signxml

What it is and what it does

SignXML is a Python implementation of the W3C XML Signature standard, used to cryptographically sign and verify XML documents in enterprise protocols like SAML 2.0, XAdES, EBICS, and WS-Security. It wraps lxml and cryptography to provide both standard XMLDSig operations and extensions for X.509 certificate chain validation, hostname/CN verification, and XAdES support.

The library is designed with security-first defaults: it uses a libxml2-based parser hardened against common XML attacks, disables network calls and unsafe transforms by default, and emphasizes the "see what is signed" principle to prevent signature-wrapping attacks. It supports exclusive XML canonicalization with inclusive prefixes, certificate validity checks at a specific point in time, and flexible trust establishment via pre-shared certificates, CA files, or subject name matching.

Use it for:

• Verify SAML 2.0 assertions from identity providers by extracting and validating X.509 certificates from SAML metadata.
• Sign and verify XAdES digital signatures for long-term archival and legal compliance in document workflows.
• Validate XML signatures in EBICS banking protocols to ensure message authenticity and non-repudiation.
• Establish trust in XML-based web services by verifying WS-Security signatures with certificate chain validation.
• Prevent SAML signature-wrapping attacks by configuring expected signature location and verifying only the returned signed_xml data.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

SignXML implements W3C XML Signature (XMLDSig) standard for signing and verifying XML documents, with support for SAML 2.0, XAdES, EBICS, and WS-Security protocols.

Yes. SignXML is actively maintained, has no known vulnerabilities, low install friction, and implements a critical security standard for enterprise XML protocols. It is appropriate for production use in SAML, XAdES, EBICS, and WS-Security integrations where XML signature verification is required.

Install

signxml on PyPI

pip install signxml

uv add signxml

poetry add signxml

Installing signxml

Before you install

Low friction: pure Python wheel with three stable, widely-used dependencies (lxml, cryptography, certifi). Active maintenance with a release 40 days ago and continuous integration.

License in practice

Apache Software License (permissive): you can use, modify, and distribute signxml freely in commercial and private projects, with minimal restrictions beyond attribution.

Quickstart

from lxml import etree
from signxml import XMLSigner, XMLVerifier

root = etree.fromstring(data_to_sign)
signed_root = XMLSigner().sign(root, key=key, cert=cert)
verified_data = XMLVerifier().verify(signed_root).signed_xml

Requires lxml (libxml2-based XML parser) and valid X.509 certificate/key pair in PEM format; openssl needed to generate test certificates.

Verify before relying

• Whether XPath and XSLT transform support is available or intentionally excluded for security
• Specific XAdES profile coverage beyond the excerpt's mention of XAdES support

Package facts

Evidence: signxml-5.1.0-py3-none-any.whl

Tags

More Software Development packages