1T\n/lkv16HCqzOmtfdX3BzS/yOow4Qz8mKgeGAptuWVLE2yJm9RfHstis72Axpz6JM8\npgz9p4eBlrh5bXNhv1vLB9EAixp66cA1g2yix1IBimJP8RL6an4Qgg==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:52Z" SessionIndex="id-qpEnRdkVh7TDyAxXN"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nFGSNoS1SAE421Lw3'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nFGSNoS1SAE421Lw3', '--output', '/tmp/tmpl9t458b2.xml', '/tmp/tmpfjnbivfz.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpfjnbivfz.xml"
output=
__________________________ TestClient.test_response_7 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-9v0pAGtxmkUne8Je3" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:52Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-9v0pAGtxmkUne8Je3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-anZVIxijp8qfvDAhz" IssueInstant="2025-04-21T14:10:52Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-anZVIxijp8qfvDAhz"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">2b092a9d367bfe1111ecbdbeb7ef5bb24e2c4f27a06d7158c72537dcc7214d19</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:52Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:52Z" NotOnOrAfter="2025-04-21T14:15:52Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:52Z" SessionIndex="id-0bWt54Clnb37RG8Ma"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Derek</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Jeter</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">derek@nyy.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">The man</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-anZVIxijp8qfvDAhz'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpitxmaisn.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpitxmaisn.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa4d2af00>
    def test_response_7(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            encrypted_advice_attributes=True,
        )
tests/test_51_client.py:738: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-9v0pAGtxmkUne8Je3" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:52Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-9v0pAGtxmkUne8Je3"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-anZVIxijp8qfvDAhz" IssueInstant="2025-04-21T14:10:52Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-anZVIxijp8qfvDAhz"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">2b092a9d367bfe1111ecbdbeb7ef5bb24e2c4f27a06d7158c72537dcc7214d19</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:52Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:52Z" NotOnOrAfter="2025-04-21T14:15:52Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:52Z" SessionIndex="id-0bWt54Clnb37RG8Ma"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Derek</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Jeter</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">derek@nyy.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">The man</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-anZVIxijp8qfvDAhz'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-anZVIxijp8qfvDAhz', '--output', '/tmp/tmpou2cd8_f.xml', '/tmp/tmpitxmaisn.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpitxmaisn.xml"
output=
__________________________ TestClient.test_response_8 __________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-WUFBU9fuM7SOYF8JZ" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:52Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-WUFBU9fuM7SOYF8JZ"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-odLuAGIxVKA0ROCSt" IssueInstant="2025-04-21T14:10:52Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-odLuAGIxVKA0ROCSt"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">5be5e37ac6cc99ae3fd6b35240aa4053e8616bd69903bd1cd0d88fb421b20a4e</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:52Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:52Z" NotOnOrAfter="2025-04-21T14:15:52Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:52Z" SessionIndex="id-XZSiyViiIKNPIjqKT"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Derek</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Jeter</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">derek@nyy.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">The man</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-odLuAGIxVKA0ROCSt'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp2x3hseob.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp2x3hseob.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa4972b50>
    def test_response_8(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
        cert_str, cert_key_str = generate_cert()
    
        cert = {"cert": cert_str, "key": cert_key_str}
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            encrypt_cert_assertion=cert_str,
        )
tests/test_51_client.py:776: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-WUFBU9fuM7SOYF8JZ" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:52Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-WUFBU9fuM7SOYF8JZ"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-odLuAGIxVKA0ROCSt" IssueInstant="2025-04-21T14:10:52Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-odLuAGIxVKA0ROCSt"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">5be5e37ac6cc99ae3fd6b35240aa4053e8616bd69903bd1cd0d88fb421b20a4e</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:52Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:52Z" NotOnOrAfter="2025-04-21T14:15:52Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:52Z" SessionIndex="id-XZSiyViiIKNPIjqKT"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Derek</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Jeter</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">derek@nyy.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">The man</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-odLuAGIxVKA0ROCSt'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-odLuAGIxVKA0ROCSt', '--output', '/tmp/tmp9gvg0m7v.xml', '/tmp/tmp2x3hseob.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp2x3hseob.xml"
output=
_________________ TestClient.test_sign_then_encrypt_assertion __________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-00YcJdiiebrEkHpzx" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-00YcJdiiebrEkHpzx"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject>_aaa<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /></saml:Subject><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-00YcJdiiebrEkHpzx'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpzcpe_8kt.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpzcpe_8kt.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa58097f0>
    def test_sign_then_encrypt_assertion(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        assertion = s_utils.assertion_factory(
            subject=factory(saml.Subject, text="_aaa", name_id=factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT)),
            attribute_statement=do_attribute_statement(
                {
                    ("", "", "sn"): ("Jeter", ""),
                    ("", "", "givenName"): ("Derek", ""),
                }
            ),
            issuer=self.server._issuer(),
        )
    
        assertion.signature = sigver.pre_signature_part(assertion.id, _sec.my_cert, 1)
    
>       sigass = _sec.sign_statement(
            assertion, class_name(assertion), key_file=full_path("test.key"), node_id=assertion.id
        )
tests/test_51_client.py:906: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-00YcJdiiebrEkHpzx" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-00YcJdiiebrEkHpzx"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject>_aaa<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /></saml:Subject><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-00YcJdiiebrEkHpzx'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-00YcJdiiebrEkHpzx', '--output', '/tmp/tmpbitdr4br.xml', '/tmp/tmpzcpe_8kt.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpzcpe_8kt.xml"
output=
_________________ TestClient.test_sign_then_encrypt_assertion2 _________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-pjcoKjCfNUFxNsMYT" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-pjcoKjCfNUFxNsMYT"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-5zdlsgae2xU3piO6J"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-pjcoKjCfNUFxNsMYT'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpo7yh4yz_.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpo7yh4yz_.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa571ddf0>
    def test_sign_then_encrypt_assertion2(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
        asser = Assertion({"givenName": "Derek", "sn": "Jeter"})
        farg = add_path({}, ["assertion", "subject", "subject_confirmation", "method", saml.SCM_BEARER])
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "in_response_to", "_012345"],
        )
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "recipient", "http://lingon.catalogix.se:8087/"],
        )
    
        assertion = asser.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            name_id=factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            farg=farg["assertion"],
        )
    
        assertion.signature = sigver.pre_signature_part(assertion.id, _sec.my_cert, 1)
    
>       sigass = _sec.sign_statement(
            assertion, class_name(assertion), key_file=self.client.sec.key_file, node_id=assertion.id
        )
tests/test_51_client.py:979: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-pjcoKjCfNUFxNsMYT" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-pjcoKjCfNUFxNsMYT"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-5zdlsgae2xU3piO6J"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-pjcoKjCfNUFxNsMYT'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-pjcoKjCfNUFxNsMYT', '--output', '/tmp/tmpf3zebo04.xml', '/tmp/tmpo7yh4yz_.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpo7yh4yz_.xml"
output=
_____________ TestClient.test_sign_then_encrypt_assertion_advice_1 _____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-8fIFloLgCKfIkqAFf" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:53Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-r05i49ABBHOeYUq4k" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-nqDylLlNONMFnTXTy" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-nqDylLlNONMFnTXTy"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-EnC1PM2M5uPz73jza"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test01</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:1.2.840.113549.1.9.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="email"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test.testsson@test.se</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-drCZP9oVr0RATaye2"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nqDylLlNONMFnTXTy'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpsdea8_7o.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpsdea8_7o.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa571df10>
    def test_sign_then_encrypt_assertion_advice_1(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
        asser = Assertion({"givenName": "Derek", "sn": "Jeter"})
    
        subject_confirmation_specs = {
            "recipient": "http://lingon.catalogix.se:8087/",
            "in_response_to": "_012345",
            "subject_confirmation_method": saml.SCM_BEARER,
        }
        name_id = factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT)
    
        farg = add_path({}, ["assertion", "subject", "subject_confirmation", "method", saml.SCM_BEARER])
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "in_response_to", "_012345"],
        )
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "recipient", "http://lingon.catalogix.se:8087/"],
        )
    
        assertion = asser.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            name_id=name_id,
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            farg=farg["assertion"],
        )
    
        a_asser = Assertion({"uid": "test01", "email": "test.testsson@test.se"})
        a_assertion = a_asser.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_assertion.signature = sigver.pre_signature_part(a_assertion.id, _sec.my_cert, 1)
    
        assertion.advice = Advice()
    
        assertion.advice.encrypted_assertion = []
        assertion.advice.encrypted_assertion.append(EncryptedAssertion())
    
        assertion.advice.encrypted_assertion[0].add_extension_element(a_assertion)
    
        response = response_factory(
            in_response_to="_012345",
            destination="http://lingon.catalogix.se:8087/",
            status=s_utils.success_status_factory(),
            issuer=self.server._issuer(),
        )
    
        response.assertion.append(assertion)
    
>       response = _sec.sign_statement(
            f"{response}", class_name(a_assertion), key_file=self.client.sec.key_file, node_id=a_assertion.id
        )
tests/test_51_client.py:1081: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-8fIFloLgCKfIkqAFf" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:53Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-r05i49ABBHOeYUq4k" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-nqDylLlNONMFnTXTy" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-nqDylLlNONMFnTXTy"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-EnC1PM2M5uPz73jza"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test01</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:1.2.840.113549.1.9.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="email"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test.testsson@test.se</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-drCZP9oVr0RATaye2"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nqDylLlNONMFnTXTy'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nqDylLlNONMFnTXTy', '--output', '/tmp/tmpt31nlga9.xml', '/tmp/tmpsdea8_7o.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpsdea8_7o.xml"
output=
_____________ TestClient.test_sign_then_encrypt_assertion_advice_2 _____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-mMTcPdpFH2mAxHU6v" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:53Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-X2wmUUUKyyg9kL4AA" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-X2wmUUUKyyg9kL4AA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-rrjc0EGmrESkmb9qF" IssueInstant="2025-04-21T14:10:53Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature1"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-rrjc0EGmrESkmb9qF"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-hFZNB1J72ugbbFFO2"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">test01</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-ZFuWaYtkpx6sF7X6D"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-rrjc0EGmrESkmb9qF'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpumvyfhj3.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpumvyfhj3.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5872e40>
    def test_sign_then_encrypt_assertion_advice_2(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
        asser_1 = Assertion({"givenName": "Derek"})
    
        farg = add_path({}, ["assertion", "subject", "subject_confirmation", "method", saml.SCM_BEARER])
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "in_response_to", "_012345"],
        )
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "recipient", "http://lingon.catalogix.se:8087/"],
        )
        name_id = factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT)
    
        assertion_1 = asser_1.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        asser_2 = Assertion({"sn": "Jeter"})
    
        assertion_2 = asser_2.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_1 = Assertion({"uid": "test01"})
        a_assertion_1 = a_asser_1.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_2 = Assertion({"email": "test.testsson@test.se"})
        a_assertion_2 = a_asser_2.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_3 = Assertion({"street": "street"})
        a_assertion_3 = a_asser_3.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_4 = Assertion({"title": "title"})
        a_assertion_4 = a_asser_4.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_assertion_1.signature = sigver.pre_signature_part(a_assertion_1.id, _sec.my_cert, 1)
    
        a_assertion_2.signature = sigver.pre_signature_part(a_assertion_2.id, _sec.my_cert, 1)
    
        a_assertion_3.signature = sigver.pre_signature_part(a_assertion_3.id, _sec.my_cert, 1)
    
        a_assertion_4.signature = sigver.pre_signature_part(a_assertion_4.id, _sec.my_cert, 1)
    
        assertion_1.signature = sigver.pre_signature_part(assertion_1.id, _sec.my_cert, 1)
    
        assertion_2.signature = sigver.pre_signature_part(assertion_2.id, _sec.my_cert, 1)
    
        response = response_factory(
            in_response_to="_012345",
            destination="http://lingon.catalogix.se:8087/",
            status=s_utils.success_status_factory(),
            issuer=self.server._issuer(),
        )
    
        response.assertion = assertion_1
    
        response.assertion.advice = Advice()
    
        response.assertion.advice.encrypted_assertion = []
        response.assertion.advice.encrypted_assertion.append(EncryptedAssertion())
    
        response.assertion.advice.encrypted_assertion[0].add_extension_element(a_assertion_1)
    
        advice_tag = response.assertion.advice._to_element_tree().tag
        assertion_tag = a_assertion_1._to_element_tree().tag
        response = response.get_xml_string_with_self_contained_assertion_within_advice_encrypted_assertion(
            assertion_tag, advice_tag
        )
    
>       response = _sec.sign_statement(
            f"{response}", class_name(a_assertion_1), key_file=self.server.sec.key_file, node_id=a_assertion_1.id
        )
tests/test_51_client.py:1242: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-mMTcPdpFH2mAxHU6v" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:53Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-X2wmUUUKyyg9kL4AA" IssueInstant="2025-04-21T14:10:53Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-X2wmUUUKyyg9kL4AA"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-rrjc0EGmrESkmb9qF" IssueInstant="2025-04-21T14:10:53Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature1"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-rrjc0EGmrESkmb9qF"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:53Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:53Z" NotOnOrAfter="2025-04-21T14:15:53Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-hFZNB1J72ugbbFFO2"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">test01</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:53Z" SessionIndex="id-ZFuWaYtkpx6sF7X6D"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-rrjc0EGmrESkmb9qF'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-rrjc0EGmrESkmb9qF', '--output', '/tmp/tmpntizzvue.xml', '/tmp/tmpumvyfhj3.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpumvyfhj3.xml"
output=
______________ TestClient.test_signed_with_default_algo_redirect _______________
self = <test_51_client.TestClient object at 0x3ffa58730c0>
    def test_signed_with_default_algo_redirect(self):
        # Revert configuration change to disallow unsinged responses
        self.client.want_response_signed = True
    
        reqid, req = self.client.create_authn_request("http://localhost:8088/sso", message_id="id1")
        msg_str = str(req)
    
>       info = self.client.apply_binding(
            BINDING_HTTP_REDIRECT,
            msg_str,
            destination="",
            relay_state="relay2",
            sign=True,
        )
tests/test_51_client.py:1389: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:286: in apply_binding
    info = http_redirect_message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/pack.py:182: in http_redirect_message
    args["Signature"] = base64.b64encode(signer.sign(string_enc))
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:521: in sign
    return saml2.cryptography.asymmetric.key_sign(key or self.key, msg, self.digest)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
rsakey = <cryptography.hazmat.bindings._rust.openssl.rsa.RSAPrivateKey object at 0x3ffa178eb70>
message = b'SAMLRequest=tZRvb9owEMa%2FiuX3cf4AW2cRJLauGlLXocL2Yu9MfMBpiZ35zhX99lMCtFNFEZs25ZXPd%2Fk9z%2FnssaNMTyNv3T38jEAsdk3tSDvKShmD094QknamAdJc6cX0860uVKbb4NlXvpZPBUUpt8ytTlNAa0hBDL41CmJKpqkT2DE4Qu%2FoWNKFz0MMEQRG76SYXZcSbS7FNwjdX0pZqEyKGVGEmSM2jktZZMUoyYZJkS%2Fzoc4zPRp8l%2BIaiNEZ7qsOEmtfmXrrifVVdnWVEnkp5gdL79FZdJvz0lb7JNKflst5Mv%2ByWEoxPcr94B3FBsICwgNW8PX%2B9hmMbuOdqgyb2m9wpwg6CW%2FTnv%2BAFsKdaWAPb0wFGnamaWtQlW%2F6lunga%2BOsplZOxn2gb0IQNz40hs%2FL7iJok3WfqsEx8qOcXMAap7%2BhJuNubD4%2BnWi3LvRhgsBOmQOuIsOrG%2BLZo0erczVQb1SuhipXo3fFQOX9V8g%2B7xJfhjl00aOzGFCKm4DgbP24h4GNcwjk3R1WP7pcKZA6aRjAlnJtagIp0gsk962yGHpqv5lYWOsTgL%2BVvzKE1R8a4BD%2Fkf5F5Vuw0%2FUaazT76%2Fd%2FjJwAnT6S9NX5Sl9OYvryRZv8Ag%3D%3D&RelayState=relay2&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1'
digest = <cryptography.hazmat.primitives.hashes.SHA1 object at 0x3ffa87c96e0>
    def key_sign(rsakey, message, digest):
        """Sign the given message with the RSA key."""
        padding = _asymmetric.padding.PKCS1v15()
>       signature = rsakey.sign(message, padding, digest)
E       cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/asymmetric.py:17: UnsupportedAlgorithm
__________________ TestClient.test_do_logout_signed_redirect ___________________
self = <test_51_client.TestClient object at 0x3ffa58735c0>
    def test_do_logout_signed_redirect(self):
        conf = config.SPConfig()
        conf.load_file("sp_slo_redirect_conf")
        client = Saml2Client(conf)
    
        # information about the user from an IdP
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": in_a_while(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Andersson", "mail": "anders.andersson@example.com"},
        }
        client.users.add_information_about_person(session_info)
        entity_ids = client.users.issuers_of_info(nid)
        assert entity_ids == ["urn:mace:example.com:saml:roland:idp"]
    
>       resp = client.do_logout(
            nid, entity_ids, "Tired", in_a_while(minutes=5), sign=True, expected_binding=BINDING_HTTP_REDIRECT
        )
tests/test_51_client.py:1527: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:333: in do_logout
    http_info = self.apply_binding(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:286: in apply_binding
    info = http_redirect_message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/pack.py:182: in http_redirect_message
    args["Signature"] = base64.b64encode(signer.sign(string_enc))
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:521: in sign
    return saml2.cryptography.asymmetric.key_sign(key or self.key, msg, self.digest)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
rsakey = <cryptography.hazmat.bindings._rust.openssl.rsa.RSAPrivateKey object at 0x3ffa48540f0>
message = b'SAMLRequest=nVJLS8NAEP4ry97bPNpIGZJANSoJtcVahHpbko1d2OzEnQnUfy%2BJPQiFHjwNDN9zmNRRCBv8xIH3%2BmvQxOLcWUfgKMzk4B2gIkPgVKcJuIa39csG4nkIvUfGGq28EEh19jZDEWnPBp0UZZFJ08zuj9XmYfEYHYtjVVfP1UmKd%2B3JoMtkPA%2BlKIkGXTpi5TiTcRgns3A5i6NDtIQohGTxIUWhiY1TPLFOzD0EgcVa2RMSwypcrQKyKMVeKxohB%2BN1I8UWeed2ft2y9lfSySSdp2MpmEJ48YS%2BU3y74rgxzaydoKAdG%2F6W%2BcjoVK1Bn1XXWz2vsZvuBR6tcg1QnwZ%2FrC6%2BW9XpshDjeB2UNa0Zk7aI8h9Z2CtHRjuWeRQvlsndxfHXJE%2BDq0fIfwA%3D&RelayState=id-BYJLC3E1YDYJcJGJh%7C1745244653%7C7de9050d9bf20410d936ccc6ac32a516c5a5988f&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1'
digest = <cryptography.hazmat.primitives.hashes.SHA1 object at 0x3ffa87c96e0>
    def key_sign(rsakey, message, digest):
        """Sign the given message with the RSA key."""
        padding = _asymmetric.padding.PKCS1v15()
>       signature = rsakey.sign(message, padding, digest)
E       cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/asymmetric.py:17: UnsupportedAlgorithm
______________ TestClient.test_do_logout_signed_redirect_invalid _______________
self = <test_51_client.TestClient object at 0x3ffa5873700>
    def test_do_logout_signed_redirect_invalid(self):
        conf = config.SPConfig()
        conf.load_file("sp_slo_redirect_conf")
        client = Saml2Client(conf)
    
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": in_a_while(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Andersson", "mail": "anders.andersson@example.com"},
        }
        client.users.add_information_about_person(session_info)
        entity_ids = client.users.issuers_of_info(nid)
    
>       resp = client.do_logout(
            nid,
            entity_ids,
            "Tired",
            in_a_while(minutes=5),
            sign=True,
            expected_binding=BINDING_HTTP_REDIRECT,
        )
tests/test_51_client.py:1565: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:333: in do_logout
    http_info = self.apply_binding(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:286: in apply_binding
    info = http_redirect_message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/pack.py:182: in http_redirect_message
    args["Signature"] = base64.b64encode(signer.sign(string_enc))
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:521: in sign
    return saml2.cryptography.asymmetric.key_sign(key or self.key, msg, self.digest)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
rsakey = <cryptography.hazmat.bindings._rust.openssl.rsa.RSAPrivateKey object at 0x3ffa594bab0>
message = b'SAMLRequest=nVLNasJAEH6VZe8xm5gUGUxAEEvAKlXx0NuSbOrCZifdmbT27UtSDwXBQ08Dw%2Fc7zNKTgi2%2B48AH8zEYYnHtnCfwpAo5BA%2BoyRJ43RkCruG4etlCOlPQB2Ss0ckbgXTnHjM0kQls0UtRrQtpm6hOwvMnZ01z3uDxa26dFGcTyKIvZDpTUlREg6k8sfZcyFSleaSyKE1OSQaJgnz%2BJsXaEFuveWJdmHuIY4e1dhckhoVaLGJyKMXBaBohJxtMI8UOee%2F3YdWyCXfS%2BSRdLsdSMIUIYoOh0%2Fy44rixTdROUDCeLX%2FLcmR0ujZgrrrrnZnV2E33goBO%2BwaoX8Z%2FrG6%2BO92Zai3G8TpoZ1s7Jm0R5T%2BycNCerPEsyySdZ%2FnTzfHXpFzGd49Q%2FgA%3D&RelayState=id-c1rGvt4ddVFoSw3il%7C1745244653%7Ca1643c25a73b89cd4796f00847d32b8ca6896871&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1'
digest = <cryptography.hazmat.primitives.hashes.SHA1 object at 0x3ffa87c96e0>
    def key_sign(rsakey, message, digest):
        """Sign the given message with the RSA key."""
        padding = _asymmetric.padding.PKCS1v15()
>       signature = rsakey.sign(message, padding, digest)
E       cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/asymmetric.py:17: UnsupportedAlgorithm
________________________ TestClient.test_do_logout_post ________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-55EA6BfVGRBWjGq1J" Version="2.0" IssueInstant="2025-04-21T14:10:54Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:54Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-55EA6BfVGRBWjGq1J"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-55EA6BfVGRBWjGq1J'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', ...]
extra_args = ['/tmp/tmp9gugo3a0.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp9gugo3a0.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5873840>
    def test_do_logout_post(self):
        # information about the user from an IdP
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": in_a_while(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Andersson", "mail": "anders.andersson@example.com"},
            "session_index": SessionIndex("_foo"),
        }
        self.client.users.add_information_about_person(session_info)
        entity_ids = self.client.users.issuers_of_info(nid)
        assert entity_ids == ["urn:mace:example.com:saml:roland:idp"]
>       resp = self.client.do_logout(
            nid, entity_ids, "Tired", in_a_while(minutes=5), sign=True, expected_binding=BINDING_HTTP_POST
        )
tests/test_51_client.py:1609: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:321: in do_logout
    req_id, request = self.create_logout_request(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:1147: in create_logout_request
    return self._message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:588: in _message
    signed_req = self.sign(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-55EA6BfVGRBWjGq1J" Version="2.0" IssueInstant="2025-04-21T14:10:54Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:54Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-55EA6BfVGRBWjGq1J"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-55EA6BfVGRBWjGq1J'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-55EA6BfVGRBWjGq1J', '--output', '/tmp/tmp_nisf4b1.xml', '/tmp/tmp9gugo3a0.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp9gugo3a0.xml"
output=
__________________ TestClient.test_do_logout_session_expired ___________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-RK545F2ZSxIgs8ujH" Version="2.0" IssueInstant="2025-04-21T14:10:54Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:54Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-RK545F2ZSxIgs8ujH"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-RK545F2ZSxIgs8ujH'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', ...]
extra_args = ['/tmp/tmp3lu0xd1y.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp3lu0xd1y.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa5873930>
    def test_do_logout_session_expired(self):
        # information about the user from an IdP
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": a_while_ago(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Andersson", "mail": "anders.andersson@example.com"},
            "session_index": SessionIndex("_foo"),
        }
        self.client.users.add_information_about_person(session_info)
        entity_ids = self.client.users.issuers_of_info(nid)
        assert entity_ids == ["urn:mace:example.com:saml:roland:idp"]
>       resp = self.client.do_logout(
            nid, entity_ids, "Tired", in_a_while(minutes=5), sign=True, expected_binding=BINDING_HTTP_POST
        )
tests/test_51_client.py:1661: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:321: in do_logout
    req_id, request = self.create_logout_request(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:1147: in create_logout_request
    return self._message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:588: in _message
    signed_req = self.sign(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d83590>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-RK545F2ZSxIgs8ujH" Version="2.0" IssueInstant="2025-04-21T14:10:54Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:54Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-RK545F2ZSxIgs8ujH"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-RK545F2ZSxIgs8ujH'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-RK545F2ZSxIgs8ujH', '--output', '/tmp/tmp3ev31pas.xml', '/tmp/tmp3lu0xd1y.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp3lu0xd1y.xml"
output=
_______________________ TestClient.test_signature_wants ________________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-Qz1xz0GDcxapTlUpB" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:54Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-Qz1xz0GDcxapTlUpB"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-Dbla1wSyBzSqfHtw0" IssueInstant="2025-04-21T14:10:54Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="urn:mace:example.com:saml:roland:idp" SPNameQualifier="urn:mace:example.com:saml:roland:sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">975f16566cbd2bda349e7e5592bc44595e3e1f2ea51ae9aac18e09d55e710e81</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:54Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:54Z" NotOnOrAfter="2025-04-21T14:15:54Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:54Z" SessionIndex="id-gMCyouCqfhcCllYOx"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-Qz1xz0GDcxapTlUpB'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmpwmr4x5hl.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpwmr4x5hl.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClient object at 0x3ffa58739d0>
    def test_signature_wants(self):
    
        ava = {"givenName": ["Derek"], "sn": ["Jeter"], "mail": ["derek@nyy.mlb.com"], "title": ["The man"]}
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
        kwargs = {
            "identity": ava,
            "in_response_to": "id1",
            "destination": "http://lingon.catalogix.se:8087/",
            "sp_entity_id": "urn:mace:example.com:saml:roland:sp",
            "name_id_policy": nameid_policy,
            "userid": "foba0001@example.com",
            "authn": AUTHN,
        }
    
        outstanding = {"id1": "http://foo.example.com/service"}
    
        def create_authn_response(**kwargs):
            return b64encode(str(self.server.create_authn_response(**kwargs)).encode())
    
        def parse_authn_response(response):
            self.client.parse_authn_request_response(response, BINDING_HTTP_POST, outstanding)
    
        def set_client_want(response, assertion, either):
            self.client.want_response_signed = response
            self.client.want_assertions_signed = assertion
            self.client.want_assertions_or_response_signed = either
    
