Adds the validation data of every signature and document timestamp (their certificate chains, OCSP responses and CRLs) to the
document security store and writes the document, with an incremental update holding it, to stream.
public void AddValidationData(Stream stream, PdfSignatureValidationOptions? options = null)
Where to write, from its current position. It is not disposed.
The trust anchors, extra certificates, OCSP responses and CRLs to validate with, and the client to fetch missing revocation data
through (UseOnlineRevocation(HttpClient?)); null for none: nothing is fetched
unless the options give a client. The request is sent synchronously.
ISO 32000-2 §12.8.4.3, Table 261: the signatures are validated as ValidateSignatures(PdfSignatureValidationOptions?) does with
options, and every certificate of each signer's and time-stamping unit's path, and every OCSP response and
CRL that established a certificate's status (from the signature, the store, the options or fetched), goes into the store's
Certs, OCSPs and CRLs arrays, each a stream, once: what the store already holds is not added again. A
signature that validates gets a VRI dictionary (§12.8.4.4, Table 262) under the uppercase hexadecimal SHA-1 of its whole
Contents string, padding included, naming the entries used for it; one that does not gets none ("shall not be used to
record the information used in an unsuccessful validation attempt"). The store is a PDF 2.0 feature: the update raises the version
(in the catalog), or strict mode refuses before anything is fetched or changed.
ETSI EN 319 142-1: a B-T signature (signed with TimestampClient) with its validation data stored is B-LT; a document timestamp added after it (Timestamp(Stream, PdfTimestampClient, String?)) makes it B-LTA, and validation then checks everything that timestamp covers at its time (§12.8.5.3), so the document validates offline after the certificates expire. To renew, add the validation data of the last document timestamp (this method, which covers it like any signature) and time-stamp again before its unit's certificate expires. Adding a store or a document timestamp is a change every certification permits (§12.8.2.2.2, Table 257), so earlier signatures stay valid.
Edits made in memory and not yet saved are written with the update but play no part in the validation. Once the last byte is written the document reads from the new file; if validation or the save fails, nothing is written and the document is left as it was. A mutation: no read may run concurrently with it.