Fix various result propagation issues in AdES engine

MatthiasValvekens commented 1 year ago

Description of the changes

The discussion in #228 centres on some files with an LTV configuration that has some interesting properties:

Signature declared as PAdES
No DSS or any DTSes present, the signature covers the entire file.
The signature timestamp uses a TSA with a different root.
The leaf certificate is very short-lived (i.e. expected to have expired by the time the signature needs to be validated).
The file contains an OCSP response for the leaf certificate, but in a RevInfoArchival attribute (i.e. not in a DSS), which has no defined role in PAdES.
Revocation information for the intermediate CA is not included in the file, so needs to be fetched live.

PyHanko's old validation engine can't cope with some of these characteristics. The new AdES validation deals with them mostly correctly, but the status report is confusing because not all of the information that one would expect actually propagates to the status report. This PR fixes some of those issues.

Caveats

Upgrades pyhanko-certvalidator to 0.21.0, which includes a minor but breaking change in the exception hierarchy (see the changelog).

Checklist

Please go over this checklist to increase the chances of your PR being worked on in a timely manner. Deviations are allowed with proper justification (see previous section).

[x] I have read the project's CoC and contribution guidelines.
[x] I understand and agree to the terms in the Developer Certificate of Origin as applied to this contribution.
[ ] All new code in this PR has full test coverage.

For new features (delete if not applicable)

[x] I have discussed the implementation of this feature with the project maintainer(s) on the discussion forum or over email.
[x] I have verified that my changes do not break existing API or CLI functionality, or ensured that all breaking changes are clearly documented in this PR.
[x] All public API functionality in this PR is documented.

For bug fixes (delete if not applicable)

[x] My changes do not affect any public API or CLI semantics.
[x] My PR adds regression tests (i.e. tests that fail if the bug fix is not applied).
[x] All new code in this PR has full test coverage.

codecov[bot] commented 1 year ago

Codecov Report

Patch coverage: 98.43% and project coverage change: +0.02 :tada:

Comparison is base (a408c16) 98.24% compared to head (a391c8b) 98.27%.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #251 +/- ## ========================================== + Coverage 98.24% 98.27% +0.02% ========================================== Files 86 86 Lines 13048 13081 +33 ========================================== + Hits 12819 12855 +36 + Misses 229 226 -3 ``` | Flag | Coverage Δ | | |---|---|---| | unittests | `98.27% <98.43%> (+0.02%)` | :arrow_up: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens#carryforward-flags-in-the-pull-request-comment) to find out more. | [Impacted Files](https://codecov.io/gh/MatthiasValvekens/pyHanko/pull/251?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens) | Coverage Δ | | |---|---|---| | [pyhanko/sign/validation/ades.py](https://codecov.io/gh/MatthiasValvekens/pyHanko/pull/251?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens#diff-cHloYW5rby9zaWduL3ZhbGlkYXRpb24vYWRlcy5weQ==) | `91.81% <96.42%> (+0.45%)` | :arrow_up: | | [pyhanko/sign/validation/generic\_cms.py](https://codecov.io/gh/MatthiasValvekens/pyHanko/pull/251?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens#diff-cHloYW5rby9zaWduL3ZhbGlkYXRpb24vZ2VuZXJpY19jbXMucHk=) | `96.98% <100.00%> (+0.72%)` | :arrow_up: | | [pyhanko/sign/validation/status.py](https://codecov.io/gh/MatthiasValvekens/pyHanko/pull/251?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens#diff-cHloYW5rby9zaWduL3ZhbGlkYXRpb24vc3RhdHVzLnB5) | `100.00% <100.00%> (ø)` | | Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Matthias+Valvekens)

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

MatthiasValvekens commented 1 year ago

While trying to get coverage on the full diff I found a more thorny issue with how the AdES validator handles algorithm policy failures---I'll fix that on this branch as well.

MatthiasValvekens / pyHanko