<?xml version="1.0" encoding="UTF-8"?>
<!--
  any-containing-xmldsig.rnc
  
  This RELAX NG schema allows any document containing valid signatures.
  
  The first four definitions specify what is allowed as a root elemnet 
  and what is allowed as a foreign element.  A schema dedicated to 
  enveloping signatures can be obtained by using "start = ds_Signature" 
  instead of "start = anyForeignElementOrSignature".
-->
<grammar xmlns="http://relaxng.org/ns/structure/1.0">
  <start>
    <ref name="anyForeignElementOrSignature"/>
  </start>
  <define name="anyForeignElementOrSignature">
    <choice>
      <element>
        <anyName>
          <except>
            <nsName ns="http://www.w3.org/2000/09/xmldsig#"/>
          </except>
        </anyName>
        <mixed>
          <zeroOrMore>
            <ref name="anyAttribute"/>
          </zeroOrMore>
          <zeroOrMore>
            <ref name="anyForeignElementOrSignature"/>
          </zeroOrMore>
        </mixed>
      </element>
      <ref name="ds_Signature"/>
    </choice>
  </define>
  <define name="ds_anyForeignElement">
    <element>
      <anyName>
        <except>
          <nsName ns="http://www.w3.org/2000/09/xmldsig#"/>
        </except>
      </anyName>
      <mixed>
        <zeroOrMore>
          <ref name="anyAttribute"/>
        </zeroOrMore>
        <zeroOrMore>
          <ref name="anyElement"/>
        </zeroOrMore>
      </mixed>
    </element>
  </define>
  <include href="any.rng"/>
  <include href="xmldsig-core-schema.rng"/>
  <include href="xmldsig-allowAnyForeign.rng"/>
</grammar>