        # Response is signed but assertion is not.
        kwargs["sign_response"] = True
        kwargs["sign_assertion"] = False
>       response = create_authn_response(**kwargs)
tests/test_51_client.py:1706: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
tests/test_51_client.py:1693: in create_authn_response
    return b64encode(str(self.server.create_authn_response(**kwargs)).encode())
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4d80770>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-Qz1xz0GDcxapTlUpB" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:54Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-Qz1xz0GDcxapTlUpB"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-Dbla1wSyBzSqfHtw0" IssueInstant="2025-04-21T14:10:54Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="urn:mace:example.com:saml:roland:idp" SPNameQualifier="urn:mace:example.com:saml:roland:sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">975f16566cbd2bda349e7e5592bc44595e3e1f2ea51ae9aac18e09d55e710e81</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:54Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:54Z" NotOnOrAfter="2025-04-21T14:15:54Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:54Z" SessionIndex="id-gMCyouCqfhcCllYOx"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-Qz1xz0GDcxapTlUpB'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-Qz1xz0GDcxapTlUpB', '--output', '/tmp/tmpy20r4u2q.xml', '/tmp/tmpwmr4x5hl.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpwmr4x5hl.xml"
output=
________________ TestClientNonAsciiAva.test_sign_auth_request_0 ________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
statement = b'<ns0:AuthnRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://eidas.europa.eu/saml-extensions" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id1" Version="2.0" IssueInstant="2025-04-21T14:10:55Z" Destination="http://www.example.com/sso" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://lingon.catalogix.se:8087/" ProviderName="urn:mace:example.com:saml:roland:sp"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id1"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Extensions><ns3:RequestedAttributes><ns3:RequestedAttribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonNickname" isRequired="false" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonNickname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonNickname" isRequired="true" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonScopedAffiliation" isRequired="false" /></ns3:RequestedAttributes></ns0:Extensions></ns0:AuthnRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id1'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', ...]
extra_args = ['/tmp/tmp2lr7hszl.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp2lr7hszl.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa4d30d50>
    def test_sign_auth_request_0(self):
>       req_id, areq = self.client.create_authn_request("http://www.example.com/sso", sign=True, message_id="id1")
tests/test_51_client.py:2023: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client_base.py:445: in create_authn_request
    msg = self._message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:588: in _message
    signed_req = self.sign(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
statement = b'<ns0:AuthnRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://eidas.europa.eu/saml-extensions" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id1" Version="2.0" IssueInstant="2025-04-21T14:10:55Z" Destination="http://www.example.com/sso" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://lingon.catalogix.se:8087/" ProviderName="urn:mace:example.com:saml:roland:sp"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id1"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Extensions><ns3:RequestedAttributes><ns3:RequestedAttribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonNickname" isRequired="false" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonNickname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonNickname" isRequired="true" /><ns3:RequestedAttribute Name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="eduPersonScopedAffiliation" isRequired="false" /></ns3:RequestedAttributes></ns0:Extensions></ns0:AuthnRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id1'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', '--node-id', 'id1', '--output', '/tmp/tmp32j7j3e1.xml', '/tmp/tmp2lr7hszl.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp2lr7hszl.xml"
output=
____________________ TestClientNonAsciiAva.test_response_1 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-65VXWXzPI3UWpMLpp" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:55Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-65VXWXzPI3UWpMLpp"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-qNwv5CId83v8TXNpc" IssueInstant="2025-04-21T14:10:55Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="urn:mace:example.com:saml:roland:idp" SPNameQualifier="urn:mace:example.com:saml:roland:sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">975f16566cbd2bda349e7e5592bc44595e3e1f2ea51ae9aac18e09d55e710e81</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:55Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:55Z" NotOnOrAfter="2025-04-21T14:15:55Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:55Z" SessionIndex="id-0QROxlcTTUthB4bE1"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-65VXWXzPI3UWpMLpp'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', ...]
extra_args = ['/tmp/tmp9nyszfjo.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp9nyszfjo.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa5818c80>
    def test_response_1(self):
        IDP = "urn:mace:example.com:saml:roland:idp"
    
        ava = {"givenName": ["Dave"], "sn": ["Concepción"], "mail": ["Dave@cnr.mlb.com"], "title": ["#13"]}
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id_policy=nameid_policy,
            sign_response=True,
            userid="foba0001@example.com",
            authn=AUTHN,
        )
tests/test_51_client.py:2066: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-65VXWXzPI3UWpMLpp" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:55Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-65VXWXzPI3UWpMLpp"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-qNwv5CId83v8TXNpc" IssueInstant="2025-04-21T14:10:55Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID NameQualifier="urn:mace:example.com:saml:roland:idp" SPNameQualifier="urn:mace:example.com:saml:roland:sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">975f16566cbd2bda349e7e5592bc44595e3e1f2ea51ae9aac18e09d55e710e81</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:55Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:55Z" NotOnOrAfter="2025-04-21T14:15:55Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:55Z" SessionIndex="id-0QROxlcTTUthB4bE1"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepci\xc3\xb3n</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave@cnr.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">#13</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-65VXWXzPI3UWpMLpp'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-65VXWXzPI3UWpMLpp', '--output', '/tmp/tmpdpc85gzr.xml', '/tmp/tmp9nyszfjo.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp9nyszfjo.xml"
output=
____________________ TestClientNonAsciiAva.test_response_2 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-Vbl12LCGlw80dj9hP" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:55Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-Vbl12LCGlw80dj9hP"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-CMhRogkWxiQjFtyHV" IssueInstant="2025-04-21T14:10:55Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-CMhRogkWxiQjFtyHV"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">98a327295567fc36f805b484700f4af5800abf4122353dbedc7266fb020e7e11</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:55Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:55Z" NotOnOrAfter="2025-04-21T14:15:55Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_5703c84d-4843-476f-8a92-3dfdb74c729d" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_2b92a8de-61ac-46e6-a7c6-bcf84b41e6ea"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDU1WhcNMzUwNDE5MTQxMDU1WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAjOwXmBqVdJ2IkkSs1jOb+MgqXA8nylJ+17wyfvSy7pKA4CzVAb+Ad3c1\nA0pKvSoeemL0ao4E/K+at+qbXpkjVvL+wwvxjapRDbqRvqQcRdT7eJiinQ7mzmYm\nkA25xWjYQnxSkPlwiJn/gxXbHP2Jd/vxt9dDUlQa2g49YUM4OOvIZm/WvLr4NGsw\npxuD0y+9Krg3q4uSDZSR0Lu5zoWa305wAVZJq3MgDEN1yMD7p9e5O0r2jB+RDOZp\nSqSBt7l5fbOHEjDMEdRBJlt5orbWS3arhNgT08yQlJVVf3Jd9kO2YAU+/s9h+9qV\nnzjxCIVPcl2r5LYVgGndU2a1/yvRyQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBALA2\nfV+seL1pRDQHgEcyWnX5YYSDC3gWcU4+yQ1/BzeoH2ZN6B8EXTtIv0WhH3CAYws0\nQVHRCWBJ0dn/uY3CYLI6Qll5dAnf8AO0TJiEaGdUbSUxMXLGXyStd27OE1VFNBr9\nm3m4veq4QJRNSvn+XREFxsk4Vy5JhvHCn4q+pqx9</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>GXrnc9SEd7jVGslGJMVW4qIdK39Dl3ETWAGegsn2Tf8TvjLhmgBHDUoa9aAFHRyr\nBoSm9waL1y4mwyrLNIC/A1FbS1DcaCNgsZOHr7V8YD5cSQ20nlg8XeReYxfOwmyU\nD4Ps719YIYcpbDqk8Q/X8Wd5/F6wp12sJhvqTXgPW43lQSn7LGh+qvacxxhsxUq/\n8lMrZ76kcFP7G6qbqLORQvD7R5bGXQ+N2a2x8ww/E6R/URW1tP31yszd4ycjUS7C\n1DIrAvt2ejQiPH09wmOz0x0weIv+PZbeQs4PpwGf5CFj1LX6IqReT+1iRDa3jL53\nhOYwnLNZdhXAPEQMh7kUHw==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>mMr9RpGCzPBYULzd6W0eA11siaw5jYcC0d+LsfQP1qzsG82z1KcRDygPtd3hJQpE\nP6P/5HtIdpzeB16GTyw9tSo2fsmCS98jxZs1kFVEhmyW7VyeoqSGh2hrosUx4ZE0\nCFHM7nHFznU15O5GUNExi/eTi3/q4e8QH+17OGjrFQHEs4EhBbT0H9geDi63r7ET\nkhXa90X09zALBriY5fCZfQHfopQQYkF5mtJi23Xr2PAR844acQ0804kQIiPAORKg\nZwsT9y1jWBhT9Sfe7qzqVQgsfhGSk9v1HN4wV4yCloxJh57xnzx42/INQnBJ6LWg\n9TD8P0MWZGVzpcCrY/hZ+ePGDZAoEVrK7NniXZVkQpbMZTK9bHhx+TVEfO7atQYE\nWMZirbWuJnkYhqQU6D/PqEdQgRs7ULeZqZIZ7lqsH1UdiLG7B8Y3vy6L4CrVfGWs\nmfgN9jeqPit62kCuWw9FNzPu4Fi/ZxBrSBJnBAGHP9fk6qcsFChLhqjIS5VJMYD/\n7RSKN+yZ8lTr7wPjnFBw5JCyYplhoTQSiZCJMzfkwiPC92z6bpffqDiNZxj53WIe\nUC3wvc8CJV9VOQi7zVb4pCGL477mQB1NRU5/k4MjSB1A4EsKzmbTC4wi/srX9skE\nfw1MCe56SdE0hRcU3rNovqOm+lz7ZQfyinTbfUiXPdWSIcZjq38Le6Tif8g+DEIa\njpMf8m5Ba8BHPNxlYzwzmQzNosMHlpDNsZpuuXgrnFeMHvRDXWVoSpDIAMk063GN\n+x8kQV/vjXyX68fcD/TcGtwoZPsx9ABXYYtGg+Y7aW+mxW69etyheq+fb9O+SoCS\nYNFeM/2VGiKxgqzuCAInq2aTiQyaz8VgxH/LeuBLGwP8es723i/u6mqHOrd6BNpC\nJI0rdPZduXOI36ZhznnLIvHIETurWgsWwhJscuDE+ut9mILUzangmE+gMH5XmEyZ\n66davpvHc4qF68cQpQ+xEgI6M2MXXr75LQo87HdkIhbh94tgYhVn0uy+rt5FjEKk\nekTyOUaGbJi2qgo5ck7mw1tjCYeucHObP6Wu0W6KyIY3lC6N6T3KaJoQP0rzHnc3\nV7y2RXhFXySkaSyX2AbxnzYv1QdfhFUDlZDW0cJo2uWcrh8xNBPw2np/dYLeWvPO\nyBxIk5ZIWn2eGFhjQuZnw0oYydA90/VekmrFwZMu5DryAVtEKgflbJxn7DFv9M6j\n6nJwo2kW9UduFUGjUXYQg6ZfefwjRUvTXP08ZAv2OEfVAaRDWxe+T/hyOOUpevfA\n89/aCTrHnnTU3uu5DDE3cdXm8xZ5OOcn0jVXWnK1dizQj7eJrSs4xBKhAQLDcJDz\n4xX5rDxKHUWzCAwYVR801CsQGrrZUuqGV1uPY93gklvlYWxN+/h/IJfpdPAYGDZy\nFd1mnlBzyBYMMGM3dw1lUaOBrrQAl1/0x6aF0PSH3+lpFcMTgimn44LHMO+RYdxA\n1ZOQ0j/YKCAMSHDFd6iJw2dNeNi79BUpngd48HWAzBgGFA2tiqp93aFTbJ6ay3ZX\nyiniWtuUwYTLJKOXG7jeNZJlYY/aFKBpZ2qsMAsp0eOd93BqrBVehJTsAli8IHiJ\nAmrMv+TSlnHSCIFemEwe5g2R4mBlSVEDUMuop78apIYw9QbE3H0l76HkbRC+C7xb\nTHTGRE/PqjcVApzNKxbbw9hfxX+blqua7rgtrlqfP5TK7pmclKYH9NdM95ABONar\n2CvWX81p6OTo6qvRLzTnrJ59i6n1hwzD9vK0XxGEnMZPCiRkaQqL5TWh1soHM97S\nlnQPOh6AvCHnfS9KktfraDkCRXmE+2e2qbTrJv5mK3vDo78Mg8/gLm+sJoJ7c/Qy\nNbqeS74+Z6Wqqr3F9XuXMnRqxQNja5tKvxF8K7xXX8K+IPZ9pgIZkf0O3CEY1jWh\nqA24EDMkXktmHYZnZ09YesOIXQtIgHp7RKM1ds6XtnsTlC+dg6g4lLK9NzgCzqFk\nIqj3ZMl4QoZJiuuCl5zC6Z0JKFRiJ1T1UZE0N/S4PQ3ScpWnYrr4Wx05W6AAUc49\nfxmPkbqMwzEzkSQ13VTzpAUaL6R8dj9P8Qs2/4n166oM8jVddQ0kXJd1uyiWxuMT\nj3jgpJ2lrp26u/z8FE58c2Z0z2GNe4kE0PFRWQ1ArQawv4FdNsx8lovr0hD3CIj1\nxZDyWmvtVNGN4v2Emlnu9+Q3Oi48zjDu0T2KP8CUF+Uz0rDgtt932+ur9mYk6e4L\n+T0u+pGczQpvxy9N8YBDMVFFXhWvncGWO6VcgnDI9X4TdABx5X/qoeTO0tHjW8O4\n1LM4AgmJeFgZiX57nSGT6kpyy6NbaL1UslW6tBnX0EkQCC3ndU4+ID+9invSVFav\ngaxJlipd9KPV0mNkCPln4OBtQ9V03q/A4sKnFoGI4lTAE3fNx4jPyA==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:55Z" SessionIndex="id-1KLmVJyeE97Gy38XJ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-CMhRogkWxiQjFtyHV'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpflucd_ka.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpflucd_ka.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58d3930>
    def test_response_2(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        cert_str, cert_key_str = generate_cert()
    
