New features
- [DSS-2430] - Add an Apple signature token
- [DSS-2461] - Add 'user notice' to signature policy
- [DSS-2474] - PAdES : detect prohibited changes
- [DSS-2483] - SimpleReport : add timestamp signature scopes
- [DSS-2494] - Invalid signatures can be made with Revoked and Suspended certificates on level B and T
- [DSS-2532] - SAV : verify if used digest algorithm for signing-certificate reference is reliable at validation time
- [DSS-2541] - PAdES : check if a visual signature field is within page size
- [DSS-2554] - PAdES : alert on restricted signature creation
- [DSS-2645] - SVC : return possible extension time on failed signature augmentation
- [DSS-2652] - Add support for SHA-3 with PLAIN-ECDSA and ED448 signature algorithms
- [DSS-2677] - PAdES : visual signature pre-visualization
Improvements
- [DSS-2493] - PAdES : incorporate validation data with PAdESService.timestamp(...) method
- [DSS-2495] - Alignment with EN 319 412-1 v1.4.4
- [DSS-2516] - DSS XmlDefinerUtils Support factory definition
- [DSS-2521] - Validation process : move revocation processing to a separate block
- [DSS-2548] - Signature extension : ensure extension is not possible with a lower level
- [DSS-2632] - PAdES : reduce number of token builds extracted from /DSS and /VRI dictionaries
- [DSS-2501] - CAdES : include archive-tst hash algorithm to SignedData.digestAlgorithms set
- [DSS-2505] - CAdES : mime-type attribute should be present
- [DSS-2525] - Expose WebServices for TL signing
- [DSS-2529] - Enforce subFilter specific requirements for PKCS7 on SignatureLevel detection
- [DSS-2531] - ASiC : newly created manifests do not contain MimeType for signed data
- [DSS-2542] - ETSI VR : enforce validation of AttributeBaseType elements
- [DSS-2546] - Refactor ASiC Services
- [DSS-2566] - PAdES : ensure message-digest validation against byte range binaries
- [DSS-2620] - JAdESBaselineRequirementsChecker : enforce 'crit' dictionary check
- [DSS-2626] - JAdES : improve 'kid' dictionary handling
- [DSS-2628] - PDF Detailed Report : add final validation conclusion status
- [DSS-2630] - JAdES : add support for signatures containing adjacent line breaks
- [DSS-2634] - ETSI VR : define namespace prefixes according to xsd schema
- [DSS-2655] - PAdES OpenPDF Visible Signature : add support of documents with rotation
- [DSS-2661] - Improve getIssuer method
- [DSS-2670] - SVC : separate revocation freshness check between signatures and timestamps
- [DSS-2671] - Refactor RevocationFreshness constraint
Bug fixes / Issues
- [DSS-2533] - PDF/A compliance issue when a non-stroking color is used
- [DSS-2547] - WebApp : unable to sign when the used encryption algorithm is different from the one used to sign the certificate
- [DSS-2556] - XAdES : avoid NPE when XPath doesn't exists
- [DSS-2560] - Custom TokenIdentifierProvider duplicates SignerData objects in DiagnosticData
- [DSS-2568] - ASiC with XAdES : identical signatures in two different files produce the same unique id
- [DSS-2569] - Error in log when signing PDF in an ASiC-E+XAdES ([Fatal Error] :1:1: Content is not allowed in prolog.)
- [DSS-2571] - Make NativePdfBoxVisibleSignatureDrawer PDFA compabible
- [DSS-2574] - Validator warns on visual difference after adding a 2nd visible signature on a single page document
- [DSS-2575] - CMSCertificateSource nullpointer exception in extractCandidatesForSigningCertificate()
- [DSS-2577] - DSS-demonstrations : run_prettify.js transformed into relative path instead of absolute
- [DSS-2586] - Mimetype of documents always set to application/octet-stream when re-signing ASiC container
- [DSS-2587] - Signature verification report is unreliable if having multiple TrustedListsCertificateSources
- [DSS-2589] - XAdES Enveloping Signature cannot include another Envelopding XAdES when embedXML option is enabled
- [DSS-2595] - Check if best-signature-time is not before for passed basic signature validation
- [DSS-2596] - Validation de signature invalide à travers le site 'https://dss.nowina.lu/validation'
- [DSS-2598] - Past Signature Validation's result shall not be overwritten by Past Certificate Validation
- [DSS-2601] - RevocationFreshnessChecker : enforce check against thisUpdate value
- [DSS-2604] - NPE in CertificateWrapper when timestamp incluce SigningCertificateV2 calculated over another certificate
- [DSS-2605] - Set security provider to Santuario JCEMapper
- [DSS-2608] - Unhandled exception in QcStatementsUtils
- [DSS-2610] - Signature Validation of LT augmented signature doesn't use embedded revocation token
- [DSS-2612] - Visual signature text is not PDF/A compliant. It shouldn't default to DeviceRGB colorspace
- [DSS-2614] - JAdES : NullPointerException on a certificate ref when using a UserFriendlyIdentifier
- [DSS-2615] - PDFDocumentValidator.getOriginalDocuments() does not work for '\r%%EOF' ending
- [DSS-2616] - DSS-Demonstrations : wrongly encodes characters extracted from a document filename
- [DSS-2618] - PAdESUtils::retrieveLastPDFRevision don't returns with content when only CR used after %%EOF
- [DSS-2624] - DSSUtils : fix Date formatting method
- [DSS-2631] - Rotated images can be signed twice in same position
- [DSS-2637] - XAdESCertificateRefExtractionUtils : unhandled exceptions
- [DSS-2644] - JAdES : 'pars' member's values should not be URL-encoded
- [DSS-2651] - Level Detection : Extended formats shall not be based on BASELINE-B profile
- [DSS-2654] - DSS must not depend on namespace aliases (Affects manifest and possibly others)
- [DSS-2658] - PAdES : Wrong LTA level determination for a PDF with multiple signatures
- [DSS-2660] - JAdES : unnecessary decode/encode in base64Url leads to a different output
- [DSS-2664] - JAdES : avoid ClassCastException on signature validation
- [DSS-2666] - Some BasicBuildingBlocks are skipped for counter signatures
- [DSS-2679] - XAdES : ensure the same signature parameters can be used for signing of different documents
- [DSS-2681] - CAdES : counter-signing produces duplicates of signatures counter-signing other signatures
Tasks / Other
- [DSS-2509] - Upgrade httpclient
- [DSS-2606] - Upgrade Apache Santuario 2.3.0
- [DSS-2639] - Upgrade BouncyCastle 1.70
- [DSS-2642] - Cookbook revamp (part 1)
- [DSS-2667] - PdfBox update 2.0.25
- [DSS-2668] - JUnit and Logback update
- [DSS-2669] - Apache HttpClient 5 upgrade 5.1.2
- [DSS-2672] - Release preparation
- [DSS-2684] - Cookbook alignments