From 542785f876ccbe22cba1f8f02c26adbfd3901e2d Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 30 Sep 2022 15:45:11 +0100
Subject: [PATCH] Improve build.xml samlmd.mdq.sign.test target

See ukf/ukf-meta#351.
---
 build.xml                         | 23 +++++++--
 mdx/uk/mdq-multisign-test-gen.xsl | 77 +++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+), 4 deletions(-)
 create mode 100644 mdx/uk/mdq-multisign-test-gen.xsl

diff --git a/build.xml b/build.xml
index a97eb26..14d595f 100644
--- a/build.xml
+++ b/build.xml
@@ -2160,13 +2160,28 @@
     </target>
 
     <!--
-        Simple local test of per-entity metadata generation, based on a single
-        entity rather than the whole production aggregate, because dev environment
-        PKCS#11 tokens are not fast enough to sign everything.
+        Simple local test of per-entity metadata generation, based on a curated
+        selection of entities rather than the whole production aggregate, because
+        dev environment PKCS#11 tokens are not fast enough to sign everything.
+
+        Assumes that the unsigned production aggregate already exists;
+        does NOT rebuild it every time.
     -->
     <target name="samlmd.mdq.sign.test" depends="get.sign.uk.keyPassword">
-        <property name="mda.mdq.input" value="${entities.dir}/uk000006.xml"/>
+        <property name="mda.mdq.input" value="${temp.dir}/mdq-temp.xml"/>
         <property name="mda.sign.keyPassword" value="${sign.uk.keyPassword}"/>
+        <echo>Generating per-entity test selection aggregate in ${mda.mdq.input}</echo>
+        <echo>    from unsigned aggregate in ${output.dir}/${mdaggr.prod.unsigned}</echo>
+        <delete file="${mda.mdq.input}" quiet="true"/>
+        <exec executable="xsltproc" failonerror="true">
+            <!-- The OUTPUT of xsltproc is the INPUT for the signing process. -->
+            <arg value="--output"/>
+            <arg value="${mda.mdq.input}"/>
+            <!-- Transform. -->
+            <arg value="${mdx.dir}/uk/mdq-multisign-test-gen.xsl"/>
+            <!-- The INPUT to xsltproc is the unsigned production aggregate. -->
+            <arg value="${output.dir}/${mdaggr.prod.unsigned}"/>
+        </exec>
         <echo>Generating per-entity metadata in ${mda.mdq.output}</echo>
         <echo>    from test metadata in ${mda.mdq.input}</echo>
         <delete dir="${mdq.output.dir}" quiet="true"/>
diff --git a/mdx/uk/mdq-multisign-test-gen.xsl b/mdx/uk/mdq-multisign-test-gen.xsl
new file mode 100644
index 0000000..16838fc
--- /dev/null
+++ b/mdx/uk/mdq-multisign-test-gen.xsl
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    mdq-multisign-test-gen.xsl
+
+    XSL stylesheet to produce the test data for the mdq-multisign pipeline, which
+    generates signed per-entity metadata.
+
+    This works by filtering the unsigned production aggregate (which is used as
+    input to the per-entity signing process in production) and removing all
+    but a curated selection of entities, chosen to be representative.
+
+    Note that the resulting test file will contain large numbers of blank lines,
+    because the newline _after_ each entity in the input aggregate is not
+    part of the element being stripped out. This is fine.
+-->
+<xsl:stylesheet version="1.0"
+    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+
+    xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    exclude-result-prefixes="xsi xsl">
+
+    <!--Force UTF-8 encoding for the output.-->
+    <xsl:output omit-xml-declaration="no" method="xml" encoding="UTF-8" indent="yes"/>
+
+    <!--
+        Filter out entities we don't want.
+
+        Use De Morgan here:
+
+            (NOT entity-a) AND (NOT entity-b)
+
+        is the same as
+
+            NOT (entity-a OR entity-b)
+
+        We negate this again by filtering out _matching_
+        entities, so we are left with:
+
+            entity-a OR entity-b
+
+        The selection process won't notice if you mistype an
+        entityID, or if the entity in question is removed from
+        the UK federation aggregate; it will simply no longer
+        appear in the test data.
+    -->
+    <xsl:template match="//md:EntityDescriptor
+            [@entityID!='https://idp2.iay.org.uk/idp/shibboleth']
+            [@entityID!='https://test.ukfederation.org.uk/entity']
+            [@entityID!='https://test-idp.ukfederation.org.uk/idp/shibboleth']
+            [@entityID!='https://terena.org/sp']
+        ">
+        <!-- do nothing, we're filtering these out -->
+    </xsl:template>
+
+    <!--
+        *********************************************
+        ***                                       ***
+        ***   D E F A U L T   T E M P L A T E S   ***
+        ***                                       ***
+        *********************************************
+    -->
+
+    <!--By default, copy text blocks, comments and attributes unchanged.-->
+    <xsl:template match="text()|comment()|@*">
+        <xsl:copy/>
+    </xsl:template>
+
+    <!--By default, copy all elements from the input to the output, along with their attributes and contents.-->
+    <xsl:template match="*">
+        <xsl:copy>
+            <xsl:apply-templates select="node()|@*"/>
+        </xsl:copy>
+    </xsl:template>
+
+</xsl:stylesheet>