From 360abeb5ecb700fae36200ac4c53b7ec809710ec Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 23 Oct 2012 15:18:12 +0000
Subject: [PATCH] Check for entities which have both PKIX-only KeyDescriptors
 (i.e., ones with a KeyName but no embedded X.509 certificate) and also
 non-PKIX KeyDescriptors (i.e., ones with no KeyName).

This combination seems unlikely to be intentional, and most likely the result of an incomplete transition to embedded key material.
---
 mdx/check_future_2.xsl | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/mdx/check_future_2.xsl b/mdx/check_future_2.xsl
index d20b9df4..f0cd85d6 100644
--- a/mdx/check_future_2.xsl
+++ b/mdx/check_future_2.xsl
@@ -29,5 +29,21 @@
 	-->
 	<xsl:import href="../build/check_framework.xsl"/>
 
+	<!--
+		Check for entities which have both PKIX-only KeyDescriptors (i.e.,
+		ones with a KeyName but no embedded X.509 certificate) and also
+		non-PKIX KeyDescriptors (i.e., ones with no KeyName).
+		
+		This combination seems unlikely to be intentional, and most
+		likely the result of an incomplete transition to embedded key
+		material.
+	-->
+	<xsl:template match="md:EntityDescriptor
+		[descendant::md:KeyDescriptor[not(descendant::ds:X509Data)]]
+		[descendant::md:KeyDescriptor[not(descendant::ds:KeyName)]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">has both PKIX-only and no-PKIX KeyDescriptors</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
 	
 </xsl:stylesheet>