Upgrade libxmlsec to 1.2.23

Obsoletes xmlsec1-win32-fix-undeclared.patch.1.

Change-Id: I11cd52aebbe5ab224de9ab00b74c02abb46296f6
Reviewed-on: https://gerrit.libreoffice.org/30539
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

10 files changed, 75 insertions, 116 deletions

diff --git a/external/libxmlsec/UnpackedTarball_xmlsec.mk b/external/libxmlsec/UnpackedTarball_xmlsec.mk
index badd5c31b017..3a0469c6463e 100644
--- a/external/libxmlsec/UnpackedTarball_xmlsec.mk
+++ b/external/libxmlsec/UnpackedTarball_xmlsec.mk
@@ -13,8 +13,6 @@ xmlsec_patches += xmlsec1-nssdisablecallbacks.patch.1
 xmlsec_patches += xmlsec1-nssmangleciphers.patch.1
 xmlsec_patches += xmlsec1-noverify.patch.1
 xmlsec_patches += xmlsec1-mingw-keymgr-mscrypto.patch.1
-# Upstreamed as <https://github.com/lsh123/xmlsec/pull/37>.
-xmlsec_patches += xmlsec1-win32-fix-undeclared.patch.1
 xmlsec_patches += xmlsec1-vc.patch.1
 xmlsec_patches += xmlsec1-1.2.14_fix_extern_c.patch.1
 xmlsec_patches += xmlsec1-customkeymanage.patch.1
diff --git a/external/libxmlsec/xmlsec1-1.2.14_fix_extern_c.patch.1 b/external/libxmlsec/xmlsec1-1.2.14_fix_extern_c.patch.1
index 0ae592b8c9a2..9ead19c343c7 100644
--- a/external/libxmlsec/xmlsec1-1.2.14_fix_extern_c.patch.1
+++ b/external/libxmlsec/xmlsec1-1.2.14_fix_extern_c.patch.1
@@ -1,4 +1,4 @@
-From 145ae5235f79fec807f360cc34a0bf16cd6b6d75 Mon Sep 17 00:00:00 2001
+From b4cb46f2737f7e3a4073b747ed4a0dfb99d48fdd Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:12:48 +0100
 Subject: [PATCH] xmlsec1-1.2.14_fix_extern_c.patch
diff --git a/external/libxmlsec/xmlsec1-configure.patch.1 b/external/libxmlsec/xmlsec1-configure.patch.1
index b82ee085f49e..2b496d7ee9fd 100644
--- a/external/libxmlsec/xmlsec1-configure.patch.1
+++ b/external/libxmlsec/xmlsec1-configure.patch.1
@@ -1,4 +1,4 @@
-From 3a8aaa9a5baf91ef6bf9c24b4080896fb8615b0c Mon Sep 17 00:00:00 2001
+From 70139f4422c78f21ed9a7435267e37d15c4c8fa6 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:06:19 +0100
 Subject: [PATCH] xmlsec1-configure.patch
@@ -15,7 +15,7 @@ Conflicts:
  4 files changed, 42 insertions(+), 14 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index 3453c01..da71139 100644
+index 3453c01..2c5effb 100644
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -1,7 +1,7 @@
@@ -28,10 +28,10 @@ index 3453c01..da71139 100644
  DEFAULT_CRYPTO	= @XMLSEC_DEFAULT_CRYPTO@
  
 diff --git a/Makefile.in b/Makefile.in
-index 6b23543..759b33e 100644
+index f35b430..f3ca4ed 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -469,7 +469,7 @@ top_builddir = @top_builddir@
+@@ -468,7 +468,7 @@ top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
  NULL = 
  SAFE_VERSION = @XMLSEC_VERSION_SAFE@
@@ -41,10 +41,10 @@ index 6b23543..759b33e 100644
  DEFAULT_CRYPTO = @XMLSEC_DEFAULT_CRYPTO@
  bin_SCRIPTS = xmlsec1-config
 diff --git a/configure.ac b/configure.ac
-index 8fb8740..67905b5 100644
+index b8770ad..721e4ca 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -230,8 +230,8 @@ dnl find libxml
+@@ -227,8 +227,8 @@ dnl find libxml
  dnl ==========================================================================
  LIBXML_MIN_VERSION="2.7.4"
  LIBXML_CONFIG="xml2-config"
@@ -55,7 +55,7 @@ index 8fb8740..67905b5 100644
  LIBXML_FOUND="no"
  AC_ARG_WITH(libxml, 
      [  --with-libxml=[PFX]       libxml2 location]
-@@ -240,6 +240,8 @@ AC_ARG_WITH(libxml-src,
+@@ -237,6 +237,8 @@ AC_ARG_WITH(libxml-src,
      [  --with-libxml-src=[PFX]   not installed yet libxml2 location]
  )
  