        cert = {"cert": cert_str, "key": cert_key_str}
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=False,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_advice=cert_str,
        )
tests/test_51_client.py:2146: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:907: in _response
    response = signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-Vbl12LCGlw80dj9hP" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:55Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-Vbl12LCGlw80dj9hP"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-CMhRogkWxiQjFtyHV" IssueInstant="2025-04-21T14:10:55Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-CMhRogkWxiQjFtyHV"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">98a327295567fc36f805b484700f4af5800abf4122353dbedc7266fb020e7e11</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:55Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:55Z" NotOnOrAfter="2025-04-21T14:15:55Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_5703c84d-4843-476f-8a92-3dfdb74c729d" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_2b92a8de-61ac-46e6-a7c6-bcf84b41e6ea"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDU1WhcNMzUwNDE5MTQxMDU1WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAjOwXmBqVdJ2IkkSs1jOb+MgqXA8nylJ+17wyfvSy7pKA4CzVAb+Ad3c1\nA0pKvSoeemL0ao4E/K+at+qbXpkjVvL+wwvxjapRDbqRvqQcRdT7eJiinQ7mzmYm\nkA25xWjYQnxSkPlwiJn/gxXbHP2Jd/vxt9dDUlQa2g49YUM4OOvIZm/WvLr4NGsw\npxuD0y+9Krg3q4uSDZSR0Lu5zoWa305wAVZJq3MgDEN1yMD7p9e5O0r2jB+RDOZp\nSqSBt7l5fbOHEjDMEdRBJlt5orbWS3arhNgT08yQlJVVf3Jd9kO2YAU+/s9h+9qV\nnzjxCIVPcl2r5LYVgGndU2a1/yvRyQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBALA2\nfV+seL1pRDQHgEcyWnX5YYSDC3gWcU4+yQ1/BzeoH2ZN6B8EXTtIv0WhH3CAYws0\nQVHRCWBJ0dn/uY3CYLI6Qll5dAnf8AO0TJiEaGdUbSUxMXLGXyStd27OE1VFNBr9\nm3m4veq4QJRNSvn+XREFxsk4Vy5JhvHCn4q+pqx9</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>GXrnc9SEd7jVGslGJMVW4qIdK39Dl3ETWAGegsn2Tf8TvjLhmgBHDUoa9aAFHRyr\nBoSm9waL1y4mwyrLNIC/A1FbS1DcaCNgsZOHr7V8YD5cSQ20nlg8XeReYxfOwmyU\nD4Ps719YIYcpbDqk8Q/X8Wd5/F6wp12sJhvqTXgPW43lQSn7LGh+qvacxxhsxUq/\n8lMrZ76kcFP7G6qbqLORQvD7R5bGXQ+N2a2x8ww/E6R/URW1tP31yszd4ycjUS7C\n1DIrAvt2ejQiPH09wmOz0x0weIv+PZbeQs4PpwGf5CFj1LX6IqReT+1iRDa3jL53\nhOYwnLNZdhXAPEQMh7kUHw==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>mMr9RpGCzPBYULzd6W0eA11siaw5jYcC0d+LsfQP1qzsG82z1KcRDygPtd3hJQpE\nP6P/5HtIdpzeB16GTyw9tSo2fsmCS98jxZs1kFVEhmyW7VyeoqSGh2hrosUx4ZE0\nCFHM7nHFznU15O5GUNExi/eTi3/q4e8QH+17OGjrFQHEs4EhBbT0H9geDi63r7ET\nkhXa90X09zALBriY5fCZfQHfopQQYkF5mtJi23Xr2PAR844acQ0804kQIiPAORKg\nZwsT9y1jWBhT9Sfe7qzqVQgsfhGSk9v1HN4wV4yCloxJh57xnzx42/INQnBJ6LWg\n9TD8P0MWZGVzpcCrY/hZ+ePGDZAoEVrK7NniXZVkQpbMZTK9bHhx+TVEfO7atQYE\nWMZirbWuJnkYhqQU6D/PqEdQgRs7ULeZqZIZ7lqsH1UdiLG7B8Y3vy6L4CrVfGWs\nmfgN9jeqPit62kCuWw9FNzPu4Fi/ZxBrSBJnBAGHP9fk6qcsFChLhqjIS5VJMYD/\n7RSKN+yZ8lTr7wPjnFBw5JCyYplhoTQSiZCJMzfkwiPC92z6bpffqDiNZxj53WIe\nUC3wvc8CJV9VOQi7zVb4pCGL477mQB1NRU5/k4MjSB1A4EsKzmbTC4wi/srX9skE\nfw1MCe56SdE0hRcU3rNovqOm+lz7ZQfyinTbfUiXPdWSIcZjq38Le6Tif8g+DEIa\njpMf8m5Ba8BHPNxlYzwzmQzNosMHlpDNsZpuuXgrnFeMHvRDXWVoSpDIAMk063GN\n+x8kQV/vjXyX68fcD/TcGtwoZPsx9ABXYYtGg+Y7aW+mxW69etyheq+fb9O+SoCS\nYNFeM/2VGiKxgqzuCAInq2aTiQyaz8VgxH/LeuBLGwP8es723i/u6mqHOrd6BNpC\nJI0rdPZduXOI36ZhznnLIvHIETurWgsWwhJscuDE+ut9mILUzangmE+gMH5XmEyZ\n66davpvHc4qF68cQpQ+xEgI6M2MXXr75LQo87HdkIhbh94tgYhVn0uy+rt5FjEKk\nekTyOUaGbJi2qgo5ck7mw1tjCYeucHObP6Wu0W6KyIY3lC6N6T3KaJoQP0rzHnc3\nV7y2RXhFXySkaSyX2AbxnzYv1QdfhFUDlZDW0cJo2uWcrh8xNBPw2np/dYLeWvPO\nyBxIk5ZIWn2eGFhjQuZnw0oYydA90/VekmrFwZMu5DryAVtEKgflbJxn7DFv9M6j\n6nJwo2kW9UduFUGjUXYQg6ZfefwjRUvTXP08ZAv2OEfVAaRDWxe+T/hyOOUpevfA\n89/aCTrHnnTU3uu5DDE3cdXm8xZ5OOcn0jVXWnK1dizQj7eJrSs4xBKhAQLDcJDz\n4xX5rDxKHUWzCAwYVR801CsQGrrZUuqGV1uPY93gklvlYWxN+/h/IJfpdPAYGDZy\nFd1mnlBzyBYMMGM3dw1lUaOBrrQAl1/0x6aF0PSH3+lpFcMTgimn44LHMO+RYdxA\n1ZOQ0j/YKCAMSHDFd6iJw2dNeNi79BUpngd48HWAzBgGFA2tiqp93aFTbJ6ay3ZX\nyiniWtuUwYTLJKOXG7jeNZJlYY/aFKBpZ2qsMAsp0eOd93BqrBVehJTsAli8IHiJ\nAmrMv+TSlnHSCIFemEwe5g2R4mBlSVEDUMuop78apIYw9QbE3H0l76HkbRC+C7xb\nTHTGRE/PqjcVApzNKxbbw9hfxX+blqua7rgtrlqfP5TK7pmclKYH9NdM95ABONar\n2CvWX81p6OTo6qvRLzTnrJ59i6n1hwzD9vK0XxGEnMZPCiRkaQqL5TWh1soHM97S\nlnQPOh6AvCHnfS9KktfraDkCRXmE+2e2qbTrJv5mK3vDo78Mg8/gLm+sJoJ7c/Qy\nNbqeS74+Z6Wqqr3F9XuXMnRqxQNja5tKvxF8K7xXX8K+IPZ9pgIZkf0O3CEY1jWh\nqA24EDMkXktmHYZnZ09YesOIXQtIgHp7RKM1ds6XtnsTlC+dg6g4lLK9NzgCzqFk\nIqj3ZMl4QoZJiuuCl5zC6Z0JKFRiJ1T1UZE0N/S4PQ3ScpWnYrr4Wx05W6AAUc49\nfxmPkbqMwzEzkSQ13VTzpAUaL6R8dj9P8Qs2/4n166oM8jVddQ0kXJd1uyiWxuMT\nj3jgpJ2lrp26u/z8FE58c2Z0z2GNe4kE0PFRWQ1ArQawv4FdNsx8lovr0hD3CIj1\nxZDyWmvtVNGN4v2Emlnu9+Q3Oi48zjDu0T2KP8CUF+Uz0rDgtt932+ur9mYk6e4L\n+T0u+pGczQpvxy9N8YBDMVFFXhWvncGWO6VcgnDI9X4TdABx5X/qoeTO0tHjW8O4\n1LM4AgmJeFgZiX57nSGT6kpyy6NbaL1UslW6tBnX0EkQCC3ndU4+ID+9invSVFav\ngaxJlipd9KPV0mNkCPln4OBtQ9V03q/A4sKnFoGI4lTAE3fNx4jPyA==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:55Z" SessionIndex="id-1KLmVJyeE97Gy38XJ"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-CMhRogkWxiQjFtyHV'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-CMhRogkWxiQjFtyHV', '--output', '/tmp/tmp1x2dq4c4.xml', '/tmp/tmpflucd_ka.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpflucd_ka.xml"
output=
____________________ TestClientNonAsciiAva.test_response_3 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-EFzGTt5yfU4wxoavz" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:56Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-EFzGTt5yfU4wxoavz"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-PGZP0BC8xG49YqUPn" IssueInstant="2025-04-21T14:10:56Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-PGZP0BC8xG49YqUPn"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">7c0b3bcb5ed71fdeb0f7c006e835f9be1f0b1e1a3b78344e0e32395a1e9f8e26</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:56Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:56Z" NotOnOrAfter="2025-04-21T14:15:56Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_c9daca1a-eb3f-447c-8992-dd2b8e550377" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_2abfe036-7b34-457c-83b8-094ca22aeb7e"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>dgFWd4FJawBmrT+K9+5GJ8NBrAccs95oWAe7WTs6rYs1WkUR+Hq8czpjbDoGNruH\nPeXYl8ugRtVKZpfqXPDe9vxG0b7DDeYckNlrZsMYfdJhpm40vTv9/6P2G97ACoGN\nDz5Uv6j9bSeUeqDdH+LSLCMGzpaZOwr2AT9L/E7sNgw=</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>c0tbur68xwUNhso5VFMQAHUx2uUkh2SaqiFv0ltI54MKSbId/Hx/8wgvQuGGW0zH\nTjLd+C86zVDyMzDH5tyCzLKB0tCitkcfXW60doUR0DU9kcUH48GRZZWav3ajQH2p\nauzcZg/9A8CSwG1ZVOnNWHb1PB94mtomK212H9Rx5JVeMY4z1Ch4X4tC5OUCDk/R\nToCLqNvtP8X3a5LqsOkrA3nvKWiJe18xfQVqBqXivDqJmcOYwTV0eXivPzaXVKYo\n2P8//sfot75s8vlKKf+PNDgqcUE0/PtptGj10zPyCZAbe2xI49SliBWBV8fd5AWj\n318ITHgRLeYbT5xOgrcA43oZlVsXiZZbbod6NphhQhyu9G3Brs2DvEDn2iMlaVL6\ndixOLJ6rn12fiyATnNP/dr4KwVqvl/QMKY+GRYIS768R/Qz/kGM6JPav/UADHksH\nQD5+3YPxBNlJsd+jOWX+r3JL8fT3a7LVT+hLu5pviQKolX0I95oqyiOnvTWAVFO+\nJuS6wAPq2i+0Gk35EbolgymNKBKPkklt64iUfKOgwiMrwjeKd5aePRMscCK4Ha0P\nAwBqVUoV+CzSlzWnbCVH5GqxH2JIkJTlYmo7qpFiJN7GklpON4Shj7RElyOgAajv\nANrVGdNa7eqQkZhAkFma7Bqrg4yDdtUcJ3MqRxf69Kinzf5k/sh4hd2TmioSqGMS\nubNr/XVTXLebLkvAa2PLHMB7nUvAsSFgEw2+rYO9mXRpwg2yHM3qzZvjU0tOC55Y\nk9j1UhV3C2Mj43RM8zgf6DgF/mrcBpa/eVVHpOrmYemRaJ2fIpGwiinmfZc3Rpgr\nCyV2uvnTwmgNXBEW5NJcek0j4z+a9KyDfZ+mBY+a7EXiGFM4q9ZBAtVs/PHsTmy+\n3bfkxOwrZdjQMkr4m0l/n6Qr/9BNZ8QENQYm6I3LIw1mSL7DN/yQgONGFZW9TGNV\nCf92+9CokimpBbDPKtI6cUzx7AU0uChdCRf+RC/MZphJ9zv+845jFnchFd0a+6hV\nsF2aiMYp6NJz3mMvXn1W2x8bUc5zjS2wI8xdHgE6aFwfnv9AHEizQZWQwV7ADluX\nCsFqlC/qm17rtNw6fdBjOlJUCA6L09mqUjxEhUt7mqNToQuGBmCJPQ/FRNtpPCPZ\n/kJMD2f7cgy1Ztj3OxvcutU1A1oDRk6HwXuKPiCXiGuHAXi8j0PynJS0+BL85Pq1\nus6GB6YJ2Qb6pxl2oCbRCNvDjvApUZBW/4rUyxiBXV2051+ygYB6Qgk4Cy0TkWgm\nYF10slOXEchx81y2fguuGjq9OMC5ZOg/k12Zq0BqTa5LlsKpxV9BNwWs03ZSw49s\nFWGlcwlBeRvhMfkO+OggPm/OiNUXim6LJgTQxBcM36ZMgeQfmYFpNY2tS3KMduJh\ntRmOkHpqH59QqDMULu5wjrP4dZjwWPoPwOXeLOAeHy0SgTKStBgP4/zMu4YsJV5b\nrWnC8OiufUFBnpdBC7HG5Y59kF8XYuKPdjgvNj4IDsaT6jqK9c+Q5/RMVyBtTg3c\nIjhAFFpH+iHq0H73ktNKENG9BxeI+UXILmPh5xFlUebUNfaCZUg/JVtd/ebKV9hs\nk9f7c8jhzzx+k4L8YBBR67+RyDvGrffrsDPcT55CzsWF560Vm37EqlfQChRIgROn\nV6Luj7DZGHTQm+omyvJHcZdG5+vBK7Sa3QeE6tbi/3gZJb+WCnqkzelY5DtZARx+\nyS305F/HEV0CVBzAHf7xATnwZyybEUCRb6ST7t6Cj/C/VXJx/5Jzerv0wXbJDqGT\nVPtl4nwX4KvUjEbxMQ7TQMzK1BHZ6g0dSRiLv1xlSVuWftrnQlgWNycRkbq1cX1S\nTAsDdNelnZFiw2WoQBDsMusIyNIjz/XnDP9W6vyknetPbXD36zD4wrIIg9/qaTMJ\nJY+bndHMs9sWZLJWSroRhGbcCj5PDltYZNMe//mXDtJPEePHCqEYbz7w8iE5wYtY\noGlEjSDh00KKlu8QkNLR1or7ml2PITo+NruLTWHWPh5KySdRLYKSGU7s+yi+l4T6\nK7h5NWmKNbU15AYYjb2m5cRrBTKIrIqpzeMXWC5tVKhNekosMmjt5UkyeEL8rLO2\ncnysDhCsbShFHE7BVOq9fKaRnl2nLWpiiWHC5NkJOdTGPUKPda0C/mZqW9AraW0h\n0PzsYrhdaZIWe6BxDq5y2cVlEWIxPCinIpfIzJZQR3zGjinOLBMHt8iunLHlO7pC\naUVrRH+ImKZ1q4w2cuynR/EScwOR39wFkBElMnEwpEjpM8VGLvRA68V6QVTxaUe4\nACtU5cRsr+kMYf1RPxj7LXJfeEdcM1p0xx2yHZ4Z3rV+f662HKwmhvXuB0Sf9oAB\nPbPryTh5zg3ztvtk5/JVckYqif96y9BV9uxB2DWVKuuDOYRQtG2xxg==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:56Z" SessionIndex="id-NipiQOsAwTHnjRTUy"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-PGZP0BC8xG49YqUPn'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpz8njjtwx.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpz8njjtwx.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58d33f0>
    def test_response_3(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=False,
            encrypt_assertion_self_contained=True,
            pefim=True,
        )
tests/test_51_client.py:2181: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:907: in _response
    response = signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-EFzGTt5yfU4wxoavz" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:56Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-EFzGTt5yfU4wxoavz"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-PGZP0BC8xG49YqUPn" IssueInstant="2025-04-21T14:10:56Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-PGZP0BC8xG49YqUPn"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">7c0b3bcb5ed71fdeb0f7c006e835f9be1f0b1e1a3b78344e0e32395a1e9f8e26</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:56Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:56Z" NotOnOrAfter="2025-04-21T14:15:56Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><ns3:EncryptedData Id="ED_c9daca1a-eb3f-447c-8992-dd2b8e550377" Type="http://www.w3.org/2001/04/xmlenc#Element"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><ns2:KeyInfo><ns3:EncryptedKey Id="EK_2abfe036-7b34-457c-83b8-094ca22aeb7e"><ns3:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>dgFWd4FJawBmrT+K9+5GJ8NBrAccs95oWAe7WTs6rYs1WkUR+Hq8czpjbDoGNruH\nPeXYl8ugRtVKZpfqXPDe9vxG0b7DDeYckNlrZsMYfdJhpm40vTv9/6P2G97ACoGN\nDz5Uv6j9bSeUeqDdH+LSLCMGzpaZOwr2AT9L/E7sNgw=</ns3:CipherValue></ns3:CipherData></ns3:EncryptedKey></ns2:KeyInfo><ns3:CipherData><ns3:CipherValue>c0tbur68xwUNhso5VFMQAHUx2uUkh2SaqiFv0ltI54MKSbId/Hx/8wgvQuGGW0zH\nTjLd+C86zVDyMzDH5tyCzLKB0tCitkcfXW60doUR0DU9kcUH48GRZZWav3ajQH2p\nauzcZg/9A8CSwG1ZVOnNWHb1PB94mtomK212H9Rx5JVeMY4z1Ch4X4tC5OUCDk/R\nToCLqNvtP8X3a5LqsOkrA3nvKWiJe18xfQVqBqXivDqJmcOYwTV0eXivPzaXVKYo\n2P8//sfot75s8vlKKf+PNDgqcUE0/PtptGj10zPyCZAbe2xI49SliBWBV8fd5AWj\n318ITHgRLeYbT5xOgrcA43oZlVsXiZZbbod6NphhQhyu9G3Brs2DvEDn2iMlaVL6\ndixOLJ6rn12fiyATnNP/dr4KwVqvl/QMKY+GRYIS768R/Qz/kGM6JPav/UADHksH\nQD5+3YPxBNlJsd+jOWX+r3JL8fT3a7LVT+hLu5pviQKolX0I95oqyiOnvTWAVFO+\nJuS6wAPq2i+0Gk35EbolgymNKBKPkklt64iUfKOgwiMrwjeKd5aePRMscCK4Ha0P\nAwBqVUoV+CzSlzWnbCVH5GqxH2JIkJTlYmo7qpFiJN7GklpON4Shj7RElyOgAajv\nANrVGdNa7eqQkZhAkFma7Bqrg4yDdtUcJ3MqRxf69Kinzf5k/sh4hd2TmioSqGMS\nubNr/XVTXLebLkvAa2PLHMB7nUvAsSFgEw2+rYO9mXRpwg2yHM3qzZvjU0tOC55Y\nk9j1UhV3C2Mj43RM8zgf6DgF/mrcBpa/eVVHpOrmYemRaJ2fIpGwiinmfZc3Rpgr\nCyV2uvnTwmgNXBEW5NJcek0j4z+a9KyDfZ+mBY+a7EXiGFM4q9ZBAtVs/PHsTmy+\n3bfkxOwrZdjQMkr4m0l/n6Qr/9BNZ8QENQYm6I3LIw1mSL7DN/yQgONGFZW9TGNV\nCf92+9CokimpBbDPKtI6cUzx7AU0uChdCRf+RC/MZphJ9zv+845jFnchFd0a+6hV\nsF2aiMYp6NJz3mMvXn1W2x8bUc5zjS2wI8xdHgE6aFwfnv9AHEizQZWQwV7ADluX\nCsFqlC/qm17rtNw6fdBjOlJUCA6L09mqUjxEhUt7mqNToQuGBmCJPQ/FRNtpPCPZ\n/kJMD2f7cgy1Ztj3OxvcutU1A1oDRk6HwXuKPiCXiGuHAXi8j0PynJS0+BL85Pq1\nus6GB6YJ2Qb6pxl2oCbRCNvDjvApUZBW/4rUyxiBXV2051+ygYB6Qgk4Cy0TkWgm\nYF10slOXEchx81y2fguuGjq9OMC5ZOg/k12Zq0BqTa5LlsKpxV9BNwWs03ZSw49s\nFWGlcwlBeRvhMfkO+OggPm/OiNUXim6LJgTQxBcM36ZMgeQfmYFpNY2tS3KMduJh\ntRmOkHpqH59QqDMULu5wjrP4dZjwWPoPwOXeLOAeHy0SgTKStBgP4/zMu4YsJV5b\nrWnC8OiufUFBnpdBC7HG5Y59kF8XYuKPdjgvNj4IDsaT6jqK9c+Q5/RMVyBtTg3c\nIjhAFFpH+iHq0H73ktNKENG9BxeI+UXILmPh5xFlUebUNfaCZUg/JVtd/ebKV9hs\nk9f7c8jhzzx+k4L8YBBR67+RyDvGrffrsDPcT55CzsWF560Vm37EqlfQChRIgROn\nV6Luj7DZGHTQm+omyvJHcZdG5+vBK7Sa3QeE6tbi/3gZJb+WCnqkzelY5DtZARx+\nyS305F/HEV0CVBzAHf7xATnwZyybEUCRb6ST7t6Cj/C/VXJx/5Jzerv0wXbJDqGT\nVPtl4nwX4KvUjEbxMQ7TQMzK1BHZ6g0dSRiLv1xlSVuWftrnQlgWNycRkbq1cX1S\nTAsDdNelnZFiw2WoQBDsMusIyNIjz/XnDP9W6vyknetPbXD36zD4wrIIg9/qaTMJ\nJY+bndHMs9sWZLJWSroRhGbcCj5PDltYZNMe//mXDtJPEePHCqEYbz7w8iE5wYtY\noGlEjSDh00KKlu8QkNLR1or7ml2PITo+NruLTWHWPh5KySdRLYKSGU7s+yi+l4T6\nK7h5NWmKNbU15AYYjb2m5cRrBTKIrIqpzeMXWC5tVKhNekosMmjt5UkyeEL8rLO2\ncnysDhCsbShFHE7BVOq9fKaRnl2nLWpiiWHC5NkJOdTGPUKPda0C/mZqW9AraW0h\n0PzsYrhdaZIWe6BxDq5y2cVlEWIxPCinIpfIzJZQR3zGjinOLBMHt8iunLHlO7pC\naUVrRH+ImKZ1q4w2cuynR/EScwOR39wFkBElMnEwpEjpM8VGLvRA68V6QVTxaUe4\nACtU5cRsr+kMYf1RPxj7LXJfeEdcM1p0xx2yHZ4Z3rV+f662HKwmhvXuB0Sf9oAB\nPbPryTh5zg3ztvtk5/JVckYqif96y9BV9uxB2DWVKuuDOYRQtG2xxg==</ns3:CipherValue></ns3:CipherData></ns3:EncryptedData></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:56Z" SessionIndex="id-NipiQOsAwTHnjRTUy"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-PGZP0BC8xG49YqUPn'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-PGZP0BC8xG49YqUPn', '--output', '/tmp/tmpih846oih.xml', '/tmp/tmpz8njjtwx.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpz8njjtwx.xml"
output=
____________________ TestClientNonAsciiAva.test_response_4 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-KlJYc1XNzFpBOLGTs" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:56Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-KlJYc1XNzFpBOLGTs"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-ErK0ZOisSjZsU6liw" IssueInstant="2025-04-21T14:10:56Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-ErK0ZOisSjZsU6liw"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">e38bf1ee87f7cc0868133f485926a566186d4e6b6aee42cbef99a72ab84fa9d9</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:56Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:56Z" NotOnOrAfter="2025-04-21T14:15:56Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_801aa2f8-1a7b-42a5-b44c-8cfc6867ff25" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_1b500f69-dbd4-4abf-86fb-64c8e33d7170"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>vVOCtWh67UHAHZNycaqfEiYmQmXaM94wl06x1jhb3bT2XRMiQrp+6qJMrvSEhqOr\nLDHzToDGIpj0wUd063AndoRgfgF1wiWsfXXxqXuX0K3DhQ40DYnGbevTbEoXyTYY\nc0J26Atg2TeFjwHkqhnViOzrbMvNShKDB0RZVe3bVA4=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>t5labvydz7VSvs1UAm/892gnhcROxEf3wnRuIc+d4Dtd7mqngR5R1jbB7Tp9nYeE\nyrgrJklWwLTMIN5UKo4kcVS4ny9bGYn2Ho0OoovgZkJhTa/i9vcHqUR/oHBxR83F\nzunqD4nbcmp5lVccP4ZzOyA8WccmabM40TO/LAVcdqZA7khXSKT4Rw6mXmfkQGmu\nh6YMreg20UXonCgE3urbttLSdbybUfsZHPPiQWHIH8uVTxtA4dJKUWAEOw/mpgoc\nqn1Q+IZvRsyrXSU5PhMJQIm5L9daoZ7VrZUeHD4BoIE7jd1Yh5/Hu1srMgSyJXal\nwoEQgABDXqzEJHthnWVPbYdgy+GXi5WRayqF+wE4xA2QhMukY4aD63Gilo96azKy\n+ufD6Vb0ZcLGC5hC23I8RYWkV23nWEThPLoUXSR/3uOQEDEXZ25Bnn5wacH0ce4h\nGQ/i/uWdw/DyqXNTMRjRHNQFrYueG+uBCiCGYFswdrSeuMnPDKiZPelh6/3/O8lQ\nA1SFsF+5h67yywNSdcV4SZDI7OtEFEX09y2vyEqZx1z5MKQaaajFoF5cSDI5rWdI\nbXJcSCfqOHBBQFQ0SXNVl4z595Zg3EaD8E4Z0XQLIdIfEbZRUBAVzqWeghasNiHb\nERpN/cXufeTzo8ZgvVy/KOo6dMzmKTPmMASYKqm0/inV6lgDOYYycfFOC2mJB6M0\nY/hVqqMsSLgYzhc+YfM51/Vw43bbYRnYmQY/YuTGEruq4rw7wpbbqJi5rtdePV2/\n+ynyp4TDUwY/6w6yUvcQDyQcULaBzK10B3YbXYT2AQR3hqXfJnVqw8RdR7na8BUM\nhTk8R3BYKJaD/V7Ia8GdiUL93px1owurv8bVWlMCaCRPNUS5mXrEmAc0mVe7nDU2\nt5sPgMts+PUCwHxuCdTQi8rr6LFw85Y/dcGrkCAlmn06YQC+LnkMVZHihY5JXweG\nJGCnD2tu85hJd1+sT6qtomYG7dMD3mtgnCdXyMHGgHxDGFcVIPSZhIkWXQo/Q0O8\nLmDF7XTKvUMyrKdNM22cdQN95ADkLqq+nLHptqEIU4eczRE1AIkAXy7eG9p3WHrZ\nSPFeNj/97KYB0PQm26X4YAsaBrOLlsP2nA+JW169t6JhNwShj8YEeBxIYnFXxzpa\nGdu9s3+SQ+EjBSOaAtpAsnZvX9IouDpcSUqkS12FZDkubNKvgCc8Qzs0OS4MOR5r\nCj/fj1ovgfgH218bYgyvlJtxMTdwjGynAo/wz7kFmK0QW5xDffXwrmT5hSacrfuo\nIoR3xDhx9ULApf8LVUxQN1iT/BH3YS6xWnMqpv4ct2FquOiFU8XYKNbM2jZ9rHXQ\n2TaonP53mgJNUU4kYQfKgnS+QYPE2aH6fI79kzS2e/5aaiAOsylfMWbiYuN5iH/X\nb8OCEdcjSDnQyguURbXp2eIX9v/F8J+xjOefI0aHgI8U66fnGc9WUyLDpxUkHcsG\nVDOxU1cHYAc3QFDcizmAEfbsaPPO8fnxHovyQxGR3kvsZaEfGb9G93YNb2WOfErI\nHSuQpzPrs5znE0vuz1f4jkudJcKQ0POQpK9NueytjgLmctk7g5LLWqlG7ghur5Th\nk6CcYmMKo6U4+Zhi3CO1l/0GGBNzFG5HIsFZotLldd7HtYkdlNzk/4F2ayQUx4Vq\n5LNg8ZlTx/B8FsGQi/erTZ/E2H2eyoDhjvSTkViGavfB3CxhkYGDtUJrEllek1OY\nf4yD/n8PksY1Ngl+bGGmm1HfBBFingJodgRlksffFXEC7IvlvnP4Z2Ardn/iQ7+M\nhhN7ZefvWf+oKvIGjcXbCkqCQRZa8yhurot9Tsz3nmrlUa6sP5579iVNsSYtwFol\n7cN+lEgDz6dWfwk0Mp0WjyCORqKiL26/GEPgLg8oaV+6ybnKDHEkfia1c46NwCqy\nfkfrcTzfPIg2U3ENSa+fvCu3uPJOn79JviCPFzhbtnXbSN9ehAZeVRQ8RpcYUEi0\nhoRqU47qwkrJVluBv8WiBr2j8ymfTubx+UUUaI2vbWV86/XlzU0VoNK5WV6VwJ1x\nxO/lT5A1wDPaqjQvlUKJJsk5MtrI0Wm6XPsbiZpjHXhXYAqnRVYWfsyudkYXhB2n\nsQLU7BbRv+exKWMsECxaEApF5eGZgHn9h5AvN2kgVPiyQFB31Ocer/QGDLnYXzy4\npaWZ464xIKP7SDfcy8I1x9R0j/xAV7rQ/d05rLBLqMweYsgG9GWizAcf37CGLUBu\n8+edjGijONWJJrqsmnFEM8mFGX82Mz/oUounOBPV2xlbkxQHKeLbo1Znr4iXVrho\nhk8NpEJ2orl42ct4c4lnW5sf6XvvHQShS7QvWd3hoW7z+KmRYzMBKUq0Cuv0Tmzn\n+Ubb1XDTlJDdxJRfPPK+GZq6KYAt7O9Tir3gUq32Utx1VMMCk7iMrA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:56Z" SessionIndex="id-AEkQGPPtrE4BLXABP"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-ErK0ZOisSjZsU6liw'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmphioq85eb.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmphioq85eb.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa51b5230>
    def test_response_4(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
        )
tests/test_51_client.py:2215: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-KlJYc1XNzFpBOLGTs" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:56Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-KlJYc1XNzFpBOLGTs"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-ErK0ZOisSjZsU6liw" IssueInstant="2025-04-21T14:10:56Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-ErK0ZOisSjZsU6liw"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">e38bf1ee87f7cc0868133f485926a566186d4e6b6aee42cbef99a72ab84fa9d9</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:56Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:56Z" NotOnOrAfter="2025-04-21T14:15:56Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_801aa2f8-1a7b-42a5-b44c-8cfc6867ff25" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_1b500f69-dbd4-4abf-86fb-64c8e33d7170"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>vVOCtWh67UHAHZNycaqfEiYmQmXaM94wl06x1jhb3bT2XRMiQrp+6qJMrvSEhqOr\nLDHzToDGIpj0wUd063AndoRgfgF1wiWsfXXxqXuX0K3DhQ40DYnGbevTbEoXyTYY\nc0J26Atg2TeFjwHkqhnViOzrbMvNShKDB0RZVe3bVA4=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>t5labvydz7VSvs1UAm/892gnhcROxEf3wnRuIc+d4Dtd7mqngR5R1jbB7Tp9nYeE\nyrgrJklWwLTMIN5UKo4kcVS4ny9bGYn2Ho0OoovgZkJhTa/i9vcHqUR/oHBxR83F\nzunqD4nbcmp5lVccP4ZzOyA8WccmabM40TO/LAVcdqZA7khXSKT4Rw6mXmfkQGmu\nh6YMreg20UXonCgE3urbttLSdbybUfsZHPPiQWHIH8uVTxtA4dJKUWAEOw/mpgoc\nqn1Q+IZvRsyrXSU5PhMJQIm5L9daoZ7VrZUeHD4BoIE7jd1Yh5/Hu1srMgSyJXal\nwoEQgABDXqzEJHthnWVPbYdgy+GXi5WRayqF+wE4xA2QhMukY4aD63Gilo96azKy\n+ufD6Vb0ZcLGC5hC23I8RYWkV23nWEThPLoUXSR/3uOQEDEXZ25Bnn5wacH0ce4h\nGQ/i/uWdw/DyqXNTMRjRHNQFrYueG+uBCiCGYFswdrSeuMnPDKiZPelh6/3/O8lQ\nA1SFsF+5h67yywNSdcV4SZDI7OtEFEX09y2vyEqZx1z5MKQaaajFoF5cSDI5rWdI\nbXJcSCfqOHBBQFQ0SXNVl4z595Zg3EaD8E4Z0XQLIdIfEbZRUBAVzqWeghasNiHb\nERpN/cXufeTzo8ZgvVy/KOo6dMzmKTPmMASYKqm0/inV6lgDOYYycfFOC2mJB6M0\nY/hVqqMsSLgYzhc+YfM51/Vw43bbYRnYmQY/YuTGEruq4rw7wpbbqJi5rtdePV2/\n+ynyp4TDUwY/6w6yUvcQDyQcULaBzK10B3YbXYT2AQR3hqXfJnVqw8RdR7na8BUM\nhTk8R3BYKJaD/V7Ia8GdiUL93px1owurv8bVWlMCaCRPNUS5mXrEmAc0mVe7nDU2\nt5sPgMts+PUCwHxuCdTQi8rr6LFw85Y/dcGrkCAlmn06YQC+LnkMVZHihY5JXweG\nJGCnD2tu85hJd1+sT6qtomYG7dMD3mtgnCdXyMHGgHxDGFcVIPSZhIkWXQo/Q0O8\nLmDF7XTKvUMyrKdNM22cdQN95ADkLqq+nLHptqEIU4eczRE1AIkAXy7eG9p3WHrZ\nSPFeNj/97KYB0PQm26X4YAsaBrOLlsP2nA+JW169t6JhNwShj8YEeBxIYnFXxzpa\nGdu9s3+SQ+EjBSOaAtpAsnZvX9IouDpcSUqkS12FZDkubNKvgCc8Qzs0OS4MOR5r\nCj/fj1ovgfgH218bYgyvlJtxMTdwjGynAo/wz7kFmK0QW5xDffXwrmT5hSacrfuo\nIoR3xDhx9ULApf8LVUxQN1iT/BH3YS6xWnMqpv4ct2FquOiFU8XYKNbM2jZ9rHXQ\n2TaonP53mgJNUU4kYQfKgnS+QYPE2aH6fI79kzS2e/5aaiAOsylfMWbiYuN5iH/X\nb8OCEdcjSDnQyguURbXp2eIX9v/F8J+xjOefI0aHgI8U66fnGc9WUyLDpxUkHcsG\nVDOxU1cHYAc3QFDcizmAEfbsaPPO8fnxHovyQxGR3kvsZaEfGb9G93YNb2WOfErI\nHSuQpzPrs5znE0vuz1f4jkudJcKQ0POQpK9NueytjgLmctk7g5LLWqlG7ghur5Th\nk6CcYmMKo6U4+Zhi3CO1l/0GGBNzFG5HIsFZotLldd7HtYkdlNzk/4F2ayQUx4Vq\n5LNg8ZlTx/B8FsGQi/erTZ/E2H2eyoDhjvSTkViGavfB3CxhkYGDtUJrEllek1OY\nf4yD/n8PksY1Ngl+bGGmm1HfBBFingJodgRlksffFXEC7IvlvnP4Z2Ardn/iQ7+M\nhhN7ZefvWf+oKvIGjcXbCkqCQRZa8yhurot9Tsz3nmrlUa6sP5579iVNsSYtwFol\n7cN+lEgDz6dWfwk0Mp0WjyCORqKiL26/GEPgLg8oaV+6ybnKDHEkfia1c46NwCqy\nfkfrcTzfPIg2U3ENSa+fvCu3uPJOn79JviCPFzhbtnXbSN9ehAZeVRQ8RpcYUEi0\nhoRqU47qwkrJVluBv8WiBr2j8ymfTubx+UUUaI2vbWV86/XlzU0VoNK5WV6VwJ1x\nxO/lT5A1wDPaqjQvlUKJJsk5MtrI0Wm6XPsbiZpjHXhXYAqnRVYWfsyudkYXhB2n\nsQLU7BbRv+exKWMsECxaEApF5eGZgHn9h5AvN2kgVPiyQFB31Ocer/QGDLnYXzy4\npaWZ464xIKP7SDfcy8I1x9R0j/xAV7rQ/d05rLBLqMweYsgG9GWizAcf37CGLUBu\n8+edjGijONWJJrqsmnFEM8mFGX82Mz/oUounOBPV2xlbkxQHKeLbo1Znr4iXVrho\nhk8NpEJ2orl42ct4c4lnW5sf6XvvHQShS7QvWd3hoW7z+KmRYzMBKUq0Cuv0Tmzn\n+Ubb1XDTlJDdxJRfPPK+GZq6KYAt7O9Tir3gUq32Utx1VMMCk7iMrA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:56Z" SessionIndex="id-AEkQGPPtrE4BLXABP"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-ErK0ZOisSjZsU6liw'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-ErK0ZOisSjZsU6liw', '--output', '/tmp/tmpqwsln9ji.xml', '/tmp/tmphioq85eb.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmphioq85eb.xml"
output=
____________________ TestClientNonAsciiAva.test_response_5 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-ndOtsGhfluPNngABh" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:56Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-ndOtsGhfluPNngABh"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-9L0piScwwAptqo9Lw" IssueInstant="2025-04-21T14:10:56Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-9L0piScwwAptqo9Lw"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">2ad2f90117da8c9de127912e01d8fcf1478c9ba47b839cc2e357cbfba5e3e2ad</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:56Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:56Z" NotOnOrAfter="2025-04-21T14:15:56Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_bb53369d-58a5-4fc2-ada9-07b37c6c63a3" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_ee5f7acb-6347-4a3c-8127-b9b495826d7d"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>eyL76IpcTvwSoTFcJqc+ReQCkPGD0mRwlbRNYSI77kXiv5Dgn7mZC+6sVjVWAY7P\niSzt52hSRl63ziw5vvs6NBHTlrbUe6utwK+Zh4JzooI65IKiUgxU5t6cKHDDdUDn\nGV+vBnPy0WOzIkS0JHdyWllcmzsTYIKUqnTVKxDyQyo=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>P2BBoHn8Zjy+OuJ2nX/eEZtmzQHlVCDtBVQWaV2huWFhwIboy6eu3g26uJPv+dBj\nzzJ33SxpMU4+vKHHWcr5gyWPHJ1imFNCowdQF+YfkcdVhgCoym4Hi2jQfFs8r0I+\nkxluHS6HewND5t6wh8O3XuvKDQX4gXksZej2hUj45YRgmS4jV2898Vn/NKQOKDcJ\nahudqVzkblgBRvDPQxyDDw1/U7MytJp+Mbbl1SIwusSWwkkgKfLkIqLYXZ+RFU8A\ntWqdcekbQbGlLV15U/9lGZSwdGNDRQUt2nVKY2BF7TOnShaXjIrVEK+qzM37EeHR\nRzP1SUQj4H5El3CDj62ZX6DSWd4b0R3WKYzLR+v+pRhxKUZ3QgG25zv/DxlFdcb8\n8br37A7LJfsQYsAQPJxphHsvI+pCxJA7jZ6SXGM+ckNzzpmK/Jaa9UOEaVUai53Y\nP//Sw5+mUlrDrSik5G7OMwsP5EOm+ZJRKhkPd5s3ySng4c5JcIA5+TVbGxA25I4V\nS3Zard0AKneQv8S1Q0XPgK2zpfH1RtqWI3SO7Mp+maoryKSVSKxggRRjVbWt5qHS\nogFWMxCd7saaK6KjaaHU3Y9gus885fonZCouro9NwKxssLguwCzPO3TgDufQ05nF\ng29nUYilGYexVAAwYNKkSeO5zLX6LIdpubnkmp+nxheqktZHbk0DyTaSjMCcCgKk\nFEFxWM5R+qGsBRhhjn7AncXu6V20xrgk87eGn2dd7CE1nMzDcXe+9YuYbRbbgHAL\nUdvEaEPUjii1vqLcq5s+4KIZK2a9uAGTigweuVGzRAWesuDAjsl6sY9ZVgIbXfYs\nF4milTjIQ0d3mCnrsAMeB6THfk1Tm4GTS+C619oQvhtHkvye1w/vlBk6QynPSwf1\nZUBur8fjltGVYakeMtgDNOLK813ECB87KuTfNw8UvusNMu+bmPVzI7QIVwQXvQOx\nwBkGMzSa0ZjTZXOYXRAj2YixnOASYbt40mUD8zN/VGUf4Jtdiq4TAImzNaPQYQuz\nAaaDxTmxhhIzZC1Cc7D+D/p/ABNaoB7mM5IgCK8eVV2G+pH345IQ35j7HhBIoF4j\nrl6gwfgXPp5L+cBDNdk7SM2M9uevyVxLEMqH+Kewian22qISSYqEtwFzQ14fcwFc\nqKyXKilLLDeUXchlG3oED2MLvznVoIQrQ7FEwqtW5EHo5iQSGMb5WyMBjIFncCLx\n89U3hT5YKibli1XD+KmfCqD2YfrtmqTRcrsrxcUL0vXXPVnqx2gPqNMRLBQFM6t4\njMSEIuKOmTDERCgh+wgRz1WlnqdZ2hk585Gjdfr0kZf5Uig5ByVUezcBPPL1lbZh\nr0uuR07cl8fTUQ6RAodWJ12YYETY2IJf+SIkrwAR+S0OXN4MNh+kkZfQDq+9qeGP\n2tRu5QzpKiQBtpUxskdF9ROEXVYU3yOOcv5VjJuOuhxzb8QYkZgZt8qWEX4iJBzN\n9MY4UiXN5C+Fm+HT1fqyRcv/MvQUbGn/IyJlRugUOhVWidEY1J76enhd5hyMbskO\neEDzS4yFwF2lFvEZV5uHLQcR5UfvlicLFrzEvDHzYUi+ycVnPusfd67axlhK/uak\nrckn7vPlRyWMDiCshbwTrpJgVINQfuiZO27TvDIaODvlc3q7/l5npil68Ezeyb0o\nlOVwu9DcyARnLVZzRHng+xsiwmF3Y0mKea1p7ns51s9YiWu8aEUVRTCq9AOP89DQ\nkPOUe79LRO3lBthYD5D4F60PqOOg6pqhsY/kdUlej4mafyKFmGb8M02ZYq47ppMc\nzI+vSYSElgcAV3qIehFeK/FukZ9YN66AjW67eYu6V9X7gs1T4PrjZvZY1E9r5tkh\nFdcHlS0rQcI12/zkyKkRua052PxhX89XFHiB8NEC1q5+Mf4pc6IvY+pdomtyYoo5\nqXt1qe/Cw6prlezB669ATa1Da0jnWGwOPdhI5JKz1pJVmuO3QESraYzzL79z/zxx\nbDfvq1kSqFE/t4+vYqVgUk+qTFMBNwds1u5VtNnEVYcra+j61S+yEq0y6qOjHk6k\nbB7sGeoDxB6oBfyZwSJ030wycU0WYNmfX3GmP61kfvv8YM6Q2xFfQ/OpdAmd9zM1\ndiN6YxauGpJT728LZSrrgQvMCF7iEMkQUeTmqNLtbPwPCYToPaZ1JjLATmQocCEN\n2/GIs5BLruKdo6U7sGVLMGJzd2oVNTEFKCnvpvcHkcfyp/Wf8I8mNvkhKBHS3XOb\nZxTLdboNFJhs5sb2U0zvNfe6A7VoPQPJWy+m7SsyAKbsybUeK1cXaO3niCmzr5pD\nn1fn21VWdcfv7t7u1rpnqrf6ZpxUV8DDUjWhh/1uS/XUYvOUvPdyypTwqYKZqT07\nbGIcfBnEMP/GzVTLoBgXEuJMM0qfIbL7K9azJkrqQcE7f2bc4XSJ0Q==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:56Z" SessionIndex="id-32WznDmwzAUrDQyWY"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-9L0piScwwAptqo9Lw'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpzkvqtfvo.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpzkvqtfvo.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa5106ed0>
    def test_response_5(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
        cert_str, cert_key_str = generate_cert()
    
