sgcSign 2026.8.0 Latest
- 2026.8.0: 2026 August
- NewNew TsgcXMLDSigSigner component: signs XML with plain XML-DSig, no XAdES properties. One generic component driven entirely by configuration, so a signed SAML 2.0 assertion and a SOAP WS-Security message are two configurations of it rather than two different components.
- NewSign any element by its ID attribute. The attribute name is configurable because it differs by standard: ID for SAML, wsu:Id for WS-Security, Id for XAdES. The signer can add it when the element does not have one.
- NewSupport for the InclusiveNamespaces PrefixList of exclusive canonicalization, needed when a prefix appears only inside an attribute value such as xsi:type="xs:string". Without it the declaration is dropped and the digest changes, which is a common cause of a counterparty rejecting a signature.
- NewSignature placement control: first or last child of any element, or immediately before or after a named sibling. SAML requires the signature between saml2:Issuer and saml2:Subject.
- NewKeyInfo content is selectable: certificate, subject name, issuer and serial, RSA key value, or any combination.
- NewTsgcDocumentSigner can produce plain XML-DSig, by setting Format to sfXMLDSig and configuring its XMLDSig property.
- NewsgcSign Server: new /api/v1/sign/xmldsig endpoint with the same configuration as JSON, documented in the OpenAPI specification.
- NewRSASSA-PSS signatures are now verified, covering the MGF1 forms and explicit PSS parameters. A variant that cannot be checked is reported as indeterminate with the reason. The German EU Trusted List now verifies.
- NewDocuments carrying more than one signature are now fully verified, every signature checked.
- Newsgcsign CLI: new WinHTTP transport, the default on Windows, which signs over HTTPS without any OpenSSL DLL. TLS 1.2 and 1.3 come from the operating system, trust comes from the Windows certificate store, and the system proxy settings are honoured. The new --transport option selects auto, winhttp or indy.
- Newsgcsign CLI: new --openssl-api, --openssl-dir, --cacert and --tls-version options for the indy transport. --openssl-api defaults to auto, which probes OpenSSL 3.0, then 1.1, then 1.0, and uses the newest library that loads, so the client is no longer tied to OpenSSL 1.0.2. Each option also reads an environment variable: SGCSIGN_TRANSPORT, SGCSIGN_OPENSSL_API, SGCSIGN_OPENSSL_DIR, SGCSIGN_CACERT and SGCSIGN_TLS_VERSION.
- NewsgcSign Server: new server.tls.provider setting, openssl or schannel. With schannel the HTTPS listener uses the Windows TLS stack and needs no OpenSSL DLL at all, taking either a PFX through cert_file and password, or a certificate already in the Windows store through cert_hash, cert_store_name and cert_store_path.
- NewsgcSign Server: new server.tls.openssl_api setting, auto by default, which probes OpenSSL 3.0, then 1.1, then 1.0 and uses the newest library that loads. An explicit 1.0, 1.1 or 3.0 pins one generation. New server.tls.openssl_dir and server.tls.version_min settings, and the startup banner now reports the TLS provider and the API actually in use.
- NewsgcSign Server: the TLS certificate password can be supplied through server.tls.password_env, which names an environment variable and takes precedence over the literal password key, matching how every other secret in the configuration file is handled.
- FixedSecurity: a document with two or more signatures was reported as valid after checking only the first one. The enveloped-signature transform also removed the first signature in the document rather than the one being verified, and reused the first SignedInfo when checking any later signature.
- FixedSecurity: a processing instruction whose target starts with "xml", such as the common xml-stylesheet, was discarded as if it were the XML declaration and left out of the digest, so it could be deleted or altered after signing while the signature still verified. Documents of that shape should be signed again.
- FixedEU Trusted Lists and any document using xml:lang or another xml: attribute failed verification. The xml prefix is bound by the XML specification and never declared with xmlns, but was treated as undeclared, so canonicalization emitted a spurious xmlns:xml="" and sorted the attribute into the wrong group. Output now matches an independent implementation.