@@ -64,7 +64,7 @@ index 8fb8740..67905b5 100644
  if test "z$with_libxml" = "zno" -o "z$with_libxml_src" = "zno"; then 
      AC_MSG_CHECKING(for libxml2 libraries >= $LIBXML_MIN_VERSION) 
      AC_MSG_ERROR(libxml2 >= $LIBXML_MIN_VERSION is required for $XMLSEC_PACKAGE)
-@@ -288,6 +290,8 @@ if test "z$LIBXML_FOUND" = "zno" ; then
+@@ -285,6 +287,8 @@ if test "z$LIBXML_FOUND" = "zno" ; then
      fi
  fi
  
@@ -73,7 +73,7 @@ index 8fb8740..67905b5 100644
  AC_SUBST(LIBXML_CFLAGS)
  AC_SUBST(LIBXML_LIBS)
  AC_SUBST(LIBXML_CONFIG)
-@@ -601,12 +605,26 @@ dnl ==========================================================================
+@@ -598,12 +602,26 @@ dnl ==========================================================================
  XMLSEC_NO_NSS="1"
  SEAMONKEY_MIN_VERSION="1.0"
  MOZILLA_MIN_VERSION="1.4"
@@ -102,7 +102,7 @@ index 8fb8740..67905b5 100644
  NSS_CRYPTO_LIB="$XMLSEC_PACKAGE-nss"
  NSS_FOUND="no"
  NSPR_PACKAGE=mozilla-nspr
-@@ -633,6 +651,16 @@ elif test "z$with_nss" = "z" -a "z$with_nspr" = "z" -a "z$with_mozilla_ver" = "z
+@@ -630,6 +648,16 @@ elif test "z$with_nss" = "z" -a "z$with_nspr" = "z" -a "z$with_mozilla_ver" = "z
      dnl We are going to try all options
      dnl
      if test "z$NSS_FOUND" = "zno" ; then
@@ -119,7 +119,7 @@ index 8fb8740..67905b5 100644
          PKG_CHECK_MODULES(NSS, seamonkey-nspr >= $NSPR_MIN_VERSION seamonkey-nss >= $SEAMONKEY_MIN_VERSION,
      	    [NSS_FOUND=yes NSPR_PACKAGE=seamonkey-nspr NSS_PACKAGE=seamonkey-nss],
  	    [NSS_FOUND=no])
-@@ -664,8 +692,8 @@ if test "z$NSS_FOUND" = "zno" ; then
+@@ -661,8 +689,8 @@ if test "z$NSS_FOUND" = "zno" ; then
          ac_mozilla_name=mozilla-$MOZILLA_MIN_VERSION
      fi
  
@@ -130,7 +130,7 @@ index 8fb8740..67905b5 100644
  
      AC_MSG_CHECKING(for nspr libraries >= $NSPR_MIN_VERSION)
      NSPR_INCLUDES_FOUND="no"
-@@ -686,21 +714,21 @@ if test "z$NSS_FOUND" = "zno" ; then
+@@ -683,21 +711,21 @@ if test "z$NSS_FOUND" = "zno" ; then
  	NSPR_PRINIT_H="$with_nspr/include/prinit.h"
      else
  	for dir in $ac_nss_inc_dir ; do
@@ -156,7 +156,7 @@ index 8fb8740..67905b5 100644
  		dnl do not add -L/usr/lib because compiler does it anyway
          	if test "z$dir" = "z/usr/lib" ; then
              	    NSPR_LIBS="$NSPR_LIBS_LIST"
-@@ -771,7 +799,7 @@ if test "z$NSS_FOUND" = "zno" ; then
+@@ -768,7 +796,7 @@ if test "z$NSS_FOUND" = "zno" ; then
          done
         