        cert = {"cert": cert_str, "key": cert_key_str}
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_assertion=cert_str,
        )
tests/test_51_client.py:2253: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-ndOtsGhfluPNngABh" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:56Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-ndOtsGhfluPNngABh"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-9L0piScwwAptqo9Lw" IssueInstant="2025-04-21T14:10:56Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-9L0piScwwAptqo9Lw"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">2ad2f90117da8c9de127912e01d8fcf1478c9ba47b839cc2e357cbfba5e3e2ad</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:56Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:56Z" NotOnOrAfter="2025-04-21T14:15:56Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_bb53369d-58a5-4fc2-ada9-07b37c6c63a3" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_ee5f7acb-6347-4a3c-8127-b9b495826d7d"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICHzCCAYgCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNV\nBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwF\nWnp6enoxDTALBgNVBAMMBHRlc3QwHhcNMTUwNjAyMDc0MzAxWhcNMjUwNTMwMDc0\nMzAxWjBYMQswCQYDVQQGEwJ6ejELMAkGA1UECAwCenoxDTALBgNVBAcMBHp6enox\nDjAMBgNVBAoMBVp6enp6MQ4wDAYDVQQLDAVaenp6ejENMAsGA1UEAwwEdGVzdDCB\nnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA41tJCTPuG2lirbztuGbBlzbzSipM\nEzM+zluWegUaoUjqtlgNHOTQqTJOqw/GdjkxRKJT6IxI3/HVcnfw7P4a4xSkL/ME\nIG3VyzedWEyLIHeofoQSTvr84ZdD0+Gk+zNCSqOQC7UuqpOLbMKK1tgZ8Mr7BkgI\np8H3lreLf29Sd5MCAwEAATANBgkqhkiG9w0BAQsFAAOBgQB0EXxy5+hsB7Rid7Gy\nCZrAObpaC4nbyPPW/vccFKmEkYtlygEPgky7D9AGsVSaTc/YxPZcanY+vKoRIsiR\n6ZitIUU5b+NnHcdj6289tUQ0iHj5jgVyv8wYHvPntTnqH2S7he0talLER8ITYToh\n2wz3u7waz/GypMeA/suhoEfxew==</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>eyL76IpcTvwSoTFcJqc+ReQCkPGD0mRwlbRNYSI77kXiv5Dgn7mZC+6sVjVWAY7P\niSzt52hSRl63ziw5vvs6NBHTlrbUe6utwK+Zh4JzooI65IKiUgxU5t6cKHDDdUDn\nGV+vBnPy0WOzIkS0JHdyWllcmzsTYIKUqnTVKxDyQyo=</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>P2BBoHn8Zjy+OuJ2nX/eEZtmzQHlVCDtBVQWaV2huWFhwIboy6eu3g26uJPv+dBj\nzzJ33SxpMU4+vKHHWcr5gyWPHJ1imFNCowdQF+YfkcdVhgCoym4Hi2jQfFs8r0I+\nkxluHS6HewND5t6wh8O3XuvKDQX4gXksZej2hUj45YRgmS4jV2898Vn/NKQOKDcJ\nahudqVzkblgBRvDPQxyDDw1/U7MytJp+Mbbl1SIwusSWwkkgKfLkIqLYXZ+RFU8A\ntWqdcekbQbGlLV15U/9lGZSwdGNDRQUt2nVKY2BF7TOnShaXjIrVEK+qzM37EeHR\nRzP1SUQj4H5El3CDj62ZX6DSWd4b0R3WKYzLR+v+pRhxKUZ3QgG25zv/DxlFdcb8\n8br37A7LJfsQYsAQPJxphHsvI+pCxJA7jZ6SXGM+ckNzzpmK/Jaa9UOEaVUai53Y\nP//Sw5+mUlrDrSik5G7OMwsP5EOm+ZJRKhkPd5s3ySng4c5JcIA5+TVbGxA25I4V\nS3Zard0AKneQv8S1Q0XPgK2zpfH1RtqWI3SO7Mp+maoryKSVSKxggRRjVbWt5qHS\nogFWMxCd7saaK6KjaaHU3Y9gus885fonZCouro9NwKxssLguwCzPO3TgDufQ05nF\ng29nUYilGYexVAAwYNKkSeO5zLX6LIdpubnkmp+nxheqktZHbk0DyTaSjMCcCgKk\nFEFxWM5R+qGsBRhhjn7AncXu6V20xrgk87eGn2dd7CE1nMzDcXe+9YuYbRbbgHAL\nUdvEaEPUjii1vqLcq5s+4KIZK2a9uAGTigweuVGzRAWesuDAjsl6sY9ZVgIbXfYs\nF4milTjIQ0d3mCnrsAMeB6THfk1Tm4GTS+C619oQvhtHkvye1w/vlBk6QynPSwf1\nZUBur8fjltGVYakeMtgDNOLK813ECB87KuTfNw8UvusNMu+bmPVzI7QIVwQXvQOx\nwBkGMzSa0ZjTZXOYXRAj2YixnOASYbt40mUD8zN/VGUf4Jtdiq4TAImzNaPQYQuz\nAaaDxTmxhhIzZC1Cc7D+D/p/ABNaoB7mM5IgCK8eVV2G+pH345IQ35j7HhBIoF4j\nrl6gwfgXPp5L+cBDNdk7SM2M9uevyVxLEMqH+Kewian22qISSYqEtwFzQ14fcwFc\nqKyXKilLLDeUXchlG3oED2MLvznVoIQrQ7FEwqtW5EHo5iQSGMb5WyMBjIFncCLx\n89U3hT5YKibli1XD+KmfCqD2YfrtmqTRcrsrxcUL0vXXPVnqx2gPqNMRLBQFM6t4\njMSEIuKOmTDERCgh+wgRz1WlnqdZ2hk585Gjdfr0kZf5Uig5ByVUezcBPPL1lbZh\nr0uuR07cl8fTUQ6RAodWJ12YYETY2IJf+SIkrwAR+S0OXN4MNh+kkZfQDq+9qeGP\n2tRu5QzpKiQBtpUxskdF9ROEXVYU3yOOcv5VjJuOuhxzb8QYkZgZt8qWEX4iJBzN\n9MY4UiXN5C+Fm+HT1fqyRcv/MvQUbGn/IyJlRugUOhVWidEY1J76enhd5hyMbskO\neEDzS4yFwF2lFvEZV5uHLQcR5UfvlicLFrzEvDHzYUi+ycVnPusfd67axlhK/uak\nrckn7vPlRyWMDiCshbwTrpJgVINQfuiZO27TvDIaODvlc3q7/l5npil68Ezeyb0o\nlOVwu9DcyARnLVZzRHng+xsiwmF3Y0mKea1p7ns51s9YiWu8aEUVRTCq9AOP89DQ\nkPOUe79LRO3lBthYD5D4F60PqOOg6pqhsY/kdUlej4mafyKFmGb8M02ZYq47ppMc\nzI+vSYSElgcAV3qIehFeK/FukZ9YN66AjW67eYu6V9X7gs1T4PrjZvZY1E9r5tkh\nFdcHlS0rQcI12/zkyKkRua052PxhX89XFHiB8NEC1q5+Mf4pc6IvY+pdomtyYoo5\nqXt1qe/Cw6prlezB669ATa1Da0jnWGwOPdhI5JKz1pJVmuO3QESraYzzL79z/zxx\nbDfvq1kSqFE/t4+vYqVgUk+qTFMBNwds1u5VtNnEVYcra+j61S+yEq0y6qOjHk6k\nbB7sGeoDxB6oBfyZwSJ030wycU0WYNmfX3GmP61kfvv8YM6Q2xFfQ/OpdAmd9zM1\ndiN6YxauGpJT728LZSrrgQvMCF7iEMkQUeTmqNLtbPwPCYToPaZ1JjLATmQocCEN\n2/GIs5BLruKdo6U7sGVLMGJzd2oVNTEFKCnvpvcHkcfyp/Wf8I8mNvkhKBHS3XOb\nZxTLdboNFJhs5sb2U0zvNfe6A7VoPQPJWy+m7SsyAKbsybUeK1cXaO3niCmzr5pD\nn1fn21VWdcfv7t7u1rpnqrf6ZpxUV8DDUjWhh/1uS/XUYvOUvPdyypTwqYKZqT07\nbGIcfBnEMP/GzVTLoBgXEuJMM0qfIbL7K9azJkrqQcE7f2bc4XSJ0Q==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:56Z" SessionIndex="id-32WznDmwzAUrDQyWY"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-9L0piScwwAptqo9Lw'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-9L0piScwwAptqo9Lw', '--output', '/tmp/tmph17d40sj.xml', '/tmp/tmpzkvqtfvo.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpzkvqtfvo.xml"
output=
____________________ TestClientNonAsciiAva.test_response_6 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-A5H8RzUm2nCrRxiUb" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:57Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-A5H8RzUm2nCrRxiUb"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-eqL6FU9i8e7anVZhh" IssueInstant="2025-04-21T14:10:57Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-eqL6FU9i8e7anVZhh"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">262b980d649b9d83837943d4c957db684a28f73af3c151de3f877015f7453559</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:57Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:57Z" NotOnOrAfter="2025-04-21T14:15:57Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_bb9029fb-2daf-486a-893b-8aacff491294" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_bd1f140b-2032-4845-b124-45b1be27fdee"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDU3WhcNMzUwNDE5MTQxMDU3WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAwT9Fv4msuXedMse1C5YeP8ftr9RjCWMt94hyfZfGasfNyFHrr0QNmLzW\nzAWq7eOeRqmpJj2mFbOVFNQ7lLXFAh8dLpRT9et/nBlVAyq9iNWU2ql4sl9/otop\nZIfTs+rH2Xh6aKwGZejmnc5oGf10ggOlkr0trZx4Chy17FZzL69osFMJtEkf9kRv\nW7EbMJUi65PZkQE6AO+g6Mg7YrIfEimUmLJCsyR73HTGxNg+lfEGWyEwSEWF83g4\n6RrCCqC7JSHrj6nY5kECMwJrukE4m8S/gWcCpUALGuGap0+6DiNXcl1d06gDGnBX\nz94puKLlzM4KX91WmYsl/td8Ad2X0wIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAANq\nzm0nL4qrajNz1CeNRyGlG4VoIz5LPyeH/XoXdAIyC6vd0/2WzXBOlVY7+NH83j0F\n5imW0XBEAdLM+GSwIkbiL57u2170OqM/R1X2mxbddnbHoshTLLEPD3pFTw7Xg6nB\ndV/TdQgyTbtcwwVjdCS2RW2JIYf47Zd88CpLoA0h</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>Z1P3S+e/CZYG2Y7uqO3y108w7stKmJmjFMidBjjOfZS/wSXcA4X3HpBreA8x0Bnj\n/nzZQDknmeQ2w6NmlR1/pXFpjfXES5+MtHiX9CRDyVtafvl26EOqFwhLt3SPo9jQ\njhEz2IjBPBZeCsU2xAxeujIIUR7toLPARspQGMPmUbN5i/BITSqUMlXmqKqBCvAz\n8PIntYmCAv3+pqGeYazidkZkMF2poEeuajFbjzfAO5Y+POjjOvC4Hm0EmrHm1ERU\nQBUCr+oayowjjnclAQAKTfQj46FmcRqk0cs9Lq/WmpwClxlCeSeE8jl3vPPQca4v\njQg3lPTqdUpl63dR9f+inQ==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>CRjjdVI7ajyR1Ay9hkGE2NhzHRPvpwSn6fOwrh4ve1pGqaJYYu1iKk8tyl/Lsy4J\n6lhluD5Fj0/DrcPyKcK26e2Q4ojUAo9i64wGPtMi+r9ejB/tUo94qM7mVtUXZ6n4\nfSSa2+XB98zUp1fJyud2KkWKc/BOIS+RM9iLvN3rEdVp+9uyzzXF1HV2TAtWcBU+\n+o/SgTyC4BeNewOGyCaO0p683RHfbW+AMYqTMyaw3eRCSs0swwyRmaeL1Gcdd0Wo\nxcXdKxhxeBngNfOEha04CAtjzPYjcuCoQHzmq2XCCfDgaEsS6n8QAO4VLyXfGYUS\nO3wzH7ezFjiVnhRwTmo8EoaQkZjY3lq4o++5fNuy0I9Jsd2w/Jz34y+9YscOdGb/\nJ2ZKq2w+WJ9kUNlmSvbmSkLi9vGfJpgryqAx3VNeUxL7I9OKNYnQf9YpOqxpbXHM\nzgnP1w/wHqlXJHPCfVgx/iVENyUAnibw4PuIYC3KHJhvBdcolqbRwgiCwHMAaZGt\noEoa2aFUQ3GJhewTSInJAGQqrlGAOKoToEhCQDHVaWp0p+LKqWlD5cY0NRN0kuot\nwJwk4MtNZupJnKW7vaPGqi1n5b+jGU1IBaWy5KE0nhNH5ZP3isRS8U/JE8Sxr4lQ\n/ufPtJBrmHt86d4RBXui3RMdcuidouhmTx7l0cwwtmtXkpgy8iJxqu6IrZ4YaGq9\n0chyOOK8fhRtMHjrQ46BTId2X1MqZ2qMeNcjZHksKeInhn2Eue4L0mmQt0SK+ljs\n2lcVugwmXZJnLO7G7AuqyvBFUBkaxgMKB3txA0iwJt0+3OH5iFRRJzVMuDLbbCHb\nafSiDZATJuJ6s06+hykqvqVWVNZxnPnubrvLhq/DuT/Gq8o9VxNZ6LiK2uS4Jepi\nVVPZZJlS/REFtFg2/R36Zie3H2KliRESIkuW3eI2Q3zO0jn19yPf8luqSz644PbE\nYHooedkRFpxSKQTmMXnh5Fb1b4O8mKwZO1MmmH88ot82N8QITwRnFSfBMEOFLnAz\nqSQawc6EG4qiJsGwhAxIGnSN6KCHoOPmqb50d4rD9Cu14AxRtWKtn8bP0jA0vnvD\nAY3RPEesisMfnnMgZkWpJnRkwVo2hNzBZrHKQAxGeagRI1mL0nxcuYfa3w+ZEVXB\nnqKH6RrfK7zbVSBwR7/PTkZcMLoeIw0vK+bjMntIWyrpN+wuAwAqRo0BzIvQQIQL\nQHbDWrmoDnkJzCJK7zmgepqYIO/7ofeGfokK/FurRUBa6/KZl6c2lf+Ec7pYeoJr\n+5ZGTY6HssqfxHcKVRXS42kpdyYBQUdhWCSiGRZTQQXNIuuwvw3gYyzYqcE4RQ2F\nuko1+5frsXOoZhR552kdYp86Whsi3Caoy7YvgZukegdV9yXzFl6zn63qd+vvgHK1\niQc9L+PZ0FvS4lIqAkjeD+59lS1JCXJVC2JPCnc1tn/25b1r5bULxDL7e1Wxc+Aa\nkBDP8NGjRjVHTl0tCDxKTP+JwFfctQNZmfT0wUYU5J8FkTDI5WtNTB0hkn67vWGo\naey/MhfUuzMLoH7lCNNcHGGsIEKFzFn9WGuGCVxLA0p5YGd2JrrrRFrX5PqcZrWi\ny0FX+R4ArrNHKMyixVlnCSm5zSt2HgH1pziLgluvNcwZzbMD7cyoHnzNXXsxatMS\nADZOVFJmNCD1kLrRcAobJLIdqzAtSUfDa/QrCCpNZpk5U2M8hvtVWk5MZxcf2Nu5\nM8DmzU+cHfBx8jvQ75tmkc75nI15kW3+bIKMORIu8CCdekkojiNAbVgXpVFzuwP4\nmHnBC0dn8dx7U7fu5b4bs/uyGxxp/vzDa7KRlOUBEFwdH+HihE1RbJ35WCKD8dqG\nJsu8tkTEsG0cDRVGuMV32+AwbZoVl4ZXjPDYer8bpmZrolFiXGGYv/qyw1EnruH7\nKMNroruuQDTM7v+G0l9Pv/g9YdtSNrvnkGy5ZcFjUTVEqmBYpCrv8HygEvYp7Glk\nHgecgFDvSgtJwa4YRODNEsskxpB3cBcgfFFhGQdVSPrrt8zjv1BrG+MiSHhs0KXs\nx79/I3igwRZc6CUYjONMPCtWihkSXqrD7CPRNqIZgGxNIifz+WAnErjP9egfN9pF\ns0KSg6L4yUx2O30APmt6zBDvJqHseuicsfQQ7696SFTHt73qUChHJ6IRFenmn4NB\nfd9Hqt19fjZAISoKmCAKRwNShyeoM/B48IFy7ua4FK+RBfKVv6ujYLiBuicwAOOM\n23yPsu9L51IrJCdzSsQotMcvhIfITBenzC2jYaWKvP9nQI7AjElkFzJQ2S4TfRSU\n1nJkNcy2M9Kcigj6NQiwREmGWVE+CLFTyLQkxG9NL5eavIJXK+U4VhOJFUqUGkGy\nZ52a1WJS/30g7O4D+E4sgs53dtnXGgvCWJ3xSqr69XqEfjXDGDhpjA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:57Z" SessionIndex="id-8E7eLQdHY97tg91pY"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-eqL6FU9i8e7anVZhh'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpol9gjoog.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpol9gjoog.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa5105490>
    def test_response_6(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
        cert_assertion_str, cert_key_assertion_str = generate_cert()
    
