Conversation
Wire the EU List of Trusted Lists correctly so LT/LTA can embed revocation data and resolve trust anchors: - DssTrustConfigurer: build a proper European LOTL (URL + bundled Official Journal keystore + OJ announcement predicate + pivot support), fixing the null-URL NPE and the missing LOTL-signature material. Custom trust.lotlUrls entries are wired with the OJ cert source + pivot; blank URLs are guarded. - Bundle the OJ keystore (dss-demonstrations 6.4+20260415) as a classpath resource, overridable via trust.eu.ojKeystoreFile/ojKeystorePassword/ojUrl and trust.eu.lotlUrl. Refresh scripts + README under engines/dss. - Group EU LOTL keys under trust.eu.* and rename trust.useDefaultLotl -> trust.eu.enabled (config, GUI label keys, FXML, prefs VM/controller). - Add DssLtTrustPreflight: CLI fails fast and the GUI offers to enable the online + trust prerequisites when LT/LTA is selected but not configured. - Offline unit tests for the LOTL wiring and the preflight predicate. Defaults stay opt-in (online + EU LOTL both false). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…port
Follow-up fixes found while testing LT against a real (eIDAS pilot) LOTL:
- Package the DSS modules the trusted-list path needs at runtime, which were
missing/test-scoped so the whole LOTL feature failed in the distribution:
- specs-trusted-list-v211 (TrustedList211Utils) — LOTL parsing
- dss-validation + dss-policy-jaxb — LOTL/TL signature validation
(were declared test-only)
- Ship an SLF4J binding (slf4j-jdk14) in the distribution so DSS logging
(LOTL download / validation / revocation) is no longer dropped to the NOP
logger — these failures were previously invisible.
- DssTrustConfigurer: add engine.dss.trust.lotlMraSupport to enable DSS MRA
processing for third-country mutual-recognition LOTLs on the lotlUrls path.
- DssSigningEngine: catch the untrusted-chain AlertException and log an
actionable message (console.dss.untrustedChain) instead of a raw stack trace.
- Defaults + test coverage for the new flag.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #432. PAdES LT/LTA on the DSS engine failed two ways: an untrusted-chain abort (revocation skipped), and a hard NPE after enabling "use default LOTL".
Changes
DssTrustConfigurer): URL + bundled Official Journal keystore + OJ announcement predicate + pivot support. Fixes the null-URL NPE and the missing LOTL-signature material. Customtrust.lotlUrlsentries get the OJ cert source + pivot; blank URLs are guarded.dss-demonstrations6.4+20260415(post April-2026 rotation; 6 EC qualified signer certs, no private keys), overridable viatrust.eu.ojKeystoreFile/ojKeystorePassword/ojUrlandtrust.eu.lotlUrl. Refresh scripts + README underengines/dss.trust.eu.*;trust.useDefaultLotl→trust.eu.enabled(only ever shipped broken in RC-2). Updated GUI label keys (all translations), FXML, prefs VM/controller.DssLtTrustPreflight): CLI fails fast with the exact keys to set; GUI offers to enable the online + trust prerequisites — instead of the opaque deep DSS failure.Defaults stay opt-in (
online.enabled+trust.eu.enabledbothfalse).Notes
trust.truststoreFile.onlineRefresh()integration test (real network) is not included yet.🤖 Generated with Claude Code