dss

package module
v0.0.0-...-7f5ad21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 22, 2026 License: LGPL-2.1 Imports: 23 Imported by: 0

Documentation

Overview

Package dss is a Go port of the EU Digital Signature Services (DSS) library (https://github.com/esig/dss), targeting interoperability compatibility with upstream DSS 6.5: signatures produced here validate in Java DSS and vice versa, and validation verdicts and report schemas match.

This root package is a thin, idiomatic facade over the ported packages. It covers the two paths most applications need - create a signature, validate a signed document - and nothing else. Every function here delegates to the same services the port's own cross-validation harness drives; the facade holds no signature, canonicalization, or validation logic of its own.

Signing

Sign runs the two-step DSS signing dance (compute the data to be signed, then embed the signature value) for one of the six Format values, at one of the four baseline Level values: 

signer, err := dss.OpenPKCS12("keystore.p12", "password")
if err != nil { return err }
defer signer.Close()

doc, err := dss.OpenDocument("contract.pdf")
if err != nil { return err }

signed, err := dss.Sign(doc, signer, dss.SignOptions{
    Format: dss.FormatPAdES,
    Level:  dss.LevelB,
})
if err != nil { return err }
err = signed.Save("contract-signed.pdf")

Extend raises an existing signature to a higher level (B to T, T to LT, and so on).

Validation

Validate auto-detects the document format and runs the full ETSI EN 319 102-1 validation process, returning the DSS reports: 

reports, err := dss.Validate(doc, dss.ValidateOptions{})
if err != nil { return err }
for _, v := range reports.Verdicts() {
    fmt.Println(v.ID, v.Indication, v.SubIndication, v.Qualification)
}

Reports embeds the upstream *reports.Reports, so the full DSS report API - diagnostic data, detailed report, ETSI validation report, and the XML marshalling of each - is available alongside the convenience accessors.

What the facade deliberately leaves out

The facade exposes the common paths only. Anything else - visible PAdES signature appearances, counter-signatures, evidence records, XAdES references and transforms, ASiC filename factories, signature policy stores, custom certificate/revocation sources, trusted-list refresh jobs - is reached through the packages the facade delegates to, which stay fully exported and are documented on their own: github.com/ryftcore/dss-go/dss/cades, github.com/ryftcore/dss-go/dss/xades, github.com/ryftcore/dss-go/dss/pades, github.com/ryftcore/dss-go/dss/jades, github.com/ryftcore/dss-go/dss/asic, github.com/ryftcore/dss-go/dss/validation, github.com/ryftcore/dss-go/dss/tsl and github.com/ryftcore/dss-go/dss/token. Facade types are plain aliases of the underlying ones wherever possible, so mixing the two levels needs no conversion.

Network access

Nothing in this package performs a network request unless you ask for it. The upstream OnlineTSPSource, OnlineCRLSource and OnlineOCSPSource of the Java dss-service module are NOT part of this port, so:

  • Levels T, LT and LTA require a TSPSource you supply (SignOptions.TSPSource). The port ships github.com/ryftcore/dss-go/dss/spi/validation.KeyEntityTSPSource, which issues RFC 3161 tokens from a local key - enough for tests and for a self-hosted TSA, but not an HTTP TSA client.
  • Revocation data for LT and LTA must likewise come from a CRL/OCSP source you set on a CertificateVerifier of your own.
  • Certificate retrieval over AIA is available and is off by default; set ValidateOptions.EnableAIA to turn it on.

Errors

The ported services follow Java DSS and raise unchecked exceptions, which the port turns into panics. Every facade function recovers them and returns them as an error wrapping the original value, so errors.As against the port's error types (for example github.com/ryftcore/dss-go/dss/model.DSSError) keeps working.

Registration

Java DSS discovers format validators, validation policies and cryptographic suites through java.util.ServiceLoader. Go has no such mechanism, so importing this package registers all six format families, the ETSI validation policy and the XML cryptographic suite - which is what makes Validate's format auto-detection work out of the box. Applications that use the underlying packages directly must perform that registration themselves; see github.com/ryftcore/dss-go/dss/validation.RegisterDocumentValidatorFactory and github.com/ryftcore/dss-go/dss/validation/policy.RegisterValidationPolicyFactory.

Where to look next

The examples/ directory holds nine runnable programs, one story each, built on this facade; cmd/esig is a command-line front end built on it too, and is the largest worked example of the API below. The repository README states the feature matrix and the accepted gaps, and PORTING.md the porting conventions.

Index

Examples

Constants

View Source 
const (
	DigestSHA256 = enumerations.DigestAlgorithm_SHA256
	DigestSHA384 = enumerations.DigestAlgorithm_SHA384
	DigestSHA512 = enumerations.DigestAlgorithm_SHA512

	PackagingEnveloped  = enumerations.SignaturePackaging_ENVELOPED
	PackagingEnveloping = enumerations.SignaturePackaging_ENVELOPING
	PackagingDetached   = enumerations.SignaturePackaging_DETACHED

	ContainerASiCS = enumerations.ASiCContainerType_ASiC_S
	ContainerASiCE = enumerations.ASiCContainerType_ASiC_E

	JWSCompact       = enumerations.JWSSerializationType_COMPACT_SERIALIZATION
	JWSJSON          = enumerations.JWSSerializationType_JSON_SERIALIZATION
	JWSFlattenedJSON = enumerations.JWSSerializationType_FLATTENED_JSON_SERIALIZATION

	ValidationBasicSignatures = enumerations.ValidationLevel_BASIC_SIGNATURES
	ValidationTimestamps      = enumerations.ValidationLevel_TIMESTAMPS
	ValidationLongTermData    = enumerations.ValidationLevel_LONG_TERM_DATA
	ValidationArchivalData    = enumerations.ValidationLevel_ARCHIVAL_DATA

	IndicationTotalPassed      = enumerations.Indication_TOTAL_PASSED
	IndicationIndeterminate    = enumerations.Indication_INDETERMINATE
	IndicationTotalFailed      = enumerations.Indication_TOTAL_FAILED
	IndicationNoSignatureFound = enumerations.Indication_NO_SIGNATURE_FOUND
)

Frequently used enumeration values, re-exported so that the common paths need no import of the enumerations package.

Variables

View Source 
var (
	// ErrUnsupportedFormat is returned for a [Format] value the facade does
	// not know.
	ErrUnsupportedFormat = errors.New("dss: unsupported signature format")

	// ErrUnsupportedLevel is returned for a [Level] value the facade does not
	// know.
	ErrUnsupportedLevel = errors.New("dss: unsupported signature level")

	// ErrTSPSourceRequired is returned when levels T, LT or LTA are requested
	// without a TSPSource to obtain the time-stamp tokens from.
	ErrTSPSourceRequired = errors.New("dss: a TSPSource is required for levels T, LT and LTA")

	// ErrMultipleDocuments is returned by [SignMultiple] when more than one
	// document is passed to a format that signs a single document.
	ErrMultipleDocuments = errors.New("dss: only the ASiC formats can sign several documents at once")

	// ErrNoDocument is returned when no document to sign was provided.
	ErrNoDocument = errors.New("dss: at least one document to sign is required")
)

Errors the facade returns in addition to whatever the underlying services report. Match them with errors.Is.

View Source 
var ErrNoKeyEntry = errors.New("dss: the key store holds no private key entry")

ErrNoKeyEntry is returned when a key store holds no usable private key entry.

Functions

This section is empty.

Types

type CertificateSource 

type CertificateSource = spi.CertificateSource

CertificateSource is a source of certificates - a trust store, a trusted-list certificate source produced by the TSL job, and so on.

func TrustStore 

func TrustStore(certificates ...*CertificateToken) CertificateSource

TrustStore builds a trusted CertificateSource holding the given certificates, ready for ValidateOptions.TrustedCertificateSources or for a CertificateVerifier of your own. Certificates in a trusted source are treated as trust anchors: a chain that reaches one is anchored.

A trust store built this way carries no trusted-list information, so it anchors chains but cannot make a signature qualified. For that, use the trusted-list certificate source produced by the TSL validation job of github.com/ryftcore/dss-go/dss/validation/job.

Example

TrustStore turns a set of certificates into trust anchors for validation. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	certificate, err := dss.LoadCertificate("testdata/signer_rsa.cer")
	if err != nil {
		log.Fatal(err)
	}
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificateSources: []dss.CertificateSource{dss.TrustStore(certificate)},
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.Valid())
}

Output:
true

type CertificateToken 

type CertificateToken = model.CertificateToken

CertificateToken is an X.509 certificate as the library models it.

func LoadCertificate 

func LoadCertificate(path string) (*CertificateToken, error)

LoadCertificate reads an X.509 certificate, DER or PEM encoded, from the file at path. Delegates to github.com/ryftcore/dss-go/dss/spi.DSSUtilsLoadCertificate.

Example

LoadCertificate reads a DER or PEM encoded certificate from disk, ready to be used as a trust anchor. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	certificate, err := dss.LoadCertificate("testdata/signer_rsa.cer")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(certificate.Certificate().Subject.CommonName)
}

Output:
Go Port Test RSA

func LoadCertificateBytes 

func LoadCertificateBytes(der []byte) (*CertificateToken, error)

LoadCertificateBytes reads an X.509 certificate, DER or PEM encoded, from memory. Delegates to github.com/ryftcore/dss-go/dss/spi.DSSUtilsLoadCertificateFromBinary.

Example

LoadCertificateBytes is the same for an encoding already in memory. 

package main

import (
	"fmt"
	"log"
	"os"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	der, err := os.ReadFile("testdata/signer_rsa.cer")
	if err != nil {
		log.Fatal(err)
	}
	certificate, err := dss.LoadCertificateBytes(der)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(certificate.IsSelfSigned())
}

Output:
true

type CertificateVerifier 

type CertificateVerifier = spivalidation.CertificateVerifier

CertificateVerifier carries every external source the validation and augmentation processes consult: trust anchors, CRL/OCSP sources, AIA, and the alert policy. Build one with spivalidation.NewCommonCertificateVerifier when the facade options are not enough.

type ContainerType 

type ContainerType = enumerations.ASiCContainerType

ContainerType is the ASiC container flavour: ContainerASiCS or ContainerASiCE.

type DigestAlgorithm 

type DigestAlgorithm = enumerations.DigestAlgorithm

DigestAlgorithm is a message digest algorithm, for example DigestSHA256.

type Document 

type Document = model.DSSDocument

Document is a document handed to or produced by the library. See model.DSSDocument for the implementations (in-memory, file-backed, digest-only).

func Extend 

func Extend(doc Document, opts ExtendOptions) (Document, error)

Extend raises every signature in doc to the requested level - B to T, T to LT, LT to LTA - and returns the augmented document. The signing key is not involved: extension only adds time-stamps and validation data around the existing signature value.

