Inconsistent LTV Status in PDF Timestamp Signatures

[sudoman00]

Describe the bug
When adding timestamps to PDF files, I'm encountering inconsistent behavior where the same file processed with the same timestamper produces different LTV (Long Term Validation) statuses across multiple attempts.

To Reproduce

def add_timestamp_to_pdf(input_pdf, output_pdf):
    with open(input_pdf, 'rb') as pdf_buffer:
        w = IncrementalPdfFileWriter(pdf_buffer)

        tsa_client = timestamps.HTTPTimeStamper(
            TSA_URL,
            auth=HTTPBasicAuth(TIMESTAMP_USERNAME, TIMESTAMP_PASSWORD),
        )

        with open(output_pdf, 'wb') as outf:
            signers.PdfTimeStamper(tsa_client).timestamp_pdf(
                pdf_out=w, 
                md_algorithm=signers.DEFAULT_MD,
                validation_context=ValidationContext(
                    allow_fetching=True
                ),
                output=outf
            )

input_file = 'test_file.pdf'
output_file = 'timestamp.pdf'
add_timestamp_to_pdf(input_file, output_file)

Current Results:

• The issue occurs randomly.
• After several successful LTV-enabled results, some attempts will produce non-LTV-enabled signatures.

Expected behavior:

• The timestamped document should have LTV enabled status.

Environment:

• OS: macOS
• Version: 0.25.1
• PDF Viewer: Adobe Acrobat

Additional context

• Original file:
  test_file.pdf
• Timestamp output file:
  timestamp.pdf

[MatthiasValvekens]

I'm converting this to a discussion, since there are too many external factors to determine whether this is a bug in pyHanko.

First, you need to understand that "LTV enabled" is a proprietary notion in Acrobat that is (a) not formally defined anywhere, and (b) a moving target, since its implementation has been known to change between Acrobat versions. Hence, achieving "LTV enabled" status as a design goal isn't really feasible. In particular, I have no idea based on which criteria Acrobat evaluates this status for "standalone" timestamps.

Of course, there are closely related notions that have been spelled out in relevant standards (the various PAdES baseline profiles come to mind), but I know for a fact [*] that Acrobat does not validate according to the PAdES model when checking the "LTV enabled" status, so that's all moot.

[*] at least it didn't when I last tested this seriously, which is about a year ago.