          for dir in $ac_nss_lib_dir ; do
@@ -166,7 +166,7 @@ index 8fb8740..67905b5 100644
      		if test "z$dir" = "z/usr/lib" ; then
          	    NSS_LIBS="$NSS_LIBS_LIST"
 diff --git a/win32/Makefile.msvc b/win32/Makefile.msvc
-index e3d5262..978336e 100644
+index 8c887a1..bbc661a 100644
 --- a/win32/Makefile.msvc
 +++ b/win32/Makefile.msvc
 @@ -394,7 +394,7 @@ APP_LIBS  		= $(SOLIBS) $(XMLSEC_CRYPTO_SOLIBS)
diff --git a/external/libxmlsec/xmlsec1-customkeymanage.patch.1 b/external/libxmlsec/xmlsec1-customkeymanage.patch.1
index f80b9940944e..a0eb1e35c1f5 100644
--- a/external/libxmlsec/xmlsec1-customkeymanage.patch.1
+++ b/external/libxmlsec/xmlsec1-customkeymanage.patch.1
@@ -1,4 +1,4 @@
-From b902d273b54981681ee9896a015bb5bef71a4c0b Mon Sep 17 00:00:00 2001
+From e0264063089c9821acf81ea8f1086c8e1147a89c Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:19:12 +0100
 Subject: [PATCH] xmlsec1-customkeymanage.patch
@@ -32,10 +32,10 @@ Conflicts:
  src/nss/pkikeys.c                   |  51 ++-
  src/nss/symkeys.c                   | 705 ++++++++++++++++++++++++++++--
  src/nss/tokens.c                    | 548 ++++++++++++++++++++++++
- src/nss/x509.c                      | 565 +++++-------------------
+ src/nss/x509.c                      | 564 +++++-------------------
  src/nss/x509vfy.c                   | 291 ++++---------
  win32/Makefile.msvc                 |   4 +
- 22 files changed, 3034 insertions(+), 969 deletions(-)
+ 22 files changed, 3034 insertions(+), 968 deletions(-)
  create mode 100644 include/xmlsec/mscrypto/akmngr.h
  create mode 100644 include/xmlsec/nss/akmngr.h
  create mode 100644 include/xmlsec/nss/ciphers.h
@@ -57,10 +57,10 @@ index 18dff94..44837b6 100644
  certkeys.h \
  crypto.h \
 diff --git a/include/xmlsec/mscrypto/Makefile.in b/include/xmlsec/mscrypto/Makefile.in
-index 3b22b00..b2eac50 100644
+index f010d55..0ce0613 100644
 --- a/include/xmlsec/mscrypto/Makefile.in
 +++ b/include/xmlsec/mscrypto/Makefile.in
-@@ -397,6 +397,7 @@ top_srcdir = @top_srcdir@
+@@ -396,6 +396,7 @@ top_srcdir = @top_srcdir@
  NULL = 
  xmlsecmscryptoincdir = $(includedir)/xmlsec1/xmlsec/mscrypto
  xmlsecmscryptoinc_HEADERS = \
@@ -160,10 +160,10 @@ index e352162..997ca7f 100644
  
  install-exec-hook:
 diff --git a/include/xmlsec/nss/Makefile.in b/include/xmlsec/nss/Makefile.in
-index e7098c6..2f1e318 100644
+index 68aceff..86d5efe 100644
 --- a/include/xmlsec/nss/Makefile.in
 +++ b/include/xmlsec/nss/Makefile.in
-@@ -404,6 +404,9 @@ bignum.h \
+@@ -403,6 +403,9 @@ bignum.h \
  keysstore.h \
  pkikeys.h \
  x509.h \
@@ -765,7 +765,7 @@ index 8cd8586..a14199e 100644
  
  if SHAREDLIB_HACK
 diff --git a/src/nss/Makefile.in b/src/nss/Makefile.in
-index 5a1393d..5613f5b 100644
+index 0e9c5b7..8461341 100644
 --- a/src/nss/Makefile.in
 +++ b/src/nss/Makefile.in
 @@ -135,7 +135,8 @@ am__DEPENDENCIES_1 =
@@ -787,7 +787,7 @@ index 5a1393d..5613f5b 100644
  	$(am__objects_1) $(am__objects_2)
  libxmlsec1_nss_la_OBJECTS = $(am_libxmlsec1_nss_la_OBJECTS)
  AM_V_lt = $(am__v_lt_@AM_V@)
-@@ -464,6 +467,7 @@ libxmlsec1_nss_la_CPPFLAGS = \
+@@ -463,6 +466,7 @@ libxmlsec1_nss_la_CPPFLAGS = \
  libxmlsec1_nss_la_SOURCES = app.c bignum.c ciphers.c crypto.c \
  	digests.c hmac.c pkikeys.c signatures.c symkeys.c x509.c \
  	x509vfy.c keysstore.c keytrans.c kw_des.c kw_aes.c globals.h \
@@ -795,7 +795,7 @@ index 5a1393d..5613f5b 100644
  	$(NULL) $(am__append_1)
  libxmlsec1_nss_la_LIBADD = \
  	$(NSS_LIBS) \
-@@ -584,6 +588,8 @@ distclean-compile:
+@@ -583,6 +587,8 @@ distclean-compile:
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-symkeys.Plo@am__quote@
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-x509.Plo@am__quote@
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-x509vfy.Plo@am__quote@
@@ -804,7 +804,7 @@ index 5a1393d..5613f5b 100644
  
