Module validation 

Validation-data containers and non-authoritative timestamp association hints.

Structs

CertificateRoleComparison

Actual exclusive credential certificate and its current reference agreement.

CertificateRoleRow

One original ordinary Cert reference and all exclusive-credential CA comparisons.

CertificateRoles

Only the exclusive credential CA prohibition of Annex A.1.1. Root coverage, signer exclusion, credential reference completeness, status and incorporation remain separate. TSA-only or shared credential/TSA CAs are not prohibited.

CredentialCertificate

One certificate actually required by a credential authority path.

CredentialCertificateReferences

Only A.1.3(1–2)’s required X.509 reference presence, not credential trust, optional status-authority references, identifier correctness or a grade.

CredentialCertificateRow

One original reference, retaining every candidate comparison.

CredentialStatusSource

One actual credential participant’s non-anchor status contributor.

CrlReferenceIdentity

Completed mandatory fields. Optional original Number is only an acquisition hint; it is never narrowed to u64 or used as a digest identity.

CrlValueReference

One original row’s identifier and digest against the SAME actual CRL. Private construction retains the source pair for subsequent composition; a caller cannot substitute another list after the checks have completed.

Data

Original complete container, before PKI, path/status or level validation.

MaterialDigest

Completed digest fact for one original source, not path/authority agreement.

OcspEnvelopeReference

Identifier and optional digest checked against the SAME signed envelope. This does not prove authorization, target status, actual use or trust.

OcspReferenceIdentity

Completed identifier facts, separate from whole-response digest, target authorization, status usability, actual participant use and incorporation.

OcspReferenceInput

Original whole envelope and an actual signature receipt. This is an INPUT, not a trusted binding: check_ocsp_envelope_reference checks the relation.

PathStatusSource

One original source contributing to a non-anchor checked-path status result.

ReferenceDigests

All references against the complete parsed original XML material pool. Equal digests alone do not establish issuer/time/serial, actual actor use, applicability, authentication, required incorporation or a baseline grade.

ReferenceEntry

Parsed field selectors of one original reference. This type cannot replace the protected signing-certificate reference catalogue in key/path checking.

ReferencePresence

Conditional referenced-material facts bound to the same complete report.

ReferencePresenceRow

One original reference row’s conditional obligation and completed outcome.

ReferenceProperty

One complete original unsigned reference property. Original certificate paths, authority restrictions and actual artifact comparisons remain separate.

ReferenceRow

One original reference and its exact range in the comparison catalogue.

RevocationRoles

Required signer-path sources and A.1.2(5) comparisons from the complete actual actor/status closure. This is not full identifier/reference validity, status usability, anchor-reference exclusion or a grade.

RootPathReferences

Root certificate rules of Annex A.1.1(1–2), bound to the actual selected path. Optional TSA/status-authority references, exclusive credential CAs, incorporated presence and authentication/status remain separate checks.

RootReferenceRow

One original CompleteCertificateRefsV2 entry and its root-path comparisons.

StatusRoleComparison

One actual exclusive credential CA status target and a reference comparison.

StatusRoleRow

One original CRLRef/OCSPRef/open-format entry and its candidate comparisons.

StatusSourceComparison

Digest fact for an actual contributing required status source.

Enums

CertificateRoleError

Original source, classification and provider failures are terminal causes.

CredentialReferencePlace

Source of an original certificate reference; protected and ordinary copies are normative alternatives, not caller-supplied presence flags.

CrlReferenceError

Terminal causes never become missing identity or completed disagreement.

CrlValueError

Exact original processing stage; resource/source refusals never disagree.

Error

Original structural/processing cause, separate from material authenticity.

Hint

A hint is never proof that a certificate/status value belongs to a timestamp.

OcspEnvelopeError

Input/source and execution failures never become an OCSP identity mismatch.

OcspReferenceError

Exact stage/cause; processing/resource refusal is not identity disagreement.

ReferenceDigest

Exact digest processing, independent of identifier/path/authority checks.

ReferenceDigestError

Caller/source misuse and actual execution failures are terminal.

ReferenceField

Original scalar obligation, retained without copying a normalized value.

ReferenceFieldError

Original field processing or completed unproven syntax, never artifact mismatch, missing material or provider authentication.

ReferenceIdentifier

Original artifact identifier, retained for actual semantic comparison. These selectors neither authenticate a responder nor override digest bytes.

ReferenceKind

Referenced artifact schema; no issuer, presence or digest agreement follows.

ReferenceNameError

A failed name interpretation is never a completed negative comparison.

ReferencePresenceError

Invalid scope/census and processing refusal are not absent material.

ReferencePresenceFailure

Why a referenced value’s required incorporation was not established.

ReferenceSearch

How one original reference participated in the complete digest search.

ReferenceTarget

Original bytes available for reference comparison. Independently supplied path certificates/CRLs do not need fabricated XML material nodes. OCSP must retain its WHOLE envelope; a bare basic response is intentionally not a target.

ReferenceTime

A complete comparison or an explicit missing interpretation; no UTC default.

