[stable35] feat(tsa): let administrators choose the hash algorithm of the timestamp query - #8283
Merged
Merged
Conversation
The hash of the timestamp query was never configurable: JSignPdf decided it alone, and #8145 reports authorities rejecting the request because of that choice. It belongs to the TSA settings, next to the URL, the policy OID and the authentication, so every tenant that configures its own authority can also say what that authority expects. SHA256 is the default and keeps what JSignPdf 3.1.0 already does. SHA1 is not offered: it is the algorithm the authorities in the report refuse. Signed-off-by: André Maia <andrefnkmm@gmail.com> Assisted-by: Claude Code:claude-opus-5
…uthority JSignPdf decided the timestamp hash by itself, and the authorities in #8145 answer HTTP 400 when that choice is not the one they expect. Send --tsa-hash-algorithm from the TSA policy instead, spelled the way JSignPdf wants it (SHA-256, with the hyphen, unlike --hash-algorithm). The resolver answers this hash on its own, never from the signature one: that one follows the PDF version and would ask for SHA1 on any document older than PDF 1.6, which is the request the authority rejects. The php native engine reads the same policy, so it stops being pinned to SHA-256 and follows what the administrator chose. Signed-off-by: André Maia <andrefnkmm@gmail.com> Assisted-by: Claude Code:claude-opus-5
The algorithm of the timestamp query is now part of the TSA policy, so it belongs next to the URL, the policy OID and the authentication: the administrator who knows which authority is being used is the one who knows what it accepts. The select offers SHA-256, SHA-384 and SHA-512, spelled the way the authorities document them, and defaults to SHA-256. Signed-off-by: André Maia <andrefnkmm@gmail.com> Assisted-by: Claude Code:claude-opus-5
vitormattos
force-pushed
the
backport/8276/stable35
branch
from
September 6, 2026 17:34
b599a8d to
de4510a
Compare
vitormattos
marked this pull request as ready for review
September 6, 2026 17:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #8276
Warning, This backport's changes differ from the original and might be incomplete⚠️
Todo
Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.