  .c.o:
  @am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
-@@ -616,6 +622,20 @@ libxmlsec1_nss_la-app.lo: app.c
+@@ -615,6 +621,20 @@ libxmlsec1_nss_la-app.lo: app.c
  @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
  @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-app.lo `test -f 'app.c' || echo '$(srcdir)/'`app.c
  
@@ -3760,18 +3760,10 @@ index 0000000..e27d1e4
 +}
 +
 diff --git a/src/nss/x509.c b/src/nss/x509.c
-index 887c77c..749bbde 100644
+index 1bb0fed..66b571a 100644
 --- a/src/nss/x509.c
 +++ b/src/nss/x509.c
-@@ -34,7 +34,6 @@
- #include <xmlsec/keys.h>
- #include <xmlsec/keyinfo.h>
- #include <xmlsec/keysmngr.h>
--#include <xmlsec/x509.h>
- #include <xmlsec/base64.h>
- #include <xmlsec/errors.h>
- 
-@@ -61,33 +60,18 @@ static int              xmlSecNssX509DataNodeRead               (xmlSecKeyDataPt
+@@ -61,33 +61,18 @@ static int              xmlSecNssX509DataNodeRead               (xmlSecKeyDataPt
  static int              xmlSecNssX509CertificateNodeRead        (xmlSecKeyDataPtr data,
                                                                   xmlNodePtr node,
                                                                   xmlSecKeyInfoCtxPtr keyInfoCtx);
@@ -3805,7 +3797,7 @@ index 887c77c..749bbde 100644
  static int              xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data,
                                                                  xmlSecKeyPtr key,
                                                                  xmlSecKeyInfoCtxPtr keyInfoCtx);
-@@ -104,9 +88,6 @@ static CERTSignedCrl*   xmlSecNssX509CrlBase64DerRead           (xmlChar* buf,
+@@ -104,9 +89,6 @@ static CERTSignedCrl*   xmlSecNssX509CrlBase64DerRead           (xmlChar* buf,
                                                                   xmlSecKeyInfoCtxPtr keyInfoCtx);
  static xmlChar*         xmlSecNssX509CrlBase64DerWrite          (CERTSignedCrl* crl,
                                                                   int base64LineWrap);
@@ -3815,7 +3807,7 @@ index 887c77c..749bbde 100644
  static void             xmlSecNssX509CertDebugDump              (CERTCertificate* cert,
                                                                   FILE* output);
  static void             xmlSecNssX509CertDebugXmlDump           (CERTCertificate* cert,
-@@ -748,31 +729,22 @@ static int
+@@ -748,31 +730,22 @@ static int
  xmlSecNssKeyDataX509XmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key,
                                  xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
      xmlSecKeyDataPtr data;
@@ -3832,7 +3824,7 @@ index 887c77c..749bbde 100644
      xmlSecAssert2(node != NULL, -1);
      xmlSecAssert2(keyInfoCtx != NULL, -1);
  
--    content = xmlSecX509DataGetNodeContent (node, 1, keyInfoCtx);
+-    content = xmlSecX509DataGetNodeContent (node, keyInfoCtx);
 -    if (content < 0) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
@@ -3844,7 +3836,7 @@ index 887c77c..749bbde 100644
 -        /* by default we are writing certificates and crls */
 -        content = XMLSEC_X509DATA_DEFAULT;
 +    /* todo: flag in ctx remove all existing content */
-+    if(0) {
++    if (0) {
 +        xmlNodeSetContent(node, NULL);
      }
  
@@ -3852,7 +3844,7 @@ index 887c77c..749bbde 100644
      data = xmlSecKeyGetData(key, id);
      if(data == NULL) {
          /* no x509 data in the key */
-@@ -792,79 +764,74 @@ xmlSecNssKeyDataX509XmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key,
+@@ -792,79 +765,74 @@ xmlSecNssKeyDataX509XmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key,
              return(-1);
          }
  