ReferenceTimeError

Original processing refusals remain terminal, independent of label equality.

ResponderIdentifier

Original OCSP responder choice; name and key hash cannot be interchanged.

ResponderKeyError

Source/schema and visitor causes remain distinct from key disagreement.

Role

Validation-data container’s actual schema role.

StatusRoleAgreement

Whole-envelope absence is an unproven relation, never a hash of a basic payload.

Functions

check_certificate_reference_roles

Compare ordinary certificate references with exclusively credential CA certificates from the COMPLETE actual actor/status closure. Annex A.1.1 permits TSA references; this deliberately differs from the ordinary values prohibition in §§5.4.2–5.4.3. One existing lazy BC kernel classifies each distinct actual candidate once; one full-identity digest memo serves all refs. Method/declared-value validation precedes lazy certificate scans/allocation. No parse, credential/signature/path authentication or XML acquisition repeats. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

check_credential_certificate_references

Check the mandatory credential signer/ancestor/existing-anchor reference set from actual complete participant paths, honoring the normative protected and ordinary-reference alternatives. No caller-written presence flags, new path validation, key selection, certificate copies or hash engine are introduced. Method syntax/width gates precede lazy path catalogues. One provider-identity memo pays for each exact certificate once even across shared authorities. A.1.3(1–2)’s repeated-reference SHOULD NOT remains a separate advisory fact. This is not complete identifier/credential/status/trust or baseline acceptance. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

check_crl_reference

Compare every mandatory field of a written CRLIdentifier with the actual list through original name/XSD1.0 time semantics under the current query. EN319132-1 Annex A.1.2 requires issuer and issue time; Note3 expressly makes Number an optional retrieval hint. It cannot replace the whole-list digest or impose a finite-width requirement. None means no written CRL identifier, including another reference kind, never successful agreement. Signature/issuer authorization, complete/delta applicability, freshness, actual use and incorporation remain independent. No CRL parse is repeated. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

check_crl_value_reference

Compose Annex A.1.2’s mandatory DER-list digest and optional CRLIdentifier through the SAME existing digest/name/calendar kernels and current query. No parse, serialization, signature verification or acquisition repeats. A different reference kind returns None, never successful agreement.

check_ocsp_envelope_reference

Compose Annex A.1.2’s mandatory responder/time fields and optional whole OCSPResponse digest WITHOUT allowing a valid identifier from response A to be joined to a digest of envelope B. The known syntax and exact original payload relation are paid and checked before any provider callback; neither signature verification nor parsing repeats. Two different encodings of the same signed body are not normalized or silently substituted. Malformed/unavailable mandatory time syntax prevents both key and envelope digest callbacks. A readable time mismatch retains both independent facts. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf https://www.rfc-editor.org/rfc/rfc6960#section-4.2.1

check_ocsp_reference

Compare both fields of an original OCSPIdentifier with a response whose mathematical signature and ResponderID-to-signer binding already succeeded. Annex A.1.2 requires the actual responder and producedAt of the referenced response. RFC6960 §4.2.1 permits either responder identifier spelling; a ByName XML selector can identify a byKey response and conversely through the SAME authenticated signer. No signature/path/hash of the response is repeated. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf https://www.rfc-editor.org/rfc/rfc6960#section-4.2.1

check_reference_fields

Execute each retained reference field through its XML owner’s EXISTING datatype/base64 kernel, without another child parse, normalization or ASN.1 fabrication. Hint dateTimes may genuinely omit a timezone; unlike SigningTime they are not converted to a claimed UTC instant. Open OtherRef payloads retain their explicit opaque kind for a format handler, not an invented validity flag.

check_revocation_reference_roles

Check Annex A.1.2(5) using actual revocation TARGET CA facts and all actor purposes, not the authentication signer’s CA bit. External complete/delta CRLs can be compared directly; OCSP must locate an original WHOLE envelope containing the exact basic response in the XML/token pools. Missing envelopes stay explicitly unproven, never replaced with a payload hash/re-encoding. Method/width checks precede lazy classification and source indexing; one memo and one body/source index serve every original reference. Neither XML, ASN.1, signature, path nor status authentication repeats. A late refusal drops the report. Unsupported methods and identifier-only/open references retain their obligations; this report cannot assert all reference requirements. Also retains every actual signer-path complete/delta/OCSP contributor and checks its required presence independently for each written property under A.1.2(1–2). All sources share the same exact-kind/byte identity memo, including artifacts reused by different path members. Optional absent properties do not allocate or activate this requirement. Hash identity alone does not validate mandatory issuer/responder/time fields or trust-anchor exclusions. A.1.4(1–2)’s credential sources are derived through the same path/status walker when the attribute-reference property is written. Ordinary matches satisfy its alternatives without erasing A.1.2(5)’s separate prohibitions; repeated attribute copies expose the SHOULD NOT advisory. Complete/delta and whole OCSP comparisons share the same memo across both property roles. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

