Enveloped XMLDSig, as the MOC 4.00 defines it for NF-e.
Algorithms
RSA-SHA1 and SHA-1, with Canonical XML 1.0. SHA-1 is weak everywhere else and is nonetheless what the MOC prescribes here; SEFAZ rejects anything stronger, so this is compatibility, not a recommendation. Confirm the annex against the current MOC before assuming it changed.
What gets signed
One Reference, pointing at the Id of the element being signed — infNFe
for a document, infEvento for cancel and CCe, infInut for a number range.
Two transforms: enveloped-signature, then C14N.
Insertion
The signature is spliced into the original bytes rather than produced by re-serialising the parsed tree. The ERP owns that XML and SEFAZ digests what it receives; rewriting it — reordering an attribute, collapsing an empty element — would invalidate the very signature being added, and would break SEFAZ-04's promise that tax nodes arrive untouched.
A document that already carries a Signature is returned as it is, because
the MOC signs a document once.
Summary
Functions
Signs any of the MOC's signable elements.
Signs the infNFe of an NF-e, returning the document with the Signature
appended inside NFe.
Whether xml already carries an XMLDSig Signature, prefixed or not.
Functions
@spec sign(String.t(), SefazNfe.Certificate.t(), String.t(), String.t()) :: {:ok, String.t()} | {:error, term()}
Signs any of the MOC's signable elements.
tag is the element carrying the Id (infNFe, infEvento, infInut) and
parent the element the Signature belongs to.
@spec sign_nfe(String.t(), SefazNfe.Certificate.t()) :: {:ok, String.t()} | {:error, term()}
Signs the infNFe of an NF-e, returning the document with the Signature
appended inside NFe.
Whether xml already carries an XMLDSig Signature, prefixed or not.