URGENT -- fix: Add lxml 6.x compatibility for XML signature namespace handling (#444)

* fix: Add lxml 6.x compatibility for XML signature namespace handling

- Reparse XML after signing to ensure namespaces are correctly associated
  with elements (required for lxml 6.x when using default namespace)
- Update dependency constraints to allow lxml >=5.4.0 and signxml >=4.1.0
- Fix certificate test to use platform-independent temp directory

lxml 6.0 changed how elements with default namespaces (xmlns without prefix)
are handled internally. Elements created with nsmap={None: "..."} no longer
have the namespace in their tag property, causing XPath queries with
namespace prefixes to fail.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Update pyproject.toml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

pynfe/processamento/assinatura.py

@@ -48,7 +48,13 @@ def assinar(self, xml: etree._Element, retorna_string=False) -> Union[str, etree
 
         ref_uri = ("#%s" % reference) if reference else None
         signed_root = signer.sign(xml, key=self.key, cert=self.cert, reference_uri=ref_uri)
+
+        # Reparse to ensure namespaces are correctly associated with elements
+        # This is required for lxml 6.x compatibility when using default namespace (None prefix)
+        signed_xml_str = etree.tostring(signed_root, encoding="unicode", pretty_print=False)
+        signed_root = etree.fromstring(signed_xml_str)
+
         if retorna_string:
-            return etree.tostring(signed_root, encoding="unicode", pretty_print=False)
+            return signed_xml_str
         else:
             return signed_root

pyproject.toml

@@ -21,9 +21,9 @@ line-length = 100
 
 [tool.poetry.dependencies]
 requests = "^2.32.4"
-signxml = "^4.1.0"
-cryptography = "43.0.3"
-lxml = "5.4.0"
+signxml = ">=4.1.0"
+cryptography = ">=43.0.3"
+lxml = ">=5.4.0"
 pyopenssl = "^25.1.0"
 
 [tool.poetry.group.dev.dependencies]

requirements.txt

@@ -1,8 +1,8 @@
 # Dependencias basicas
-requests
-lxml
-signxml
-cryptography
+requests>=2.32.4
+lxml>=5.4.0
+signxml>=4.1.0
+cryptography>=43.0.3
 # Opcional para NFS-e
 #-r requirements-nfse.txt
 # Opcional para Desenvolvimento (Pytest, Ruff, MyPy, etc)

tests/test_certificadoA1.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python
 # *-* encoding: utf8 *-*
 
+import tempfile
 import unittest
 
 from pynfe.entidades.certificado import CertificadoA1
@@ -17,8 +18,9 @@ def test_assinatura_com_caminho(self):
         self.a1 = CertificadoA1(self.certificado_correto)
         cert = self.a1.separar_arquivo(senha=self.senha_correto, caminho=self.certificado_correto)
 
-        self.assertTrue(cert[0].startswith("/tmp/"))
-        self.assertTrue(cert[1].startswith("/tmp/"))
+        temp_dir = tempfile.gettempdir()
+        self.assertTrue(cert[0].startswith(temp_dir))
+        self.assertTrue(cert[1].startswith(temp_dir))
 
         self.a1.excluir()