Fix some mismatches with the original implementation

Author: roblabla

hlkx-sign/src/opc.rs

@@ -44,6 +44,17 @@ pub const MIME_RELS: &str =
     "application/vnd.openxmlformats-package.relationships+xml";
 pub const MIME_OCTET: &str = "application/octet-stream";
 
+/// Extension token used with `[Content_Types].xml` lookup, mirroring .NET
+/// `Path.GetExtension(partPath)?.TrimStart('.')` on `OpcPart` paths.
+///
+/// Rust's [`std::path::Path::extension`] returns `None` for file names like
+/// `.rels` (a leading dot before the extension), which would incorrectly fall
+/// back to `application/octet-stream` for `/_rels/.rels`.
+pub fn extension_for_opc_content_type(part_path: &str) -> &str {
+    let file = part_path.rsplit('/').next().unwrap_or(part_path);
+    file.rfind('.').map(|i| &file[i + 1..]).unwrap_or("")
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // OpcRelationship
 // ─────────────────────────────────────────────────────────────────────────────

hlkx-sign/src/signing.rs

@@ -11,9 +11,9 @@
 
 use crate::c14n::c14n;
 use crate::opc::{
-    entry_to_uri, rels_path_for_part, serialize_rels, OpcPackage, OpcRelationship,
-    MIME_DS_CERTIFICATE, MIME_DS_ORIGIN, MIME_DS_SIGNATURE, MIME_RELS, REL_DS_CERTIFICATE,
-    REL_DS_ORIGIN, REL_DS_SIGNATURE,
+    entry_to_uri, extension_for_opc_content_type, rels_path_for_part, serialize_rels, OpcPackage,
+    OpcRelationship, MIME_DS_CERTIFICATE, MIME_DS_ORIGIN, MIME_DS_SIGNATURE, MIME_RELS,
+    REL_DS_CERTIFICATE, REL_DS_ORIGIN, REL_DS_SIGNATURE,
 };
 use crate::timestamp;
 use crate::xml_sig::{build_signature_xml, DigestAlgorithm, PartDigest, TransformInfo};
@@ -152,12 +152,8 @@ pub fn sign(
 
     for part_path in &parts_to_sign {
         let data = pkg.entries.get(part_path.as_str()).cloned().unwrap_or_default();
-        let mime = pkg.content_type_for_extension(
-            std::path::Path::new(part_path)
-                .extension()
-                .and_then(|e| e.to_str())
-                .unwrap_or(""),
-        ).to_string();
+        let ext_token = extension_for_opc_content_type(part_path);
+        let mime = pkg.content_type_for_extension(ext_token).to_string();
 
         if part_path == crate::opc::GLOBAL_RELS {
             // Two digest entries for _rels/.rels (mirrors OpcSignatureManifest.Build).
@@ -277,13 +273,9 @@ fn digest_rels_part(
     let c14n_filtered = c14n(filtered_xml.as_bytes())?;
     let hash2 = digest_alg.hash(&c14n_filtered);
 
-    // Collect the relationship types for the RelationshipsGroupReference elements.
-    let source_types: Vec<String> = {
-        let mut types: Vec<String> =
-            filtered.iter().map(|r| r.rel_type.clone()).collect();
-        types.dedup();
-        types
-    };
+    // One RelationshipsGroupReference per filtered relationship (same order as C#
+    // `XmlSignatureBuilder` iterating `nodes` from the filtered relationships doc).
+    let source_types: Vec<String> = filtered.iter().map(|r| r.rel_type.clone()).collect();
 
     Ok(vec![
         // Entry 1 – C14N transform only.
@@ -324,15 +316,14 @@ fn build_filtered_rels_xml(rels: &[&OpcRelationship]) -> String {
     s
 }
 
-/// Compute the certificate file name: serial number bytes reversed, hex-encoded.
-/// Matches the C# `ByteArrayToReverseString(certificate.GetSerialNumber())`.
+/// Compute the certificate file name: serial number bytes, hex-encoded.
 fn cert_der_filename(cert_der: &[u8]) -> Result<String> {
     // Parse the DER certificate to extract the serial number.
     let cert = Certificate::from_der(cert_der)
         .context("Failed to parse certificate DER")?;
-    // serial_number().as_bytes() returns the big-endian integer content bytes.
     let bytes = cert.tbs_certificate.serial_number.as_bytes();
-    let reversed: Vec<u8> = bytes.iter().rev().copied().collect();
-    let hex_str = hex::encode_upper(&reversed);
+    // Don't reverse the hex. C# had some broken code that appeared to reverse
+    // it, but actually doesn't.
+    let hex_str = hex::encode_upper(bytes);
     Ok(format!("{}.cer", hex_str))
 }

hlkx-sign/src/xml_sig.rs

@@ -200,27 +200,16 @@ pub fn build_signature_xml(
     // canonicalised – it just embeds the same content).
     doc.extend_from_slice(&object_xml);
 
-    // Optional timestamp <Object>, matching the C# OpcPackageTimestampBuilder output:
-    //
-    //   <Object xmlns="http://www.w3.org/2000/09/xmldsig#">
-    //     <mdssi:TimeStamp Id="idSignatureTimestamp"
-    //         xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature">
-    //       <mdssi:Comment>Timestamp got from the time stamp server</mdssi:Comment>
-    //       <mdssi:EncodedTime>BASE64</mdssi:EncodedTime>
-    //     </mdssi:TimeStamp>
-    //   </Object>
+    // Optional timestamp <Object>, matching `OpcPackageTimestampBuilder.ApplyTimestamp`.
     if let Some(token) = timestamp_token {
         let token_b64 = B64.encode(token);
-        doc.extend_from_slice(b"<Object>");
-        doc.extend_from_slice(b"<mdssi:TimeStamp Id=\"idSignatureTimestamp\" xmlns:mdssi=\"");
+        // Match `OpcPackageTimestampBuilder.ApplyTimestamp` (default namespace on
+        // `TimeStamp`, unprefixed children — not `mdssi:` prefixes).
+        doc.extend_from_slice(b"<Object><TimeStamp Id=\"idSignatureTimestamp\" xmlns=\"");
         doc.extend_from_slice(NS_OPC_DSIG.as_bytes());
-        doc.extend_from_slice(b"\">");
-        doc.extend_from_slice(b"<mdssi:Comment>Timestamp got from the time stamp server</mdssi:Comment>");
-        doc.extend_from_slice(b"<mdssi:EncodedTime>");
+        doc.extend_from_slice(b"\"><Comment>Timestamp got from the time stamp server</Comment><EncodedTime>");
         doc.extend_from_slice(token_b64.as_bytes());
-        doc.extend_from_slice(b"</mdssi:EncodedTime>");
-        doc.extend_from_slice(b"</mdssi:TimeStamp>");
-        doc.extend_from_slice(b"</Object>");
+        doc.extend_from_slice(b"</EncodedTime></TimeStamp></Object>");
     }
 
     doc.extend_from_slice(b"</Signature>");