Migrate XML and signature processing to pyuppsala and pybergshamra

docs/usage/examples.rst

@@ -223,6 +223,25 @@ the Signature object.
     - publish: /tmp/idp.xml
     - stats
 
+If the PKCS#11 library exposes several initialized tokens, select one explicitly
+by its token label and, when labels are duplicated, its serial number. For
+example, a Luna HA client configured by ``/etc/Chrystoki.conf`` can use:
+
+.. code-block:: yaml
+
+    - sign:
+        key: pkcs11:///usr/lib/libCryptoki2_64.so/sctest2
+        token_label: sc_ha
+        token_serial: "11429933786539"
+        cert: /etc/credentials/sc-test-md-signer.crt
+
+``token_serial`` is optional when ``token_label`` uniquely identifies the
+token. Alternatively, use ``slot_id`` or the historical ``:slot`` URI suffix,
+for example ``pkcs11:///usr/lib/libCryptoki2_64.so:17/sctest2``. Do not combine
+a slot selector with ``token_label`` or ``token_serial``. The token label selects
+the HSM token; the final URI component (``sctest2`` above) selects the key object
+within that token.
+
 Running this example requires some preparation. Run the 'p11setup.sh' script in the examples directory.
 This results in a SoftHSM token being setup with the PIN 'secret1' and SO_PIN 'secret2'. Now run pyFF (assuming
 you are using a unix-like environment).
@@ -231,4 +250,3 @@ you are using a unix-like environment).
 
     # env PYKCS11PIN=secret1 SOFTHSM_CONF=softhsm.conf pyff --loglevel=DEBUG p11.fd
 
-

pyproject.toml

@@ -19,16 +19,16 @@ dependencies = [
     "accept-types>=0.4.1",
     "apscheduler==3.6.3",
     "cachetools>=5.5.2",
-    "eval-type-backport>=0.2.2 ; python_full_version == '3.9.*'",
+    "cryptography>=42",
     "gunicorn==25.0.3 ; python_full_version >= '3.10'",
     "gunicorn>=23.0.0",
-    "lxml>=4.1.1",
     "mako>=1.3.10",
     "pyconfig>=3.2.3,<3.3.0",
     "pydantic>=2.8",
     "pyramid>=2.0.2",
     "pytz>=2025.2",
-    "pyxmlsecurity>=1.0.0",
+    "pyuppsala>=0.11.0",
+    "pybergshamra>=0.9.0",
     "pyyaml>=3.10",
     "redis>=5.3.0",
     "redis-collections>=0.13.0",

src/pyff/api.py

@@ -11,11 +11,11 @@
 import requests
 from accept_types import AcceptableType
 from cachetools import TTLCache
-from lxml import etree
 from pyramid.config import Configurator
 from pyramid.events import NewRequest
 from pyramid.request import Request
 from pyramid.response import Response
+from pyuppsala import etree
 
 from pyff import __version__
 from pyff.constants import config