Native Linux Signing Workflows

The versioned callback ABI executes schemaVersion 1 sign jobs against loaded documents or explicit input callbacks; original source revisions, document IDs and authenticated AES-256 R5/R6 policies are retained

Signing identity

Supply certificatePEM and privateKeyPEM, or supply canonical padded pfxBase64 and pfxPassword; mixing these identity forms is invalid

password authenticates explicit PDF input; a loaded context retains its PDF password, and the separate PFX password authenticates the signing container

PFX decoding checks alphabet, padding and unused bits before OpenSSL parses the bounded container; private identity buffers are cleared once the operation completes

Signature fields and appearance

field selects an existing unsigned signature field; set createField: true to create a new fully qualified field name on zero-based page

New field coordinates use PDF user space: left, bottom, right and top default to 36, 36, 240 and 108; an existing name cannot be recreated

An optional caption generates an explicit Unicode appearance with an embedded TrueType font, ToUnicode mapping and native complex-script shaping; fontFamily defaults to DejaVu Sans and fontSize to 12

Profile and certification

cades selects ETSI.CAdES.detached; trustedCAFile supplies an explicit CA policy for sign-time trust verification, and reservedCMSBytes defaults to 16384

certificationPermission is 0 for an approval signature or 1, 2 or 3 for a first-document certification signature; the writer creates the matching DocMDP transform and catalog permission binding

User-password permission restrictions, read-only fields, existing signatures and certification constraints remain enforced by the native document signing policy

Transactional publication

The portable Pascal TimestampToFile API creates an independent DocTimeStamp with ETSI.RFC3161 over the PDF ByteRange, including its ESIC declaration, explicit TSA trust and CRL policy, and authenticated DocMDP/FieldMDP timestamp exception

This document timestamp entry point is a Pascal API; the ABI timestamp callback below supplies signature timestamps for existing sign jobs

Extended ABI timestamp transport supplies actual RFC 3161 responses through a synchronous caller-owned callback with bounded response bytes, shared cancellation and explicit TSA trust/revocation policy

Output and result callbacks receive a fully prepared signature; before callback publication, the ABI reloads the candidate to validate the signed document context

Only successful publication replaces the loaded context; invalid identities, field creation, budgets, cancellation or callback failure preserve the previous document and its field tree

Output callbacks are caller-owned and may already have consumed bytes when a later callback fails; callers requiring external rollback must stage those bytes themselves

Acceptance

Linux FPC 3.2.2 and 3.3.1 each pass 270 real ctypes assertions, 228 independent PDF/image/security/CMS checks, 33 C ABI assertions and 80 concurrent shared-handle operations

Independent checks authenticate AES IDs/security policies, validate CMS and CAdES with OpenSSL, reject tampered content, inspect certification transforms and embedded appearance fonts, and verify actual visible signature pixels

Native C ABI · Pascal PFX signing · Pascal timestamp transport