XML Signature using an XPath filter

Question

I want to sign an XML document, just based on the content of a particular element in the document. Based on the jwsdp docs it looked pretty simple, but I'm getting strange results. I'll get the same digest value in the SignedInfo for different Xpath filter strings.
Anybody out there have good luck trying to sign XML documents using Xpath filters?
I'm using JDK 1.5.05 and JWSDP 1.6.
Here is my simple XML doc
<?xml version="1.0" encoding="UTF-8"?>
<myns:whole_doc xmlns:myns="http://namespace.myns.com/test"
attr1="attr_one" attr2="attr_two" attr3="attr_three">
<myns:part_one attr="attr_one">
<myns:tag1>this is part_one tag_one</myns:tag1>
<myns:tag2>this is part_one tag_two</myns:tag2>
</myns:part_one>
<myns:part_two attr="attr_two">
<myns:tag1>this is part_two tag_one</myns:tag1>
<myns:tag2>this is part_two tag_two</myns:tag2>
</myns:part_two>
<myns:part_three attr="attr_three">
<myns:tag1>this is part_three tag_one</myns:tag1>
<myns:tag2>this is part_three tag_two</myns:tag2>
</myns:part_three>
</myns:whole_doc>
When I use an XPath filter = "/myns:whole_doc/myns:part_one" I get the same digest as when I use "/myns:whole_doc/myns:part_two", which is the same digest when I don't use XPath filtering. See example output below
<?xml version="1.0" encoding="UTF-8" ?>
- <myns:whole_doc xmlns:myns="http://namespace.myns.com/test" attr1="attr_one" attr2="attr_two" attr3="attr_three">
- <myns:part_one attr="attr_one">
</myns:part_three>
- <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
- <SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" />
- <Reference URI="">
- <Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
- <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
<XPath>/myns:whole_doc/myns:part_two</XPath>
</Transform>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>9D5CFDkWd9bHx65txuHOeXWeTns=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>D686H//H5A0zDrlQx8+0fBNpVeJGgWdTXivlI8S/+WqB/E4oBYzeIQ==</SignatureValue>
</Signature>
</myns:whole_doc>

Answer 1

It took me all day, but I did find the answer.
When using XPath filters in references, you can't use XPath exactly the way you would use XPath to find nodes in a document. I can't exactly explain why, but it has to do with the fact that the XPath statement is acting as a filter.
Anyway, to just include the part_one element from the following abbreviated XML
<myns:whole_doc> .....
<myns:part_one> ..... </myns:part_one>
<myns:part_two> .... </myns:part_two>
</myns:whole_doc>
the XPath statement should be "ancestor-or-self::myns:part_one"
to make sure that part_one was part of whole_doc you could use something like
(ancestor-or-self::node() = /myns:whole_doc/myns:part_one)
This allows me to sign a document, but still allow portions outside of whole_doc/part_one to change.