From 9e82e61b57d0f3a1bff060f502b26a1684c80309 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 11 Oct 2012 13:10:24 +0000
Subject: [PATCH] Validate signed metadata against the 2012 signing certificate
 as well as against the 2010 one.

---
 build.xml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/build.xml b/build.xml
index f582d579..83c99aac 100644
--- a/build.xml
+++ b/build.xml
@@ -124,7 +124,6 @@
 	<!--
 		Verification keystore.
 	-->
-	<property name="keystore.uk.vfy.loc" value="${build.dir}/ukfederation-2010.jks"/>
 	<property name="keystore.uk.vfy.alias" value="ukfederation"/>
 	
 	<property name="known.hosts" value="${build.dir}/known_hosts"/>
@@ -499,7 +498,12 @@
 	<macrodef name="MDT.VFY.uk">
 		<attribute name="i"/>
 		<sequential>
-			<MDT i="@{i}" o="${null.device}" keystore="${keystore.uk.vfy.loc}" alias="${keystore.uk.vfy.alias}"/>
+			<MDT i="@{i}" o="${null.device}"
+				keystore="${build.dir}/ukfederation-2010.jks"
+				alias="${keystore.uk.vfy.alias}"/>
+            <MDT i="@{i}" o="${null.device}"
+                keystore="${build.dir}/ukfederation-2012.jks"
+                alias="${keystore.uk.vfy.alias}"/>
 		</sequential>
 	</macrodef>
 		
@@ -582,6 +586,16 @@
 					-->
 				</args>
 			</XMLSECTOOL>
+            <XMLSECTOOL i="@{i}">
+                <args>
+                    <arg value="--verifySignature"/>
+                    <arg value="--certificate"/>
+                    <arg value="${build.dir}/ukfederation-2012.pem"/>
+                    <!--
+                    <arg value="- -quiet"/>
+                    -->
+                </args>
+            </XMLSECTOOL>
 		</sequential>
 	</macrodef>