@@ -3876,8 +3868,8 @@ index 887c77c..749bbde 100644
 -        if((content & XMLSEC_X509DATA_SUBJECTNAME_NODE) != 0) {
 -            ret = xmlSecNssX509SubjectNameNodeWrite(cert, node, keyInfoCtx);
 -            if(ret < 0) {
-+       cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs);
-+       if(cur == NULL) {
++        cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs);
++        if(cur == NULL) {
                  xmlSecError(XMLSEC_ERRORS_HERE,
                              xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
 -                            "xmlSecNssX509SubjectNameNodeWrite",
@@ -3983,7 +3975,7 @@ index 887c77c..749bbde 100644
      }
  
      return(0);
-@@ -1054,46 +1021,6 @@ xmlSecNssX509CertificateNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecK
+@@ -1054,46 +1022,6 @@ xmlSecNssX509CertificateNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecK
  }
  
  static int
@@ -4006,11 +3998,11 @@ index 887c77c..749bbde 100644
 -        return(-1);
 -    }
 -
--    cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs);
+-    cur = xmlSecEnsureEmptyChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs);
 -    if(cur == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    NULL,
--                    "xmlSecAddChild",
+-                    "xmlSecEnsureEmptyChild",
 -                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -                    "node=%s",
 -                    xmlSecErrorsSafeString(xmlSecNodeX509Certificate));
@@ -4030,7 +4022,7 @@ index 887c77c..749bbde 100644
  xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
      xmlSecKeyDataStorePtr x509Store;
      xmlChar* subject;
-@@ -1116,19 +1043,13 @@ xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecK
+@@ -1116,19 +1044,13 @@ xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecK
      }
  
      subject = xmlNodeGetContent(node);
@@ -4051,7 +4043,7 @@ index 887c77c..749bbde 100644
      }
  
      cert = xmlSecNssX509StoreFindCert(x509Store, subject, NULL, NULL, NULL, keyInfoCtx);
-@@ -1166,40 +1087,6 @@ xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecK
+@@ -1166,40 +1088,6 @@ xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecK
  }
  
  static int
@@ -4072,11 +4064,11 @@ index 887c77c..749bbde 100644
 -        return(-1);
 -    }
 -
--    cur = xmlSecAddChild(node, xmlSecNodeX509SubjectName, xmlSecDSigNs);
+-    cur = xmlSecEnsureEmptyChild(node, xmlSecNodeX509SubjectName, xmlSecDSigNs);
 -    if(cur == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -            NULL,
--            "xmlSecAddChild",
+-            "xmlSecEnsureEmptyChild",
 -            XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -            "node=%s",
 -            xmlSecErrorsSafeString(xmlSecNodeX509SubjectName));
@@ -4092,7 +4084,7 @@ index 887c77c..749bbde 100644
  xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
      xmlSecKeyDataStorePtr x509Store;
      xmlNodePtr cur;
-@@ -1224,21 +1111,9 @@ xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSec
+@@ -1224,21 +1112,9 @@ xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSec
      }
  
      cur = xmlSecGetNextElementNode(node->children);
@@ -4115,7 +4107,7 @@ index 887c77c..749bbde 100644
          xmlSecError(XMLSEC_ERRORS_HERE,
                      xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
                      xmlSecErrorsSafeString(xmlSecNodeX509IssuerName),
-@@ -1333,78 +1208,6 @@ xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSec
+@@ -1333,78 +1209,6 @@ xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSec
  }
  
  static int
@@ -4129,33 +4121,33 @@ index 887c77c..749bbde 100644
 -    xmlSecAssert2(node != NULL, -1);
 -
 -    /* create xml nodes */
--    cur = xmlSecAddChild(node, xmlSecNodeX509IssuerSerial, xmlSecDSigNs);
+-    cur = xmlSecEnsureEmptyChild(node, xmlSecNodeX509IssuerSerial, xmlSecDSigNs);
 -    if(cur == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    NULL,
--                    "xmlSecAddChild",
+-                    "xmlSecEnsureEmptyChild",
 -                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -                    "node=%s",
 -                    xmlSecErrorsSafeString(xmlSecNodeX509IssuerSerial));
 -        return(-1);
 -    }
 -
--    issuerNameNode = xmlSecAddChild(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs);
+-    issuerNameNode = xmlSecEnsureEmptyChild(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs);
 -    if(issuerNameNode == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    NULL,
--                    "xmlSecAddChild",
+-                    "xmlSecEnsureEmptyChild",
 -                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -                    "node=%s",
 -                    xmlSecErrorsSafeString(xmlSecNodeX509IssuerName));
 -        return(-1);
 -    }
 -
--    issuerNumberNode = xmlSecAddChild(cur, xmlSecNodeX509SerialNumber, xmlSecDSigNs);
+-    issuerNumberNode = xmlSecEnsureEmptyChild(cur, xmlSecNodeX509SerialNumber, xmlSecDSigNs);
 -    if(issuerNumberNode == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    NULL,
--                    "xmlSecAddChild",
+-                    "xmlSecEnsureEmptyChild",
 -                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -                    "node=%s",
 -                    xmlSecErrorsSafeString(xmlSecNodeX509SerialNumber));
@@ -4194,7 +4186,7 @@ index 887c77c..749bbde 100644
  xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
      xmlSecKeyDataStorePtr x509Store;
      xmlChar* ski;
-@@ -1427,11 +1230,7 @@ xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
+@@ -1427,11 +1231,7 @@ xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
      }
  