Example

Raise an existing B-level signature to T by adding a time-stamp. The signing key is not needed: extension never touches the signature value. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
	spivalidation "github.com/ryftcore/dss-go/dss/spi/validation"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleTSA turns the test EC key into a local time-stamp authority. A real
// deployment points a TSPSource at its TSA instead; see the package doc on
// what the port ships.
func exampleTSA() dss.TSPSource {
	tsa, err := spivalidation.NewKeyEntityTSPSourceFromKeyStorePath(
		"testdata/tsa_ec.p12", "PKCS12", "testpassword", "", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	tsa.SetTsaPolicy("1.2.3.4.5.6.7.8.9")
	return tsa
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	doc := dss.NewDocument("payload.bin", []byte("payload"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatCAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}

	extended, err := dss.Extend(signed, dss.ExtendOptions{
		Format:    dss.FormatCAdES,
		Level:     dss.LevelT,
		TSPSource: exampleTSA(),
	})
	if err != nil {
		log.Fatal(err)
	}

	reports, err := dss.Validate(extended, dss.ValidateOptions{
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.Verdicts()[0].SignatureLevel)
}

Output:
CAdES-BASELINE-T

func NewDocument 

func NewDocument(name string, content []byte) Document

NewDocument wraps content as an in-memory Document carrying the given name. The name matters: it ends up in the ASiC container entries and in the report's document filename. Delegates to model.NewInMemoryDocumentWithName.

Example

NewDocument wraps bytes already in memory. The name travels with the document into container entries and into the reports. 

package main

import (
	"fmt"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	doc := dss.NewDocument("invoice.xml", []byte("<invoice/>"))
	fmt.Println(doc.Name())
}

Output:
invoice.xml

func OpenDocument 

func OpenDocument(path string) (Document, error)

OpenDocument reads the file at path as a Document. The content is read lazily, on demand, not slurped into memory. Delegates to model.NewFileDocument.

Example

OpenDocument reads a document from disk, lazily. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	doc, err := dss.OpenDocument("testdata/sample.pdf")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(doc.Name(), doc.MimeType())
}

Output:
sample.pdf PDF

func Sign 

func Sign(doc Document, signer *Signer, opts SignOptions) (Document, error)

Sign signs doc and returns the signed document. It runs the two-step DSS signing flow: the selected service computes the data to be signed, the Signer's token produces the signature value over it, and the service embeds that value in the final signature.

The returned document is not written anywhere; call its Save method or read it as a stream.

Example

Sign an XML document with an enveloped XAdES-BASELINE-B signature. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	defer signer.Close()

	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))

	signed, err := dss.Sign(doc, signer, dss.SignOptions{
		Format: dss.FormatXAdES,
		Level:  dss.LevelB,
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(signed.Name())
}

Output:
invoice-signed-xades-baseline-b.xml
Example (Detached)

Sign detached: the signature is a separate file, and validating it later needs the original content back through ValidateOptions.DetachedContents. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	content := dss.NewDocument("payload.bin", []byte("payload"))

	signature, err := dss.Sign(content, signer, dss.SignOptions{
		Format:    dss.FormatCAdES,
		Level:     dss.LevelB,
		Packaging: dss.PackagingDetached,
	})
	if err != nil {
		log.Fatal(err)
	}

	reports, err := dss.Validate(signature, dss.ValidateOptions{
		DetachedContents:    []dss.Document{content},
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(signature.Name(), reports.Verdicts()[0].Indication)
}

Output:
payload-signed-cades-baseline-b.p7s TOTAL_PASSED
Example (Pdf)

Sign a PDF. PAdES ignores SignOptions.Packaging: a PDF signature is always embedded in an incremental update of the document itself. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	doc, err := dss.OpenDocument("testdata/sample.pdf")
	if err != nil {
		log.Fatal(err)
	}

	signed, err := dss.Sign(doc, signer, dss.SignOptions{
		Format: dss.FormatPAdES,
		Level:  dss.LevelB,
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(signed.Name())
}

Output:
sample-signed-pades-baseline-b.pdf
Example (Timestamped)

Sign at level T, which adds a time-stamp over the signature value and therefore needs a TSPSource. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
	spivalidation "github.com/ryftcore/dss-go/dss/spi/validation"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleTSA turns the test EC key into a local time-stamp authority. A real
// deployment points a TSPSource at its TSA instead; see the package doc on
// what the port ships.
func exampleTSA() dss.TSPSource {
	tsa, err := spivalidation.NewKeyEntityTSPSourceFromKeyStorePath(
		"testdata/tsa_ec.p12", "PKCS12", "testpassword", "", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	tsa.SetTsaPolicy("1.2.3.4.5.6.7.8.9")
	return tsa
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	doc := dss.NewDocument("payload.bin", []byte("payload"))

	signed, err := dss.Sign(doc, signer, dss.SignOptions{
		Format:    dss.FormatCAdES,
		Level:     dss.LevelT,
		TSPSource: exampleTSA(),
	})
	if err != nil {
		log.Fatal(err)
	}

	reports, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.Verdicts()[0].SignatureLevel)
}

Output:
CAdES-BASELINE-T

func SignMultiple 

func SignMultiple(docs []Document, signer *Signer, opts SignOptions) (Document, error)

SignMultiple signs several documents into one ASiC container. Only FormatASiCWithCAdES and FormatASiCWithXAdES can cover more than one document; every other format returns ErrMultipleDocuments when given more than one, and behaves exactly like Sign when given one.

Example

Package several documents into one signed ASiC-E container. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	docs := []dss.Document{
		dss.NewDocument("payload.bin", []byte("payload")),
		dss.NewDocument("metadata.json", []byte(`{"amount":42}`)),
	}

	container, err := dss.SignMultiple(docs, signer, dss.SignOptions{
		Format:        dss.FormatASiCWithXAdES,
		Level:         dss.LevelB,
		ContainerType: dss.ContainerASiCE,
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(container.Name())
}

Output:
container-signed-xades-baseline-b.sce

type ExtendOptions 

type ExtendOptions struct {
	// Format is the format family of the signatures in the document.
	// Required: extension has no auto-detection, because the caller has to
	// name the target level in that format's terms anyway.
	Format Format

	// Level is the level to reach. Required, and it must be above the level
	// the signatures currently have.
	Level Level

	// TSPSource issues the time-stamp tokens. Required, since every level
	// reachable by extension is above [LevelB].
	TSPSource TSPSource

	// CertificateVerifier carries the revocation sources and trust anchors
	// [LevelLT] and [LevelLTA] need to collect validation data, and the alert
	// policy that decides what an incomplete collection does. Defaults to an
	// offline [spivalidation.NewCommonCertificateVerifierSimple], which is
	// enough only for [LevelT].
	CertificateVerifier CertificateVerifier

	// DetachedContents supplies the documents a detached signature covers,
	// without which its validation data cannot be collected.
	DetachedContents []Document
}

ExtendOptions configures Extend. Level is the level to raise the existing signatures to; the other fields carry the same meaning as in SignOptions.

type Format 

type Format string

Format identifies a signature format family. It selects which of the ported signature services the facade delegates to. 

const (
	// FormatCAdES is CMS Advanced Electronic Signatures (ETSI EN 319 122),
	// the format for binary content; delegates to
	// [github.com/ryftcore/dss-go/dss/cades].
	FormatCAdES Format = "CAdES"

	// FormatXAdES is XML Advanced Electronic Signatures (ETSI EN 319 132);
	// delegates to [github.com/ryftcore/dss-go/dss/xades].
	FormatXAdES Format = "XAdES"

	// FormatPAdES is PDF Advanced Electronic Signatures (ETSI EN 319 142);
	// delegates to [github.com/ryftcore/dss-go/dss/pades].
	FormatPAdES Format = "PAdES"

	// FormatJAdES is JSON Advanced Electronic Signatures (ETSI TS 119 182);
	// delegates to [github.com/ryftcore/dss-go/dss/jades].
	FormatJAdES Format = "JAdES"

	// FormatASiCWithCAdES is an ASiC container (ETSI EN 319 162) holding
	// CAdES signatures; delegates to
	// [github.com/ryftcore/dss-go/dss/asic/cades].
	FormatASiCWithCAdES Format = "ASiC-CAdES"

	// FormatASiCWithXAdES is an ASiC container (ETSI EN 319 162) holding
	// XAdES signatures; delegates to
	// [github.com/ryftcore/dss-go/dss/asic/xades].
	FormatASiCWithXAdES Format = "ASiC-XAdES"
)

The signature formats the facade can create, extend and validate.

func (Format) BaselineLevel 

func (f Format) BaselineLevel(l Level) (SignatureLevel, error)

BaselineLevel returns the upstream SignatureLevel the format and level pair denotes, for example FormatXAdES.BaselineLevel(LevelLTA) is "XAdES_BASELINE_LTA". It reports ErrUnsupportedFormat or ErrUnsupportedLevel for values outside the two enumerations.

Example

BaselineLevel resolves a facade format and level onto the ETSI signature level the underlying services take. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	level, err := dss.FormatXAdES.BaselineLevel(dss.LevelLTA)
	if err != nil {
		log.Fatal(err)
	}
	// String renders the dash spelling, as Java's toString() does; the
	// underlying value is the Java enum name.
	fmt.Println(level, string(level))

	// An ASiC container carries the levels of the signature format inside it.
	level, err = dss.FormatASiCWithCAdES.BaselineLevel(dss.LevelT)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(level)
}

Output:
XAdES-BASELINE-LTA XAdES_BASELINE_LTA
CAdES-BASELINE-T

func (Format) IsContainer 

func (f Format) IsContainer() bool

IsContainer reports whether the format produces an ASiC container, which is the case exactly for FormatASiCWithCAdES and FormatASiCWithXAdES. Only container formats accept more than one document in SignMultiple.

Example

IsContainer tells the two ASiC formats - the only ones that can cover several documents with one signature - from the rest. 

package main

import (
	"fmt"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	fmt.Println(dss.FormatASiCWithCAdES.IsContainer(), dss.FormatPAdES.IsContainer())
}

Output:
true false

func (Format) String 

func (f Format) String() string

String returns the format name.