        cert_assertion = {"cert": cert_assertion_str, "key": cert_key_assertion_str}
    
        cert_advice_str, cert_key_advice_str = generate_cert()
    
        cert_advice = {"cert": cert_advice_str, "key": cert_key_advice_str}
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            pefim=True,
            encrypt_cert_assertion=cert_assertion_str,
            encrypt_cert_advice=cert_advice_str,
        )
tests/test_51_client.py:2296: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-A5H8RzUm2nCrRxiUb" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:57Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-A5H8RzUm2nCrRxiUb"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-eqL6FU9i8e7anVZhh" IssueInstant="2025-04-21T14:10:57Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/04/xmlenc#" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-eqL6FU9i8e7anVZhh"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">262b980d649b9d83837943d4c957db684a28f73af3c151de3f877015f7453559</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:57Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:57Z" NotOnOrAfter="2025-04-21T14:15:57Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:Advice><encas2:EncryptedAssertion><encas1:EncryptedData Id="ED_bb9029fb-2daf-486a-893b-8aacff491294" Type="http://www.w3.org/2001/04/xmlenc#Element"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" /><encas0:KeyInfo><encas1:EncryptedKey Id="EK_bd1f140b-2032-4845-b124-45b1be27fdee"><encas1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICujCCAiMCAQEwDQYJKoZIhvcNAQELBQAwbTELMAkGA1UEBhMCc2UxCzAJBgNV\nBAgMAmFjMQ0wCwYDVQQHDAR1bWVhMRwwGgYDVQQKDBNJVFMgVW1lYSBVbml2ZXJz\naXR5MQ0wCwYDVQQLDARESVJHMRUwEwYDVQQDDAxsb2NhbGhvc3QuY2EwHhcNMjUw\nNDIxMTQxMDU3WhcNMzUwNDE5MTQxMDU3WjBaMQswCQYDVQQGEwJzZTELMAkGA1UE\nCAwCYWMxDTALBgNVBAcMBFVtZWExDDAKBgNVBAoMA0lUUzENMAsGA1UECwwERElS\nRzESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAwT9Fv4msuXedMse1C5YeP8ftr9RjCWMt94hyfZfGasfNyFHrr0QNmLzW\nzAWq7eOeRqmpJj2mFbOVFNQ7lLXFAh8dLpRT9et/nBlVAyq9iNWU2ql4sl9/otop\nZIfTs+rH2Xh6aKwGZejmnc5oGf10ggOlkr0trZx4Chy17FZzL69osFMJtEkf9kRv\nW7EbMJUi65PZkQE6AO+g6Mg7YrIfEimUmLJCsyR73HTGxNg+lfEGWyEwSEWF83g4\n6RrCCqC7JSHrj6nY5kECMwJrukE4m8S/gWcCpUALGuGap0+6DiNXcl1d06gDGnBX\nz94puKLlzM4KX91WmYsl/td8Ad2X0wIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAANq\nzm0nL4qrajNz1CeNRyGlG4VoIz5LPyeH/XoXdAIyC6vd0/2WzXBOlVY7+NH83j0F\n5imW0XBEAdLM+GSwIkbiL57u2170OqM/R1X2mxbddnbHoshTLLEPD3pFTw7Xg6nB\ndV/TdQgyTbtcwwVjdCS2RW2JIYf47Zd88CpLoA0h</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>Z1P3S+e/CZYG2Y7uqO3y108w7stKmJmjFMidBjjOfZS/wSXcA4X3HpBreA8x0Bnj\n/nzZQDknmeQ2w6NmlR1/pXFpjfXES5+MtHiX9CRDyVtafvl26EOqFwhLt3SPo9jQ\njhEz2IjBPBZeCsU2xAxeujIIUR7toLPARspQGMPmUbN5i/BITSqUMlXmqKqBCvAz\n8PIntYmCAv3+pqGeYazidkZkMF2poEeuajFbjzfAO5Y+POjjOvC4Hm0EmrHm1ERU\nQBUCr+oayowjjnclAQAKTfQj46FmcRqk0cs9Lq/WmpwClxlCeSeE8jl3vPPQca4v\njQg3lPTqdUpl63dR9f+inQ==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedKey></encas0:KeyInfo><encas1:CipherData><encas1:CipherValue>CRjjdVI7ajyR1Ay9hkGE2NhzHRPvpwSn6fOwrh4ve1pGqaJYYu1iKk8tyl/Lsy4J\n6lhluD5Fj0/DrcPyKcK26e2Q4ojUAo9i64wGPtMi+r9ejB/tUo94qM7mVtUXZ6n4\nfSSa2+XB98zUp1fJyud2KkWKc/BOIS+RM9iLvN3rEdVp+9uyzzXF1HV2TAtWcBU+\n+o/SgTyC4BeNewOGyCaO0p683RHfbW+AMYqTMyaw3eRCSs0swwyRmaeL1Gcdd0Wo\nxcXdKxhxeBngNfOEha04CAtjzPYjcuCoQHzmq2XCCfDgaEsS6n8QAO4VLyXfGYUS\nO3wzH7ezFjiVnhRwTmo8EoaQkZjY3lq4o++5fNuy0I9Jsd2w/Jz34y+9YscOdGb/\nJ2ZKq2w+WJ9kUNlmSvbmSkLi9vGfJpgryqAx3VNeUxL7I9OKNYnQf9YpOqxpbXHM\nzgnP1w/wHqlXJHPCfVgx/iVENyUAnibw4PuIYC3KHJhvBdcolqbRwgiCwHMAaZGt\noEoa2aFUQ3GJhewTSInJAGQqrlGAOKoToEhCQDHVaWp0p+LKqWlD5cY0NRN0kuot\nwJwk4MtNZupJnKW7vaPGqi1n5b+jGU1IBaWy5KE0nhNH5ZP3isRS8U/JE8Sxr4lQ\n/ufPtJBrmHt86d4RBXui3RMdcuidouhmTx7l0cwwtmtXkpgy8iJxqu6IrZ4YaGq9\n0chyOOK8fhRtMHjrQ46BTId2X1MqZ2qMeNcjZHksKeInhn2Eue4L0mmQt0SK+ljs\n2lcVugwmXZJnLO7G7AuqyvBFUBkaxgMKB3txA0iwJt0+3OH5iFRRJzVMuDLbbCHb\nafSiDZATJuJ6s06+hykqvqVWVNZxnPnubrvLhq/DuT/Gq8o9VxNZ6LiK2uS4Jepi\nVVPZZJlS/REFtFg2/R36Zie3H2KliRESIkuW3eI2Q3zO0jn19yPf8luqSz644PbE\nYHooedkRFpxSKQTmMXnh5Fb1b4O8mKwZO1MmmH88ot82N8QITwRnFSfBMEOFLnAz\nqSQawc6EG4qiJsGwhAxIGnSN6KCHoOPmqb50d4rD9Cu14AxRtWKtn8bP0jA0vnvD\nAY3RPEesisMfnnMgZkWpJnRkwVo2hNzBZrHKQAxGeagRI1mL0nxcuYfa3w+ZEVXB\nnqKH6RrfK7zbVSBwR7/PTkZcMLoeIw0vK+bjMntIWyrpN+wuAwAqRo0BzIvQQIQL\nQHbDWrmoDnkJzCJK7zmgepqYIO/7ofeGfokK/FurRUBa6/KZl6c2lf+Ec7pYeoJr\n+5ZGTY6HssqfxHcKVRXS42kpdyYBQUdhWCSiGRZTQQXNIuuwvw3gYyzYqcE4RQ2F\nuko1+5frsXOoZhR552kdYp86Whsi3Caoy7YvgZukegdV9yXzFl6zn63qd+vvgHK1\niQc9L+PZ0FvS4lIqAkjeD+59lS1JCXJVC2JPCnc1tn/25b1r5bULxDL7e1Wxc+Aa\nkBDP8NGjRjVHTl0tCDxKTP+JwFfctQNZmfT0wUYU5J8FkTDI5WtNTB0hkn67vWGo\naey/MhfUuzMLoH7lCNNcHGGsIEKFzFn9WGuGCVxLA0p5YGd2JrrrRFrX5PqcZrWi\ny0FX+R4ArrNHKMyixVlnCSm5zSt2HgH1pziLgluvNcwZzbMD7cyoHnzNXXsxatMS\nADZOVFJmNCD1kLrRcAobJLIdqzAtSUfDa/QrCCpNZpk5U2M8hvtVWk5MZxcf2Nu5\nM8DmzU+cHfBx8jvQ75tmkc75nI15kW3+bIKMORIu8CCdekkojiNAbVgXpVFzuwP4\nmHnBC0dn8dx7U7fu5b4bs/uyGxxp/vzDa7KRlOUBEFwdH+HihE1RbJ35WCKD8dqG\nJsu8tkTEsG0cDRVGuMV32+AwbZoVl4ZXjPDYer8bpmZrolFiXGGYv/qyw1EnruH7\nKMNroruuQDTM7v+G0l9Pv/g9YdtSNrvnkGy5ZcFjUTVEqmBYpCrv8HygEvYp7Glk\nHgecgFDvSgtJwa4YRODNEsskxpB3cBcgfFFhGQdVSPrrt8zjv1BrG+MiSHhs0KXs\nx79/I3igwRZc6CUYjONMPCtWihkSXqrD7CPRNqIZgGxNIifz+WAnErjP9egfN9pF\ns0KSg6L4yUx2O30APmt6zBDvJqHseuicsfQQ7696SFTHt73qUChHJ6IRFenmn4NB\nfd9Hqt19fjZAISoKmCAKRwNShyeoM/B48IFy7ua4FK+RBfKVv6ujYLiBuicwAOOM\n23yPsu9L51IrJCdzSsQotMcvhIfITBenzC2jYaWKvP9nQI7AjElkFzJQ2S4TfRSU\n1nJkNcy2M9Kcigj6NQiwREmGWVE+CLFTyLQkxG9NL5eavIJXK+U4VhOJFUqUGkGy\nZ52a1WJS/30g7O4D+E4sgs53dtnXGgvCWJ3xSqr69XqEfjXDGDhpjA==</encas1:CipherValue></encas1:CipherData></encas1:EncryptedData></encas2:EncryptedAssertion></encas2:Advice><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:57Z" SessionIndex="id-8E7eLQdHY97tg91pY"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-eqL6FU9i8e7anVZhh'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-eqL6FU9i8e7anVZhh', '--output', '/tmp/tmpwnpstkou.xml', '/tmp/tmpol9gjoog.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpol9gjoog.xml"
output=
____________________ TestClientNonAsciiAva.test_response_7 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-sSTRh9QYTT6Vlz0md" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:57Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-sSTRh9QYTT6Vlz0md"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-nXmF5TWJtBWojEdgO" IssueInstant="2025-04-21T14:10:57Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-nXmF5TWJtBWojEdgO"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">9b7f13ba4ac8a723ebf44533899d6817e129bccdc39f001511dd2158ca2460a2</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:57Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:57Z" NotOnOrAfter="2025-04-21T14:15:57Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:57Z" SessionIndex="id-DhPHmtWkv645XeDkg"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Concepción</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave@cnr.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">#13</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nXmF5TWJtBWojEdgO'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp9fdha_3c.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp9fdha_3c.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58ac470>
    def test_response_7(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            encrypted_advice_attributes=True,
        )
tests/test_51_client.py:2335: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-sSTRh9QYTT6Vlz0md" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:57Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-sSTRh9QYTT6Vlz0md"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-nXmF5TWJtBWojEdgO" IssueInstant="2025-04-21T14:10:57Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-nXmF5TWJtBWojEdgO"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">9b7f13ba4ac8a723ebf44533899d6817e129bccdc39f001511dd2158ca2460a2</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:57Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:57Z" NotOnOrAfter="2025-04-21T14:15:57Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:57Z" SessionIndex="id-DhPHmtWkv645XeDkg"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Concepción</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave@cnr.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">#13</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nXmF5TWJtBWojEdgO'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nXmF5TWJtBWojEdgO', '--output', '/tmp/tmpf78hafoi.xml', '/tmp/tmp9fdha_3c.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp9fdha_3c.xml"
output=
____________________ TestClientNonAsciiAva.test_response_8 _____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-3u1PB9gwpbtsw6fqD" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:58Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-3u1PB9gwpbtsw6fqD"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-XN0P637BIY85XWFkf" IssueInstant="2025-04-21T14:10:58Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-XN0P637BIY85XWFkf"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">3a741d4f95eb9bf74f73ba0c00fd7a4e4a074cccc93671f4da413900a71b186a</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-k7SttdASqWppCdnmr"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Concepción</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave@cnr.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">#13</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-XN0P637BIY85XWFkf'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpb61eclcn.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpb61eclcn.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58ac3c0>
    def test_response_8(self):
        conf = config.SPConfig()
        conf.load_file("server_conf")
        _client = Saml2Client(conf)
    
        idp, ava, ava_verify, nameid_policy = self.setup_verify_authn_response()
    
        self.name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id1")
    
        cert_str, cert_key_str = generate_cert()
    
        cert = {"cert": cert_str, "key": cert_key_str}
    
>       resp = self.server.create_authn_response(
            identity=ava,
            in_response_to="id1",
            destination="http://lingon.catalogix.se:8087/",
            sp_entity_id="urn:mace:example.com:saml:roland:sp",
            name_id=self.name_id,
            userid="foba0001@example.com",
            authn=AUTHN,
            sign_response=True,
            sign_assertion=True,
            encrypt_assertion=True,
            encrypt_assertion_self_contained=True,
            encrypt_cert_assertion=cert_str,
        )
tests/test_51_client.py:2373: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:900: in _response
    response = signed_instance_factory(response, self.sec, to_sign_assertion)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-3u1PB9gwpbtsw6fqD" InResponseTo="id1" Version="2.0" IssueInstant="2025-04-21T14:10:58Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-3u1PB9gwpbtsw6fqD"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-XN0P637BIY85XWFkf" IssueInstant="2025-04-21T14:10:58Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature2"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-XN0P637BIY85XWFkf"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID NameQualifier="" SPNameQualifier="id1" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">3a741d4f95eb9bf74f73ba0c00fd7a4e4a074cccc93671f4da413900a71b186a</encas2:NameID><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id1" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-k7SttdASqWppCdnmr"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Concepción</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">Dave@cnr.mlb.com</encas2:AttributeValue></encas2:Attribute><encas2:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">#13</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-XN0P637BIY85XWFkf'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-XN0P637BIY85XWFkf', '--output', '/tmp/tmpr9wsg61r.xml', '/tmp/tmpb61eclcn.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpb61eclcn.xml"
output=
____________ TestClientNonAsciiAva.test_sign_then_encrypt_assertion ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-Pp4AyqZGkZbIMxPEN" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-Pp4AyqZGkZbIMxPEN"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject>_aaa<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /></saml:Subject><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-Pp4AyqZGkZbIMxPEN'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp8bnpmsdx.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp8bnpmsdx.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa492b650>
    def test_sign_then_encrypt_assertion(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        assertion = s_utils.assertion_factory(
            subject=factory(saml.Subject, text="_aaa", name_id=factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT)),
            attribute_statement=do_attribute_statement(
                {
                    ("", "", "sn"): ("Jeter", ""),
                    ("", "", "givenName"): ("Derek", ""),
                }
            ),
            issuer=self.server._issuer(),
        )
    
        assertion.signature = sigver.pre_signature_part(assertion.id, _sec.my_cert, 1)
    
>       sigass = _sec.sign_statement(
            assertion, class_name(assertion), key_file=full_path("test.key"), node_id=assertion.id
        )
tests/test_51_client.py:2557: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-Pp4AyqZGkZbIMxPEN" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-Pp4AyqZGkZbIMxPEN"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject>_aaa<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /></saml:Subject><saml:AttributeStatement><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-Pp4AyqZGkZbIMxPEN'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-Pp4AyqZGkZbIMxPEN', '--output', '/tmp/tmpbscew6jj.xml', '/tmp/tmp8bnpmsdx.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp8bnpmsdx.xml"
output=
___________ TestClientNonAsciiAva.test_sign_then_encrypt_assertion2 ____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-5pOD5ckNEXtlNAzwU" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-5pOD5ckNEXtlNAzwU"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-vOwYGZl8iETLorXvr"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepción</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-5pOD5ckNEXtlNAzwU'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp2gp285xj.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp2gp285xj.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58f7f50>
    def test_sign_then_encrypt_assertion2(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
        asser = Assertion({"givenName": "Dave", "sn": "Concepción"})
        farg = add_path({}, ["assertion", "subject", "subject_confirmation", "method", saml.SCM_BEARER])
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "in_response_to", "_012345"],
        )
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "recipient", "http://lingon.catalogix.se:8087/"],
        )
    
        assertion = asser.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            name_id=factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            farg=farg["assertion"],
        )
    
        assertion.signature = sigver.pre_signature_part(assertion.id, _sec.my_cert, 1)
    
>       sigass = _sec.sign_statement(
            assertion, class_name(assertion), key_file=self.client.sec.key_file, node_id=assertion.id
        )
tests/test_51_client.py:2628: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<saml:Assertion xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="id-5pOD5ckNEXtlNAzwU" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns1:Signature Id="Signature1"><ns1:SignedInfo><ns1:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns1:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns1:Reference URI="#id-5pOD5ckNEXtlNAzwU"><ns1:Transforms><ns1:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns1:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns1:Transforms><ns1:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns1:DigestValue /></ns1:Reference></ns1:SignedInfo><ns1:SignatureValue /><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns1:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-vOwYGZl8iETLorXvr"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepción</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-5pOD5ckNEXtlNAzwU'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-5pOD5ckNEXtlNAzwU', '--output', '/tmp/tmp66f3th81.xml', '/tmp/tmp2gp285xj.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp2gp285xj.xml"
output=
_______ TestClientNonAsciiAva.test_sign_then_encrypt_assertion_advice_1 ________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-MzoBG6KkdRGRctpIU" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:58Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-SUQdV1oTDxUQ19nl4" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-96aQNlh7440Wome5J" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-96aQNlh7440Wome5J"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-6o21tvkU6nrwQiXIy"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test01</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:1.2.840.113549.1.9.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="email"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test.testsson@test.se</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-KsFqswGc6TnV7FfOU"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepción</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-96aQNlh7440Wome5J'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmp1mmcg6r4.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmp1mmcg6r4.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58f7af0>
    def test_sign_then_encrypt_assertion_advice_1(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        nameid_policy = samlp.NameIDPolicy(allow_create="false", format=saml.NAMEID_FORMAT_PERSISTENT)
    
        asser = Assertion({"givenName": "Dave", "sn": "Concepción"})
    
        subject_confirmation_specs = {
            "recipient": "http://lingon.catalogix.se:8087/",
            "in_response_to": "_012345",
            "subject_confirmation_method": saml.SCM_BEARER,
        }
        name_id = factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT)
    
        farg = add_path({}, ["assertion", "subject", "subject_confirmation", "method", saml.SCM_BEARER])
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "in_response_to", "_012345"],
        )
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "recipient", "http://lingon.catalogix.se:8087/"],
        )
    
        assertion = asser.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            name_id=name_id,
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            farg=farg["assertion"],
        )
    
        a_asser = Assertion({"uid": "test01", "email": "test.testsson@test.se"})
        a_assertion = a_asser.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_assertion.signature = sigver.pre_signature_part(a_assertion.id, _sec.my_cert, 1)
    
        assertion.advice = Advice()
    
        assertion.advice.encrypted_assertion = []
        assertion.advice.encrypted_assertion.append(EncryptedAssertion())
    
        assertion.advice.encrypted_assertion[0].add_extension_element(a_assertion)
    
        response = response_factory(
            in_response_to="_012345",
            destination="http://lingon.catalogix.se:8087/",
            status=s_utils.success_status_factory(),
            issuer=self.server._issuer(),
        )
    
        response.assertion.append(assertion)
    
