From c6b87d9dddc327572d4ad5cb281913e83a402dc0 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 1 Aug 2016 10:17:48 +0100
Subject: [PATCH] Conditionalise use of --pkcs11Config option to XmlSecTool.

Only supply the option if there is a PKCS11 configuration file
specified, so that we can also sign using non-PKCS11 methods if
required.
---
 build.xml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/build.xml b/build.xml
index b6e3669c..dc1f7fa5 100644
--- a/build.xml
+++ b/build.xml
@@ -9,7 +9,7 @@
     * "ant push" sends all files to the remote site, and requires
       the remote site password.
 -->
-<project default="echoproperties">
+<project default="echoproperties" xmlns:if="ant:if" xmlns:unless="ant:unless">
 
     <!--
         *******************************************
@@ -654,13 +654,11 @@
                     <arg value="@{digest}"/>
 
                     <!--
-                        Sign using pkcs11Config with keystoreProvider
-
-                        This only works with XmlSecTool 1.2.0 and later.
-                        It requires the java.security file to be unmodified.
+                        If we have a PKCS11 configuration specified, include it.
                     -->
-                    <arg value="--pkcs11Config"/>
-                    <arg value="${keystore.pkcs11.config}"/>
+                    <arg if:set="keystore.pkcs11.config" value="--pkcs11Config"/>
+                    <arg if:set="keystore.pkcs11.config" value="${keystore.pkcs11.config}"/>
+
                     <arg value="--keystoreProvider"/>
                     <arg value="sun.security.pkcs11.SunPKCS11"/>