Example

String returns the format name. 

package main

import (
	"fmt"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	fmt.Println(dss.FormatJAdES.String())
}

Output:
JAdES

type Indication 

type Indication = enumerations.Indication

Indication is the top-level validation verdict of EN 319 102-1: IndicationTotalPassed, IndicationIndeterminate or IndicationTotalFailed.

type JWSSerializationType 

type JWSSerializationType = enumerations.JWSSerializationType

JWSSerializationType is the JAdES serialization: compact, JSON or flattened JSON.

type Level 

type Level string

Level is a baseline signature level as defined by the ETSI baseline profiles. Higher levels build on the lower ones. 

const (
	// LevelB is the baseline B-B level: the signature itself, with the signed
	// attributes the profile mandates. No time-stamp, no revocation data.
	LevelB Level = "B"

	// LevelT is the baseline B-T level: B plus a trusted time-stamp over the
	// signature value, proving the signature existed at that time. Requires a
	// [TSPSource].
	LevelT Level = "T"

	// LevelLT is the baseline B-LT level: T plus the certificates and
	// revocation data a verifier needs long after the fact. Requires a
	// [TSPSource] and revocation sources on the [CertificateVerifier].
	LevelLT Level = "LT"

	// LevelLTA is the baseline B-LTA level: LT plus an archival time-stamp,
	// which can be renewed to keep the signature verifiable past the
	// cryptographic lifetime of the algorithms used. Requires a [TSPSource].
	LevelLTA Level = "LTA"
)

The four baseline levels.

func (Level) NeedsTimestamp 

func (l Level) NeedsTimestamp() bool

NeedsTimestamp reports whether the level requires a TSPSource, which is the case for every level above LevelB.

Example

NeedsTimestamp reports which levels require a TSPSource. 

package main

import (
	"fmt"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	for _, level := range []dss.Level{dss.LevelB, dss.LevelT, dss.LevelLT, dss.LevelLTA} {
		fmt.Println(level, level.NeedsTimestamp())
	}
}

Output:
B false
T true
LT true
LTA true

func (Level) String 

func (l Level) String() string

String returns the level name.

Example

String returns the level name. 

package main

import (
	"fmt"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	fmt.Println(dss.LevelLTA.String())
}

Output:
LTA

type Reports 

type Reports struct {
	*reports.Reports
}

Reports is what Validate returns: the four DSS validation reports, plus a few accessors for the questions most callers actually have.

It embeds the upstream reports.Reports, so the whole DSS report API stays reachable - GetSimpleReport, GetDetailedReport, GetDiagnosticData, GetEtsiValidationReportJaxb and the JAXB models behind them - without going through this type. The methods declared here add nothing the embedded API cannot express; they only spare the caller the walk.

func Validate 

func Validate(doc Document, opts ValidateOptions) (*Reports, error)

Validate validates every signature, time-stamp and evidence record in doc and returns the DSS reports. The document format is detected automatically - CMS, XML, PDF, JWS or ASiC - so the caller does not name it.

The returned error reports a failure to RUN the validation (an unreadable document, an unsupported format, a broken policy). A signature that does not verify is not an error: it is a verdict, carried by the reports. Check Reports.Valid or read Reports.Verdicts.

Example

Validate a signed document. With no trust anchor the chain reaches nothing trusted, so the verdict is INDETERMINATE rather than a pass - which is the correct answer, not a failure of the library. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	verdict := reports.Verdicts()[0]
	fmt.Println(verdict.Indication, verdict.SubIndication)
}

Output:
INDETERMINATE NO_CERTIFICATE_CHAIN_FOUND
Example (Trusted)

Validate with trust anchors: the same document, now anchored, passes. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificateSources: []dss.CertificateSource{
			dss.TrustStore(signer.CertificateChain()...),
		},
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.Verdicts()[0].Indication)
}

Output:
TOTAL_PASSED

func (*Reports) DetailedReportXML 

func (r *Reports) DetailedReportXML() (string, error)

DetailedReportXML marshals the DetailedReport - every EN 319 102-1 building block and check, with its own conclusion. Passthrough of GetXmlDetailedReport.

Example

DetailedReportXML carries every EN 319 102-1 building block and check. 

package main

import (
	"fmt"
	"log"
	"strings"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	xml, err := reports.DetailedReportXML()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(strings.Contains(xml, "<DetailedReport"))
}

Output:
true

func (*Reports) DiagnosticDataXML 

func (r *Reports) DiagnosticDataXML() (string, error)

DiagnosticDataXML marshals the diagnostic data - the raw facts the process reasoned over: certificates, revocation data, time-stamps, signature properties. Passthrough of GetXmlDiagnosticData.

Example

DiagnosticDataXML carries the raw facts the process reasoned over. 

package main

import (
	"fmt"
	"log"
	"strings"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	xml, err := reports.DiagnosticDataXML()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(strings.Contains(xml, "<DiagnosticData"))
}

Output:
true

func (*Reports) ETSIValidationReportXML 

func (r *Reports) ETSIValidationReportXML() (string, error)

ETSIValidationReportXML marshals the ETSI TS 119 102-2 validation report, the standardised, machine-readable report format. Passthrough of GetXmlValidationReport.

Example

ETSIValidationReportXML is the standardised, machine-readable report. 

package main

import (
	"fmt"
	"log"
	"strings"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	xml, err := reports.ETSIValidationReportXML()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(strings.Contains(xml, "ValidationReport"))
}

Output:
true

func (*Reports) SignatureCount 

func (r *Reports) SignatureCount() int

SignatureCount returns the number of signatures found in the document.

Example

SignatureCount and ValidSignatureCount count what was found and what passed. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.SignatureCount(), reports.ValidSignatureCount())
}

Output:
1 1

func (*Reports) SimpleReportXML 

func (r *Reports) SimpleReportXML() (string, error)

SimpleReportXML marshals the SimpleReport - the short, human-oriented verdict document. Passthrough of GetXmlSimpleReport.

Example

SimpleReportXML is the report an operator reads. The examples print only the root element, because the reports carry the validation time. 

package main

import (
	"fmt"
	"log"
	"strings"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	xml, err := reports.SimpleReportXML()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(strings.Contains(xml, "<SimpleReport"))
}

Output:
true

func (*Reports) TimestampVerdicts 

func (r *Reports) TimestampVerdicts() []TimestampVerdict

TimestampVerdicts returns one TimestampVerdict per detached time-stamp token the document carries. Time-stamps embedded in a signature are reported under that signature in the detailed report, not here.

Example

TimestampVerdicts covers the detached time-stamp tokens a document carries; an ordinary signed document carries none, because its time-stamps live inside the signature. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(len(reports.TimestampVerdicts()))
}

Output:
0

func (*Reports) Valid 

func (r *Reports) Valid() bool

Valid reports whether the document carries at least one signature and every signature reached TOTAL_PASSED. It is the single-boolean answer; anything more nuanced needs Reports.Verdicts.

Example

Valid is the single-boolean answer: every signature passed, and there was at least one. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	untrusted, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	trusted, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(untrusted.Valid(), trusted.Valid())
}

Output:
false true

func (*Reports) ValidSignatureCount 

func (r *Reports) ValidSignatureCount() int

ValidSignatureCount returns the number of signatures that reached TOTAL_PASSED.

Example

ValidSignatureCount counts the signatures that reached TOTAL_PASSED. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.ValidSignatureCount())
}

Output:
0

func (*Reports) Verdicts 

func (r *Reports) Verdicts() []Verdict

Verdicts returns one Verdict per signature found in the document, in the order the SimpleReport lists them. A document with no signature yields an empty slice, not an error.

Example

Verdicts is the short answer for each signature in the document. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	for _, verdict := range reports.Verdicts() {
		fmt.Println(verdict.SignatureLevel, verdict.Indication, verdict.SignedBy, verdict.Valid())
	}
}

Output:
XAdES-BASELINE-B TOTAL_PASSED Go Port Test RSA true

type SignOptions 

type SignOptions struct {
	// Format selects the signature format family and therefore which ported
	// service does the work. Required.
	Format Format

	// Level is the baseline level to produce. Required. Levels above
	// [LevelB] need TSPSource; LT and LTA additionally need revocation data,
	// which means a CertificateVerifier carrying CRL and/or OCSP sources.
	Level Level

	// DigestAlgorithm is the digest used for the signature and for the
	// references it covers. Defaults to [DigestSHA256].
	DigestAlgorithm DigestAlgorithm

	// Packaging says how the signature relates to the signed data. It applies
	// to CAdES, XAdES and JAdES only; the facade never passes it on for
	// PAdES (whose signature is always embedded in the PDF) or for the ASiC
	// containers (whose services decide it themselves). Defaults to
	// [PackagingEnveloped] for XAdES and [PackagingEnveloping] for CAdES and
	// JAdES.
	Packaging SignaturePackaging

	// DetachedContents supplies the documents a detached signature covers.
	// Required when signing a document that already carries a detached
	// signature being counter-parallel-signed; for a first detached signature
	// the document being signed is the content and this can stay empty.
	DetachedContents []Document

	// ContainerType selects the ASiC flavour, [ContainerASiCS] (one signed
	// document) or [ContainerASiCE] (several). Applies to the two ASiC
	// formats only; defaults to [ContainerASiCE] for several documents and
	// [ContainerASiCS] for one.
	ContainerType ContainerType

	// JWSSerialization selects the JAdES serialization. Applies to JAdES
	// only; defaults to [JWSCompact]. A detached or a multi-signature JAdES
	// needs [JWSJSON] or [JWSFlattenedJSON].
	JWSSerialization JWSSerializationType

	// SigningTime pins the claimed signing time placed in the signed
	// attributes. Defaults to the moment the signature is built.
	SigningTime *time.Time

	// TSPSource issues the RFC 3161 time-stamp tokens levels T, LT and LTA
	// need. The port ships no HTTP TSA client; see the package doc.
	TSPSource TSPSource

	// CertificateVerifier carries the trust anchors, revocation sources and
	// alert policy the signing services consult - which matters from [LevelLT]
	// upwards, where the signature has to embed validation data. Defaults to
	// a [spivalidation.NewCommonCertificateVerifierSimple] with no network
	// access, which is enough for [LevelB] and [LevelT].
	CertificateVerifier CertificateVerifier
}

SignOptions configures Sign, SignMultiple and - for the fields it shares - Extend. Only Format and Level are required; everything else has a documented default.

type SignatureLevel 

type SignatureLevel = enumerations.SignatureLevel

SignatureLevel is the ETSI signature level of a signature. Its value is the upstream enum name, "XAdES_BASELINE_LTA"; its String method renders the dash spelling, "XAdES-BASELINE-LTA", exactly as Java's toString() does, which is also what the reports show. Use Format.BaselineLevel to obtain one from a Format and a Level.

type SignaturePackaging 

type SignaturePackaging = enumerations.SignaturePackaging

SignaturePackaging says how a signature relates to the data it covers: PackagingEnveloped, PackagingEnveloping or PackagingDetached.

type SignatureQualification 

type SignatureQualification = enumerations.SignatureQualification

SignatureQualification is the eIDAS qualification determined for a signature, for example "QESig". It is "NA" when nothing in the trusted lists applies.

type Signer 

type Signer struct {
	// contains filtered or unexported fields
}

Signer pairs a key store connection with the one key entry a signature is produced with. It is what Sign and SignMultiple take instead of a raw private key: DSS never hands the private key to the signature builder, it asks the token to sign the computed data-to-be-signed, so a smart card, an HSM or a remote signing service fits the same interface.

