WORK AROUND

I will not be integrating this into the code unless the customer acknowledges it.
Also, since their initial request was just a workaround, probably we can also consider the case closed if they are happy with it.
                                     

SUGGESTED FIX

diff --git a/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java b/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java
--- a/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java
+++ b/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java
@@ -31,6 +31,10 @@ import org.w3c.dom.NodeList;
 import org.w3c.dom.NodeList;
 
 public abstract class ApacheCanonicalizer extends TransformService {
+
+    static {
+        com.sun.org.apache.xml.internal.security.Init.init();
+    }
 
     private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
     protected Canonicalizer apacheCanonicalizer;
diff --git a/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheTransform.java b/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheTransform.java
--- a/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheTransform.java
+++ b/src/share/classes/org/jcp/xml/dsig/internal/dom/ApacheTransform.java
@@ -32,6 +32,10 @@ import javax.xml.crypto.dsig.spec.Transf
  * @author Erwin van der Koogh
  */
 public abstract class ApacheTransform extends TransformService {
+
+    static {
+        com.sun.org.apache.xml.internal.security.Init.init();
+    }
 
     private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
     private Transform apacheTransform;
                                     

WORK AROUND

The problem can also be worked around if you use a later version of the Apache XML Security libaries with JDK 6. I discuss how to do this in my blog entry at: http://blogs.sun.com/mullan/entry/using_more_recent_apache_xml

These are the steps:

1) Download xml-security-bin-1_4_3.zip from http://santuario.apache.org/mirrors.cgi and unzip it.

2) Copy xml-security-1_4_3/libs/xmlsec-1.4.3.jar to <java-home>/lib/endorsed

3) Download commons-logging-1.1.1-bin.zip from http://commons.apache.org/logging/download_logging.cgi and unzip it.

4) Copy commons-logging-1.1.1/commons-logging-1.1.1.jar to <java-home>/lib/endorsed

5) Run your test. You should no longer get an exception.
                                     

EVALUATION

I have identified the cause of the problem. The internal Canonicalization and Transform implementations were not invoking the com.sun.org.apache.xml.internal.security.Init.init() method. This method initializes variables and so forth. A NullPointerException was being thrown due to this. I have pasted a patch to the Suggested Fix.
                                     

WORK AROUND

Here is another very simple workaround:

If you add the following line to your code:

com.sun.org.apache.xml.internal.security.Init.init();

before invoking any of the XML Signature APIs, then the exception does not occur. You can also invoke this method in a static initializer, ex:

static {
    com.sun.org.apache.xml.internal.security.Init.init();
}
                                     

WORK AROUND

The bug has been fixed in JDK 7 so you can use that as a workaround. I'm not quite sure what the specific fix is, since JDK 7 uses a more recent version of Apache XML Security where the problem does not occur. I need to debug the problem further to see if it is practical to backport a fix to JDK 6.