You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2018/10/29 18:00:24 UTC
svn commit: r1845156 -
/pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
Author: tilman
Date: Mon Oct 29 18:00:24 2018
New Revision: 1845156
URL: http://svn.apache.org/viewvc?rev=1845156&view=rev
Log:
PDFBOX-3017: refactor TimestampToken validation
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
Modified: pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
URL: http://svn.apache.org/viewvc/pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java?rev=1845156&r1=1845155&r2=1845156&view=diff
==============================================================================
--- pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java (original)
+++ pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java Mon Oct 29 18:00:24 2018
@@ -245,17 +245,7 @@ public final class ShowSignature
System.err.println("ETSI.RFC3161 timestamp signature verification failed");
}
- // https://stackoverflow.com/questions/42114742/
- Collection<X509CertificateHolder> tstMatches
- = timeStampToken.getCertificates().getMatches(timeStampToken.getSID());
- X509CertificateHolder holder = tstMatches.iterator().next();
- X509Certificate tstCert = new JcaX509CertificateConverter().getCertificate(holder);
- SignerInformationVerifier siv = new JcaSimpleSignerInfoVerifierBuilder().setProvider(SecurityProvider.getProvider()).build(tstCert);
- timeStampToken.validate(siv);
- System.out.println("TimeStampToken validated");
-
- //TODO check certificate chain, revocation lists, etc
- // verifyPKCS7(hash, contents, sig) does not work
+ validateTimestampToken(timeStampToken);
}
else
{
@@ -333,14 +323,7 @@ public final class ShowSignature
CMSSignedData signedTSTData = new CMSSignedData(obj.getEncoded());
TimeStampToken timeStampToken = new TimeStampToken(signedTSTData);
- // https://stackoverflow.com/questions/42114742/
- Collection<X509CertificateHolder> tstMatches =
- timeStampToken.getCertificates().getMatches(timeStampToken.getSID());
- X509CertificateHolder holder = tstMatches.iterator().next();
- X509Certificate tstCert = new JcaX509CertificateConverter().getCertificate(holder);
- SignerInformationVerifier siv = new JcaSimpleSignerInfoVerifierBuilder().setProvider(SecurityProvider.getProvider()).build(tstCert);
- timeStampToken.validate(siv);
- System.out.println("TimeStampToken validated");
+ validateTimestampToken(timeStampToken);
}
try
@@ -409,6 +392,19 @@ public final class ShowSignature
}
}
+ private void validateTimestampToken(TimeStampToken timeStampToken)
+ throws StoreException, IOException, CertificateException, TSPException, OperatorCreationException
+ {
+ // https://stackoverflow.com/questions/42114742/
+ Collection<X509CertificateHolder> tstMatches =
+ timeStampToken.getCertificates().getMatches(timeStampToken.getSID());
+ X509CertificateHolder holder = tstMatches.iterator().next();
+ X509Certificate tstCert = new JcaX509CertificateConverter().getCertificate(holder);
+ SignerInformationVerifier siv = new JcaSimpleSignerInfoVerifierBuilder().setProvider(SecurityProvider.getProvider()).build(tstCert);
+ timeStampToken.validate(siv);
+ System.out.println("TimeStampToken validated");
+ }
+
/**
* Analyzes the DSS-Dictionary (Document Security Store) of the document. Which is used for
* signature validation. The DSS is defined in PAdES Part 4 - Long Term Validation.