Add advanced PAdES and long-term signature validation
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 15/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Active
- Domain
- cryptography, security
Research direction
No implementation files or tests are named; this issue explicitly says not to implement the epic directly. Start by defining the target PAdES profiles and validation requirements, then split the work into focused child issues. Coordinate with #8335, #8943, #8944, and #8945, with automated regression and interoperability tests as the completion criteria.
Written by the indexing model from the issue text.
Description
This is a roadmap and funding epic.
[!IMPORTANT]
Do not implement this epic directly.
This issue is for planning, research and funding of the PAdES and validation capabilities needed by future remote-signing, eIDAS and long-term document workflows.
Implementation should be split into focused child issues after each profile and validation requirement is clearly defined.
Background
External signing changes where the private-key operation happens, but it does not remove the need for correct PDF, CMS and PAdES processing.
Future eIDAS and long-term validation use cases may require stronger signature profiles, timestamps, revocation information and validation evidence.
These capabilities belong in the signing and validation layers, not in CSC, QTSP or hardware-provider integrations.
Goal
Extend LibreSign's PAdES and validation capabilities so that remote and local external signing can use the same standards-compliant document layer.
Areas to evaluate
The roadmap should evaluate and, where required, implement:
- PAdES baseline profiles;
- timestamp support;
- certificate and chain validation;
- OCSP and CRL handling;
- embedding validation material for long-term validation;
- preservation of existing signatures during incremental updates;
- validation at signing time;
- long-term validation behavior;
- interoperability with independent PDF signature validators.
The exact target profiles, including B-B, B-T, B-LT and B-LTA, must be selected based on real use cases and standards requirements before implementation starts.
Why this matters
A remote signature is only useful if the resulting document remains interoperable and verifiable.
Keeping these capabilities in a common PAdES layer means that CSC, eIDAS trust services, HSMs and physical certificates can all reuse the same document implementation.
Business and funding value
Long-lived documents, public-sector workflows, regulated organizations and archival processes often require stronger validation guarantees than a basic digital signature.
Funding this work improves LibreSign for all signing methods, not only one provider or certificate type.
Dependencies
This epic can progress incrementally, but its priorities should be coordinated with:
- #8335;
- #8943 CSC support;
- #8944 eIDAS trust service interoperability;
- #8945 local and hardware-backed signing.
Out of scope
Provider authentication, credential discovery, OAuth and hardware communication are not part of this epic.
Done when
The selected PAdES profiles and validation requirements are implemented with automated regression and interoperability tests and can be reused by local and remote signing providers.
- Dominant language
- PHP
- Stars
- 828
- Forks
- 159
- Avg merge
- 7h 43m
- Merged PRs (30d)
- 537
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from LibreSign/libresign
-
Difficulty 1/5 Under an hour Newbie friendliness 83/100
LibreSign/libresign#9007 · 1 reaction ·
Maintainers usually reply within 1 day
-
backend enhancement php
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Validation page says "This document is valid" for a document with no signaturePossibly taken @maia-andre claimed this 7 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
LibreSign/libresign#8284 · 5 comments ·
Maintainers usually reply within 1 day
-
backend php
Difficulty 5/5 Over a week Newbie friendliness 25/100
Maintainers usually reply within 1 day
All issues in LibreSign/libresign
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 2 days
-
backend bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
smarty-php/smarty#1215 ·
-
sync-en
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day