Native signature validation evidence

HPDFHeadlessLTV vets certificate chains and DER OCSP or CRL evidence before a document security store is added to a signed PDF

AddSignatureValidationEvidence verifies the original PDF ByteRanges, CMS signature, trusted signer chain and required RFC3161 signature timestamp, then checks revocation coverage for every non-anchor certificate in the signer and TSA chains

OCSP verification checks the responder signature, chain and authorisation, complete issuer-name and issuer-key certificate identifiers, serial numbers, good status, producedAt, thisUpdate, nextUpdate and configured freshness windows; revoked, unknown, unrelated, duplicated, stale, future or unauthenticated responses are rejected

CRL verification uses an isolated store for each supplied issuer list and checks its issuer, signature, scope, validity window and certificate revocation status; an older CRL loaded through another source cannot replace the actual supplied evidence

The catalog DSS contains global Certs, OCSPs and CRLs arrays, with a VRI entry referencing verified evidence for the selected signature; its uppercase SHA-1 key covers the complete Contents string, including reserved zero padding, as required for the PDF VRI index

SHA-1 is used only for the prescribed VRI index or a supplied OCSP certificate identifier; it does not select the PDF signer, TSA, responder or certificate signature algorithm

The writer retains the original signed bytes and existing DSS entries and appends an incremental revision; Standard AES-256 sources keep encryption for newly generated evidence streams, subject to modification permission or owner authentication

Trust and evidence checks use the current verification clock; this API does not provide historical validation after certificate expiry or add a document timestamp protecting later DSS revisions

DSS data added after a signature is outside that signature's ByteRange; independently authenticate the embedded evidence whenever it is used, and reach for a later signature or document timestamp when an authenticated archival revision is required

Resource and failure behaviour

Explicit caller-provided trust roots are mandatory, and the timestamp requirement defaults to True; initialise THPDFHeadlessLTVOptions with Default

Byte, object, decoded-stream, output and cancellation limits are checked before graph publication; rejected evidence leaves the document unchanged and SaveToFile publishes through the existing atomic writer

Acceptance

Run-HeadlessLTVTests.sh, Run-HeadlessLTVTests-Windows.cmd and Run-HeadlessLTVTests-Delphi.ps1 exercise actual OpenSSL OCSP, CRL, CMS and local RFC3161 responses on Linux and Windows without a desktop or PDF reader

Verify-HeadlessLTV.py independently checks evidence signatures and identifiers with cryptography, DSS/VRI references with pypdf, the signature Contents encryption exception with MuPDF and exact PDF ByteRanges with OpenSSL