Comment by eps
6 hours ago
Why not use RFC 3161?
Due to how the code signing works, timestamping servers are provided by all major CAs with full public access, e.g. timestamp.digicert.com, timestamp.comodoca.com, timestamp.sectigo.com, etc.
PS. OP, your comments are auto-killed for some reason. You may want to message mods to get this sorted.
Thanks for the heads up on the comments, ive messaged. Not sure if this will be flagged too.
Youre right, I conflated two things in my reply to sscaryterry. B-T needs an RFC 3161 token from any TSA. Its only a qualified timestamp under eIDAS that needs a QTSP. Those are separate claims I ran them together.
Although the code already has the path. The signing service uses pyhanko with an HTTPtimestamper pointed at timestamp.digicert.com, and its switched off at every call site. Reason was availability, an external TSA sits on the signing path, so if its slow or down, sealing fails, whereas the anchor is async and can never fail a seal. That reasoning holds for the default and doesnt justify never offering it.
It should be optional, and on where the caller wears the dependency, which also gets pyhanko to embed validation info and go to LTA rather than just B-T. Only thing I want to check first is the terms on those public TSAs, since a few are scoped to code signing. Opening an issue, and thx agaain.