Improvements

• [DSS-2593] Introduce an Algorithm Obsolescence Check block
• [DSS-3634] Add support of StructTreeRoot on object modification detection
• [DSS-3641] Cryptographic validation shall validate signature algorithm, instead of digest and encryption algo separately
• [DSS-3703] Harmonize CMS creation process
• [DSS-3715] DSS Demonstrations : switch to file cache revocation sources instead of generic FileCacheDataLoader
• [DSS-3720] Inconsistent trust anchor usage during signature verification when multiple certificates share the same DN and key pair
• [DSS-3742] Improve default validation policy name and description
• [DSS-3743] Make content type policy constraints to accept multiple values
• [DSS-3746] JAXB PKI Factory : add SubjectAlternativeName certificate extension
• [DSS-3751] Unnecessary digest computation in PdfBoxSignatureService.signDocument(...) for external CMS PAdES signing
• [DSS-3753] Add CRL number on XAdES-E-C augmentation (PR #187 by @erdembas)
• [DSS-3757] Add policy description within certificate validation reports HTML and PDF
• [DSS-3759] Enable sunset date handling in Demos by default
• [DSS-3777] Improve error handling for Pkcs11SignatureToken
• [DSS-3778] TL6 support based on ETSI TS 119 612 v2.4.1 instead of v2.3.1.

Bug fixes / Issues

• [DSS-3636] ASiC creation or augmentation fails when a detached content provided in parameters
• [DSS-3649] ASiC-E with CAdES with an archive-time-stamp unsigned attribute fail LTA augmentation
• [DSS-3672] Inconsistent behavior when validating XML detached and manifest signatures with DSSDocument name attribute
• [DSS-3680] DSS WebApp : server-sign process is not resolved when using a reverse-proxy
• [DSS-3694] KeyUsage leads to ArrayIndexOutOfBoundsException when used with an alternative security provider
• [DSS-3702] FileCacheOCSPSource shall create OCSP key based on URL+Certificate combination
• [DSS-3704] JSON schema validation skips some single issues
• [DSS-3705] Enveloped countersignature ignored when Reference Type is missing
• [DSS-3712] AIACertificateSource ignores candidates when full certification path is returned
• [DSS-3722] DSS fails to build a report when DigestAlgorithm used for signature policy is not known
• [DSS-3725] XAdES and JAdES counter signatures are validated multiple times
• [DSS-3732] Fix XAdES Archive Timestamp v1.3.2 message-imprint computation for enveloped signatures
• [DSS-3750] Incorrect URI Encoding in Detached Signature with ESIG/DSS from Version 6.2
• [DSS-3758] IssuerSerial not matching when DN has line breaks after non-space text ending
• [DSS-3770] OpenPdf implementation does not generate field id when using the #addNewSignatureField method
• [DSS-3771] PAdESService#addNewSignatureField does not check for overlapping field names
• [DSS-3780] Performance of timestamp's ContainerSignedAndTimestampedFilesCovered constraint
• [DSS-3781] PKI Factory : missing Authority Key Identifier certificate extension
• [DSS-3783] Validation fails when a third country Trust Service defines qualifiers, but no MRA mapping is provided
• [DSS-3784] Javadoc generation fails for JAXB generated classes with JDK 25
• [DSS-3787] XAdES-B-T is displayed as XAdES-E-C when only self-signed certificates are used

Tasks / Other

• [DSS-3697] Add publiccode.yml file for repository inclusion in EU OSS Catalogue
• [DSS-3734] Avoid ZIP bomb in source code
• [DSS-3747] ETSI TS 119 411-5 : add unit tests
• [DSS-3764] Upgrade to BouncyCastle 1.83
• [DSS-3765] Upgrade to PdfBox 3.0.6
• [DSS-3766] Upgrade to Tomcat 11.0.15

Migration

For information about code changes and migration process, please refer to the Migration Guide in documentation.