From 43a81b90ea20c785a45f8b5d1ac6ac59d8cdda67 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 1 Aug 2016 11:32:19 +0100
Subject: [PATCH] Enable key+certificate signing for development use.

---
 build.xml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/build.xml b/build.xml
index cc142510..1616d4b2 100644
--- a/build.xml
+++ b/build.xml
@@ -660,10 +660,24 @@
                     <arg if:set="sign.uk.keystoreProvider" value="--keystoreProvider"/>
                     <arg if:set="sign.uk.keystoreProvider" value="${sign.uk.keystoreProvider}"/>
 
-                    <arg value="--key"/>
-                    <arg value="${sign.uk.keyAlias}"/>
+                    <!--
+                        The "key" option can represent either a key file or a key alias.
+                        Different properties are used for the two cases (see XSTJ-67).
+                    -->
+                    <arg if:set="sign.uk.keyFile" value="--key"/>
+                    <arg if:set="sign.uk.keyFile" value="${sign.uk.keyFile}"/>
+                    <arg if:set="sign.uk.keyAlias" value="--key"/>
+                    <arg if:set="sign.uk.keyAlias" value="${sign.uk.keyAlias}"/>
+
+                    <!--
+                        Include an X.509 certificate if one is specified.
+                    -->
+                    <arg if:set="sign.uk.certificate" value="--certificate"/>
+                    <arg if:set="sign.uk.certificate" value="${sign.uk.certificate}"/>
+
                     <arg value="--keyPassword"/>
                     <arg value="${sign.uk.keyPassword}"/>
+
                     <arg value="--outFile"/>
                     <arg value="@{o}"/>
                     <arg value="--referenceIdAttributeName"/>