diff -Nru xmltooling-3.2.1/debian/changelog xmltooling-3.2.1/debian/changelog
--- xmltooling-3.2.1/debian/changelog	2022-01-12 11:45:42.000000000 +0000
+++ xmltooling-3.2.1/debian/changelog	2022-03-13 23:27:18.000000000 +0000
@@ -1,3 +1,10 @@
+xmltooling (3.2.1-1ubuntu2) jammy; urgency=medium
+
+  * d/patches/lp-1957166-harder.patch: Remove tests that download obsolete
+    certificates from upstream git. 
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Mon, 14 Mar 2022 12:27:18 +1300
+
 xmltooling (3.2.1-1ubuntu1) jammy; urgency=medium
 
   * Regenerate xmltoolingtest/data/test.pfx to use 3DES, as RC2 is disabled
diff -Nru xmltooling-3.2.1/debian/patches/lp-1957166-harder.patch xmltooling-3.2.1/debian/patches/lp-1957166-harder.patch
--- xmltooling-3.2.1/debian/patches/lp-1957166-harder.patch	1970-01-01 00:00:00.000000000 +0000
+++ xmltooling-3.2.1/debian/patches/lp-1957166-harder.patch	2022-03-13 23:27:16.000000000 +0000
@@ -0,0 +1,56 @@
+--- a/xmltoolingtest/SecurityHelperTest.h
++++ b/xmltoolingtest/SecurityHelperTest.h
+@@ -67,22 +67,6 @@
+         TSM_ASSERT("Different keys matched", !SecurityHelper::matches(*key3.get(), *key4.get()));
+     }
+ 
+-    void testKeysFromURLs() {
+-        skipNetworked();
+-        string pathname = data_path + "key.pem.bak";
+-        scoped_ptr<SOAPTransport> t1(getTransport("https://test.shibboleth.net/git/view/?p=cpp-xmltooling.git&a=blob_plain&hb=HEAD&f=xmltoolingtest/data/key.pem"));
+-        scoped_ptr<XSECCryptoKey> key1(SecurityHelper::loadKeyFromURL(*t1.get(), pathname.c_str()));
+-        pathname = data_path + "key.der.bak";
+-        scoped_ptr<SOAPTransport> t2(getTransport("https://test.shibboleth.net/git/view/?p=cpp-xmltooling.git&a=blob_plain&hb=HEAD&f=xmltoolingtest/data/key.der"));
+-        scoped_ptr<XSECCryptoKey> key2(SecurityHelper::loadKeyFromURL(*t2.get(), pathname.c_str()));
+-        pathname = data_path + "test.pfx.bak";
+-        scoped_ptr<SOAPTransport> t3(getTransport("https://test.shibboleth.net/git/view/?p=cpp-xmltooling.git&a=blob_plain&hb=HEAD&f=xmltoolingtest/data/test.pfx"));
+-        scoped_ptr<XSECCryptoKey> key3(SecurityHelper::loadKeyFromURL(*t3.get(), pathname.c_str(), nullptr, "password"));
+-
+-        TSM_ASSERT("PEM/DER keys did not match", SecurityHelper::matches(*key1.get(), *key2.get()));
+-        TSM_ASSERT("DER/PKCS12 keys did not match", SecurityHelper::matches(*key2.get(), *key3.get()));
+-    }
+-
+     void testCertificatesFromFiles() {
+         string pathname = data_path + "cert.pem";
+         SecurityHelper::loadCertificatesFromFile(certs, pathname.c_str());
+@@ -117,30 +101,5 @@
+ 
+         for_each(certs.begin(), certs.end(), xmltooling::cleanup<XSECCryptoX509>());
+         certs.clear();
+-    }
+-
+-    void testCertificatesFromURLs() {
+-        skipNetworked();
+-        string pathname = data_path + "cert.pem.bak";
+-        scoped_ptr<SOAPTransport> t1(getTransport("https://test.shibboleth.net/git/view/?p=cpp-xmltooling.git&a=blob_plain&hb=HEAD&f=xmltoolingtest/data/cert.pem"));
+-        SecurityHelper::loadCertificatesFromURL(certs, *t1.get(), pathname.c_str());
+-        pathname = data_path + "cert.der.bak";
+-        scoped_ptr<SOAPTransport> t2(getTransport("https://test.shibboleth.net/git/view/?p=cpp-xmltooling.git&a=blob_plain&hb=HEAD&f=xmltoolingtest/data/cert.der"));
+-        SecurityHelper::loadCertificatesFromURL(certs, *t2.get(), pathname.c_str());
+-        pathname = data_path + "test.pfx.bak";
+-        scoped_ptr<SOAPTransport> t3(getTransport("https://test.shibboleth.net/git/view/?p=cpp-xmltooling.git&a=blob_plain&hb=HEAD&f=xmltoolingtest/data/test.pfx"));
+-        SecurityHelper::loadCertificatesFromURL(certs, *t3.get(), pathname.c_str(), nullptr, "password");
+-
+-        TSM_ASSERT_EQUALS("Wrong certificate count", certs.size(), 3);
+-
+-        scoped_ptr<XSECCryptoKey> key1(certs[0]->clonePublicKey());
+-        scoped_ptr<XSECCryptoKey> key2(certs[0]->clonePublicKey());
+-        scoped_ptr<XSECCryptoKey> key3(certs[0]->clonePublicKey());
+-
+-        TSM_ASSERT("PEM/DER keys did not match", SecurityHelper::matches(*key1.get(), *key2.get()));
+-        TSM_ASSERT("DER/PKCS12 keys did not match", SecurityHelper::matches(*key2.get(), *key3.get()));
+-
+-        for_each(certs.begin(), certs.end(), xmltooling::cleanup<XSECCryptoX509>());
+-        certs.clear();
+     }
+ };
diff -Nru xmltooling-3.2.1/debian/patches/series xmltooling-3.2.1/debian/patches/series
--- xmltooling-3.2.1/debian/patches/series	1970-01-01 00:00:00.000000000 +0000
+++ xmltooling-3.2.1/debian/patches/series	2022-03-13 23:26:44.000000000 +0000
@@ -0,0 +1 @@
+lp-1957166-harder.patch