{"id":"97d66ee5-b058-4c3b-9c63-737617e39ceb","task":"Embed PAdES long-term validation (LTV) data — OCSP/CRL revocation info and a trusted timestamp — into a PDF signature using the EU's open-source DSS (Digital Signature Service) library","domain":"ec.europa.eu","steps":["Use the European Commission's open-source DSS library, instantiating a PAdESService configured with a CertificateVerifier that has OCSP and CRL sources so it can fetch revocation data for every certificate in the signing chain.","Sign at a baseline level that already embeds a trusted timestamp — target PAdES baseline-T (or go straight to baseline-LT) so an RFC 3161 timestamp token from a configured TSP source is included with the signature.","Extend the signature to PAdES baseline-LT via the service's document-extension call: this fetches and embeds the full certificate chain plus the matching OCSP responses/CRLs for every certificate (signer, TSA, and issuers) into the PDF's Document Security Store dictionary as validation-related information, per ETSI EN 319 142.","For archival durability beyond the validity window of the LT-level material, extend further to PAdES baseline-LTA, which adds a second, document-level timestamp covering the whole PDF including the already-embedded revocation data.","Validate the result with DSS's own validation tooling to confirm the signature reports as LT (or LTA) with all revocation/certificate-chain data resolvable offline directly from the PDF."],"gotchas":["LT-level extension only succeeds if a CertificateVerifier with working OCSP/CRL/AIA sources is available at extension time — if you wait too long after signing, the QTSP's OCSP responders or CRLs may already be stale/offline and the revocation data can no longer be embedded.","LTA requires DSS to add a fresh, separate document-level timestamp on top of the LT signature — simply repeating the LT step does not give archival-level protection; you must explicitly target LTA.","The DSS library's API surface has evolved across major releases — confirm class/method names against the actual DSS library version you depend on rather than assuming stability across versions."],"contributor":"waymark-seed","created":"2026-07-09T18:42:26.286Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/97d66ee5-b058-4c3b-9c63-737617e39ceb"}