edockit 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.3] - 2025-12-30
+
+### Fixed
+
+- **Long-Term Validation (LTV) for revoked certificates** - Signatures made before certificate revocation are now correctly validated as valid when a trusted timestamp proves the signing time
+
 ## [0.2.2] - 2025-12-30
 
 ### Fixed
@@ -54,6 +60,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - File checksum verification (SHA-256/384/512)
 - Browser and Node.js support
 
+[0.2.3]: https://github.com/edgarsj/edockit/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/edgarsj/edockit/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/edgarsj/edockit/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/edgarsj/edockit/compare/v0.1.2...v0.2.0

package/dist/index.cjs.js

@@ -10569,11 +10569,23 @@ async function verifySignature(signatureInfo, files, options = {}) {
                 ...options.revocationOptions,
             });
             certResult.revocation = revocationResult;
-            // If certificate is revoked, mark certificate as invalid
+            // If certificate is revoked, check if signature was made before revocation (LTV)
             if (revocationResult.status === "revoked") {
-                certResult.isValid = false;
-                certResult.reason = revocationResult.reason || "Certificate has been revoked";
-                errors.push(`Certificate revoked: ${revocationResult.reason || "No reason provided"}`);
+                const revokedAt = revocationResult.revokedAt;
+                // Long-Term Validation: if we have a trusted timestamp proving the signature
+                // was made before revocation, the signature is still valid
+                if (revokedAt && trustedSigningTime < revokedAt) {
+                    // Signature was made before revocation - still valid (LTV)
+                    certResult.revocation.isValid = true;
+                    certResult.revocation.reason = `Certificate was revoked on ${revokedAt.toISOString()}, but signature was made on ${trustedSigningTime.toISOString()} (before revocation)`;
+                }
+                else {
+                    // Signature was made after revocation or no revocation date available
+                    certResult.isValid = false;
+                    const revokedAtStr = revokedAt ? ` on ${revokedAt.toISOString()}` : "";
+                    certResult.reason = `Certificate was revoked${revokedAtStr}`;
+                    errors.push(`Certificate revoked${revokedAtStr}`);
+                }
             }
             // Note: 'unknown' status is a soft fail - certificate remains valid
             // but user can check revocation.status to see if it couldn't be verified