Use OpenPKCS12 for the common case, or NewSigner to drive any token.SignatureTokenConnection the port provides (see the github.com/ryftcore/dss-go/dss/token package) or one of your own.

func NewSigner 

func NewSigner(conn token.SignatureTokenConnection, key token.DSSPrivateKeyEntry) (*Signer, error)

NewSigner pairs an already-open token connection with the key entry to sign with. Close is a no-op for such a Signer: the caller keeps ownership of the connection and closes it itself.

Example

NewSigner pairs any token connection with the key entry to sign with - a smart card, an HSM, or, as here, a key store the caller opened itself and keeps ownership of. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
	"github.com/ryftcore/dss-go/dss/token"
)

func main() {
	connection, err := token.NewPkcs12SignatureTokenFromFilepath(
		"testdata/signer_rsa.p12", token.NewPasswordProtection([]byte("testpassword")))
	if err != nil {
		log.Fatal(err)
	}
	defer connection.Close()

	keys, err := connection.Keys()
	if err != nil {
		log.Fatal(err)
	}
	signer, err := dss.NewSigner(connection, keys[0])
	if err != nil {
		log.Fatal(err)
	}

	fmt.Println(signer.KeyEntry().EncryptionAlgorithm())
}

Output:
RSA

func OpenPKCS12 

func OpenPKCS12(path, password string) (*Signer, error)

OpenPKCS12 opens the PKCS#12 (.p12/.pfx) key store at path with the given password and selects its first key entry. The returned Signer owns the connection, so Signer.Close closes it.

RSA, EC, Ed25519 and DSA key stores all load, through the port's own RFC 7292 reader. Note the port's accepted gaps in the neighbouring key store types: JKS, PKCS#11, the Windows certificate store and the macOS Keychain are not supported at all, since none of them has a Go counterpart under this port's dependency policy.

Example

OpenPKCS12 opens a .p12 or .pfx key store and selects its first key entry. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	defer signer.Close()

	fmt.Println(signer.Certificate().Certificate().Subject.CommonName)
}

Output:
Go Port Test RSA

func OpenPKCS12Bytes 

func OpenPKCS12Bytes(store []byte, password string) (*Signer, error)

OpenPKCS12Bytes is OpenPKCS12 for a key store already held in memory.

Example

OpenPKCS12Bytes is the same for a key store already in memory. 

package main

import (
	"fmt"
	"log"
	"os"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	store, err := os.ReadFile("testdata/signer_rsa.p12")
	if err != nil {
		log.Fatal(err)
	}
	signer, err := dss.OpenPKCS12Bytes(store, "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	defer signer.Close()

	fmt.Println(len(signer.CertificateChain()))
}

Output:
1

func (*Signer) Certificate 

func (s *Signer) Certificate() *CertificateToken

Certificate returns the signing certificate of the selected key entry.

Example

Certificate returns the certificate the signature will name as its signing certificate. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	fmt.Println(signer.Certificate().IsSelfSigned())
}

Output:
true

func (*Signer) CertificateChain 

func (s *Signer) CertificateChain() []*CertificateToken

CertificateChain returns the certificate chain of the selected key entry, as the key store carries it. It is embedded in the signature so that a verifier can build the path.

Example

CertificateChain returns the chain the key store carries, which is what gets embedded in the signature. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	for _, certificate := range signer.CertificateChain() {
		fmt.Println(certificate.Certificate().Subject.CommonName)
	}
}

Output:
Go Port Test RSA

func (*Signer) Close 

func (s *Signer) Close()

Close releases the key store connection when this Signer opened it. It is a no-op for a Signer built with NewSigner, whose connection the caller owns.

Example

Close releases a key store this package opened. It is a no-op for a Signer built with NewSigner. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

func main() {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	signer.Close()
	fmt.Println("closed")
}

Output:
closed

func (*Signer) KeyEntry 

func (s *Signer) KeyEntry() token.DSSPrivateKeyEntry

KeyEntry returns the underlying key entry, for code that drives the ported services directly.

Example

KeyEntry exposes the underlying key entry for code that drives the ported services directly. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	fmt.Println(signer.KeyEntry().EncryptionAlgorithm())
}

Output:
RSA

func (*Signer) Token 

func (s *Signer) Token() token.SignatureTokenConnection

Token returns the underlying token connection, for code that drives the ported services directly.

Example

Token exposes the underlying connection, for instance to list the other key entries of the same store. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

func main() {
	signer := exampleSigner()
	defer signer.Close()

	keys, err := signer.Token().Keys()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(len(keys))
}

Output:
1

type SubIndication 

type SubIndication = enumerations.SubIndication

SubIndication refines an Indication with the reason behind it.

type TSPSource 

type TSPSource = spivalidation.TSPSource

TSPSource issues RFC 3161 time-stamp tokens. Required for levels T, LT and LTA; see the package doc on what the port does and does not ship.

type TimestampQualification 

type TimestampQualification = enumerations.TimestampQualification

TimestampQualification is the eIDAS qualification determined for a time-stamp token, for example "QTSA".

type TimestampVerdict 

type TimestampVerdict struct {
	// ID is the time-stamp identifier the reports use.
	ID string

	// Indication is the verdict for the time-stamp token itself.
	Indication Indication

	// SubIndication says why, and is empty for a passed time-stamp.
	SubIndication SubIndication

	// Qualification is the eIDAS qualification of the time-stamp, "NA" unless
	// trusted-list information was supplied.
	Qualification TimestampQualification

	// ProductionTime is the time the TSA asserts, and ProducedBy names the
	// TSA that asserted it.
	ProductionTime *time.Time
	ProducedBy     string
}

TimestampVerdict is the outcome of validating one time-stamp token.

type TokenExtractionStrategy 

type TokenExtractionStrategy = enumerations.TokenExtractionStrategy

TokenExtractionStrategy selects which tokens are embedded, base64 encoded, into the diagnostic data.

type ValidateOptions 

type ValidateOptions struct {
	// DetachedContents supplies the original documents a detached signature
	// covers. Without them a detached signature can only report that its
	// signed data is missing.
	DetachedContents []Document

	// TrustedCertificates are trust anchors given as individual certificates,
	// typically read with [LoadCertificate].
	TrustedCertificates []*CertificateToken

	// TrustedCertificateSources are whole trust stores. The trusted-list
	// certificate source the TSL validation job produces
	// ([github.com/ryftcore/dss-go/dss/spi/tsl.TrustedListsCertificateSource]) goes
	// here; that is what makes eIDAS qualification determination possible,
	// since the qualifiers come from the trusted lists.
	TrustedCertificateSources []CertificateSource

	// CertificateVerifier takes over completely: when set, the facade passes
	// it to the validator untouched and ignores TrustedCertificates,
	// TrustedCertificateSources and EnableAIA. Use it to add CRL/OCSP sources,
	// a revocation-data verifier, or a different alert policy.
	CertificateVerifier CertificateVerifier

	// EnableAIA lets the validator download missing issuer certificates over
	// the Authority Information Access extension. Off by default: a library
	// call should not reach the network unasked. Ignored when
	// CertificateVerifier is set.
	EnableAIA bool

	// Policy is a custom validation policy document (the DSS constraint XML).
	// Defaults to the ETSI policy shipped with the library.
	Policy Document

	// CryptographicSuite is a custom cryptographic suite catalogue (ETSI TS
	// 119 312 XML, or its JSON flavour) constraining algorithms and key sizes
	// over time. Requires Policy to be set as well, mirroring the underlying
	// two-document entry point.
	CryptographicSuite Document

	// ValidationTime pins the moment the validation is performed at, which
	// decides whether certificates were valid and revocation data fresh.
	// Defaults to now.
	ValidationTime *time.Time

	// Level is how far the validation process is taken. Defaults to
	// [ValidationArchivalData], the fullest process.
	Level ValidationLevel

	// TokenExtractionStrategy selects which tokens are embedded, base64
	// encoded, into the diagnostic data. Defaults to embedding none.
	TokenExtractionStrategy TokenExtractionStrategy

	// IncludeSemantics adds the human-readable meaning of each Indication and
	// SubIndication to the reports.
	IncludeSemantics bool

	// Locale is the language of the report messages, as a language tag such
	// as "en" or "fr". Defaults to the library default.
	Locale string
}

ValidateOptions configures Validate. The zero value is meaningful: it validates against the default ETSI policy, at the current time, with no trust anchors and no network access - which yields INDETERMINATE (NO_CERTIFICATE_CHAIN_FOUND, or a similar sub-indication) rather than a pass, because nothing anchors the certificate chain. Supply trust anchors to get a verdict that means something.

type ValidationLevel 

type ValidationLevel = enumerations.ValidationLevel

ValidationLevel is how far the validation process is taken; the default is ValidationArchivalData.

type Verdict 

type Verdict struct {
	// ID is the signature identifier the reports use throughout. It is stable
	// for a given signature and is the key into every other report.
	ID string

	// Indication is the EN 319 102-1 verdict: TOTAL_PASSED, INDETERMINATE or
	// TOTAL_FAILED.
	Indication Indication

	// SubIndication says why, and is empty for a TOTAL_PASSED signature.
	SubIndication SubIndication

	// SignatureLevel is the level the signature was recognised as, for
	// example "XAdES-BASELINE-LTA" when printed. It reports what the
	// signature IS, not what it should have been.
	SignatureLevel SignatureLevel

	// Qualification is the eIDAS qualification determined from the trusted
	// lists, for example "QESig". It is "NA" when no trusted-list information
	// was supplied - see ValidateOptions.TrustedCertificateSources - which is
	// a statement that the question could not be answered, not that the
	// signature is unqualified.
	Qualification SignatureQualification

	// SignedBy is the signing certificate's subject as the report renders it.
	SignedBy string

	// SigningTime is the signing time claimed in the signed attributes, which
	// nothing but the signer vouches for. Nil when the signature carries none.
	SigningTime *time.Time

	// BestSignatureTime is the earliest time the signature is PROVEN to have
	// existed at, from the time-stamps covering it. It falls back to the
	// validation time when no time-stamp proves anything.
	BestSignatureTime *time.Time

	// Errors, Warnings and Infos are the AdES validation messages behind the
	// indication, already localised.
	Errors   []simplereport.Message
	Warnings []simplereport.Message
	Infos    []simplereport.Message
}

Verdict is the outcome of validating one signature, gathered from the SimpleReport.

func (Verdict) Valid 

func (v Verdict) Valid() bool

Valid reports whether the signature reached TOTAL_PASSED.

