feat(xmldsig): resolve X509 selectors

README.md

@@ -39,7 +39,7 @@ Currently implemented (core paths):
 - C14N 1.0, C14N 1.1, and Exclusive C14N
 - XMLDSig parsing, same-document URI dereference, transform chains, and digest verification
 - XMLDSig full verify pipeline (`SignedInfo` canonicalization + `SignatureValue` verification)
-- Built-in verification-key resolution from X.509, DER, `KeyName`, RSA `KeyValue`, and EC `KeyValue` sources
+- Built-in verification-key resolution from embedded X.509/DER/`KeyValue` sources and configured `KeyName`, X.509 subject, issuer/serial, SKI, or digest selectors
 - RSA PKCS#1 v1.5 verification helpers for SHA-1 / SHA-256 / SHA-384 / SHA-512
 - ECDSA verification helpers for P-256/SHA-256 and P-384/SHA-384
 - Opt-in X.509 certificate-chain validation with explicit trust anchors, validity checks, CA constraints, and CRLs

scripts/import-donor-fixtures.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+donor_root="$repo_root/donors/xmlsec/tests"
+fixture_root="$repo_root/tests/fixtures/xmldsig"
+
+fixture_paths=("$@")
+if (( ${#fixture_paths[@]} == 0 )); then
+  fixture_paths=(
+    "aleksey-xmldsig-01/enveloping-rsa-x509chain.xml"
+  )
+fi
+
+for relative_path in "${fixture_paths[@]}"; do
+  target="$fixture_root/$relative_path"
+  mkdir -p "$(dirname "$target")"
+  install -m 0644 "$donor_root/$relative_path" "$target"
+done