Package com.pd4ml.pdf.sign.ltv

Class LtvUpdater

java.lang.Object

com.pd4ml.pdf.sign.ltv.LtvUpdater

public final class LtvUpdater
extends java.lang.Object

Adds PAdES-LT ("Long Term Validation") information to an already-signed PDF: a /DSS (Document Security Store) dictionary at /Root/DSS holding the OCSP responses, CRLs and certificates needed to validate one or more signatures long after their signing certificates -- or even the TSA's -- may have expired or been revoked, plus a /VRI (Validation Related Information) entry keyed by the hex-uppercase SHA-1 of the target signature's exact /Contents bytes (ETSI TS 102 778-4 / ISO 32000-2 §12.8.4.3).

This is applied as its own incremental update, layered on top of an already-complete signed PDF (typically the byte[] from SignResult.getSignedPdf()) -- it never touches the signature itself, so it never invalidates it. Call it once per signature that needs LTV; each call appends another revision.

Two entry points: addLtv(byte[], byte[], java.security.cert.Certificate[], com.pd4ml.pdf.sign.ltv.LtvOptions) does the whole job, including fetching OCSP/CRL over the network via RevocationFetcher. If you already have the revocation data (your own fetcher, a cache, a corporate proxy), build a RevocationFetcher.Result yourself and call embedValidationInformation(byte[], byte[], java.security.cert.Certificate[], com.pd4ml.pdf.sign.ltv.RevocationFetcher.Result) directly -- the COS/PDF plumbing is the same either way.

Caveat: if the signature being extended was applied with SigningOptions.CertificationLevel.NO_CHANGES_ALLOWED, a strict DocMDP-checking validator may flag this (or any) subsequent incremental update as a disallowed modification, even though nothing about the signed content changed. There is no DocMDP permission level that carves out "LTV additions only"; this is a known tension in the PAdES/DocMDP model, not something this class can route around.

Method Summary

Modifier and Type	Method	Description
static byte[]	addLtv(byte[] signedPdf, byte[] cmsSignature, java.security.cert.Certificate[] certificateChain, LtvOptions options)	Fetches OCSP/CRL for certificateChain (via RevocationFetcher) and embeds it, plus the chain itself, as LTV information for the signature whose CMS bytes are cmsSignature.
static byte[]	embedValidationInformation(byte[] signedPdf, byte[] cmsSignature, java.security.cert.Certificate[] certificateChain, RevocationFetcher.Result revocationData)	Embeds already-fetched revocation data (see addLtv(byte[], byte[], java.security.cert.Certificate[], com.pd4ml.pdf.sign.ltv.LtvOptions) for the all-in-one version).

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

addLtv

public static byte[] addLtv(byte[] signedPdf,
                            byte[] cmsSignature,
                            java.security.cert.Certificate[] certificateChain,
                            LtvOptions options)
                     throws PdfSigningException

Fetches OCSP/CRL for certificateChain (via RevocationFetcher) and embeds it, plus the chain itself, as LTV information for the signature whose CMS bytes are cmsSignature.

Parameters:

signedPdf - the signed PDF, e.g. SignResult.getSignedPdf()

cmsSignature - the exact CMS/PKCS#7 bytes embedded as that signature's /Contents, e.g. SignResult.getCmsSignature()

certificateChain - the signing certificate and its issuer chain, e.g. SigningIdentity.getCertificateChain()

options - revocation-fetching behavior, or null for the defaults

Throws:

PdfSigningException

embedValidationInformation

public static byte[] embedValidationInformation(byte[] signedPdf,
                                                byte[] cmsSignature,
                                                java.security.cert.Certificate[] certificateChain,
                                                RevocationFetcher.Result revocationData)
                                         throws PdfSigningException

Embeds already-fetched revocation data (see addLtv(byte[], byte[], java.security.cert.Certificate[], com.pd4ml.pdf.sign.ltv.LtvOptions) for the all-in-one version). certificateChain is embedded into /DSS/Certs regardless of whether revocationData has anything in it -- PAdES-LT validators generally expect the chain to be present in the DSS even though it can usually also be recovered from the CMS SignedData's own certificate set.

Throws:

PdfSigningException