HPDFVerifyHeadlessDocumentTimestamp
function HPDFVerifyHeadlessDocumentTimestamp(Source: TStream;
const ByteRange: array of Int64; const TokenDER: SysUtils.TBytes;
const Options: THPDFHeadlessCMSOptions): THPDFHeadlessCMSResult;Authenticates a genuine encapsulated RFC3161 document timestamp and binds its signed message imprint to the exact covered source bytes
Integrity always requires one actual TSA signer, the cryptographic CMS signature and signed content digest, authenticated ESS certificate binding, exclusive critical timeStamping EKU, compatible key usage, TSTInfo version 1, and any included TSA signer name
The imprint algorithm is read from authenticated TSTInfo and supports SHA256, SHA384, and SHA512 with absent or NULL algorithm parameters
TokenDER may include only zero bytes after its complete DER token; MaxCMSBytes limits the complete input, including reservation padding
Default options evaluate actual integrity without a certificate trust claim; TimestampValid describes the authenticated timestamp imprint and does not imply certificate trust
A supplied Timestamp.TrustedCAFile, RequireTimestamp, or Timestamp.RequireRevocation invokes explicit RFC 3161 certificate-chain and configured revocation verification; ordinary TrustedCAFile is reserved for approval signatures
UseAdobeRevocationInfo additionally requires the TSA CMS signer to carry a genuine signed Adobe revocation information attribute, with RevocationValidation.TrustedCAFile explicitly authenticating its embedded CRL or OCSP evidence and complete signer-chain coverage
This requirement sets RevocationInfoEvaluated and RevocationInfoValid on success and raises EHPDFHeadlessCMSError for missing, malformed, revoked, expired, incomplete, or untrusted evidence; ordinary TSA CRL verification does not substitute for the required signed attribute
The encapsulated RFC 3161 token itself satisfies the timestamp requirement when validating its embedded evidence, without requiring an additional unsigned signature timestamp attribute
Historical offline verification does not assert that a request nonce was freshly generated; creation checks the actual response against its fresh request
The source position is restored, reads are bounded to 64 KiB, MaxSignedBytes limits covered bytes, and cancellation remains observable during hashing
SignedRevisionLength and UnsignedTrailingBytes identify the covered revision and subsequent bytes; BytesRead reports actual covered hash input
The document wrapper additionally validates DocTimeStamp/ETSI.RFC3161 dictionary types, forbidden entries, and the exact excluded hexadecimal or literal Contents string