      ski = xmlNodeGetContent(node);
@@ -4207,7 +4199,7 @@ index 887c77c..749bbde 100644
              xmlSecError(XMLSEC_ERRORS_HERE,
                          xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
                          xmlSecErrorsSafeString(xmlSecNodeGetName(node)),
-@@ -1439,8 +1238,6 @@ xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
+@@ -1439,8 +1239,6 @@ xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
                          "node=%s",
                          xmlSecErrorsSafeString(xmlSecNodeX509SKI));
              return(-1);
@@ -4216,7 +4208,7 @@ index 887c77c..749bbde 100644
      }
  
      cert = xmlSecNssX509StoreFindCert(x509Store, NULL, NULL, NULL, ski, keyInfoCtx);
-@@ -1476,41 +1273,6 @@ xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
+@@ -1476,41 +1274,6 @@ xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
  }
  
  static int
@@ -4237,11 +4229,11 @@ index 887c77c..749bbde 100644
 -        return(-1);
 -    }
 -
--    cur = xmlSecAddChild(node, xmlSecNodeX509SKI, xmlSecDSigNs);
+-    cur = xmlSecEnsureEmptyChild(node, xmlSecNodeX509SKI, xmlSecDSigNs);
 -    if(cur == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    NULL,
--                    "xmlSecAddChild",
+-                    "xmlSecEnsureEmptyChild",
 -                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -                    "new_node=%s",
 -                    xmlSecErrorsSafeString(xmlSecNodeX509SKI));
@@ -4258,7 +4250,7 @@ index 887c77c..749bbde 100644
  xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
      xmlChar *content;
      CERTSignedCrl* crl;
-@@ -1520,19 +1282,13 @@ xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
+@@ -1520,19 +1283,13 @@ xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
      xmlSecAssert2(keyInfoCtx != NULL, -1);
  
      content = xmlNodeGetContent(node);
@@ -4279,7 +4271,7 @@ index 887c77c..749bbde 100644
      }
  
      crl = xmlSecNssX509CrlBase64DerRead(content, keyInfoCtx);
-@@ -1552,47 +1308,6 @@ xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
+@@ -1552,47 +1309,6 @@ xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCt
  }
  
  static int
@@ -4302,11 +4294,11 @@ index 887c77c..749bbde 100644
 -        return(-1);
 -    }
 -
--    cur = xmlSecAddChild(node, xmlSecNodeX509CRL, xmlSecDSigNs);
+-    cur = xmlSecEnsureEmptyChild(node, xmlSecNodeX509CRL, xmlSecDSigNs);
 -    if(cur == NULL) {
 -        xmlSecError(XMLSEC_ERRORS_HERE,
 -                    NULL,
--                    "xmlSecAddChild",
+-                    "xmlSecEnsureEmptyChild",
 -                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
 -                    "new_node=%s",
 -                    xmlSecErrorsSafeString(xmlSecNodeX509CRL));
@@ -4327,7 +4319,7 @@ index 887c77c..749bbde 100644
  xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
                                      xmlSecKeyInfoCtxPtr keyInfoCtx) {
      xmlSecNssX509DataCtxPtr ctx;
-@@ -1601,6 +1316,10 @@ xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
+@@ -1601,6 +1317,10 @@ xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
      SECStatus status;
      PRTime notBefore, notAfter;
  
@@ -4338,7 +4330,7 @@ index 887c77c..749bbde 100644
      xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataX509Id), -1);
      xmlSecAssert2(key != NULL, -1);
      xmlSecAssert2(keyInfoCtx != NULL, -1);
-@@ -1632,10 +1351,14 @@ xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
+@@ -1632,10 +1352,14 @@ xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
                              xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
                              "CERT_DupCertificate",
                              XMLSEC_ERRORS_R_CRYPTO_FAILED,
@@ -4354,7 +4346,7 @@ index 887c77c..749bbde 100644
              keyValue = xmlSecNssX509CertGetKey(ctx->keyCert);
              if(keyValue == NULL) {
                  xmlSecError(XMLSEC_ERRORS_HERE,
-@@ -1645,6 +1368,54 @@ xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
+@@ -1645,6 +1369,54 @@ xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
                              XMLSEC_ERRORS_NO_MESSAGE);
                  return(-1);
              }
@@ -4409,7 +4401,7 @@ index 887c77c..749bbde 100644
  