- FixedSignature verification could be misled by a decoy. The signature was located with a plain text search, so something resembling a signature inside a comment, CDATA section, processing instruction or DOCTYPE internal subset could capture it, or capture a reference by its Id.
- FixedCanonicalization emitted a line break for a comment before the root element even under a method that strips comments and produces no output for it, so signatures over such documents did not match what a conforming verifier computed.
- FixedDocuments starting with a UTF-8 byte order mark failed to parse, so verification failed on signatures that were perfectly sound.
- FixedSigning failed on a document with a comment, processing instruction or DOCTYPE before the root element, and a DOCTYPE with an internal subset failed to parse. With a signature parent element configured, a prolog comment containing text resembling a closing tag could place the signature inside that comment.
- FixedSignatures referencing an element by its ID, and the SignedInfo element, are now canonicalized with the namespaces inherited from their ancestors, as the specification requires. Signatures made by earlier versions under an inclusive canonicalization profile are still accepted and reported as such, so they stay usable while telling you to sign again; the new TsgcSignatureVerifier.StrictCanonicalization property turns that acceptance off. The reference covering your document is always verified strictly.
- FixedEU Trusted Lists were being damaged by our own downloader, which moved these signed documents as text and re-encoded them on the way to the cache, changing bytes and breaking the signature. They are now carried as bytes end to end, and a document that is not valid UTF-8 is reported as an error instead of being guessed. A list cached by an earlier version may already be damaged, so refresh the cache once after updating.
- FixedDemos: a certificate provider could be released while an interface pointing at it was still alive, which could crash the demo. The Authenticode, ClickOnce, NuGet and VSIX demos leaked a provider on every signing operation, and EU_Employment reported its own containers as invalid by passing the whole signature file, envelope included, to the verifier.
- FixedPFX certificates: fixed an error when signing on 64-bit Windows with a certificate that uses a modern CNG private key. Signing could fail with "NCryptSignHash failed: NTSTATUS=$200000000" even though the certificate and the password were correct. The signature was in fact created correctly, the problem was the check on the result, so nothing signed before the error appeared was affected. 32-bit applications were never affected.
- Fixedsgcsign CLI: signing over HTTPS could fail with "server unreachable: server closed the connection without sending a response (server-side error)" when the fault was entirely on the client. Every OpenSSL failure, including being unable to load the library at all, was reported as a server error, which sent users looking at a server that was working correctly. Client side TLS failures are now reported as TLS errors, naming the libraries that were tried and the bitness of the process, and exit with the new code 7.
- Fixedsgcsign CLI: the client could only load the OpenSSL 1.0 API, so it required libeay32.dll and ssleay32.dll and could not use OpenSSL 1.1 or 3.x. The server had the same restriction. Both now select the API generation, and both default to detecting the newest one available.
- Fixedsgcsign CLI: the TLS connection offered SSL 2.0 and SSL 3.0 alongside the TLS versions. Only TLS 1.0 through 1.3 are offered now, and --tls-version raises the minimum.
- FixedDocumentation: the technical guide stated that the server accepted the OpenSSL 1.1 and 3.x library names. That was never true, the server always loaded the OpenSSL 1.0 API. The guide now documents the TLS provider settings, the CLI TLS options and the full list of CLI exit codes.
- FixedPAdES: signing never finished. It hung at 100% CPU on any PDF, because two loops that copy bytes out of the document never advanced their index and so kept reading the same byte. The first reads the document Catalog dictionary and runs on every signature, which is why no PDF could be signed. The second reads an object number and runs when the Catalog cannot be read from a classic trailer, as in PDFs that use a cross-reference stream, and on every visible signature to locate the page object; that one also grew a string on each pass, so it ended in an out of memory rather than only spinning. The .NET implementation was never affected, it uses counted loops in both places. Reported by a customer with a sample PDF, thank you.