Example

Valid reports whether one signature reached TOTAL_PASSED. 

package main

import (
	"fmt"
	"log"

	"github.com/ryftcore/dss-go/dss"
)

// exampleSigner opens the test key store the examples sign with.
func exampleSigner() *dss.Signer {
	signer, err := dss.OpenPKCS12("testdata/signer_rsa.p12", "testpassword")
	if err != nil {
		log.Fatal(err)
	}
	return signer
}

// exampleSignedXML signs a small XML invoice at level B, for the examples that
// are about the reports rather than about signing.
func exampleSignedXML() (dss.Document, *dss.Signer) {
	signer := exampleSigner()
	doc := dss.NewDocument("invoice.xml", []byte("<invoice><total>42</total></invoice>"))
	signed, err := dss.Sign(doc, signer, dss.SignOptions{Format: dss.FormatXAdES, Level: dss.LevelB})
	if err != nil {
		log.Fatal(err)
	}
	return signed, signer
}

func main() {
	signed, signer := exampleSignedXML()
	defer signer.Close()

	reports, err := dss.Validate(signed, dss.ValidateOptions{
		TrustedCertificates: signer.CertificateChain(),
	})
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(reports.Verdicts()[0].Valid())
}

Output:
true

Source Files

View all Source files

Directories

Path Synopsis
Ported from dss-alert/src/main/java/eu/europa/esig/dss/alert/AbstractAlert.java (DSS 6.5.RC1).
 Ported from dss-alert/src/main/java/eu/europa/esig/dss/alert/AbstractAlert.java (DSS 6.5.RC1).
Ported from dss-asic-common/src/main/java/eu/europa/esig/dss/asic/common/validation/AbstractASiCContainerAnalyzer.java (DSS 6.5.RC1).
 Ported from dss-asic-common/src/main/java/eu/europa/esig/dss/asic/common/validation/AbstractASiCContainerAnalyzer.java (DSS 6.5.RC1).
cades
Ported from dss-asic-cades/src/main/java/eu/europa/esig/dss/asic/cades/merge/AbstractASiCWithCAdESContainerMerger.java (DSS 6.5.RC1).
 Ported from dss-asic-cades/src/main/java/eu/europa/esig/dss/asic/cades/merge/AbstractASiCWithCAdESContainerMerger.java (DSS 6.5.RC1).
cades/extension
Ported from dss-asic-cades/src/main/java/eu/europa/esig/dss/asic/cades/extension/ASiCWithCAdESDocumentExtender.java (DSS 6.5.RC1).
 Ported from dss-asic-cades/src/main/java/eu/europa/esig/dss/asic/cades/extension/ASiCWithCAdESDocumentExtender.java (DSS 6.5.RC1).
xades
Ported from dss-asic-xades/src/main/java/eu/europa/esig/dss/asic/xades/merge/AbstractASiCWithXAdESContainerMerger.java (DSS 6.5.RC1).
 Ported from dss-asic-xades/src/main/java/eu/europa/esig/dss/asic/xades/merge/AbstractASiCWithXAdESContainerMerger.java (DSS 6.5.RC1).
xades/extension
Ported from dss-asic-xades/src/main/java/eu/europa/esig/dss/asic/xades/extension/ASiCWithXAdESDocumentExtender.java (DSS 6.5.RC1).
 Ported from dss-asic-xades/src/main/java/eu/europa/esig/dss/asic/xades/extension/ASiCWithXAdESDocumentExtender.java (DSS 6.5.RC1).
Ported from dss-cades/src/main/java/eu/europa/esig/dss/cades/validation/CAdESAttribute.java (DSS 6.5.RC1).
 Ported from dss-cades/src/main/java/eu/europa/esig/dss/cades/validation/CAdESAttribute.java (DSS 6.5.RC1).
extension
Ported from dss-cades/src/main/java/eu/europa/esig/dss/cades/extension/CAdESDocumentExtender.java (DSS 6.5.RC1).
 Ported from dss-cades/src/main/java/eu/europa/esig/dss/cades/extension/CAdESDocumentExtender.java (DSS 6.5.RC1).
cmd
esig command
Command esig is a command-line front end for the dss Go module (github.com/ryftcore/dss-go/dss): sign, extend, validate and inspect the signature formats the library supports, render the reports dss.Validate produces, and refresh a local trusted-list cache.
 Command esig is a command-line front end for the dss Go module (github.com/ryftcore/dss-go/dss): sign, extend, validate and inspect the signature formats the library supports, render the reports dss.Validate produces, and refresh a local trusted-list cache.
Ported from dss-cms/src/main/java/eu/europa/esig/dss/cms/AbstractCMSGenerator.java (DSS 6.5.RC1), plus - since this package has one native CMSGenerator rather than the dss-cms-object/dss-cms-stream pair Java's ServiceLoader chooses between (see doc.go) - the generation logic Java splits out into dss-cms-object's CMSObjectGenerator (not part of this port's manifest; read as behavioural reference per the porter brief) and CMSObjectUtils' populateDigestAlgorithmSet, folded into Generate below.
 Ported from dss-cms/src/main/java/eu/europa/esig/dss/cms/AbstractCMSGenerator.java (DSS 6.5.RC1), plus - since this package has one native CMSGenerator rather than the dss-cms-object/dss-cms-stream pair Java's ServiceLoader chooses between (see doc.go) - the generation logic Java splits out into dss-cms-object's CMSObjectGenerator (not part of this port's manifest; read as behavioural reference per the porter brief) and CMSObjectUtils' populateDigestAlgorithmSet, folded into Generate below.
Ported from dss-crl-parser/src/main/java/eu/europa/esig/dss/crl/AbstractCRLUtils.java (DSS 6.5.RC1).
 Ported from dss-crl-parser/src/main/java/eu/europa/esig/dss/crl/AbstractCRLUtils.java (DSS 6.5.RC1).
Ported from dss-detailed-report-jaxb/src/main/java/eu/europa/esig/dss/detailedreport/DetailedReport.java (DSS 6.5.RC1).
 Ported from dss-detailed-report-jaxb/src/main/java/eu/europa/esig/dss/detailedreport/DetailedReport.java (DSS 6.5.RC1).
jaxb
Package jaxb is the schema-shaped model of a DSS detailed report.
 Package jaxb is the schema-shaped model of a DSS detailed report.
Ported from dss-diagnostic-jaxb/src/main/java/eu/europa/esig/dss/diagnostic/AbstractSignatureWrapper.java (DSS 6.5.RC1).
 Ported from dss-diagnostic-jaxb/src/main/java/eu/europa/esig/dss/diagnostic/AbstractSignatureWrapper.java (DSS 6.5.RC1).
jaxb
Package jaxb is the schema-shaped model of a DSS diagnostic-data report.
 Package jaxb is the schema-shaped model of a DSS diagnostic-data report.
Ported from dss-document/src/main/java/eu/europa/esig/dss/extension/AbstractDocumentExtender.java (DSS 6.5.RC1).
 Ported from dss-document/src/main/java/eu/europa/esig/dss/extension/AbstractDocumentExtender.java (DSS 6.5.RC1).
Ported from dss-enumerations/.../ArchiveTimestampHashIndexVersion.java (DSS 6.5.RC1).
 Ported from dss-enumerations/.../ArchiveTimestampHashIndexVersion.java (DSS 6.5.RC1).
examples
01-sign-pdf-pades command
Command 01-sign-pdf-pades signs a PDF with a PAdES-BASELINE-B signature, then raises a second copy to PAdES-BASELINE-T by adding a trusted time-stamp over the signature value.
 Command 01-sign-pdf-pades signs a PDF with a PAdES-BASELINE-B signature, then raises a second copy to PAdES-BASELINE-T by adding a trusted time-stamp over the signature value.
02-validate-pdf command
Command 02-validate-pdf signs a PDF and then validates it twice: once with no trust anchor configured, and once trusting the signer's certificate.
 Command 02-validate-pdf signs a PDF and then validates it twice: once with no trust anchor configured, and once trusting the signer's certificate.
03-xades-enveloped-invoice command
Command 03-xades-enveloped-invoice signs a small XML invoice with an enveloped XAdES-BASELINE-B signature - the signature lives inside the signed document itself, as a ds:Signature element next to the business content, which is the usual choice for XML business documents (invoices, orders, e-government forms).
 Command 03-xades-enveloped-invoice signs a small XML invoice with an enveloped XAdES-BASELINE-B signature - the signature lives inside the signed document itself, as a ds:Signature element next to the business content, which is the usual choice for XML business documents (invoices, orders, e-government forms).
04-cades-detached command
Command 04-cades-detached produces a detached CAdES-BASELINE-B signature over an arbitrary binary payload: the signature is a separate .p7s file that never touches the original content, which is the usual shape for signing files you cannot or do not want to modify (archives, media, already-published documents).
 Command 04-cades-detached produces a detached CAdES-BASELINE-B signature over an arbitrary binary payload: the signature is a separate .p7s file that never touches the original content, which is the usual shape for signing files you cannot or do not want to modify (archives, media, already-published documents).
05-jades-json-payload command
Command 05-jades-json-payload signs a JSON payload with a compact JAdES-BASELINE-B signature (ETSI TS 119 182) - the JOSE-family format for JSON APIs, where the signature travels as a single base64url string instead of an XML or CMS structure.
 Command 05-jades-json-payload signs a JSON payload with a compact JAdES-BASELINE-B signature (ETSI TS 119 182) - the JOSE-family format for JSON APIs, where the signature travels as a single base64url string instead of an XML or CMS structure.
06-asice-container command
Command 06-asice-container signs two documents into a single ASiC-E container (ETSI EN 319 162) carrying an XAdES signature - the shape to reach for when one signature has to cover several files at once, such as a payload and its metadata.
 Command 06-asice-container signs two documents into a single ASiC-E container (ETSI EN 319 162) carrying an XAdES signature - the shape to reach for when one signature has to cover several files at once, such as a payload and its metadata.
07-validate-eu-trusted-lists command
Command 07-validate-eu-trusted-lists runs the TSL validation job (Phase 9 of the port: dss/tsl and dss/validation/job) against the real European List Of Trusted Lists (LOTL) and reports what it found.
 Command 07-validate-eu-trusted-lists runs the TSL validation job (Phase 9 of the port: dss/tsl and dss/validation/job) against the real European List Of Trusted Lists (LOTL) and reports what it found.
08-custom-policy command
Command 08-custom-policy validates the same signature against two policies: the ETSI policy the library ships as its default, and a copy of it with one constraint relaxed - showing that a policy is a plain XML document you can load, edit and pass to Validate yourself, not something only the library's authors can change.
 Command 08-custom-policy validates the same signature against two policies: the ETSI policy the library ships as its default, and a copy of it with one constraint relaxed - showing that a policy is a plain XML document you can load, edit and pass to Validate yourself, not something only the library's authors can change.
09-render-reports command
Command 09-render-reports signs and validates a document, then walks through the four reports Validate returns: the SimpleReport a human reads first, the DetailedReport behind every check that led to its verdict, the diagnostic data the process reasoned over, and the standardised ETSI TS 119 102-2 validation report.
 Command 09-render-reports signs and validates a document, then walks through the four reports Validate returns: the SimpleReport a human reads first, the DetailedReport behind every check that led to its verdict, the diagnostic data the process reasoned over, and the standardised ETSI TS 119 102-2 validation report.
internal/fixtures
