HPDFFinalizeHeadlessDocumentTimestampReservation

function HPDFFinalizeHeadlessDocumentTimestampReservation(Target: TStream;
  const Reservation: THPDFHeadlessSignatureReservation;
  const Options: THPDFHeadlessCMSOptions;
  out SignerCertificatePEM: SysUtils.TBytes): THPDFHeadlessCMSResult;

Finalizes a fresh DocumentTimestamp reservation after the caller has written the complete PDF xref and trailer

Target must remain seekable and read/write; the reservation must come from HPDFWriteHeadlessSignatureReservation with DocumentTimestamp set to true

The function checks object bounds, gap size and delimiters, numeric-slot ordering, and fresh zero-filled range slots before patching

It hashes the actual patched ByteRange, obtains and validates a fresh RFC3161 TSA token, and writes the token with zero reservation padding before an immediate integrity check

The complete token must fit ReservedCMSBytes, and creation requires an explicit trusted TSA configuration and transport

SignerCertificatePEM returns the actual TSA identity for caller-side seed certificate validation before publication

Stream position is restored on success or failure; this low-level helper does not publish files or independently enforce document signature-field policies

Use THPDFHeadlessDocument.TimestampToFile for atomic publication with actual inherited signature seed, DocMDP, FieldMDP, encryption, and field permission checks

Document timestamp workflow · Options