>       response = _sec.sign_statement(
            f"{response}", class_name(a_assertion), key_file=self.client.sec.key_file, node_id=a_assertion.id
        )
tests/test_51_client.py:2730: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-MzoBG6KkdRGRctpIU" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:58Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-SUQdV1oTDxUQ19nl4" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><saml:Assertion Version="2.0" ID="id-96aQNlh7440Wome5J" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-96aQNlh7440Wome5J"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-6o21tvkU6nrwQiXIy"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test01</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:1.2.840.113549.1.9.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="email"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">test.testsson@test.se</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-KsFqswGc6TnV7FfOU"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="sn"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Concepción</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-96aQNlh7440Wome5J'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-96aQNlh7440Wome5J', '--output', '/tmp/tmp7h_uiulv.xml', '/tmp/tmp1mmcg6r4.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmp1mmcg6r4.xml"
output=
_______ TestClientNonAsciiAva.test_sign_then_encrypt_assertion_advice_2 ________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-7LSG9yptNhlzBY14P" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:58Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-PGR7sphm0wwJbkVt8" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-PGR7sphm0wwJbkVt8"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-rvsjku97w2kPY9hIn" IssueInstant="2025-04-21T14:10:58Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature1"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-rvsjku97w2kPY9hIn"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-n5QT6AMRmX3TVENZL"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">test01</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-SWIF8My65TJDP3HQj"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-rvsjku97w2kPY9hIn'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpvltw6233.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpvltw6233.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa51a9eb0>
    def test_sign_then_encrypt_assertion_advice_2(self):
        # Begin with the IdPs side
        _sec = self.server.sec
    
        asser_1 = Assertion({"givenName": "Dave"})
    
        farg = add_path({}, ["assertion", "subject", "subject_confirmation", "method", saml.SCM_BEARER])
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "in_response_to", "_012345"],
        )
        add_path(
            farg["assertion"]["subject"]["subject_confirmation"],
            ["subject_confirmation_data", "recipient", "http://lingon.catalogix.se:8087/"],
        )
        name_id = factory(saml.NameID, format=NAMEID_FORMAT_TRANSIENT)
    
        assertion_1 = asser_1.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        asser_2 = Assertion({"sn": "Concepción"})
    
        assertion_2 = asser_2.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_1 = Assertion({"uid": "test01"})
        a_assertion_1 = a_asser_1.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_2 = Assertion({"email": "test.testsson@test.se"})
        a_assertion_2 = a_asser_2.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_3 = Assertion({"street": "street"})
        a_assertion_3 = a_asser_3.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_asser_4 = Assertion({"title": "title"})
        a_assertion_4 = a_asser_4.construct(
            self.client.config.entityid,
            self.server.config.attribute_converters,
            self.server.config.getattr("policy", "idp"),
            issuer=self.server._issuer(),
            authn_class=INTERNETPROTOCOLPASSWORD,
            authn_auth="http://www.example.com/login",
            name_id=name_id,
            farg=farg["assertion"],
        )
    
        a_assertion_1.signature = sigver.pre_signature_part(a_assertion_1.id, _sec.my_cert, 1)
    
        a_assertion_2.signature = sigver.pre_signature_part(a_assertion_2.id, _sec.my_cert, 1)
    
        a_assertion_3.signature = sigver.pre_signature_part(a_assertion_3.id, _sec.my_cert, 1)
    
        a_assertion_4.signature = sigver.pre_signature_part(a_assertion_4.id, _sec.my_cert, 1)
    
        assertion_1.signature = sigver.pre_signature_part(assertion_1.id, _sec.my_cert, 1)
    
        assertion_2.signature = sigver.pre_signature_part(assertion_2.id, _sec.my_cert, 1)
    
        response = response_factory(
            in_response_to="_012345",
            destination="http://lingon.catalogix.se:8087/",
            status=s_utils.success_status_factory(),
            issuer=self.server._issuer(),
        )
    
        response.assertion = assertion_1
    
        response.assertion.advice = Advice()
    
        response.assertion.advice.encrypted_assertion = []
        response.assertion.advice.encrypted_assertion.append(EncryptedAssertion())
    
        response.assertion.advice.encrypted_assertion[0].add_extension_element(a_assertion_1)
    
        advice_tag = response.assertion.advice._to_element_tree().tag
        assertion_tag = a_assertion_1._to_element_tree().tag
        response = response.get_xml_string_with_self_contained_assertion_within_advice_encrypted_assertion(
            assertion_tag, advice_tag
        )
    
>       response = _sec.sign_statement(
            f"{response}", class_name(a_assertion_1), key_file=self.server.sec.key_file, node_id=a_assertion_1.id
        )
tests/test_51_client.py:2890: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa59c5370>
statement = '<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-7LSG9yptNhlzBY14P" InResponseTo="_012345" Version="2.0" IssueInstant="2025-04-21T14:10:58Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-PGR7sphm0wwJbkVt8" IssueInstant="2025-04-21T14:10:58Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-PGR7sphm0wwJbkVt8"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:Advice><saml:EncryptedAssertion><encas2:Assertion Version="2.0" ID="id-rvsjku97w2kPY9hIn" IssueInstant="2025-04-21T14:10:58Z" xmlns:encas0="http://www.w3.org/2000/09/xmldsig#" xmlns:encas1="http://www.w3.org/2001/XMLSchema-instance" xmlns:encas2="urn:oasis:names:tc:SAML:2.0:assertion"><encas2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</encas2:Issuer><encas0:Signature Id="Signature1"><encas0:SignedInfo><encas0:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><encas0:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><encas0:Reference URI="#id-rvsjku97w2kPY9hIn"><encas0:Transforms><encas0:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><encas0:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></encas0:Transforms><encas0:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><encas0:DigestValue /></encas0:Reference></encas0:SignedInfo><encas0:SignatureValue /><encas0:KeyInfo><encas0:X509Data><encas0:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</encas0:X509Certificate></encas0:X509Data></encas0:KeyInfo></encas0:Signature><encas2:Subject><encas2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><encas2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><encas2:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:15:58Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="_012345" /></encas2:SubjectConfirmation></encas2:Subject><encas2:Conditions NotBefore="2025-04-21T14:10:58Z" NotOnOrAfter="2025-04-21T14:15:58Z"><encas2:AudienceRestriction><encas2:Audience>urn:mace:example.com:saml:roland:sp</encas2:Audience></encas2:AudienceRestriction></encas2:Conditions><encas2:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-n5QT6AMRmX3TVENZL"><encas2:AuthnContext><encas2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</encas2:AuthnContextClassRef><encas2:AuthenticatingAuthority>http://www.example.com/login</encas2:AuthenticatingAuthority></encas2:AuthnContext></encas2:AuthnStatement><encas2:AttributeStatement><encas2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="uid"><encas2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" encas1:type="xs:string">test01</encas2:AttributeValue></encas2:Attribute></encas2:AttributeStatement></encas2:Assertion></saml:EncryptedAssertion></saml:Advice><saml:AuthnStatement AuthnInstant="2025-04-21T14:10:58Z" SessionIndex="id-SWIF8My65TJDP3HQj"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword</saml:AuthnContextClassRef><saml:AuthenticatingAuthority>http://www.example.com/login</saml:AuthenticatingAuthority></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Dave</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-rvsjku97w2kPY9hIn'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-rvsjku97w2kPY9hIn', '--output', '/tmp/tmpercx_l7e.xml', '/tmp/tmpvltw6233.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpvltw6233.xml"
output=
_____________ TestClientNonAsciiAva.test_do_logout_signed_redirect _____________
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa5873ac0>
    def test_do_logout_signed_redirect(self):
        conf = config.SPConfig()
        conf.load_file("sp_slo_redirect_conf")
        client = Saml2Client(conf)
    
        # information about the user from an IdP
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": in_a_while(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Österberg", "mail": "anders.osterberg@example.com"},
        }
        client.users.add_information_about_person(session_info)
        entity_ids = client.users.issuers_of_info(nid)
        assert entity_ids == ["urn:mace:example.com:saml:roland:idp"]
    
>       resp = client.do_logout(
            nid, entity_ids, "Tired", in_a_while(minutes=5), sign=True, expected_binding=BINDING_HTTP_REDIRECT
        )
tests/test_51_client.py:3066: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:333: in do_logout
    http_info = self.apply_binding(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:286: in apply_binding
    info = http_redirect_message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/pack.py:182: in http_redirect_message
    args["Signature"] = base64.b64encode(signer.sign(string_enc))
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:521: in sign
    return saml2.cryptography.asymmetric.key_sign(key or self.key, msg, self.digest)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
rsakey = <cryptography.hazmat.bindings._rust.openssl.rsa.RSAPrivateKey object at 0x3ffa178fc50>
message = b'SAMLRequest=nVLNasJAEH6VZe8xazRVBxMQQiFolVrpobclbnTp7o7dmYDt05ekHgoFDz0NDN%2FvMMtACjZ4wo735qMzxOLqXSAIpArZxQCoyRIE7Q0BN%2FCyetpANlJwicjYoJM3Amnv7jM0kYlsMUhRV4W0x8Qvsi6sZ%2B%2FtdledZpOvtRSvJpLFUMhspKSoiTpTB2IduJCZyvJETZNsfBhPYawgX7xJURliGzQPrDPzBdLUYaPdGYlhrubzlBxKsTeaesjBRnOUYou8C7u4atnEP9L5IF0u%2B1IwhIjiEaPXfL9iv7HHpB2gYAJb%2FpRlz%2FC6MWCu2l%2BcGTXoh3tBRKfDEeiyTH9Z3Xy32pu6Ev147rSzre2TtojyH1k46kDWBJblOJtM84eb449JuUz%2FPEL5DQ%3D%3D&RelayState=id-m92unK7kfNODg73zK%7C1745244659%7Cc1c846efb728044cae84e0f358d74aeb970d46d0&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1'
digest = <cryptography.hazmat.primitives.hashes.SHA1 object at 0x3ffa87c96e0>
    def key_sign(rsakey, message, digest):
        """Sign the given message with the RSA key."""
        padding = _asymmetric.padding.PKCS1v15()
>       signature = rsakey.sign(message, padding, digest)
E       cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/asymmetric.py:17: UnsupportedAlgorithm
__________________ TestClientNonAsciiAva.test_do_logout_post ___________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-2jcLYAwUFu1BUAPNL" Version="2.0" IssueInstant="2025-04-21T14:10:59Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:59Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-2jcLYAwUFu1BUAPNL"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-2jcLYAwUFu1BUAPNL'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', ...]
extra_args = ['/tmp/tmph4sz6frb.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmph4sz6frb.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa58732f0>
    def test_do_logout_post(self):
        # information about the user from an IdP
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": in_a_while(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Österberg", "mail": "anders.osterberg@example.com"},
            "session_index": SessionIndex("_foo"),
        }
        self.client.users.add_information_about_person(session_info)
        entity_ids = self.client.users.issuers_of_info(nid)
        assert entity_ids == ["urn:mace:example.com:saml:roland:idp"]
>       resp = self.client.do_logout(
            nid, entity_ids, "Tired", in_a_while(minutes=5), sign=True, expected_binding=BINDING_HTTP_POST
        )
tests/test_51_client.py:3102: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:321: in do_logout
    req_id, request = self.create_logout_request(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:1147: in create_logout_request
    return self._message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:588: in _message
    signed_req = self.sign(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-2jcLYAwUFu1BUAPNL" Version="2.0" IssueInstant="2025-04-21T14:10:59Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:59Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-2jcLYAwUFu1BUAPNL"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-2jcLYAwUFu1BUAPNL'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-2jcLYAwUFu1BUAPNL', '--output', '/tmp/tmpe5z1ope9.xml', '/tmp/tmph4sz6frb.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmph4sz6frb.xml"
output=
_____________ TestClientNonAsciiAva.test_do_logout_session_expired _____________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-RbHSApz8DvnUqZkO6" Version="2.0" IssueInstant="2025-04-21T14:10:59Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:59Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-RbHSApz8DvnUqZkO6"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-RbHSApz8DvnUqZkO6'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', ...]
extra_args = ['/tmp/tmpfsy48rq4.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpfsy48rq4.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_51_client.TestClientNonAsciiAva object at 0x3ffa5873c00>
    def test_do_logout_session_expired(self):
        # information about the user from an IdP
        session_info = {
            "name_id": nid,
            "issuer": "urn:mace:example.com:saml:roland:idp",
            "not_on_or_after": a_while_ago(minutes=15),
            "ava": {"givenName": "Anders", "sn": "Österberg", "mail": "anders.osterberg@example.com"},
            "session_index": SessionIndex("_foo"),
        }
        self.client.users.add_information_about_person(session_info)
        entity_ids = self.client.users.issuers_of_info(nid)
        assert entity_ids == ["urn:mace:example.com:saml:roland:idp"]
>       resp = self.client.do_logout(
            nid, entity_ids, "Tired", in_a_while(minutes=5), sign=True, expected_binding=BINDING_HTTP_POST
        )
tests/test_51_client.py:3127: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/client.py:321: in do_logout
    req_id, request = self.create_logout_request(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:1147: in create_logout_request
    return self._message(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:588: in _message
    signed_req = self.sign(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa5939f70>
statement = b'<ns0:LogoutRequest xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-RbHSApz8DvnUqZkO6" Version="2.0" IssueInstant="2025-04-21T14:10:59Z" Destination="http://localhost:8088/slop" Reason="Tired" NotOnOrAfter="2025-04-21T14:15:59Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-RbHSApz8DvnUqZkO6"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:NameID NameQualifier="foo" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">123456</saml:NameID><ns0:SessionIndex>_foo</ns0:SessionIndex></ns0:LogoutRequest>'
node_name = 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-RbHSApz8DvnUqZkO6'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-RbHSApz8DvnUqZkO6', '--output', '/tmp/tmpem5vo3i6.xml', '/tmp/tmpfsy48rq4.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpfsy48rq4.xml"
output=
___________________ TestSignedResponse.test_signed_response ____________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4a948f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-eOgZ6PPaKatfkKPwv" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:11:00Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-jCYIznvdUKe1GgO9L" IssueInstant="2025-04-21T14:11:00Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-jCYIznvdUKe1GgO9L"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">845998d312f2c62df90fa3c67e1ddb0d8516cfa43b983e7312b18bb56f8775a9</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:16:00Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:11:00Z" NotOnOrAfter="2025-04-21T14:16:00Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-jCYIznvdUKe1GgO9L'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4a948f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmposeviz1p.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmposeviz1p.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_52_default_sign_alg.TestSignedResponse object at 0x3ffa4da87d0>
    def test_signed_response(self):
        print(ds.DefaultSignature().get_digest_alg())
        name_id = self.server.ident.transient_nameid("urn:mace:example.com:saml:roland:sp", "id12")
        ava = {"givenName": ["Derek"], "surName": ["Jeter"], "mail": ["derek@nyy.mlb.com"], "title": "The man"}
    
>       signed_resp = self.server.create_authn_response(
            ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=name_id,
            sign_assertion=True,
        )
tests/test_52_default_sign_alg.py:70: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:760: in _response
    return signed_instance_factory(response, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4a948f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-eOgZ6PPaKatfkKPwv" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:11:00Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-jCYIznvdUKe1GgO9L" IssueInstant="2025-04-21T14:11:00Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-jCYIznvdUKe1GgO9L"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">845998d312f2c62df90fa3c67e1ddb0d8516cfa43b983e7312b18bb56f8775a9</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:16:00Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:11:00Z" NotOnOrAfter="2025-04-21T14:16:00Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-jCYIznvdUKe1GgO9L'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-jCYIznvdUKe1GgO9L', '--output', '/tmp/tmpw5ypm4vs.xml', '/tmp/tmposeviz1p.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
----------------------------- Captured stdout call -----------------------------
http://www.w3.org/2000/09/xmldsig#sha1
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmposeviz1p.xml"
output=
__________________ TestSignedResponse.test_signed_response_1 ___________________
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4a948f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-JkVrSq9QYNcUY7R9H" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:11:00Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-JkVrSq9QYNcUY7R9H"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-nxI1BAsmhf0P0tnpa" IssueInstant="2025-04-21T14:11:00Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-nxI1BAsmhf0P0tnpa"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">09620fcc9988ad833b139b122a0241762cdc5a2dd4a9f3a3dbc9cdcbc46a9ba9</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:16:00Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:11:00Z" NotOnOrAfter="2025-04-21T14:16:00Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nxI1BAsmhf0P0tnpa'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
>           (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:796: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4a948f0>
com_list = ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', ...]
extra_args = ['/tmp/tmpxzvug6ww.xml']
    def _run_xmlsec(self, com_list, extra_args):
        """
        Common code to invoke xmlsec and parse the output.
        :param com_list: Key-value parameter list for xmlsec
        :param extra_args: Positional parameters to be appended after all
            key-value parameters
        :result: Whatever xmlsec wrote to an --output temporary file
        """
        with NamedTemporaryFile(suffix=".xml") as ntf:
            com_list.extend(["--output", ntf.name])
            if self.version_nums >= (1, 3):
                com_list.extend(['--lax-key-search'])
            com_list += extra_args
    
            logger.debug("xmlsec command: %s", " ".join(com_list))
    
            pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
            p_out, p_err = pof.communicate()
            p_out = p_out.decode()
            p_err = p_err.decode()
    
            if pof.returncode != 0:
                errmsg = f"returncode={pof.returncode}\nerror={p_err}\noutput={p_out}"
                logger.error(errmsg)
>               raise XmlsecError(errmsg)
E               saml2.sigver.XmlsecError: returncode=1
E               error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
E               func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
E               func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
E               func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
E               func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
E               func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
E               func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
E               Error: signature failed 
E               Error: failed to sign file "/tmp/tmpxzvug6ww.xml"
E               
E               output=
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:870: XmlsecError
The above exception was the direct cause of the following exception:
self = <test_52_default_sign_alg.TestSignedResponse object at 0x3ffa4da8550>
    def test_signed_response_1(self):
>       signed_resp = self.server.create_authn_response(
            self.ava,
            "id12",  # in_response_to
            "http://lingon.catalogix.se:8087/",  # consumer_url
            "urn:mace:example.com:saml:roland:sp",  # sp_entity_id
            name_id=self.name_id,
            sign_response=True,
            sign_assertion=True,
        )
tests/test_52_default_sign_alg.py:87: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:860: in create_authn_response
    return self._authn_response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/server.py:590: in _authn_response
    return self._response(
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:918: in _response
    return self.sign(response, to_sign=to_sign, sign_alg=sign_alg, digest_alg=digest_alg)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/entity.py:524: in sign
    return signed_instance_factory(msg, self.sec, to_sign)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:331: in signed_instance_factory
    signed_xml = seccont.sign_statement(signed_xml, node_name=node_name, node_id=nodeid)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1695: in sign_statement
    return self.crypto.sign_statement(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.CryptoBackendXmlSec1 object at 0x3ffa4a948f0>
statement = b'<ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="id-JkVrSq9QYNcUY7R9H" InResponseTo="id12" Version="2.0" IssueInstant="2025-04-21T14:11:00Z" Destination="http://lingon.catalogix.se:8087/"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-JkVrSq9QYNcUY7R9H"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><saml:Assertion Version="2.0" ID="id-nxI1BAsmhf0P0tnpa" IssueInstant="2025-04-21T14:11:00Z"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:idp</saml:Issuer><ns2:Signature Id="Signature2"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><ns2:Reference URI="#id-nxI1BAsmhf0P0tnpa"><ns2:Transforms><ns2:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><saml:Subject><saml:NameID NameQualifier="" SPNameQualifier="id12" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">09620fcc9988ad833b139b122a0241762cdc5a2dd4a9f3a3dbc9cdcbc46a9ba9</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-04-21T14:16:00Z" Recipient="http://lingon.catalogix.se:8087/" InResponseTo="id12" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-04-21T14:11:00Z" NotOnOrAfter="2025-04-21T14:16:00Z"><saml:AudienceRestriction><saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="givenName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Derek</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="surName"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">Jeter</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="mail"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">derek@nyy.mlb.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="title"><saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema">The man</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></ns0:Response>'
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
key_file = '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key'
node_id = 'id-nxI1BAsmhf0P0tnpa'
    def sign_statement(self, statement, node_name, key_file, node_id):
        """
        Sign an XML statement.
    
