Native Linux signing options
The native callback ABI binds document signing constraints to the actual CMS output and generated appearance
Digest and Unicode metadata
The sign operation accepts digestMethod as SHA256, SHA384, or SHA512; the default is SHA256 and the selected value determines the actual CMS signer digest
reason, location, contactInfo, signerName, and legalAttestation accept Unicode strings without embedded NUL characters
Metadata follows the source document string encryption policy, including authenticated AES-256 input
legalAttestation applies to certification signatures and becomes the catalog Legal.Attestation value
Required seed values govern the actual digest, reason, certificate properties, certification permission, legal attestation, appearance profile, revocation information, and timestamp behaviour
Explicit trust bytes
trustedCAPEM, timestampTrustedCAPEM, and timestampTrustedCRLPEM accept PEM bytes in JSON strings
The corresponding legacy path inputs are trustedCAFile, timestampTrustedCAFile, and timestampTrustedCRLFile; supply bytes or a path for each trust source
PEM inputs are held in exclusive private files with mode 0600 for the operation and removed afterward; responses do not expose those generated paths
Signer certificate trust is evaluated only when explicitly configured, whilst CMS integrity verification still checks the actual signature and signing certificate binding
Validated signed revocation information
Supply a revocationInfo object with enabled, certificatesBase64, ocspResponsesBase64, crlsBase64, and trustedCAPEM or trustedCAFile
enabled defaults to true; disabled information cannot include evidence arrays
The arrays contain canonical Base64 strings for complete DER certificates, successful OCSPResponse objects, and CertificateList objects
clockSkewSeconds defaults to 300 and must be between 0 and 86400; maxOCSPAgeSeconds defaults to 86400 and must be positive; requireTimestamp defaults to false
Validation checks signer and included timestamp certificate chains against explicit trust, complete non-root coverage, issuer and serial matching, CRL and OCSP signatures, responder authorization, validity intervals, and revoked status
Malformed, stale, incomplete, untrusted, or revoked evidence fails before PDF publication
Validated evidence becomes the signed CMS attribute 1.2.840.113583.1.1.8, and the result reports revocationInfoEvaluated and revocationInfoValid
signatures.verify accepts the same revocationInfo object to validate the actual embedded signed attribute; caller CRLs and OCSP responses do not replace that attribute during verification
Evidence objects and total bytes share the operation limits, and cryptographic checks use the operation cancellation token
Actual named appearance presets
Supply an appearance object with caption, optional fontFamily, and optional profileName
| profileName | Actual generated style |
|---|---|
| HotPDF.StandardApproval | Centred blue text at 11 points, a rectangle border, a white background, and a single text line |
| HotPDF.StandardCertification | Left-aligned black text at 10 points, a rectangle border, a white background, and multiline wrapping |
| HotPDF.Compact | Right-aligned black text at 8 points, no painted background or border, and a single text line |
The preset determines its style and font size; an unknown profile fails instead of labelling an arbitrary appearance
A required AppearanceFilter matches the actual profile generated during the current operation; a previously loaded appearance must be regenerated
Without profileName, fontSize defaults to 12; legacy top-level caption, fontFamily, and fontSize remain supported
Do not combine a top-level caption with an appearance object
Application transport provenance
credentialSourceURL states the credential provenance asserted by the application supplying the identity, and timestampServerURL states the endpoint provenance asserted by its timestamp callback
These values are compared with corresponding required seed constraints; they do not retrieve credentials, access a remote server, or independently authenticate HTTPS endpoint identity
The application controls identity retrieval and transport authentication
timestampServerURL requires an actual callback in hpdf_signing_operation_v1, and the returned RFC 3161 response must pass signature-imprint, nonce, TSA certificate purpose, explicit trust, and requested revocation checks
Signing workflows · Timestamp transport · Seed constraints · Appearance profiles