              /* verify that the key matches our expectations */
              if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), keyValue) != 1) {
-@@ -1946,108 +1717,6 @@ xmlSecNssX509CrlBase64DerWrite(CERTSignedCrl* crl, int base64LineWrap) {
+@@ -1946,108 +1718,6 @@ xmlSecNssX509CrlBase64DerWrite(CERTSignedCrl* crl, int base64LineWrap) {
      return(res);
  }
  
diff --git a/external/libxmlsec/xmlsec1-mingw-keymgr-mscrypto.patch.1 b/external/libxmlsec/xmlsec1-mingw-keymgr-mscrypto.patch.1
index bab4d00df364..31e3f070a865 100644
--- a/external/libxmlsec/xmlsec1-mingw-keymgr-mscrypto.patch.1
+++ b/external/libxmlsec/xmlsec1-mingw-keymgr-mscrypto.patch.1
@@ -1,4 +1,4 @@
-From 37e2cf159580f9b4e737dfe650f30981f92ad381 Mon Sep 17 00:00:00 2001
+From f7c31f73a103226c9f8b334f071d70243e27f6ff Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:11:52 +0100
 Subject: [PATCH] xmlsec1-mingw-keymgr-mscrypto.patch
@@ -23,7 +23,7 @@ index 5cea654..3dc6452 100644
  
  if SHAREDLIB_HACK
 diff --git a/src/mscrypto/Makefile.in b/src/mscrypto/Makefile.in
-index d542fe4..f682964 100644
+index f8ad32b..36c4765 100644
 --- a/src/mscrypto/Makefile.in
 +++ b/src/mscrypto/Makefile.in
 @@ -135,7 +135,8 @@ am__DEPENDENCIES_1 =
@@ -46,7 +46,7 @@ index d542fe4..f682964 100644
  	$(am__objects_2)
  libxmlsec1_mscrypto_la_OBJECTS = $(am_libxmlsec1_mscrypto_la_OBJECTS)
  AM_V_lt = $(am__v_lt_@AM_V@)
-@@ -472,6 +474,7 @@ libxmlsec1_mscrypto_la_CPPFLAGS = \
+@@ -471,6 +473,7 @@ libxmlsec1_mscrypto_la_CPPFLAGS = \
  libxmlsec1_mscrypto_la_SOURCES = globals.h private.h app.c certkeys.c \
  	ciphers.c crypto.c digests.c hmac.c keysstore.c kw_aes.c \
  	kw_des.c kt_rsa.c signatures.c symkeys.c x509.c x509vfy.c \
@@ -54,7 +54,7 @@ index d542fe4..f682964 100644
  	csp_calg.h csp_oid.h xmlsec-mingw.h $(NULL) $(am__append_1)
  libxmlsec1_mscrypto_la_LIBADD = \
  	$(MSCRYPTO_LIBS) \
-@@ -592,6 +595,7 @@ distclean-compile:
+@@ -591,6 +594,7 @@ distclean-compile:
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-symkeys.Plo@am__quote@
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-x509.Plo@am__quote@
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-x509vfy.Plo@am__quote@
@@ -62,7 +62,7 @@ index d542fe4..f682964 100644
  
  .c.o:
  @am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
-@@ -624,6 +628,13 @@ libxmlsec1_mscrypto_la-app.lo: app.c
+@@ -623,6 +627,13 @@ libxmlsec1_mscrypto_la-app.lo: app.c
  @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
  @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_mscrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_mscrypto_la-app.lo `test -f 'app.c' || echo '$(srcdir)/'`app.c
  