Package fixtures locates the tiny signing fixtures the examples under dss/examples share with the root package's own tests (dss/testdata/README.md): a self-signed RSA test key store, an EC test key acting as a local RFC 3161 time-stamp authority, and a minimal sample PDF.
 Package fixtures locates the tiny signing fixtures the examples under dss/examples share with the root package's own tests (dss/testdata/README.md): a self-signed RSA test key store, an EC test key acting as a local RFC 3161 time-stamp authority, and a minimal sample PDF.
Package i18n ports dss-i18n (eu.europa.esig.dss.i18n), the message catalog and MessageFormat-style formatter behind every human-readable string the EN 319 102-1 validation engine and its reports produce: the ETSI validation-process building-block messages (e.g.
 Package i18n ports dss-i18n (eu.europa.esig.dss.i18n), the message catalog and MessageFormat-style formatter behind every human-readable string the EN 319 102-1 validation engine and its reports produce: the ETSI validation-process building-block messages (e.g.
internal
asn1ber
Package asn1ber is the BER/DER/DL engine the DSS port uses in place of BouncyCastle's ASN.1 layer (org.bouncycastle.asn1.*).
 Package asn1ber is the BER/DER/DL engine the DSS port uses in place of BouncyCastle's ASN.1 layer (org.bouncycastle.asn1.*).
cmscore
Attribute and the signed/unsigned attribute sets of RFC 5652 clause 5.3, replacing org.bouncycastle.asn1.cms.Attribute and org.bouncycastle.asn1.cms.AttributeTable.
 Attribute and the signed/unsigned attribute sets of RFC 5652 clause 5.3, replacing org.bouncycastle.asn1.cms.Attribute and org.bouncycastle.asn1.cms.AttributeTable.
corpustest
Package corpustest locates the repository's external oracle/fixture corpus (repo-root corpus/, outside the dss module) for tests whose testdata is too heavy to ship inside the `go get`-able module zip.
 Package corpustest locates the repository's external oracle/fixture corpus (repo-root corpus/, outside the dss module) for tests whose testdata is too heavy to ship inside the `go get`-able module zip.
eccurve
Curve constants for the RFC 5639 Brainpool curves.
 Curve constants for the RFC 5639 Brainpool curves.
jose
Ported from org.jose4j.base64url.Base64Url, the bundled org.jose4j.base64url.internal.apache.commons.codec.binary.Base64 it delegates to, and org.jose4j.lang.StringUtil (jose4j 0.9.6).
 Ported from org.jose4j.base64url.Base64Url, the bundled org.jose4j.base64url.internal.apache.commons.codec.binary.Base64 it delegates to, and org.jose4j.lang.StringUtil (jose4j 0.9.6).
pdf
Package pdf implements the subset of ISO 32000-1/2 that DSS's PAdES support needs: a lenient reader for the whole corpus of signed PDFs DSS validates, and an append-only incremental writer for the ones it produces.
 Package pdf implements the subset of ISO 32000-1/2 that DSS's PAdES support needs: a lenient reader for the whole corpus of signed PDFs DSS validates, and an append-only incremental writer for the ones it produces.
pfx
Package pfx is a minimal, dependency-free reader for PKCS#12 (PFX) key stores, replacing golang.org/x/crypto/pkcs12 for the two capabilities that package does not offer (see dss/token/key_store_signature_token_connection.go's file header for why they are needed): decrypting a SafeBag without discarding its private key's type, and parsing every PKCS#8 key type DSS's own fixtures use - RSA, EC and Ed25519 through crypto/x509, and DSA (which neither x509.ParsePKCS8PrivateKey nor crypto/dsa itself parses) by hand.
 Package pfx is a minimal, dependency-free reader for PKCS#12 (PFX) key stores, replacing golang.org/x/crypto/pkcs12 for the two capabilities that package does not offer (see dss/token/key_store_signature_token_connection.go's file header for why they are needed): decrypting a SafeBag without discarding its private key's type, and parsing every PKCS#8 key type DSS's own fixtures use - RSA, EC and Ed25519 through crypto/x509, and DSA (which neither x509.ParsePKCS8PrivateKey nor crypto/dsa itself parses) by hand.
xmlc14n
Ported from the canonicalization registry of dss-xml-utils/.../XMLCanonicalizer.java (DSS 6.5.RC1), plus org.apache.xml.security.transforms.params.InclusiveNamespaces#prefixStr2Set and org.apache.xml.security.c14n.helper.C14nHelper (Apache Santuario xmlsec 3.0.6).
 Ported from the canonicalization registry of dss-xml-utils/.../XMLCanonicalizer.java (DSS 6.5.RC1), plus org.apache.xml.security.transforms.params.InclusiveNamespaces#prefixStr2Set and org.apache.xml.security.c14n.helper.C14nHelper (Apache Santuario xmlsec 3.0.6).
xmldom
Package xmldom is a minimal, namespace-aware XML document model sufficient for XML-DSig canonicalization, reference processing and XAdES construction.
 Package xmldom is a minimal, namespace-aware XML document model sufficient for XML-DSig canonicalization, reference processing and XAdES construction.
xmldsig
Ported from org.apache.xml.security.signature.XMLSignatureInput (Apache Santuario xmlsec 3.0.6).
 Ported from org.apache.xml.security.signature.XMLSignatureInput (Apache Santuario xmlsec 3.0.6).
xpath10
Package xpath10 evaluates the subset of XPath 1.0 that DSS uses, over internal/xmldom trees.
 Package xpath10 evaluates the subset of XPath 1.0 that DSS uses, over internal/xmldom trees.
Ported from dss-jades/src/main/java/eu/europa/esig/dss/jades/signature/AbstractJAdESBuilder.java (DSS 6.5.RC1).
 Ported from dss-jades/src/main/java/eu/europa/esig/dss/jades/signature/AbstractJAdESBuilder.java (DSS 6.5.RC1).
extension
Ported from dss-jades/src/main/java/eu/europa/esig/dss/jades/extension/JAdESDocumentExtender.java (DSS 6.5.RC1).
 Ported from dss-jades/src/main/java/eu/europa/esig/dss/jades/extension/JAdESDocumentExtender.java (DSS 6.5.RC1).
specs
Ported from specs-jades/src/main/java/eu/europa/esig/jades/AbstractJAdESUtils.java (DSS 6.5.RC1).
 Ported from specs-jades/src/main/java/eu/europa/esig/jades/AbstractJAdESUtils.java (DSS 6.5.RC1).
Ported from dss-model/.../AbstractSerializableSignatureParameters.java (DSS 6.5.RC1).
 Ported from dss-model/.../AbstractSerializableSignatureParameters.java (DSS 6.5.RC1).
eaa
Ported from dss-model/.../eaa/DisclosureValidation.java (DSS 6.5.RC1).
 Ported from dss-model/.../eaa/DisclosureValidation.java (DSS 6.5.RC1).
eaa/claim
Ported from dss-model/.../claim/AbstractClaim.java (DSS 6.5.RC1).
 Ported from dss-model/.../claim/AbstractClaim.java (DSS 6.5.RC1).
http
Package http ports the dss-model http subpackage (eu.europa.esig.dss.model.http), a small envelope type wrapping an HTTP response's body and metadata as returned by DSS's data-loader clients.
 Package http ports the dss-model http subpackage (eu.europa.esig.dss.model.http), a small envelope type wrapping an HTTP response's body and metadata as returned by DSS's data-loader clients.
job
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/job/AbstractDocumentInfo.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/job/AbstractDocumentInfo.java (DSS 6.5.RC1).
lote
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/lote/identifier/AbstractLoTEIdentifier.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/lote/identifier/AbstractLoTEIdentifier.java (DSS 6.5.RC1).
policy
Ported from dss-model/.../model/policy/CertificateApplicabilityRule.java (DSS 6.5.RC1).
 Ported from dss-model/.../model/policy/CertificateApplicabilityRule.java (DSS 6.5.RC1).
scope
Package scope ports the dss-model scope subpackage (eu.europa.esig.dss.model.scope), the value object describing what part of a signed document a signature actually covers (the whole document, an XML element, a PDF byte range, an ASiC manifest entry, ...).
 Package scope ports the dss-model scope subpackage (eu.europa.esig.dss.model.scope), the value object describing what part of a signed document a signature actually covers (the whole document, an XML element, a PDF byte range, an ASiC manifest entry, ...).
signature
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/signature/CommitmentTypeIndication.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/signature/CommitmentTypeIndication.java (DSS 6.5.RC1).
timedependent
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/timedependent/BaseTimeDependent.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/timedependent/BaseTimeDependent.java (DSS 6.5.RC1).
tls
Package tls ports the dss-model tls subpackage (eu.europa.esig.dss.model.tls), a value object wrapping the certificate chain presented by a TLS server, used when validating a Trusted List fetched over HTTPS against its expected TLS identity.
 Package tls ports the dss-model tls subpackage (eu.europa.esig.dss.model.tls), a value object wrapping the certificate chain presented by a TLS server, used when validating a Trusted List fetched over HTTPS against its expected TLS identity.
tsl
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/tsl/identifier/AbstractTLIdentifier.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/tsl/identifier/AbstractTLIdentifier.java (DSS 6.5.RC1).
x509/extension
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/x509/extension/AuthorityInformationAccess.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/x509/extension/AuthorityInformationAccess.java (DSS 6.5.RC1).
x509/revocation
Ported from dss-model/src/main/java/eu/europa/esig/dss/model/x509/revocation/crl/CRL.java (DSS 6.5.RC1).
 Ported from dss-model/src/main/java/eu/europa/esig/dss/model/x509/revocation/crl/CRL.java (DSS 6.5.RC1).
Ported from dss-pades/src/main/java/eu/europa/esig/dss/pades/AbstractDSSFont.java (DSS 6.5.RC1).
 Ported from dss-pades/src/main/java/eu/europa/esig/dss/pades/AbstractDSSFont.java (DSS 6.5.RC1).
alerts
Ported from dss-pades/src/main/java/eu/europa/esig/dss/pades/alerts/ProtectedDocumentExceptionOnStatusAlert.java (DSS 6.5.RC1).
 Ported from dss-pades/src/main/java/eu/europa/esig/dss/pades/alerts/ProtectedDocumentExceptionOnStatusAlert.java (DSS 6.5.RC1).
exception
Ported from dss-pades/src/main/java/eu/europa/esig/dss/pades/exception/InvalidPasswordException.java (DSS 6.5.RC1).
 Ported from dss-pades/src/main/java/eu/europa/esig/dss/pades/exception/InvalidPasswordException.java (DSS 6.5.RC1).
Ported from dss-policy-jaxb/.../policy/CertificateValuesConstraintWrapper.java (DSS 6.5.RC1).
 Ported from dss-policy-jaxb/.../policy/CertificateValuesConstraintWrapper.java (DSS 6.5.RC1).
crypto/json
Ported from dss-policy-crypto-json/.../json/CryptographicSuiteJsonCatalogue.java (DSS 6.5.RC1).
 Ported from dss-policy-crypto-json/.../json/CryptographicSuiteJsonCatalogue.java (DSS 6.5.RC1).
crypto/xml
Ported from dss-policy-crypto-xml/.../xml/CryptographicSuiteXmlCatalogue.java (DSS 6.5.RC1).
 Ported from dss-policy-crypto-xml/.../xml/CryptographicSuiteXmlCatalogue.java (DSS 6.5.RC1).
jaxb
Package jaxb is the Go form of the JAXB classes generated by dss-policy-jaxb (target/generated-sources/xjc/eu/europa/esig/dss/policy/jaxb, from src/main/resources/xsd/policy.xsd) into package eu.europa.esig.dss.policy.jaxb.
