Native Linux ABI Timestamp Transport

Native Linux signing jobs support actual RFC 3161 timestamp transport through an extended operation record; the original ABI version, operation prefix, exported function and ordinary operation record size stay unchanged

typedef hpdf_status (HPDF_CDECL *hpdf_timestamp_transport_v1)(
    void *user_data, const void *request, size_t request_length,
    const hpdf_io_v1 *response_io);

typedef struct hpdf_signing_operation_v1 {
    hpdf_operation_v1 operation;
    void *timestamp_user_data;
    hpdf_timestamp_transport_v1 timestamp_transport;
} hpdf_signing_operation_v1;

Record and JSON configuration

Initialise the original operation fields and set operation.struct_size to sizeof(hpdf_signing_operation_v1); pass &record.operation to hpdf_document_execute_json_v1 with a schemaVersion 1 sign job and timestamp: true

The extension is 72 bytes on native Linux x86-64; the original hpdf_operation_v1 remains 56 bytes and hpdf_abi_operation_v1_size carries on reporting that original size

timestampTrustedCAFile supplies the TSA trust roots; optional timestampTrustedCRLFile and requireTimestampRevocation activate explicit revocation verification

The callback receives the actual DER timestamp request, including the signature imprint and generated nonce; return actual DER response bytes via the supplied write callback and return an ABI status

Ownership and cancellation

The transport runs synchronously on the calling thread; request bytes, response callback table and response user data are borrowed solely until the transport returns

Poll response_io->is_cancelled during transport work, honour response write failures and enforce network or subprocess deadlines in the application callback

maxTimestampResponseBytes defaults to the lesser of 4194304 bytes and one eighth of the operation working budget; a configured limit must be positive and cannot exceed that working-budget fraction

The library retains a failed or cancelled response write even if the application callback later returns success; timestamp failures preserve the unsigned loaded context and publish nothing signed

Validation and results

The native implementation verifies response status, signature imprint, nonce, TSA certificate purpose, certificate chain and requested revocation policy before adding the signatureTimeStampToken attribute and publishing the signature

Signing results include timestampCount, timestampValid and timestampTrustEvaluated; signatures.verify accepts requireTimestamp and the same explicit TSA trust/revocation options

Acceptance

Both native Linux compilers pass 319 real ctypes assertions, 39 actual C timestamp-client assertions, 33 existing C ABI assertions and 296 independent output checks

Independent OpenSSL verification authenticates the CMS signatures and embedded timestamp tokens, rejects changed signature imprints and revoked TSA certificates, and checks timestamped plain and AES-256 R5/R6 documents

Native signing jobs · Native C ABI · Pascal timestamp transport