        :param statement: The statement to be signed
        :param node_name: string like 'urn:oasis:names:...:Assertion'
        :param key_file: The file where the key can be found
        :param node_id:
        :return: The signed statement
        """
        if isinstance(statement, SamlBase):
            statement = str(statement)
    
        tmp = make_temp(statement, suffix=".xml", decode=False, delete_tmpfiles=self.delete_tmpfiles)
    
        com_list = [
            self.xmlsec,
            "--sign",
            "--privkey-pem",
            key_file,
            "--id-attr:ID",
            node_name,
        ]
    
        if node_id:
            com_list.extend(["--node-id", node_id])
    
        try:
            (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
        except XmlsecError as e:
>           raise SignatureError(com_list) from e
E           saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nxI1BAsmhf0P0tnpa', '--output', '/tmp/tmp6ocg29q9.xml', '/tmp/tmpxzvug6ww.xml']
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:798: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=389:obj=x509-store:subj=unknown:error=71:certificate verification failed:X509_verify_cert: subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=432:obj=x509-store:subj=unknown:error=71:certificate verification failed:subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd; err=18; msg=self-signed certificate
func=xmlSecOpenSSLEvpSignatureExecute:file=evp_signatures.c:line=562:obj=rsa-sha1:subj=EVP_SignFinal:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1934:obj=rsa-sha1:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1
func=xmlSecTransformIOBufferClose:file=transforms.c:line=2563:obj=rsa-sha1:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed: 
func=xmlSecTransformC14NPushXml:file=c14n.c:line=243:obj=exc-c14n:subj=xmlOutputBufferClose:error=5:libxml2 library function failed:xml error: 0: NULL
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1052:obj=exc-c14n:subj=xmlSecTransformPushXml:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=561:obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxSign:file=xmldsig.c:line=296:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed: 
Error: signature failed 
Error: failed to sign file "/tmp/tmpxzvug6ww.xml"
output=
_____________________________________ test _____________________________________
    def test():
        with closing(Server(config_file=dotname("idp_all_conf"))) as idp:
            conf = SPConfig()
            conf.load_file(dotname("servera_conf"))
            sp = Saml2Client(conf)
    
            srvs = sp.metadata.single_sign_on_service(idp.config.entityid, BINDING_HTTP_REDIRECT)
    
            destination = srvs[0]["location"]
            req_id, req = sp.create_authn_request(destination, id="id1")
    
>           info = http_redirect_message(
                req,
                destination,
                relay_state="RS",
                typ="SAMLRequest",
                sigalg=SIG_RSA_SHA1,
                sign=True,
                backend=sp.sec.sec_backend,
            )
tests/test_70_redirect_signing.py:33: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/pack.py:182: in http_redirect_message
    args["Signature"] = base64.b64encode(signer.sign(string_enc))
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:521: in sign
    return saml2.cryptography.asymmetric.key_sign(key or self.key, msg, self.digest)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
rsakey = <cryptography.hazmat.bindings._rust.openssl.rsa.RSAPrivateKey object at 0x3ffa563c490>
message = b'SAMLRequest=pZPNbtswEIRfReBdv0gRg7AFuA4KG0hrwVZ66I2lNjYbcVflrlKlT19IcVAfWqFAr%2BQs5%2BNwuETO9LqXMx7gew8s0eBbZI2crVQfUJNhxxqNB9Zi9XH98V4XSaa7QEKWWnUZYOPb%2BQnDDEEcoYp2dyvlmrj4KU%2FbfbW1%2B3b7rbitahV9hsCOcKWKJFPRjrmHHbIYlJUqsuJdnN3ERV7nNzrPdZZ%2FUdEdsDg0Mk2dRTqdpi1Z056JRS%2ByxSJlpjRA4wJYUVF1IX%2FvsHF4mof%2B%2Bipiva3rKq72x1pF67eLbAi59xCOEJ6dhYfD%2FW8ChyfCxBoxLZ3ckDCMLLfp5P%2FsGgifjIdXc28saBiM71pILPkpTB2oNdho7lS5nBamNEL0gYI3Mo89rrgmfpykGlCcvKjyH7yW6ZVVuRzbcSkGNFNNNoQCg0Qb8p0JjsfUYTBW3iivVZvWMB%2FgsZzthdV21AHryjD%2FoNCMTwRWoKmDQe4oyIXrj4f%2Fv2%2FtPBxf0Nb0BDhrlf41kcve9V8qfwE%3D&RelayState=RS&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1'
digest = <cryptography.hazmat.primitives.hashes.SHA1 object at 0x3ffa87c96e0>
    def key_sign(rsakey, message, digest):
        """Sign the given message with the RSA key."""
        padding = _asymmetric.padding.PKCS1v15()
>       signature = rsakey.sign(message, padding, digest)
E       cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/asymmetric.py:17: UnsupportedAlgorithm
______________ TestGenerateCertificates.test_validate_cert_chains ______________
self = <test_81_certificates.TestGenerateCertificates testMethod=test_validate_cert_chains>
    def test_validate_cert_chains(self):
    
        cert_info_ca = {
            "cn": "qwerty",
            "country_code": "qw",
            "state": "qwerty",
            "city": "qwerty",
            "organization": "qwerty",
            "organization_unit": "qwerty",
        }
    
        cert_intermediate_1_info = {
            "cn": "intermediate_1",
            "country_code": "as",
            "state": "asdfgh",
            "city": "asdfgh",
            "organization": "asdfgh",
            "organization_unit": "asdfg",
        }
    
        cert_intermediate_2_info = {
            "cn": "intermediate_2",
            "country_code": "as",
            "state": "asdfgh",
            "city": "asdfgh",
            "organization": "asdfgh",
            "organization_unit": "asdfg",
        }
    
        cert_client_cert_info = {
            "cn": "intermediate_1",
            "country_code": "as",
            "state": "asdfgh",
            "city": "asdfgh",
            "organization": "asdfgh",
            "organization_unit": "asdfg",
        }
    
        osw = OpenSSLWrapper()
    
        ca_cert_str, ca_key_str = osw.create_certificate(cert_info_ca, request=False)
    
        req_cert_str, intermediate_1_key_str = osw.create_certificate(cert_intermediate_1_info, request=True)
        intermediate_cert_1_str = osw.create_cert_signed_certificate(ca_cert_str, ca_key_str, req_cert_str)
    
        req_cert_str, intermediate_2_key_str = osw.create_certificate(cert_intermediate_2_info, request=True)
        intermediate_cert_2_str = osw.create_cert_signed_certificate(
            intermediate_cert_1_str, intermediate_1_key_str, req_cert_str
        )
    
        req_cert_str, client_key_str = osw.create_certificate(cert_client_cert_info, request=True)
        client_cert_str = osw.create_cert_signed_certificate(
            intermediate_cert_2_str, intermediate_2_key_str, req_cert_str
        )
    
        cert_chain = [intermediate_cert_2_str, intermediate_cert_1_str, ca_cert_str]
    
        valid, mess = osw.verify_chain(cert_chain, client_cert_str)
>       self.assertTrue(valid)
E       AssertionError: False is not true
tests/test_81_certificates.py:131: AssertionError
____________ TestGenerateCertificates.test_validate_with_root_cert _____________
self = <test_81_certificates.TestGenerateCertificates testMethod=test_validate_with_root_cert>
    def test_validate_with_root_cert(self):
    
        cert_info_ca = {
            "cn": "qwerty",
            "country_code": "qw",
            "state": "qwerty",
            "city": "qwerty",
            "organization": "qwerty",
            "organization_unit": "qwerty",
        }
    
        cert_info = {
            "cn": "asdfgh",
            "country_code": "as",
            "state": "asdfgh",
            "city": "asdfgh",
            "organization": "asdfgh",
            "organization_unit": "asdfg",
        }
    
        osw = OpenSSLWrapper()
    
        ca_cert, ca_key = osw.create_certificate(
            cert_info_ca,
            request=False,
            write_to_file=True,
            cert_dir=f"{os.path.dirname(os.path.abspath(__file__))}/pki",
        )
    
        req_cert_str, req_key_str = osw.create_certificate(cert_info, request=True)
    
        ca_cert_str = osw.read_str_from_file(ca_cert)
        ca_key_str = osw.read_str_from_file(ca_key)
    
        cert_str = osw.create_cert_signed_certificate(ca_cert_str, ca_key_str, req_cert_str)
    
        valid, mess = osw.verify(ca_cert_str, cert_str)
>       self.assertTrue(valid)
E       AssertionError: False is not true
tests/test_81_certificates.py:50: AssertionError
_ TestAuthnResponse.test_signed_assertion_with_random_embedded_cert_should_be_ignored _
self = <test_xmlsec1_key_data.TestAuthnResponse object at 0x3ffa482b230>
mock_validate_on_or_after = <MagicMock name='validate_on_or_after' id='4396452609536'>
    @patch("saml2.response.validate_on_or_after", return_value=True)
    def test_signed_assertion_with_random_embedded_cert_should_be_ignored(self, mock_validate_on_or_after):
        """
        if the embedded cert is not ignored then verification will fail
        """
    
        conf = config_factory("sp", dotname("server_conf"))
        ar = authn_response(conf, return_addrs="https://51.15.251.81.xip.io/acs/post")
        ar.issue_instant_ok = Mock(return_value=True)
    
        with open(SIGNED_ASSERTION_RANDOM_EMBEDDED_CERT) as fp:
            xml_response = fp.read()
    
        ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"}
        ar.timeslack = 10000
    
        # .loads does not check the assertion, only the response signature
        # use .verify to verify the contents of the response
        assert ar.loads(xml_response, decode=False)
>       assert ar.verify()
tests/test_xmlsec1_key_data.py:78: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/response.py:1026: in verify
    if self.parse_assertion(keys):
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/response.py:918: in parse_assertion
    if not self._assertion(assertion, False):
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/response.py:791: in _assertion
    self.sec.check_signature(assertion, class_name(assertion), self.xmlstr)
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1538: in check_signature
    return self._check_signature(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <saml2.sigver.SecurityContext object at 0x3ffa3b649f0>
decoded_xml = '<?xml version="1.0"?>\n<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="the-response-id" IssueInstant="2020-12-04T07:48:09.700Z" InResponseTo="id-abc" Destination="https://51.15.251.81.xip.io/acs/post">\n    <saml:Issuer>urn:mace:example.com:saml:roland:idp</saml:Issuer>\n    <samlp:Status>\n        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>\n    </samlp:Status>\n    <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="the-assertion-id" IssueInstant="2020-12-04T07:48:09.600Z">\n        <saml:Issuer>urn:mace:example.com:saml:roland:idp</saml:Issuer>\n        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">\n            <ds:SignedInfo>\n                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>\n                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>\n                <ds:Reference URI="#the-assertion-id">\n                    <ds:Transforms>\n                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>\n                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>\n                    </ds:Transforms>\n                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>\n                    <ds:DigestValue>NHB0WhPWj5OyRz9N52fZrEBWK3dXT2pVVT54f4kg1tM=</ds:DigestValue>\n                </ds:Reference>\n            </ds:SignedInfo>\n            <ds:SignatureValue>Mo4ZheAEDvdPQwWvT5SOYZZ2IBELwtmBpdsn+Th+IvsanychWQ6JHYKTI8hl+3DigbqQwdsqet8n9sfdvr+D+Q7XozjVaFPdzUGC9d96Mn/vrc+JIP/ESoDjDUQEsoSBhUFlrbu7tPJDJehPgd/maIwd/GqEHWXFlm1ZWVCmaH8=</ds:SignatureValue>\n            <ds:KeyInfo>\n                <ds:X509Data>\n                    <ds:X509Certificate>MIIFLDCCBBSgAwIBAgISA3UxXAgBWRS1D74GOLiAjky6MA0GCSqGSIb3DQEBCwUAMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJSMzAeFw0yMTAxMTcyMDIxNTNaFw0yMTA0MTcyMDIxNTNaMB4xHDAaBgNVBAMTEzUxLjE1LjI1MS44MS54aXAuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkjSN9vZDOwE1m7g1vyiwBsKBKNItyy05BcHUkM8fabBcsavugT8uE4wYz5aeZrnKb5dbDLHaZe6Dl5GHgRO8s7REwSJ/BHT3/eMaEakLwIGE5/6QSWuBjOawPfmYarW5IqoITjSt/o/jxu3haouqbr7XYf1WOuZmc6iwGnEgm0+cVB4CA0VGnnLYfsjp9iMt3pFI8a8ipdwp5lfzZU+j8JMVEn6SZhNjjTAjcakBQmZv4Q5/yU6yqfGjG47DO62xB/PPbDy78hDorER2v8UkoDTGV4aZrZaNltHBUxNohIiQnkhuakMmbf0NhA2ExBJw6KTCCxfYkyUX3CgYzaAnxAgMBAAGjggJOMIICSjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFHD7gcF0sNITPqhwcUlFyOBrkxRFMB8GA1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5jci5vcmcvMB4GA1UdEQQXMBWCEzUxLjE1LjI1MS44MS54aXAuaW8wTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEEBgorBgEEAdZ5AgQCBIH1BIHyAPAAdQBc3EOS/uarRUSxXprUVuYQN/vV+kfcoXOUsl7m9scOygAAAXcSOcqvAAAEAwBGMEQCIFhvPWYY+2VO55bHO1Sa9zJQk7B1kvCi7sfDCxAYp7mEAiBTKx6XD0GkfNGhji0LGuelvfD7gZOUSzURlJW1ahYcgQB3APZclC/RdzAiFFQYCDCUVo7jTRMZM7/fDC8gC8xO8WTjAAABdxI5yq4AAAQDAEgwRgIhAONNwcNZ66IxsWcUNDS0B9KV8Kk4VS9b/wUFNBHAQl3SAiEAxO5GwgaK3glL/6L/J7qpiedJBAs3h5406MWC0v4uYZ8wDQYJKoZIhvcNAQELBQADggEBAAZgbgfOb4+uI9kMGF4fMiompHeUFDXGyIND6y4FsfWHJG4Fn3aG+VQN/UtHeO8UusjS13/2yw3O+PeNTstBl+q6Ssega8zTYx2j3h3RFqM9JR8SWa83B0UTgyaxX3PTmfegV4/RZxC7KQ8pqjcLwKJSTgZF6W40Jo16tKVoi0VQY/2Gre6E9D1tPVw//mDGJST/5IcbFvtr79uft76IA+T674qNgAriBKxWncSbGzE42w2QsYsGMHHJn3vKbNl7alll9eJBqvdi1Q7ay86oI7NDQ0PPwjnB0/i4BOO0qQBcBSUIPPEChcrooEqN9PwM20aoyIjje0rtDGSxnEQRrg0=</ds:X509Certificate>\n                    <ds:X509Certificate>MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFowMjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMTAlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLsjVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKpTm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnBU840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1RoYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kHejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfLqjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9pO5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2TwUdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg==</ds:X509Certificate>\n                </ds:X509Data>\n            </ds:KeyInfo>\n        </ds:Signature>\n        <saml:Subject>\n            <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">attack-name-id</saml:NameID>\n            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">\n                <saml:SubjectConfirmationData NotOnOrAfter="2020-12-04T07:58:09.600Z" Recipient="https://51.15.251.81.xip.io/acs/post" InResponseTo="id-abc"/>\n            </saml:SubjectConfirmation>\n        </saml:Subject>\n        <saml:Conditions NotBefore="2020-12-04T07:48:09.600Z" NotOnOrAfter="2020-12-04T07:58:09.600Z">\n            <saml:AudienceRestriction>\n                <saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience>\n            </saml:AudienceRestriction>\n        </saml:Conditions>\n        <saml:AuthnStatement AuthnInstant="2020-12-04T07:48:09.600Z" SessionNotOnOrAfter="2020-12-04T07:58:09.600Z" SessionIndex="_samling_8227405_474676521">\n            <saml:AuthnContext>\n                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>\n            </saml:AuthnContext>\n        </saml:AuthnStatement>\n    </saml:Assertion>\n</samlp:Response>\n'
item = <saml2.saml.Assertion object at 0x3ffa3b674d0>
node_name = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
origdoc = '<?xml version="1.0"?>\n<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="the-response-id" IssueInstant="2020-12-04T07:48:09.700Z" InResponseTo="id-abc" Destination="https://51.15.251.81.xip.io/acs/post">\n    <saml:Issuer>urn:mace:example.com:saml:roland:idp</saml:Issuer>\n    <samlp:Status>\n        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>\n    </samlp:Status>\n    <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="the-assertion-id" IssueInstant="2020-12-04T07:48:09.600Z">\n        <saml:Issuer>urn:mace:example.com:saml:roland:idp</saml:Issuer>\n        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">\n            <ds:SignedInfo>\n                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>\n                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>\n                <ds:Reference URI="#the-assertion-id">\n                    <ds:Transforms>\n                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>\n                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>\n                    </ds:Transforms>\n                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>\n                    <ds:DigestValue>NHB0WhPWj5OyRz9N52fZrEBWK3dXT2pVVT54f4kg1tM=</ds:DigestValue>\n                </ds:Reference>\n            </ds:SignedInfo>\n            <ds:SignatureValue>Mo4ZheAEDvdPQwWvT5SOYZZ2IBELwtmBpdsn+Th+IvsanychWQ6JHYKTI8hl+3DigbqQwdsqet8n9sfdvr+D+Q7XozjVaFPdzUGC9d96Mn/vrc+JIP/ESoDjDUQEsoSBhUFlrbu7tPJDJehPgd/maIwd/GqEHWXFlm1ZWVCmaH8=</ds:SignatureValue>\n            <ds:KeyInfo>\n                <ds:X509Data>\n                    <ds:X509Certificate>MIIFLDCCBBSgAwIBAgISA3UxXAgBWRS1D74GOLiAjky6MA0GCSqGSIb3DQEBCwUAMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJSMzAeFw0yMTAxMTcyMDIxNTNaFw0yMTA0MTcyMDIxNTNaMB4xHDAaBgNVBAMTEzUxLjE1LjI1MS44MS54aXAuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkjSN9vZDOwE1m7g1vyiwBsKBKNItyy05BcHUkM8fabBcsavugT8uE4wYz5aeZrnKb5dbDLHaZe6Dl5GHgRO8s7REwSJ/BHT3/eMaEakLwIGE5/6QSWuBjOawPfmYarW5IqoITjSt/o/jxu3haouqbr7XYf1WOuZmc6iwGnEgm0+cVB4CA0VGnnLYfsjp9iMt3pFI8a8ipdwp5lfzZU+j8JMVEn6SZhNjjTAjcakBQmZv4Q5/yU6yqfGjG47DO62xB/PPbDy78hDorER2v8UkoDTGV4aZrZaNltHBUxNohIiQnkhuakMmbf0NhA2ExBJw6KTCCxfYkyUX3CgYzaAnxAgMBAAGjggJOMIICSjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFHD7gcF0sNITPqhwcUlFyOBrkxRFMB8GA1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5jci5vcmcvMB4GA1UdEQQXMBWCEzUxLjE1LjI1MS44MS54aXAuaW8wTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEEBgorBgEEAdZ5AgQCBIH1BIHyAPAAdQBc3EOS/uarRUSxXprUVuYQN/vV+kfcoXOUsl7m9scOygAAAXcSOcqvAAAEAwBGMEQCIFhvPWYY+2VO55bHO1Sa9zJQk7B1kvCi7sfDCxAYp7mEAiBTKx6XD0GkfNGhji0LGuelvfD7gZOUSzURlJW1ahYcgQB3APZclC/RdzAiFFQYCDCUVo7jTRMZM7/fDC8gC8xO8WTjAAABdxI5yq4AAAQDAEgwRgIhAONNwcNZ66IxsWcUNDS0B9KV8Kk4VS9b/wUFNBHAQl3SAiEAxO5GwgaK3glL/6L/J7qpiedJBAs3h5406MWC0v4uYZ8wDQYJKoZIhvcNAQELBQADggEBAAZgbgfOb4+uI9kMGF4fMiompHeUFDXGyIND6y4FsfWHJG4Fn3aG+VQN/UtHeO8UusjS13/2yw3O+PeNTstBl+q6Ssega8zTYx2j3h3RFqM9JR8SWa83B0UTgyaxX3PTmfegV4/RZxC7KQ8pqjcLwKJSTgZF6W40Jo16tKVoi0VQY/2Gre6E9D1tPVw//mDGJST/5IcbFvtr79uft76IA+T674qNgAriBKxWncSbGzE42w2QsYsGMHHJn3vKbNl7alll9eJBqvdi1Q7ay86oI7NDQ0PPwjnB0/i4BOO0qQBcBSUIPPEChcrooEqN9PwM20aoyIjje0rtDGSxnEQRrg0=</ds:X509Certificate>\n                    <ds:X509Certificate>MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFowMjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMTAlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLsjVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKpTm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnBU840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1RoYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kHejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfLqjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9pO5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2TwUdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg==</ds:X509Certificate>\n                </ds:X509Data>\n            </ds:KeyInfo>\n        </ds:Signature>\n        <saml:Subject>\n            <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">attack-name-id</saml:NameID>\n            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">\n                <saml:SubjectConfirmationData NotOnOrAfter="2020-12-04T07:58:09.600Z" Recipient="https://51.15.251.81.xip.io/acs/post" InResponseTo="id-abc"/>\n            </saml:SubjectConfirmation>\n        </saml:Subject>\n        <saml:Conditions NotBefore="2020-12-04T07:48:09.600Z" NotOnOrAfter="2020-12-04T07:58:09.600Z">\n            <saml:AudienceRestriction>\n                <saml:Audience>urn:mace:example.com:saml:roland:sp</saml:Audience>\n            </saml:AudienceRestriction>\n        </saml:Conditions>\n        <saml:AuthnStatement AuthnInstant="2020-12-04T07:48:09.600Z" SessionNotOnOrAfter="2020-12-04T07:58:09.600Z" SessionIndex="_samling_8227405_474676521">\n            <saml:AuthnContext>\n                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>\n            </saml:AuthnContext>\n        </saml:AuthnStatement>\n    </saml:Assertion>\n</samlp:Response>\n'
must = False, only_valid_cert = False, issuer = None
    def _check_signature(
        self, decoded_xml, item, node_name=NODE_NAME, origdoc=None, must=False, only_valid_cert=False, issuer=None
    ):
        try:
            _issuer = item.issuer.text.strip()
        except AttributeError:
            _issuer = None
    
        if _issuer is None:
            try:
                _issuer = issuer.text.strip()
            except AttributeError:
                _issuer = None
    
        # More trust in certs from metadata then certs in the XML document
        if self.metadata:
            try:
                _certs = self.metadata.certs(_issuer, "any", "signing")
            except KeyError:
                _certs = []
            certs = []
    
            for cert_name, cert in _certs:
                if isinstance(cert, str):
                    content = pem_format(cert)
                    tmp = make_temp(content, suffix=".pem", decode=False, delete_tmpfiles=self.delete_tmpfiles)
                    certs.append(tmp)
                else:
                    certs.append(cert)
        else:
            certs = []
    
        if not certs and not self.only_use_keys_in_metadata:
            logger.debug("==== Certs from instance ====")
            certs = [
                make_temp(content=pem_format(cert), suffix=".pem", decode=False, delete_tmpfiles=self.delete_tmpfiles)
                for cert in cert_from_instance(item)
            ]
        else:
            logger.debug("==== Certs from metadata ==== %s: %s ====", _issuer, certs)
    
        if not certs:
            raise MissingKey(_issuer)
    
        try:
            validate_doc_with_schema(str(item))
        except XMLSchemaError as e:
            error_context = {
                "message": "Signature verification failed. Invalid document format.",
                "reason": str(e),
                "ID": item.id,
                "issuer": _issuer,
                "type": node_name,
                "document": decoded_xml,
            }
            raise SignatureError(error_context) from e
    
        # saml-core section "5.4 XML Signature Profile" defines constrains on the
        # xmldsig-core facilities. It explicitly dictates that enveloped signatures
        # are the only signatures allowed. This means that:
        # * Assertion/RequestType/ResponseType elements must have an ID attribute
        # * signatures must have a single Reference element
        # * the Reference element must have a URI attribute
        # * the URI attribute contains an anchor
        # * the anchor points to the enclosing element's ID attribute
        signed_info = item.signature.signed_info
        references = signed_info.reference
        signatures_must_have_a_single_reference_element = len(references) == 1
        the_Reference_element_must_have_a_URI_attribute = signatures_must_have_a_single_reference_element and hasattr(
            references[0], "uri"
        )
        the_URI_attribute_contains_an_anchor = (
            the_Reference_element_must_have_a_URI_attribute
            and references[0].uri.startswith("#")
            and len(references[0].uri) > 1
        )
        the_anchor_points_to_the_enclosing_element_ID_attribute = (
            the_URI_attribute_contains_an_anchor and references[0].uri == f"#{item.id}"
        )
    
        # SAML implementations SHOULD use Exclusive Canonicalization,
        # with or without comments
        canonicalization_method_is_c14n = signed_info.canonicalization_method.algorithm in ALLOWED_CANONICALIZATIONS
    
        # Signatures in SAML messages SHOULD NOT contain transforms other than the
        # - enveloped signature transform
        #   (with the identifier http://www.w3.org/2000/09/xmldsig#enveloped-signature)
        # - or the exclusive canonicalization transforms
        #   (with the identifier http://www.w3.org/2001/10/xml-exc-c14n#
        #   or http://www.w3.org/2001/10/xml-exc-c14n#WithComments).
        transform_algos = [transform.algorithm for transform in references[0].transforms.transform]
        tranform_algos_valid = ALLOWED_TRANSFORMS.intersection(transform_algos)
        transform_algos_n = len(transform_algos)
        tranform_algos_valid_n = len(tranform_algos_valid)
    
        the_number_of_transforms_is_one_or_two = (
            signatures_must_have_a_single_reference_element and 1 <= transform_algos_n <= 2
        )
        all_transform_algs_are_allowed = (
            the_number_of_transforms_is_one_or_two and transform_algos_n == tranform_algos_valid_n
        )
        the_enveloped_signature_transform_is_defined = (
            the_number_of_transforms_is_one_or_two and TRANSFORM_ENVELOPED in transform_algos
        )
    
