[timzifer]

Fixes #193. Stacked on #227 (on #226, #225); merge those first. Follow-up: #228.

API

type SignOptions struct {
	// …
	Timestamp TimestampFunc // B-T: a token over the signature value
}
type TimestampFunc func(ctx context.Context, digest []byte) ([]byte, error)

func (e *Editor) SignContext(ctx context.Context, w io.Writer, opt SignOptions) error
func (e *Editor) Timestamp(ctx context.Context, w io.Writer, ts TimestampFunc) error // ETSI.RFC3161

type Validation struct {
	Certificates []*x509.Certificate
	OCSPs, CRLs  [][]byte // DER
}
func (e *Editor) AddValidation(sig *Signature, v Validation) error // /DSS, B-LT

Details

• B-T (internal/cms.AddTimestamp): the token for the SHA-256 digest of the signer info's signature value becomes the unsigned attribute signature-time-stamp. The function may return the TimeStampToken or the whole TimeStampResp (cms.Token unwraps it, refusing a status other than granted). cms.Stamps checks that the authority signed the token and that it stamps the digest. The room for /Contents grows by 16 KB (timestampRoom; public TSA tokens take 2–8 KB); a larger one gives ErrSignatureRoom. Sign = SignContext(context.Background(), …).
• Document timestamp: Editor.Timestamp writes an update with an invisible signature field whose value is /Type /DocTimeStamp /SubFilter /ETSI.RFC3161, /Contents the token over the byte range. The signing code (signed, signTarget) is shared with Sign.
• B-LT / B-LTA: AddValidation records data; dssPlan writes /DSS (a patch of the catalogue, or of the store where it is an object): /Certs, /OCSPs, /CRLs as Flate streams, and /VRI keyed by the upper-case hex SHA-1 of the signature's /Contents (for a document timestamp: of the token without padding, ETSI EN 319 142-1, 5.4.2.2). Existing entries stay, data already stored is not stored twice (by SHA-256), entries of one signature are merged. A document timestamp in the same or a later update makes it B-LTA.
• Certification: per PDF 2.0, 12.8.2.2.2 a DSS and document timestamps are no change: allowed under DocMDP P=1, and Verify does not count a DocTimeStamp field as Changes.Signed.

Two faults of Verify fixed on the way (found by the corpus run)

• objectCompare.same compared a reference to a page by the page's content: a Link to a page whose /Annots a later signature changed made the first signature report Changes.Annotated. Pages are now compared by their place. (TestSign now checks it.)
• changes() matched fields by name: issue15096.pdf has two fields Group1.Group1, and signing twice reported FormFilled. Fields are now matched by their objects (TestSignSameNames).

Tests

• TestSignTimestamp (token and response forms; refused, another digest, a failing authority, a cancelled context — nothing written), TestDocumentTimestamp (approval and P=1 certification: the earlier signature sees no change; the timestamp verifies, is trusted by the TSA root, covers the file), TestAddValidation (counts in /DSS and /VRI, the VRI key, a second round merged without duplicates under a document timestamp, P=1 still allowed, the key of a timestamp), TestSignSameNames.
• Corpus API step sign now: sign with a timestamp (B-T), add validation data and a document timestamp, verify both. pdf.js corpus: no difference (the first run showed issue15096.pdf, fixed above).
• go test ./... green.

Not done (#228): revocation from /DSS when verifying, the chain of a timestamp authority, streaming the base file while signing, EdDSA/PSS keys, an HTTP client package.