Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Add eIDAS trust service interoperability

Abierto
  • ¿Algo no está bien?
#8,944 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
20/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Activo
Área
backend-api-design, security

Línea de trabajo

Do not implement this epic directly. Start by reviewing dependencies #8335, #8942, #8943, and #8946, then define the supported eIDAS signature levels, provider integrations, validation requirements, and interoperability tests. Done means those requirements are explicit and focused child issues can guide implementation with external trust services.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

This is a roadmap and funding epic.

[!IMPORTANT]

Do not implement this epic directly.

This issue exists to study, define and fund the work required for LibreSign to interoperate with European eIDAS trust services.

It must be implemented later through focused child issues. Discussion, requirements and references from trust service providers and European users are welcome.

Background

LibreSign is building the foundation for external and remote signing.

Supporting a remote certificate is not by itself the same as supporting the requirements and trust model used in the European eIDAS ecosystem.

LibreSign should integrate with qualified trust service providers instead of trying to become a trust service provider itself.

Goal

Make LibreSign able to use and validate signing services from the European eIDAS trust ecosystem through open and interoperable mechanisms.

The exact supported eIDAS signature levels and validation requirements must be defined during this epic before implementation starts.

Expected areas of work

This epic may include:

  • interoperability with Qualified Trust Service Providers (QTSPs);
  • remote signing through standards-based provider integrations such as CSC;
  • use of qualified certificates where applicable;
  • support for remote QSCD-based signing flows where provided by the trust service;
  • PAdES requirements needed by the selected eIDAS use cases;
  • certificate chain and revocation validation;
  • trusted service status and European Trusted List integration where required;
  • timestamp and long-term validation requirements where required;
  • interoperability testing with European services.

Important boundary

LibreSign should orchestrate the document signing process and integrate with trust services.

It should not claim to issue qualified certificates, operate a QSCD or become a QTSP unless that is ever addressed as a completely separate project.

Why this matters

Organizations using Nextcloud and LibreSign should be able to keep their document workflows under their own control while using trusted European signing services when a higher assurance level is required.

This creates a practical open-source bridge between self-hosted collaboration and the European digital trust ecosystem.

Business and funding value

This is directly relevant to European public administrations, companies and other organizations that need open digital signing workflows but rely on qualified external trust services for certificate and key operations.

It is also a strong candidate for public-interest and European digital sovereignty funding because the result remains reusable free software and is not tied to one QTSP.

Potential funders and validation partners include:

  • European organizations that already use LibreSign or Nextcloud;
  • QTSPs interested in open-source integrations;
  • public administrations and SMEs that need self-hosted signing workflows;
  • digital sovereignty and open infrastructure funds.

Dependencies

This epic depends on:

  • #8335;
  • #8942 for the remote signing provider architecture;
  • #8943 for CSC support where CSC is selected for a target trust service;
  • #8946 for the required PAdES and validation capabilities.

Out of scope

This epic does not promise generic “eIDAS compliance” without defining the supported signature level and validation scope.

Each supported level must have explicit technical requirements, tests and validation criteria.

Done when

LibreSign can complete and validate the agreed eIDAS-oriented signing workflows with independent European trust services, with the private key remaining under the control of the external qualified service when required.

Lenguaje dominante
PHP
Estrellas
838
Forks
171
Merge medio
1 d 3 h
PR fusionados (30 d)
414

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de LibreSign/libresign

Todos los issues de LibreSign/libresign

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.