Processing XML node sets

1. A method, comprising:

deriving by a computing device, from an initial representation that describes a node set of an XML document, a derived representation of the node set, the initial representation including an ordered sequence of set manipulations of the XML document, the derived representation including:

a first set of nodes such that all nodes in the node set are included in or descendants of a node in the first set of nodes,

a second set of nodes such that no nodes in the node set are included in or descendants of a node in the second set of nodes, and

a set of node tests that characterize the node set, to be applied to those nodes within the first set of nodes but outside the second set of nodes; and

evaluating the derived representation to compute the node set.

2. The method of claim 1 , further comprising enumerating the node set computed from the derived representation.

3. The method of claim 2 , wherein the node set is enumerated in document order.

4. The method of claim 2 , further comprising signing the enumerated node set.

5. The method of claim 2 , further comprising:

applying a canonicalization algorithm to the enumerated node set to create a byte stream; and

creating at least one of a message digest and a digital signature based on the byte stream.

6. The method of claim 5 , further comprising inserting the at least one of the message digest and the digital signature into the XML document.

7. The method of claim 5 , wherein applying the canonicalization algorithm includes removing comments from the enumerated node set.

8. The method of claim 1 , wherein:

the first set of nodes is defined by a first set of root nodes such that all nodes from the node set are within trees rooted by one of the first set of root nodes, and

the second set of nodes is defined by a second set of root nodes such that no nodes from the node set are within trees rooted by one of the second set of root nodes.

9. The method of claim 1 , further comprising at least one of sorting the first set of nodes to be in document order, and sorting the second set of nodes to be in document order.

10. The method of claim 1 , further comprising applying at least one axiom of algebra to the initial representation to derive the derived representation, without enumerating the initial representation.

11. The method of claim 10 , wherein applying the at least one axiom of algebra to the initial representation to derive the derived representation includes reordering terms of the initial representation.

12. A non-transitory computer-readable medium storing a software program, the software program being executable to provide operations comprising:

deriving, from an initial representation that describes a node set of an XML document, a derived representation of the node set, the initial representation including an ordered sequence of set manipulations of the XML document, the derived representation including:

a first set of nodes such that all nodes in the node set are included in or descendants of a node in the first set of nodes,

a second set of nodes such that no nodes in the node set are included in or descendants of a node in the second set of nodes, and

a set of node tests that characterize the node set to be applied to those nodes within the first set of nodes but outside the second set of nodes; and

evaluating the derived representation to compute the node set.

13. The computer-readable medium of claim 12 , wherein the operations further comprise enumerating the node set computed from the derived representation.

14. The computer-readable medium of claim 12 , wherein the operations further comprise signing the enumerated node set.

15. The computer-readable medium of claim 12 , wherein the operations further comprise

applying a canonicalization algorithm to the enumerated node set to create a byte stream;

creating at least one of a message digest and a digital signature based on the byte stream; and

inserting the at least one of a message digest and a digital signature into the XML document.

16. The computer-readable medium of claim 12 , wherein the operations further comprise applying at least one axiom of algebra to the initial representation to derive the derived representation, without enumerating the initial representation.

17. A system, comprising:

a computing device configured to:

derive, from an initial representation that describes a node set of an XML document, a derived representation of the node set, the initial representation including an ordered sequence of set manipulations of the XML document, the derived representation including:

a first set of nodes such that all nodes in the node set are included in or descendants of a node in the first set of nodes,

a second set of nodes such that no nodes in the node set are included in or descendants of a node in the second set of nodes, and

a set of node tests that characterize the node set to be applied to those nodes within the first set of nodes but outside the second set of nodes; and

evaluate the derived representation to compute the node set.

18. The system of claim 17 wherein the computing device is further configured to enumerate the node set computed from the derived representation.

19. The system of claim 18 wherein the computing device is further configured to sign the enumerated node set.

20. The system of claim 18 wherein the computing device is further configured to:

apply a canonicalization algorithm to the enumerated node set to create a byte stream;

create a digital signature based on the byte stream; and

insert the digital signature into the XML document.

21. The system of claim 19 , wherein the computing device is further configured to:

receive an indication from a user that the node set is to be signed; and

create the digital signature according to a key associated with the user.

22. The system of claim 17 , wherein the computing device is further configured to apply at least one axiom of algebra to the initial representation to derive the derived representation, without enumerating the initial representation.