check_root_certificate_references

Check the complete ordinary certificate reference catalogue against the SAME actually selected certificate path. A.1.1(1–2) requires anchor/CA references and forbids the signing certificate. Extra references can relate to other actual TSA/status paths; they are not rejected merely for differing from this root path. Unsupported comparisons cannot prove signer exclusion. Every reference shares the existing method/width/MD5/streaming core and one full-provider-identity/exact-certificate memo. No XML copy, re-encoding, acquisition, signature/path replay or new crypto dispatcher is needed. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

compare_reference_catalogues

Compare EVERY prepared reference with EVERY compatible original parsed material view. Hashes are memoized by exact kind/bytes and complete resolved provider identity, never by width, URI spelling or unauthenticated hint. EN319132-1 Annex A.1.1–A.1.4 digest whole certificate/CRL/OCSPResponse DER. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

compare_reference_catalogues_with_tokens

Include original timestamp-carried certificates, complete/delta CRLs and WHOLE OCSP envelopes in the same paid candidate/hash memo. Equal DER copied between XML and tokens shares one digest output while every location stays in the report. Embedded OCSP certificates keep their enclosing token/choice. No source is reparsed or copied. Both pools must belong to the same original generation/selected signature before any allocation/provider work.

compare_reference_digest

Compare a retained original reference with a retained original artifact. EN319132-1 A.1.1/A.1.2/A.1.3/A.1.4 use whole certificate/CRL DER and whole OCSPResponse, NOT merely its BasicOCSPResponse payload. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

compare_reference_target

Compare an original reference against an actual external parsed certificate or CRL, or a retained whole XML envelope, through the SAME digest kernel. External acquisition/path trust stays with the caller; only the CURRENT operation pays this comparison and original storage ownership is unchanged. This does not imply that an external value is incorporated in the signature. The Annex A full-DER/whole-response and separate identifier obligations are identical to compare_reference_digest; no basic-only OCSP hash is allowed.

matches_reference_key

Compare the original DER byKey selector with an actual responder certificate. Reuses the same shared RFC6960 identity kernel as OCSP authentication; original source/depth and current query ceilings govern the hash callback. The certificate’s signature/path/authorization and response producedAt remain independent. None identifies a different original selector branch.

matches_reference_name

Compare an original CRL issuer or OCSP ByName hint with an actual PKIX Name. Annex A.1.2 refers to XMLDSig §4.5.4.1 DN strings; RFC4514 parsing and RFC5280 name preparation remain with the existing PKIX owner. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

matches_reference_time

Compare original CRL IssueTime or OCSP ProducedAt with its actual PKIX time. Annex A.1.2 requires the referenced response’s production time. XSD1.0 Datatypes §3.2.7 uses 1 BCE=-0001, end-of-day24 and arbitrary fractions; §§3.2.7.3–4 define timezone conversion. These are label comparisons, not authenticated occurrence, freshness or historical trust. https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/#dateTime https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

read

Reads one direct unsigned validation-data container of the selected signature.

reference_presence

Evaluate Annex A.1.1–A.1.4’s conditional “present elsewhere” requirement from the SAME completed original digest search. Certificate/status values, qualifying nonempty AnyValidationData and ArchiveTimeStamp activate their respective obligations. Their URI and Number hints never replace presence. The exact token source census is checked against whole-scope requirements and the complete counter receipt before any output allocation. This prevents a root-only/failed-token subset from reporting another pool’s values missing or accepting a fabricated empty source set. No parsing/hashing is repeated. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

with_reference_issuer_serial

Read an optional original certificate-reference issuer/serial hint using exactly the same DER/RFC5035 kernel as protected SigningCertificateV2. Annex A.1.1/A.1.3 import the original clause5.2.2 CertIDListV2 grammar. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

with_responder_key

Visit the complete original OCSP byKey hash. Annex A.1.2 requires base64 of the DER-encoded RFC6960 byKey FIELD, not a naked twenty-byte digest. https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf

Type Aliases

CertificateRoleResult

Complete certificate-role comparisons or an unchanged terminal cause.

CredentialCertificateResult

Original source/provider/resource failures remain terminal and located.

CrlReferenceResult

Original XML enclosure and both fields, or the exact terminal cause.

CrlValueResult

Complete source-paired CRL facts or the unchanged terminal cause.

OcspEnvelopeResult

Complete paired facts or the unchanged stage-specific terminal cause.

OcspReferenceResult

One complete original identifier result in this XML owner’s source domain.

Reading

Reading in this XML owner’s original identity types.

ReferenceCatalogueResult

Complete catalogue comparison with unchanged XML/provider/resource causes.

ReferenceFieldResult

Scalar interpretation result in the original XML owner’s identity domain.

ReferenceKeyResult

Original XML enclosure and shared/provider failure for a responder-key query.

ReferencePresenceResult

Conditional incorporation result in this original XML identity domain.

RevocationRoleResult

Terminal XML/provider/admission and original target CA classification causes.

RootPathReferenceResult

Actual selected-path reference report or the unchanged terminal cause.

ValidationResult

Original XML/property refusal types.