mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-28 03:58:45 -06:00
0079bead14
* M9: validate a document timestamp that sits in a signature field Documenso (and others) store the document timestamp as an AcroForm signature field (`Timestamp_1`) whose /V is a /Type /DocTimeStamp dictionary. Field values only went through the signature validator, which read the RFC 3161 token as a CMS signature, compared its TSTInfo with the document digest and reported "altered or corrupted since the signature was applied" for an untouched file. - A field value with /SubFilter /ETSI.RFC3161 is validated as a timestamp. - Standalone timestamps are found with /Type /DocTimeStamp (ISO 32000-2 12.8.5) as well as the /Type /Sig older writers used; our own timestamp_document now writes /DocTimeStamp. The discovery cache (#419) selects its candidates with the same test, so it sees both. - The discovery test that lists a signature field holding a timestamp used to assert `doc_timestamp == false`, which is the bug above; it asserts true now. What that test is about (the field is listed once, not also as a standalone timestamp) is unchanged. Regression tests build the same structure with a test TSA; no third-party file is needed, and they fail without the fix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * M9: a trusted TSA whose certificate wasn't valid when it stamped leaves a document timestamp Unknown, never Valid Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>