CMS Signature Validation Reports

The standalone CMS APIs expose every primary SignerInfo and recursively nested counterSignature in deterministic document order

Signer graph

HPDFParseCMSSignatures returns all primary signer records, whilst HPDFVerifyCMSSignaturesEx verifies them against the supplied content stream

HPDFVerifyCMSSignerReport adds recursive countersignatures and identifies each entry by Kind, SignerIndex, ParentSignerIndex, NestingDepth and a stable path such as SignerInfo[0].CounterSignature[1]

THPDFCMSVerifyOptions.MaxSignerCount and MaxCounterSignatureDepth bound work on hostile containers whilst preserving deterministic output

Certificate and evidence report

HPDFBuildCMSValidationReport combines signer verification with caller-controlled offline certificate validation for every signer in the graph

The returned THPDFSignatureValidationReport contains aggregate signature and path results, signer counts, success state, a machine-readable THPDFValidationFailureCode and the complete per-signer THPDFSignatureInfo

Per-signer certificate details include the selected path, trust result, revocation source and timestamps, OCSP nonce decisions, delta and indirect CRL use, effective certificate policies, minimum observed key strengths and algorithm-policy diagnostics

JSON export

HPDFSignatureValidationReportToJSON exports the report as schema version 1 JSON with escaped text values and stable field names suitable for audit logs, policy engines and test automation

The exporter performs no network access and does not modify the report or source stream

Operational guidance

Use explicit trust anchors and set ValidationTime when reproducing a historical validation decision
Use rvmRequire when a successful result must include current offline revocation evidence
Use onpRequireMatch with ExpectedOCSPNonce when the workflow controls the originating OCSP request
Set conservative signer and nesting limits for untrusted CMS input
Persist the JSON report together with the exact signed revision and evidence set when an audit trail must be reproducible