        # The <ds:Object> element is not defined for use with SAML signatures,
        # and SHOULD NOT be present.
        # Since it can be used in service of an attacker by carrying unsigned data,
        # verifiers SHOULD reject signatures that contain a <ds:Object> element.
        object_element_is_not_present = not item.signature.object
    
        validators = {
            "signatures must have a single reference element": (signatures_must_have_a_single_reference_element),
            "the Reference element must have a URI attribute": (the_Reference_element_must_have_a_URI_attribute),
            "the URI attribute contains an anchor": (the_URI_attribute_contains_an_anchor),
            "the anchor points to the enclosing element ID attribute": (
                the_anchor_points_to_the_enclosing_element_ID_attribute
            ),
            "canonicalization method is c14n": canonicalization_method_is_c14n,
            "the number of transforms is one or two": (the_number_of_transforms_is_one_or_two),
            "all transform algs are allowed": all_transform_algs_are_allowed,
            "the enveloped signature transform is defined": (the_enveloped_signature_transform_is_defined),
            "object element is not present": object_element_is_not_present,
        }
        if not all(validators.values()):
            error_context = {
                "message": "Signature failed to meet constraints on xmldsig",
                "validators": validators,
                "item ID": item.id,
                "reference URI": item.signature.signed_info.reference[0].uri,
                "issuer": _issuer,
                "node name": node_name,
                "xml document": decoded_xml,
            }
            raise SignatureError(error_context)
    
        verified = False
        last_pem_file = None
    
        for pem_fd in certs:
            try:
                last_pem_file = pem_fd.name
                if self.verify_signature(
                    decoded_xml,
                    pem_fd.name,
                    node_name=node_name,
                    node_id=item.id,
                ):
                    verified = True
                    break
            except XmlsecError as exc:
                logger.error("check_sig: %s", str(exc))
            except Exception as exc:
                logger.error("check_sig: %s", str(exc))
                raise
    
        if verified or only_valid_cert:
            if not self.cert_handler.verify_cert(last_pem_file):
                raise CertificateError("Invalid certificate!")
        else:
>           raise SignatureError("Failed to verify signature")
E           saml2.sigver.SignatureError: Failed to verify signature
../BUILDROOT/usr/lib/python3.13/site-packages/saml2/sigver.py:1525: SignatureError
------------------------------ Captured log call -------------------------------
ERROR    saml2.sigver:sigver.py:869 returncode=1
error=func=xmlSecOpenSSLEvpSignatureVerify:file=evp_signatures.c:line=449:obj=rsa-sha1:subj=EVP_VerifyFinal_ex:error=4:crypto library function failed:openssl error: error:03000098:digital envelope routines::invalid digest
func=xmlSecTransformVerifyNodeContent:file=transforms.c:line=1544:obj=rsa-sha1:subj=xmlSecTransformVerify:error=1:xmlsec library function failed: 
func=xmlSecDSigCtxVerify:file=xmldsig.c:line=367:obj=unknown:subj=xmlSecTransformVerifyNodeContent:error=1:xmlsec library function failed: 
Error: signature failed 
ERROR
SignedInfo References (ok/all): 1/1
Manifests References (ok/all): 0/0
Error: failed to verify file "/tmp/tmpro6bknlw.xml"
output=
ERROR    saml2.sigver:sigver.py:1516 check_sig: ['/usr/bin/xmlsec1', '--verify', '--enabled-reference-uris', 'empty,same-doc', '--enabled-key-data', 'raw-x509-cert', '--pubkey-cert-pem', '/tmp/tmpqfl8ed30.pem', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'the-assertion-id', '--output', '/tmp/tmph_rr0xd8.xml', '/tmp/tmpro6bknlw.xml']
ERROR    saml2.response:response.py:793 correctly_signed_response: Failed to verify signature
=============================== warnings summary ===============================
../../../../../usr/lib64/python3.13/site-packages/bson/__init__.py:193
  /usr/lib64/python3.13/site-packages/bson/__init__.py:193: DeprecationWarning: datetime.datetime.utcfromtimestamp() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.fromtimestamp(timestamp, datetime.UTC).
    EPOCH_NAIVE = datetime.datetime.utcfromtimestamp(0)
tests/test_10_time_util.py: 2 warnings
tests/test_20_assertion.py: 6 warnings
tests/test_32_cache.py: 5 warnings
tests/test_34_population.py: 4 warnings
tests/test_41_response.py: 4 warnings
tests/test_42_enc.py: 6 warnings
tests/test_44_authnresp.py: 4 warnings
tests/test_50_server.py: 152 warnings
tests/test_51_client.py: 145 warnings
tests/test_52_default_sign_alg.py: 6 warnings
tests/test_62_vo.py: 2 warnings
tests/test_63_ecp.py: 5 warnings
tests/test_64_artifact.py: 4 warnings
tests/test_65_authn_query.py: 7 warnings
tests/test_66_name_id_mapping.py: 2 warnings
tests/test_67_manage_name_id.py: 3 warnings
tests/test_68_assertion_id.py: 4 warnings
tests/test_89_http_post_relay_state.py: 2 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/time_util.py:177: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
    return datetime.utcnow() + delta
tests/test_50_server.py: 7 warnings
tests/test_51_client.py: 27 warnings
tests/test_63_ecp.py: 3 warnings
tests/test_64_artifact.py: 2 warnings
tests/test_65_authn_query.py: 5 warnings
tests/test_66_name_id_mapping.py: 2 warnings
tests/test_67_manage_name_id.py: 3 warnings
tests/test_68_assertion_id.py: 2 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/time_util.py:187: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
    return datetime.utcnow() - delta
tests/test_50_server.py: 18 warnings
tests/test_51_client.py: 10 warnings
tests/test_81_certificates.py: 10 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cert.py:141: DeprecationWarning: CSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.
    cert = crypto.X509Req()
tests/test_50_server.py: 18 warnings
tests/test_51_client.py: 10 warnings
tests/test_81_certificates.py: 10 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cert.py:161: DeprecationWarning: CSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.
    tmp_cert = crypto.dump_certificate_request(crypto.FILETYPE_PEM, cert)
tests/test_50_server.py: 18 warnings
tests/test_51_client.py: 10 warnings
tests/test_81_certificates.py: 10 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cert.py:246: DeprecationWarning: CSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.
    req_cert = crypto.load_certificate_request(crypto.FILETYPE_PEM, request_cert_str)
tests/test_50_server.py: 18 warnings
tests/test_51_client.py: 10 warnings
tests/test_81_certificates.py: 10 warnings
  /usr/lib/python3.13/site-packages/OpenSSL/crypto.py:2434: DeprecationWarning: CSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.
    x509req = X509Req.__new__(X509Req)
tests/test_50_server.py: 4 warnings
tests/test_81_certificates.py: 11 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cert.py:281: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
    now = pytz.UTC.localize(datetime.datetime.utcnow())
tests/test_92_aes.py: 35 warnings
  /builddir/build/BUILD/python-pysaml2-7.4.2-build/BUILDROOT/usr/lib/python3.13/site-packages/saml2/cryptography/symmetric.py:124: DeprecationWarning: AESCipher type is deprecated. It will be removed in the next version. Use saml2.cryptography.symmetric.Default or saml2.cryptography.symmetric.Fernet instead.
    _warn(_deprecation_msg, DeprecationWarning)
-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
=========================== short test summary info ============================
SKIPPED [1] tests/test_37_entity_categories.py:296: Temporarily disabled
SKIPPED [1] tests/test_37_entity_categories.py:325: Temporarily disabled
SKIPPED [1] tests/test_37_entity_categories.py:358: Temporarily disabled
SKIPPED [1] tests/test_40_sigver.py:101: pyasn1 is not installed
SKIPPED [1] tests/test_60_sp.py:59: s2repoze dependencies not installed
SKIPPED [1] tests/test_60_sp.py:62: s2repoze dependencies not installed
ERROR tests/test_41_response.py::TestResponse::test_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
ERROR tests/test_41_response.py::TestResponse::test_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
ERROR tests/test_41_response.py::TestResponse::test_issuer_none - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
ERROR tests/test_41_response.py::TestResponse::test_false_sign - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
ERROR tests/test_41_response.py::TestResponse::test_other_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7oNuXh947nGzsezY3', '--output', '/tmp/tmpte22kwl1.xml', '/tmp/tmpqczslhql.xml']
ERROR tests/test_44_authnresp.py::TestAuthnResponse::test_verify_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
ERROR tests/test_44_authnresp.py::TestAuthnResponse::test_verify_signed_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
ERROR tests/test_44_authnresp.py::TestAuthnResponse::test_parse_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
ERROR tests/test_44_authnresp.py::TestAuthnResponse::test_verify_w_authn - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
ERROR tests/test_44_authnresp.py::TestAuthnResponse::test_unpack_nested_eptid - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
ERROR tests/test_44_authnresp.py::TestAuthnResponse::test_multiple_attribute_statement - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-mKsbO4xzoBv6YP3hA', '--output', '/tmp/tmpulxi1i5k.xml', '/tmp/tmp7aelbbbm.xml']
FAILED tests/test_39_metadata.py::test_signed_metadata_proper_str_bytes_handling - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor', '--output', '/tmp/tmpx3roizbu.xml', '/tmp/tmp38nmsy_n.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_sign_assertion - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpodsr56n3.xml', '/tmp/tmptus3uzrh.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_multiple_signatures_assertion - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpajdbvogl.xml', '/tmp/tmp8hdrzc0j.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_multiple_signatures_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpn4f567x5.xml', '/tmp/tmp3cm4cb2t.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_sign_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmp878ryu_e.xml', '/tmp/tmp_98x9ml2.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_sign_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11122', '--output', '/tmp/tmpt6cq311b.xml', '/tmp/tmp3w7q26nh.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_sign_verify - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpbgeajy8d.xml', '/tmp/tmpdn11wpo0.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_sign_verify_with_cert_from_instance - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmp3pqnwt43.xml', '/tmp/tmpsn9752n7.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_sign_verify_assertion_with_cert_from_instance - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11100', '--output', '/tmp/tmp8f1z57va.xml', '/tmp/tmp5uad15xn.xml']
FAILED tests/test_40_sigver.py::TestSecurity::test_exception_sign_verify_with_cert_from_instance - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-22222', '--output', '/tmp/tmpm2va5ufd.xml', '/tmp/tmpgt0wczsc.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_assertion - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpsmrskww7.xml', '/tmp/tmpcpipng6m.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_multiple_signatures_assertion - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpuxqdebnm.xml', '/tmp/tmpcr9buzod.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_multiple_signatures_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpc635y7s5.xml', '/tmp/tmprg4fk7yq.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpszj9042f.xml', '/tmp/tmppvg_55xp.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11122', '--output', '/tmp/tmpbub0yrwr.xml', '/tmp/tmpdo9pah9u.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_verify - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpcyspr4ld.xml', '/tmp/tmp_y6rxezv.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_verify_with_cert_from_instance - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmphdkndw6s.xml', '/tmp/tmp_2ud5w1b.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_sign_verify_assertion_with_cert_from_instance - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11100', '--output', '/tmp/tmpwvnlz61z.xml', '/tmp/tmpwu45_sf0.xml']
FAILED tests/test_40_sigver.py::TestSecurityNonAsciiAva::test_exception_sign_verify_with_cert_from_instance - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-22222', '--output', '/tmp/tmp6muxxpno.xml', '/tmp/tmp990jqimd.xml']
FAILED tests/test_40_sigver.py::test_xbox - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmpd3ict2e1.xml', '/tmp/tmp68k3w4mh.xml']
FAILED tests/test_40_sigver.py::test_xbox_non_ascii_ava - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-11111', '--output', '/tmp/tmp0iznxov8.xml', '/tmp/tmpqs29desm.xml']
FAILED tests/test_50_server.py::TestServer1::test_signed_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-8pbbbugJQ2tJbdOBU', '--output', '/tmp/tmpb_ir03pc.xml', '/tmp/tmp50uwwgdn.xml']
FAILED tests/test_50_server.py::TestServer1::test_signed_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-7EYH8P23TOwvImHM6', '--output', '/tmp/tmp8wwkfoal.xml', '/tmp/tmp_i6_130e.xml']
FAILED tests/test_50_server.py::TestServer1::test_signed_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-7bLTco5BZ8cGXKuID', '--output', '/tmp/tmp13rhu1j2.xml', '/tmp/tmpdusaypvt.xml']
FAILED tests/test_50_server.py::TestServer1::test_signed_response_3 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-1t0aqPNa4kbvvcURP', '--output', '/tmp/tmpxn560629.xml', '/tmp/tmppdpuwcd1.xml']
FAILED tests/test_50_server.py::TestServer1::test_encrypted_signed_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-KhaqbkgaAnL3SckFR', '--output', '/tmp/tmpybn02myr.xml', '/tmp/tmpxpewlv77.xml']
FAILED tests/test_50_server.py::TestServer1::test_encrypted_signed_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-47n6Gd3HY7FY2HuZs', '--output', '/tmp/tmp8_r6p1a0.xml', '/tmp/tmpp5r8j1xi.xml']
FAILED tests/test_50_server.py::TestServer1::test_encrypted_signed_response_3 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-LmBB71Ab9cpgjsVyH', '--output', '/tmp/tmponogz__2.xml', '/tmp/tmpyhepof_7.xml']
FAILED tests/test_50_server.py::TestServer1::test_encrypted_signed_response_4 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-UeWVZhDCn5FXf7T45', '--output', '/tmp/tmpj_q9_u_8.xml', '/tmp/tmpik6z8ju4.xml']
FAILED tests/test_50_server.py::TestServer1::test_encrypted_response_6 - saml2.cert.CertificateError: Invalid certificate for encryption!
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-TJm2FOPJpTQFRujvl', '--output', '/tmp/tmp67uc0vkj.xml', '/tmp/tmp0_gg_j5y.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-syq0E67NJuzLWbzqz', '--output', '/tmp/tmpzcxegqel.xml', '/tmp/tmppiorobsv.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-0ostGSuBJZzyLGaYS', '--output', '/tmp/tmpc77hwp17.xml', '/tmp/tmp1gta2jyz.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_signed_response_3 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-v84ACvkCkQC7v2pFN', '--output', '/tmp/tmpc600_jry.xml', '/tmp/tmp545t9a5d.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-5KV5mjqwdzeDe1sjG', '--output', '/tmp/tmpd0uo96li.xml', '/tmp/tmpbabwmha7.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-TKV28iyJFCPo2s8Dq', '--output', '/tmp/tmp4_8qy8yo.xml', '/tmp/tmpedhpnthd.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_3 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-RNw5YdPKjDIwKzqxm', '--output', '/tmp/tmpngb70g4a.xml', '/tmp/tmpkakn6jer.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_signed_response_4 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-fEhawwyVqYT7gXjf6', '--output', '/tmp/tmpxa0f38q9.xml', '/tmp/tmpqu576vtq.xml']
FAILED tests/test_50_server.py::TestServer1NonAsciiAva::test_encrypted_response_6 - saml2.cert.CertificateError: Invalid certificate for encryption!
FAILED tests/test_51_client.py::TestClient::test_sign_auth_request_0 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', '--node-id', 'id1', '--output', '/tmp/tmpjmn_iw_w.xml', '/tmp/tmp_alihmdq.xml']
FAILED tests/test_51_client.py::TestClient::test_logout_response - saml2.SAMLError: {'message': 'No supported bindings found to create LogoutResponse', 'issuer': 'urn:mace:example.com:saml:roland:idp', 'response_bindings': ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST', 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect']}
FAILED tests/test_51_client.py::TestClient::test_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-lsIrpDunHPgudyMXq', '--output', '/tmp/tmp7yoq6nhu.xml', '/tmp/tmp_9mky568.xml']
FAILED tests/test_51_client.py::TestClient::test_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-JLtHgxi2AccfsDbLx', '--output', '/tmp/tmp4_oy96re.xml', '/tmp/tmpm1pfxm7c.xml']
FAILED tests/test_51_client.py::TestClient::test_response_3 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-j64rfS7S4n8lvxXrs', '--output', '/tmp/tmpb0ias8ja.xml', '/tmp/tmpadbyocfc.xml']
FAILED tests/test_51_client.py::TestClient::test_response_4 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-VxXKxNJg4EmQ2mdCh', '--output', '/tmp/tmp3wjnr5xg.xml', '/tmp/tmpsflxk14o.xml']
FAILED tests/test_51_client.py::TestClient::test_response_5 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-JdBTieTV7dK2S2F4B', '--output', '/tmp/tmpb10cb459.xml', '/tmp/tmp11s4boon.xml']
FAILED tests/test_51_client.py::TestClient::test_response_6 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nFGSNoS1SAE421Lw3', '--output', '/tmp/tmpl9t458b2.xml', '/tmp/tmpfjnbivfz.xml']
FAILED tests/test_51_client.py::TestClient::test_response_7 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-anZVIxijp8qfvDAhz', '--output', '/tmp/tmpou2cd8_f.xml', '/tmp/tmpitxmaisn.xml']
FAILED tests/test_51_client.py::TestClient::test_response_8 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-odLuAGIxVKA0ROCSt', '--output', '/tmp/tmp9gvg0m7v.xml', '/tmp/tmp2x3hseob.xml']
FAILED tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-00YcJdiiebrEkHpzx', '--output', '/tmp/tmpbitdr4br.xml', '/tmp/tmpzcpe_8kt.xml']
FAILED tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-pjcoKjCfNUFxNsMYT', '--output', '/tmp/tmpf3zebo04.xml', '/tmp/tmpo7yh4yz_.xml']
FAILED tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion_advice_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nqDylLlNONMFnTXTy', '--output', '/tmp/tmpt31nlga9.xml', '/tmp/tmpsdea8_7o.xml']
FAILED tests/test_51_client.py::TestClient::test_sign_then_encrypt_assertion_advice_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-rrjc0EGmrESkmb9qF', '--output', '/tmp/tmpntizzvue.xml', '/tmp/tmpumvyfhj3.xml']
FAILED tests/test_51_client.py::TestClient::test_signed_with_default_algo_redirect - cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
FAILED tests/test_51_client.py::TestClient::test_do_logout_signed_redirect - cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
FAILED tests/test_51_client.py::TestClient::test_do_logout_signed_redirect_invalid - cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
FAILED tests/test_51_client.py::TestClient::test_do_logout_post - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-55EA6BfVGRBWjGq1J', '--output', '/tmp/tmp_nisf4b1.xml', '/tmp/tmp9gugo3a0.xml']
FAILED tests/test_51_client.py::TestClient::test_do_logout_session_expired - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-RK545F2ZSxIgs8ujH', '--output', '/tmp/tmp3ev31pas.xml', '/tmp/tmp3lu0xd1y.xml']
FAILED tests/test_51_client.py::TestClient::test_signature_wants - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-Qz1xz0GDcxapTlUpB', '--output', '/tmp/tmpy20r4u2q.xml', '/tmp/tmpwmr4x5hl.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_sign_auth_request_0 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', '--node-id', 'id1', '--output', '/tmp/tmp32j7j3e1.xml', '/tmp/tmp2lr7hszl.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:Response', '--node-id', 'id-65VXWXzPI3UWpMLpp', '--output', '/tmp/tmpdpc85gzr.xml', '/tmp/tmp9nyszfjo.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-CMhRogkWxiQjFtyHV', '--output', '/tmp/tmp1x2dq4c4.xml', '/tmp/tmpflucd_ka.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_3 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-PGZP0BC8xG49YqUPn', '--output', '/tmp/tmpih846oih.xml', '/tmp/tmpz8njjtwx.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_4 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-ErK0ZOisSjZsU6liw', '--output', '/tmp/tmpqwsln9ji.xml', '/tmp/tmphioq85eb.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_5 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-9L0piScwwAptqo9Lw', '--output', '/tmp/tmph17d40sj.xml', '/tmp/tmpzkvqtfvo.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_6 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-eqL6FU9i8e7anVZhh', '--output', '/tmp/tmpwnpstkou.xml', '/tmp/tmpol9gjoog.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_7 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nXmF5TWJtBWojEdgO', '--output', '/tmp/tmpf78hafoi.xml', '/tmp/tmp9fdha_3c.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_response_8 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-XN0P637BIY85XWFkf', '--output', '/tmp/tmpr9wsg61r.xml', '/tmp/tmpb61eclcn.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-Pp4AyqZGkZbIMxPEN', '--output', '/tmp/tmpbscew6jj.xml', '/tmp/tmp8bnpmsdx.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-5pOD5ckNEXtlNAzwU', '--output', '/tmp/tmp66f3th81.xml', '/tmp/tmp2gp285xj.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion_advice_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-96aQNlh7440Wome5J', '--output', '/tmp/tmp7h_uiulv.xml', '/tmp/tmp1mmcg6r4.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_sign_then_encrypt_assertion_advice_2 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-rvsjku97w2kPY9hIn', '--output', '/tmp/tmpercx_l7e.xml', '/tmp/tmpvltw6233.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_do_logout_signed_redirect - cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_do_logout_post - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-2jcLYAwUFu1BUAPNL', '--output', '/tmp/tmpe5z1ope9.xml', '/tmp/tmph4sz6frb.xml']
FAILED tests/test_51_client.py::TestClientNonAsciiAva::test_do_logout_session_expired - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest', '--node-id', 'id-RbHSApz8DvnUqZkO6', '--output', '/tmp/tmpem5vo3i6.xml', '/tmp/tmpfsy48rq4.xml']
FAILED tests/test_52_default_sign_alg.py::TestSignedResponse::test_signed_response - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-jCYIznvdUKe1GgO9L', '--output', '/tmp/tmpw5ypm4vs.xml', '/tmp/tmposeviz1p.xml']
FAILED tests/test_52_default_sign_alg.py::TestSignedResponse::test_signed_response_1 - saml2.sigver.SignatureError: ['/usr/bin/xmlsec1', '--sign', '--privkey-pem', '/builddir/build/BUILD/python-pysaml2-7.4.2-build/pysaml2-7.4.2/tests/test.key', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion', '--node-id', 'id-nxI1BAsmhf0P0tnpa', '--output', '/tmp/tmp6ocg29q9.xml', '/tmp/tmpxzvug6ww.xml']
FAILED tests/test_70_redirect_signing.py::test - cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
FAILED tests/test_81_certificates.py::TestGenerateCertificates::test_validate_cert_chains - AssertionError: False is not true
FAILED tests/test_81_certificates.py::TestGenerateCertificates::test_validate_with_root_cert - AssertionError: False is not true
FAILED tests/test_xmlsec1_key_data.py::TestAuthnResponse::test_signed_assertion_with_random_embedded_cert_should_be_ignored - saml2.sigver.SignatureError: Failed to verify signature
= 81 failed, 687 passed, 6 skipped, 617 warnings, 11 errors in 176.38s (0:02:56) =
RPM build errors:
error: Bad exit status from /var/tmp/rpm-tmp.1H0O46 (%check)
    Bad exit status from /var/tmp/rpm-tmp.1H0O46 (%check)
Child return code was: 1
EXCEPTION: [Error('Command failed: \n # /usr/bin/systemd-nspawn -q -M 15df3dc7ae3443a1afe6f08e0c8de190 -D /var/lib/mock/f42-build-58989463-6569521/root -a -u mockbuild --capability=cap_ipc_lock --bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf --bind=/dev/btrfs-control --bind=/dev/mapper/control --bind=/dev/fuse --bind=/dev/loop-control --bind=/dev/loop0 --bind=/dev/loop1 --bind=/dev/loop2 --bind=/dev/loop3 --bind=/dev/loop4 --bind=/dev/loop5 --bind=/dev/loop6 --bind=/dev/loop7 --bind=/dev/loop8 --bind=/dev/loop9 --bind=/dev/loop10 --bind=/dev/loop11 --console=pipe --setenv=TERM=vt100 --setenv=SHELL=/bin/bash --setenv=HOME=/builddir --setenv=HOSTNAME=mock --setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin \'--setenv=PROMPT_COMMAND=printf "\\033]0;<mock-chroot>\\007"\' \'--setenv=PS1=<mock-chroot> \\s-\\v\\$ \' --setenv=LANG=C.UTF-8 --resolv-conf=off bash --login -c \'/usr/bin/rpmbuild -ba --noprep --noclean --target noarch /builddir/build/SPECS/python-pysaml2.spec\'\n', 1)]
Traceback (most recent call last):
  File "/usr/lib/python3.13/site-packages/mockbuild/trace_decorator.py", line 93, in trace
    result = func(*args, **kw)
  File "/usr/lib/python3.13/site-packages/mockbuild/util.py", line 610, in do_with_status
    raise exception.Error("Command failed: \n # %s\n%s" % (cmd_pretty(command, env), output), child.returncode)
mockbuild.exception.Error: Command failed: 
 # /usr/bin/systemd-nspawn -q -M 15df3dc7ae3443a1afe6f08e0c8de190 -D /var/lib/mock/f42-build-58989463-6569521/root -a -u mockbuild --capability=cap_ipc_lock --bind=/tmp/mock-resolv.shp1hz7j:/etc/resolv.conf --bind=/dev/btrfs-control --bind=/dev/mapper/control --bind=/dev/fuse --bind=/dev/loop-control --bind=/dev/loop0 --bind=/dev/loop1 --bind=/dev/loop2 --bind=/dev/loop3 --bind=/dev/loop4 --bind=/dev/loop5 --bind=/dev/loop6 --bind=/dev/loop7 --bind=/dev/loop8 --bind=/dev/loop9 --bind=/dev/loop10 --bind=/dev/loop11 --console=pipe --setenv=TERM=vt100 --setenv=SHELL=/bin/bash --setenv=HOME=/builddir --setenv=HOSTNAME=mock --setenv=PATH=/usr/bin:/bin:/usr/sbin:/sbin '--setenv=PROMPT_COMMAND=printf "\033]0;<mock-chroot>\007"' '--setenv=PS1=<mock-chroot> \s-\v\$ ' --setenv=LANG=C.UTF-8 --resolv-conf=off bash --login -c '/usr/bin/rpmbuild -ba --noprep --noclean --target noarch /builddir/build/SPECS/python-pysaml2.spec'