 Package jaxb is the Go form of the JAXB classes generated by dss-policy-jaxb (target/generated-sources/xjc/eu/europa/esig/dss/policy/jaxb, from src/main/resources/xsd/policy.xsd) into package eu.europa.esig.dss.policy.jaxb.
Ported from dss-jaxb-parsers/src/main/java/eu/europa/esig/dss/jaxb/object/Message.java (DSS 6.5.RC1).
 Ported from dss-jaxb-parsers/src/main/java/eu/europa/esig/dss/jaxb/object/Message.java (DSS 6.5.RC1).
jaxb
Package jaxb is the schema-shaped model of a DSS simple certificate report.
 Package jaxb is the schema-shaped model of a DSS simple certificate report.
Ported from dss-jaxb-parsers/src/main/java/eu/europa/esig/dss/jaxb/object/Message.java (DSS 6.5.RC1).
 Ported from dss-jaxb-parsers/src/main/java/eu/europa/esig/dss/jaxb/object/Message.java (DSS 6.5.RC1).
jaxb
Package jaxb is the schema-shaped model of a DSS simple report.
 Package jaxb is the schema-shaped model of a DSS simple report.
spi
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/x509/AlternateUrlsSourceAdapter.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/x509/AlternateUrlsSourceAdapter.java (DSS 6.5.RC1).
alerts
Package alerts ports the dss-spi alerts subpackage (eu.europa.esig.dss.spi.alerts), a ready-made alert.Alert wiring for one specific SPI-layer condition: an external resource (e.g.
 Package alerts ports the dss-spi alerts subpackage (eu.europa.esig.dss.spi.alerts), a ready-made alert.Alert wiring for one specific SPI-layer condition: an external resource (e.g.
client/http
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/client/http/AdvancedDataLoader.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/client/http/AdvancedDataLoader.java (DSS 6.5.RC1).
client/jdbc
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/client/jdbc/JdbcCacheConnector.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/client/jdbc/JdbcCacheConnector.java (DSS 6.5.RC1).
eaa/status
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/eaa/status/EAARevocationSource.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/eaa/status/EAARevocationSource.java (DSS 6.5.RC1).
exception
Package exception ports the dss-spi exception subpackage (eu.europa.esig.dss.spi.exception), the error types SPI-layer data loading and revocation retrieval raise: aggregated multi-source loader failures, external-resource failures, and illegal-input conditions.
 Package exception ports the dss-spi exception subpackage (eu.europa.esig.dss.spi.exception), the error types SPI-layer data loading and revocation retrieval raise: aggregated multi-source loader failures, external-resource failures, and illegal-input conditions.
extension
Package extension ports the dss-spi extension subpackage (eu.europa.esig.dss.spi.extension), the minimal interface a per-format signature extension service implements, decoupling generic extend-to-a-higher-level callers from any specific format package.
 Package extension ports the dss-spi extension subpackage (eu.europa.esig.dss.spi.extension), the minimal interface a per-format signature extension service implements, decoupling generic extend-to-a-higher-level callers from any specific format package.
lote
Package lote ports the dss-spi lote subpackage (eu.europa.esig.dss.spi.lote), a CertificateSource backed by a List of Trusted Entities (LoTE), used by EUDI Wallet-style trust schemes as a trust anchor source alongside or instead of eIDAS trusted lists.
 Package lote ports the dss-spi lote subpackage (eu.europa.esig.dss.spi.lote), a CertificateSource backed by a List of Trusted Entities (LoTE), used by EUDI Wallet-style trust schemes as a trust anchor source alongside or instead of eIDAS trusted lists.
policy
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/policy/AbstractSignaturePolicyValidator.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/policy/AbstractSignaturePolicyValidator.java (DSS 6.5.RC1).
random
Package random ports the dss-spi random subpackage (eu.europa.esig.dss.spi.random), the SecureRandomProvider abstraction signing/timestamping code draws random bytes from, plus a deterministic fixed-output implementation used by the test/oracle harness for byte-reproducible output.
 Package random ports the dss-spi random subpackage (eu.europa.esig.dss.spi.random), the SecureRandomProvider abstraction signing/timestamping code draws random bytes from, plus a deterministic fixed-output implementation used by the test/oracle harness for byte-reproducible output.
signature/resources
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/signature/resources/DSSResourcesHandler.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/signature/resources/DSSResourcesHandler.java (DSS 6.5.RC1).
tsl
Package tsl ports the dss-spi tsl subpackage (eu.europa.esig.dss.spi.tsl), a CertificateSource backed by the trust anchors accumulated from validating one or more eIDAS Trusted Lists, consumed by the certificate verifier as its trust source.
 Package tsl ports the dss-spi tsl subpackage (eu.europa.esig.dss.spi.tsl), a CertificateSource backed by the trust anchors accumulated from validating one or more eIDAS Trusted Lists, consumed by the certificate verifier as its trust source.
validation
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/evidencerecord/AbstractEmbeddedEvidenceRecordHelper.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/evidencerecord/AbstractEmbeddedEvidenceRecordHelper.java (DSS 6.5.RC1).
validation/analyzer
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/analyzer/DefaultDocumentAnalyzer.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/analyzer/DefaultDocumentAnalyzer.java (DSS 6.5.RC1).
validation/analyzer/eaa
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/analyzer/eaa/EAAPresentationAnalyzer.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/analyzer/eaa/EAAPresentationAnalyzer.java (DSS 6.5.RC1).
validation/analyzer/timestamp
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/analyzer/timestamp/TimestampAnalyzer.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/analyzer/timestamp/TimestampAnalyzer.java (DSS 6.5.RC1).
validation/executor
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/executor/CompleteValidationContextExecutor.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/executor/CompleteValidationContextExecutor.java (DSS 6.5.RC1).
validation/identifier
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/identifier/SignatureAttributeIdentifier.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/identifier/SignatureAttributeIdentifier.java (DSS 6.5.RC1).
validation/scope
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/scope/AbstractSignatureScopeFinder.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/scope/AbstractSignatureScopeFinder.java (DSS 6.5.RC1).
validation/timestamp
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/timestamp/AbstractTimestampSource.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/timestamp/AbstractTimestampSource.java (DSS 6.5.RC1).
validation/tls
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/tls/TLSCertificateLoader.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/validation/tls/TLSCertificateLoader.java (DSS 6.5.RC1).
x509/aia
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/x509/aia/AIACertificateSource.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/x509/aia/AIACertificateSource.java (DSS 6.5.RC1).
x509/evidencerecord/digest
Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/x509/evidencerecord/digest/DataObjectDigestBuilder.java (DSS 6.5.RC1).
 Ported from dss-spi/src/main/java/eu/europa/esig/dss/spi/x509/evidencerecord/digest/DataObjectDigestBuilder.java (DSS 6.5.RC1).
Ported from dss-token/src/main/java/eu/europa/esig/dss/token/AbstractKeyStoreTokenConnection.java (DSS 6.5.RC1).
 Ported from dss-token/src/main/java/eu/europa/esig/dss/token/AbstractKeyStoreTokenConnection.java (DSS 6.5.RC1).
Package trustedlist ports specs-trusted-list, the ETSI TS 119 612 trusted-list XML facade layer: (un)marshaling and helper accessors over the generated JAXB-equivalent model in trustedlist/jaxb, plus the eIDAS Mutual Recognition Agreement (MRA) extension types.
 Package trustedlist ports specs-trusted-list, the ETSI TS 119 612 trusted-list XML facade layer: (un)marshaling and helper accessors over the generated JAXB-equivalent model in trustedlist/jaxb, plus the eIDAS Mutual Recognition Agreement (MRA) extension types.
jaxb
Package jaxb is the schema-shaped model of an ETSI TS 119 612 Trusted List / List of Trusted Lists (LOTL) document, plus its MRA (Mutual Recognition Agreement, ETSI TS 119 612 Annex B / the EC's mra_schema_v2) extension.
 Package jaxb is the schema-shaped model of an ETSI TS 119 612 Trusted List / List of Trusted Lists (LOTL) document, plus its MRA (Mutual Recognition Agreement, ETSI TS 119 612 Annex B / the EC's mra_schema_v2) extension.
Ported from dss-tsl-validation/src/main/java/eu/europa/esig/dss/tsl/function/AbstractOtherTSLPointerPredicate.java (DSS 6.5.RC1).
 Ported from dss-tsl-validation/src/main/java/eu/europa/esig/dss/tsl/function/AbstractOtherTSLPointerPredicate.java (DSS 6.5.RC1).
Package utils ports dss-utils (eu.europa.esig.dss.utils.Utils / IUtils), a small set of general-purpose helpers (string/collection null-and-empty checks, byte/hex/base64 conversion, stream copying) that the rest of the module uses in place of the Apache Commons helpers the Java implementation wraps.
 Package utils ports dss-utils (eu.europa.esig.dss.utils.Utils / IUtils), a small set of general-purpose helpers (string/collection null-and-empty checks, byte/hex/base64 conversion, stream copying) that the rest of the module uses in place of the Apache Commons helpers the Java implementation wraps.
Package validation ports dss-validation's core signature and certificate validation entry points: the interfaces and base types that turn a signed document (or a bare certificate) into a validation report by driving the EN 319 102-1 process implemented in validation/process and its sub-packages.
 Package validation ports dss-validation's core signature and certificate validation entry points: the interfaces and base types that turn a signed document (or a bare certificate) into a validation report by driving the EN 319 102-1 process implemented in validation/process and its sub-packages.
eaa
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/eaa/EAAPresentationValidator.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/eaa/EAAPresentationValidator.java (DSS 6.5.RC1).
evidencerecord
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/evidencerecord/EvidenceRecordValidator.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/evidencerecord/EvidenceRecordValidator.java (DSS 6.5.RC1).
executor
Package executor ports dss-validation's eu.europa.esig.dss.validation.executor package: the process executors that run the EN 319 102-1 validation process (dss/validation/process) over already-built diagnostic data and turn the result into the three report flavors consumers read - SimpleReport, DetailedReport and the ETSI Validation Report.