diff --git a/external/libxmlsec/xmlsec1-noverify.patch.1 b/external/libxmlsec/xmlsec1-noverify.patch.1
index 479fe88d35d0..07b5398ab7e8 100644
--- a/external/libxmlsec/xmlsec1-noverify.patch.1
+++ b/external/libxmlsec/xmlsec1-noverify.patch.1
@@ -1,4 +1,4 @@
-From d2b22f265df84d605338546b457aec4fb0888861 Mon Sep 17 00:00:00 2001
+From 06564ccc3e2484553a23a2595d48b0ef3445497b Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:10:16 +0100
 Subject: [PATCH] xmlsec1-noverify.patch
diff --git a/external/libxmlsec/xmlsec1-nssdisablecallbacks.patch.1 b/external/libxmlsec/xmlsec1-nssdisablecallbacks.patch.1
index f68be69b0964..9215a2fd6f6a 100644
--- a/external/libxmlsec/xmlsec1-nssdisablecallbacks.patch.1
+++ b/external/libxmlsec/xmlsec1-nssdisablecallbacks.patch.1
@@ -1,4 +1,4 @@
-From 7904a285f91af7e33e73ffa36c2f0a77030fd822 Mon Sep 17 00:00:00 2001
+From b317891749a5dd23ad75ce289ac1a318851bda0d Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:09:10 +0100
 Subject: [PATCH] xmlsec1-nssdisablecallbacks.patch
diff --git a/external/libxmlsec/xmlsec1-nssmangleciphers.patch.1 b/external/libxmlsec/xmlsec1-nssmangleciphers.patch.1
index d3bb506cebcf..ea5088fcea97 100644
--- a/external/libxmlsec/xmlsec1-nssmangleciphers.patch.1
+++ b/external/libxmlsec/xmlsec1-nssmangleciphers.patch.1
@@ -1,4 +1,4 @@
-From e91666c3d84ca8e945f0a8f408365496cfba0a22 Mon Sep 17 00:00:00 2001
+From 31942f69c090c27ec6c36f1fd36a5967c7ca9f74 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:09:39 +0100
 Subject: [PATCH] xmlsec1-nssmangleciphers.patch
diff --git a/external/libxmlsec/xmlsec1-vc.patch.1 b/external/libxmlsec/xmlsec1-vc.patch.1
index c4f9307b3b29..0c8475a79194 100644
--- a/external/libxmlsec/xmlsec1-vc.patch.1
+++ b/external/libxmlsec/xmlsec1-vc.patch.1
@@ -1,14 +1,14 @@
-From 8586bb027cde6713a9048472917c75095e186643 Mon Sep 17 00:00:00 2001
+From c821fea172b4ffdb60f65867862dd48049589ea6 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:12:29 +0100
 Subject: [PATCH] xmlsec1-vc.patch
 
 ---
- win32/Makefile.msvc | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
+ win32/Makefile.msvc | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/win32/Makefile.msvc b/win32/Makefile.msvc
-index 978336e..a474592 100644
+index bbc661a..a474592 100644
 --- a/win32/Makefile.msvc
 +++ b/win32/Makefile.msvc
 @@ -311,6 +311,10 @@ CFLAGS 			= $(CFLAGS) /D PACKAGE=\"$(XMLSEC_NAME)\"
diff --git a/external/libxmlsec/xmlsec1-win32-fix-undeclared.patch.1 b/external/libxmlsec/xmlsec1-win32-fix-undeclared.patch.1
deleted file mode 100644
index ed4b47e5f73d..000000000000
--- a/external/libxmlsec/xmlsec1-win32-fix-undeclared.patch.1
+++ /dev/null
@@ -1,31 +0,0 @@
-From 9481001992e12300db1a264144569ee1a2c4e24e Mon Sep 17 00:00:00 2001
-From: Miklos Vajna <vmiklos@collabora.co.uk>
-Date: Fri, 8 Jul 2016 09:56:59 +0200
-Subject: [PATCH] win32: fix undeclared XMLSEC_DEFAULT_CRYPTO
-
-The problem was that APP_CFLAGS is not used for src/xmlsec.c, but it now
-uses the identifier. This wasn't a problem on Linux, where commit
-29da6cbb8f161ad01ff69ee5f8f6ec5d9f3dfab5 (replace XMLSEC_CRYPTO define
-with xmlSecGetDefaultCrypto() function, 2016-02-06) updated
-src/Makefile.am to include XMLSEC_DEFAULT_CRYPTO in the generic
-AM_CFLAGS.
----
- win32/Makefile.msvc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/win32/Makefile.msvc b/win32/Makefile.msvc
-index e3d5262..8c887a1 100644
---- a/win32/Makefile.msvc
-+++ b/win32/Makefile.msvc
-@@ -334,7 +334,7 @@ CFLAGS 			= $(CFLAGS) /DXMLSEC_MSCRYPTO_NT4=1
- !else 
- !endif
- 
--APP_CFLAGS		= /D "XMLSEC_DEFAULT_CRYPTO=\"$(XMLSEC_DEFAULT_CRYPTO)\""
-+CFLAGS			= $(CFLAGS) /D "XMLSEC_DEFAULT_CRYPTO=\"$(XMLSEC_DEFAULT_CRYPTO)\""
- !if "$(WITH_DL)" == "1"
- CFLAGS			= $(CFLAGS) /D "XMLSEC_DL_WIN32"
- APP_CFLAGS		= $(APP_CFLAGS) /D "XMLSEC_CRYPTO_DYNAMIC_LOADING"
--- 
-2.6.6
-