 Package executor ports dss-validation's eu.europa.esig.dss.validation.executor package: the process executors that run the EN 319 102-1 validation process (dss/validation/process) over already-built diagnostic data and turn the result into the three report flavors consumers read - SimpleReport, DetailedReport and the ETSI Validation Report.
identifier
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/identifier/UserFriendlyIdentifierProvider.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/identifier/UserFriendlyIdentifierProvider.java (DSS 6.5.RC1).
job
Ported from dss-validation-job/src/main/java/eu/europa/esig/dss/validation/job/runnable/AbstractAnalysis.java (DSS 6.5.RC1).
 Ported from dss-validation-job/src/main/java/eu/europa/esig/dss/validation/job/runnable/AbstractAnalysis.java (DSS 6.5.RC1).
policy
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/policy/ContextAndSubContext.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/policy/ContextAndSubContext.java (DSS 6.5.RC1).
process
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/BasicBuildingBlockDefinition.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/BasicBuildingBlockDefinition.java (DSS 6.5.RC1).
process/bbb
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/AbstractCertificateCheckItem.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/AbstractCertificateCheckItem.java (DSS 6.5.RC1).
process/bbb/aov
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/aov/cc/AbstractAlgorithmCryptographicChecker.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/aov/cc/AbstractAlgorithmCryptographicChecker.java (DSS 6.5.RC1).
process/bbb/cv
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/cv/checks/AtLeastOneReferenceDataObjectFoundCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/cv/checks/AtLeastOneReferenceDataObjectFoundCheck.java (DSS 6.5.RC1).
process/bbb/fc
Ported from dss-validation/.../validation/process/bbb/fc/AbstractFormatChecking.java (DSS 6.5.RC1).
 Ported from dss-validation/.../validation/process/bbb/fc/AbstractFormatChecking.java (DSS 6.5.RC1).
process/bbb/isc
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/isc/checks/DigestValueMatchCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/isc/checks/DigestValueMatchCheck.java (DSS 6.5.RC1).
process/bbb/sav
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/sav/AbstractAcceptanceValidation.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/sav/AbstractAcceptanceValidation.java (DSS 6.5.RC1).
process/bbb/vci
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/vci/checks/SignaturePolicyHashValidCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/vci/checks/SignaturePolicyHashValidCheck.java (DSS 6.5.RC1).
process/bbb/xcv
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/xcv/rfc/checks/AbstractRevocationFreshCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/xcv/rfc/checks/AbstractRevocationFreshCheck.java (DSS 6.5.RC1).
process/blocks
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/BasicBuildingBlocks.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/bbb/BasicBuildingBlocks.java (DSS 6.5.RC1).
process/eaa
Package eaa ports eu.europa.esig.dss.validation.process.eaa (DSS 6.5.RC1): EAAValidationBlock, EAAValidationProcess, and the one eaa.checks class that belongs here rather than in the sibling eaa/checks package - KeyBindingSignatureValidationResultCheck, since it wires qualification.SignatureValidationResultCheck and this package already imports qualification for EAAValidationBlock/EAAValidationProcess.
 Package eaa ports eu.europa.esig.dss.validation.process.eaa (DSS 6.5.RC1): EAAValidationBlock, EAAValidationProcess, and the one eaa.checks class that belongs here rather than in the sibling eaa/checks package - KeyBindingSignatureValidationResultCheck, since it wires qualification.SignatureValidationResultCheck and this package already imports qualification for EAAValidationBlock/EAAValidationProcess.
process/eaa/checks
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/eaa/checks/AcceptableEAARevocationFoundCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/eaa/checks/AcceptableEAARevocationFoundCheck.java (DSS 6.5.RC1).
process/qualification
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/qualification/certificate/qwac/sub/AbstractQWACValidationProcessBlock.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/qualification/certificate/qwac/sub/AbstractQWACValidationProcessBlock.java (DSS 6.5.RC1).
process/vpfbs
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfbs/AbstractBasicValidationProcess.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfbs/AbstractBasicValidationProcess.java (DSS 6.5.RC1).
process/vpfltvd
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfltvd/checks/AcceptableBasicSignatureValidationCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfltvd/checks/AcceptableBasicSignatureValidationCheck.java (DSS 6.5.RC1).
process/vpfltvdsig
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfltvd/ValidationProcessForSignaturesWithLongTermValidationData.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfltvd/ValidationProcessForSignaturesWithLongTermValidationData.java (DSS 6.5.RC1).
process/vpfswatsp
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfswatsp/checks/AbstractPastTokenValidationCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfswatsp/checks/AbstractPastTokenValidationCheck.java (DSS 6.5.RC1).
process/vpfswatsp/evidencerecord
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfswatsp/evidencerecord/checks/EvidenceRecordSignedAndTimestampedFilesCoveredCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpfswatsp/evidencerecord/checks/EvidenceRecordSignedAndTimestampedFilesCoveredCheck.java (DSS 6.5.RC1).
process/vpftsp
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpftsp/TimestampBasicValidationProcess.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpftsp/TimestampBasicValidationProcess.java (DSS 6.5.RC1).
process/vpftspwatsp
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpftspwatsp/checks/AcceptableBasicTimestampValidationCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpftspwatsp/checks/AcceptableBasicTimestampValidationCheck.java (DSS 6.5.RC1).
process/vpftspwatsp/checks
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpftspwatsp/checks/TimestampMessageImprintCheck.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/process/vpftspwatsp/checks/TimestampMessageImprintCheck.java (DSS 6.5.RC1).
qwac
Ported from the nested class dss-validation/src/main/java/eu/europa/esig/dss/validation/qwac/LinkHeaderParser.java$LinkHeader (DSS 6.5.RC1).
 Ported from the nested class dss-validation/src/main/java/eu/europa/esig/dss/validation/qwac/LinkHeaderParser.java$LinkHeader (DSS 6.5.RC1).
qwac/qwacvalidator
Package qwacvalidator ports dss-validation/src/main/java/eu/europa/esig/dss/validation/qwac/QWACValidator.java (DSS 6.5.RC1).
 Package qwacvalidator ports dss-validation/src/main/java/eu/europa/esig/dss/validation/qwac/QWACValidator.java (DSS 6.5.RC1).
reports
Package reports ports dss-validation's eu.europa.esig.dss.validation.reports package: the top-level report containers consumers receive back from a validation call, bundling the diagnostic data, simple report, detailed report and (where applicable) the ETSI Validation Report produced by validation/executor.
 Package reports ports dss-validation's eu.europa.esig.dss.validation.reports package: the top-level report containers consumers receive back from a validation call, bundling the diagnostic data, simple report, detailed report and (where applicable) the ETSI Validation Report produced by validation/executor.
reports/diagnostic
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/reports/diagnostic/CertificateDiagnosticDataBuilder.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/reports/diagnostic/CertificateDiagnosticDataBuilder.java (DSS 6.5.RC1).
timestamp
Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/timestamp/DetachedTimestampAnalyzer.java (DSS 6.5.RC1).
 Ported from dss-validation/src/main/java/eu/europa/esig/dss/validation/timestamp/DetachedTimestampAnalyzer.java (DSS 6.5.RC1).
Ported from specs-validation-report/src/main/java/eu/europa/esig/validationreport/enums/ConstraintStatus.java (DSS 6.5.RC1).
 Ported from specs-validation-report/src/main/java/eu/europa/esig/validationreport/enums/ConstraintStatus.java (DSS 6.5.RC1).
jaxb
Package jaxb is the schema-shaped model of an ETSI TS 119 102-2 Validation Report.
 Package jaxb is the schema-shaped model of an ETSI TS 119 102-2 Validation Report.
Ported from dss-xades/src/main/java/eu/europa/esig/dss/xades/reference/AbstractTransform.java (DSS 6.5.RC1).
 Ported from dss-xades/src/main/java/eu/europa/esig/dss/xades/reference/AbstractTransform.java (DSS 6.5.RC1).
definition
Package definition ports the dss-xades definition subpackage (eu.europa.esig.dss.xades.definition), the XML element/attribute name and XPath vocabulary for every XML Signature and XAdES schema version (1.1.1 through 1.4.2) DSS understands, plus a Trusted List element vocabulary used when producing/verifying trusted-list signatures.
 Package definition ports the dss-xades definition subpackage (eu.europa.esig.dss.xades.definition), the XML element/attribute name and XPath vocabulary for every XML Signature and XAdES schema version (1.1.1 through 1.4.2) DSS understands, plus a Trusted List element vocabulary used when producing/verifying trusted-list signatures.
extension
Package extension ports the dss-xades extension subpackage (eu.europa.esig.dss.xades.extension), XAdES-specific extend-to-a-higher-level logic (adding a signature timestamp, revocation data, or an archive timestamp to an existing XAdES signature).
 Package extension ports the dss-xades extension subpackage (eu.europa.esig.dss.xades.extension), XAdES-specific extend-to-a-higher-level logic (adding a signature timestamp, revocation data, or an archive timestamp to an existing XAdES signature).
tsl
Ported from dss-xades/src/main/java/eu/europa/esig/dss/xades/tsl/AbstractTrustedListSignatureParametersBuilder.java (DSS 6.5.RC1).
 Ported from dss-xades/src/main/java/eu/europa/esig/dss/xades/tsl/AbstractTrustedListSignatureParametersBuilder.java (DSS 6.5.RC1).
xml
common
Ported from dss-xml-common/src/main/java/eu/europa/esig/dss/xml/common/AbstractConfigurator.java (DSS 6.5.RC1).
 Ported from dss-xml-common/src/main/java/eu/europa/esig/dss/xml/common/AbstractConfigurator.java (DSS 6.5.RC1).
utils
Ported from dss-xml-utils/src/main/java/eu/europa/esig/dss/xml/utils/xpath/AbstractXPathQueryExecutor.java (DSS 6.5.RC1).
 Ported from dss-xml-utils/src/main/java/eu/europa/esig/dss/xml/utils/xpath/AbstractXPathQueryExecutor.java (DSS 6.5.RC1).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.