From 1db8be91dbfe6d0b5913b1f6437a97190b9e4480 Mon Sep 17 00:00:00 2001
From: Patrick Robertson <robertson.patrick@gmail.com>
Date: Tue, 11 Mar 2025 11:08:52 +0000
Subject: [PATCH] Improved unit tests for timestamping

---
 .../timestamping_enricher.py                  |  44 +++++++++----
 tests/data/timestamp_token_digicert_com.crt   | Bin 5964 -> 0 bytes
 tests/data/timestamping/intermediate.crt      |  44 +++++++++++++
 tests/data/timestamping/leaf.crt              |  39 +++++++++++
 .../timestamping/rfc3161-client-issue-104.tsr | Bin 0 -> 4775 bytes
 tests/data/timestamping/root.crt              |  31 +++++++++
 .../data/timestamping/timestamp_response.tsr  | Bin 0 -> 4776 bytes
 tests/enrichers/test_timestamping_enricher.py |  61 +++++++++++-------
 8 files changed, 184 insertions(+), 35 deletions(-)
 delete mode 100644 tests/data/timestamp_token_digicert_com.crt
 create mode 100644 tests/data/timestamping/intermediate.crt
 create mode 100644 tests/data/timestamping/leaf.crt
 create mode 100644 tests/data/timestamping/rfc3161-client-issue-104.tsr
 create mode 100644 tests/data/timestamping/root.crt
 create mode 100644 tests/data/timestamping/timestamp_response.tsr

diff --git a/src/auto_archiver/modules/timestamping_enricher/timestamping_enricher.py b/src/auto_archiver/modules/timestamping_enricher/timestamping_enricher.py
index b29d338..9742587 100644
--- a/src/auto_archiver/modules/timestamping_enricher/timestamping_enricher.py
+++ b/src/auto_archiver/modules/timestamping_enricher/timestamping_enricher.py
@@ -81,7 +81,7 @@ class TimestampingEnricher(Enricher):
                     raise ValueError(f"No valid root certificate found for {tsa_url=}. Are you sure it's a trusted TSA? Or define an alternative trusted root with `cert_authorities`.")
 
                 # save the timestamping certificate
-                cert_chain = self.save_certificate(signed)
+                cert_chain = self.save_certificate(signed, root_cert)
 
                 # continue with saving the timestamp token
                 tst_fn = os.path.join(self.tmp_dir, f"timestamp_token_{slugify(tsa_url)}")
@@ -102,9 +102,19 @@ class TimestampingEnricher(Enricher):
         else:
             logger.warning(f"No successful timestamps for {url=}")
 
-    def verify_signed(self, timestamp_response: TimeStampResponse, message: bytes) ->  None:
+    def verify_signed(self, timestamp_response: TimeStampResponse, message: bytes) ->  x509.Certificate:
         """
-        Verify a Signed Timestamp using the TSA provided by the Trusted Root.
+        Verify a Signed Timestamp Response is trusted by a known Certificate Authority.
+
+        Args:
+            timestamp_response (TimeStampResponse): The signed timestamp response.
+            message (bytes): The message that was timestamped.
+
+        Returns:
+            x509.Certificate: A valid root certificate that was used to sign the timestamp response, or None
+
+        Raises:
+            ValueError: If no valid root certificate was found in the trusted root store.
         """
 
         trusted_root_path = self.cert_authorities or certifi.where()
@@ -148,7 +158,7 @@ class TimestampingEnricher(Enricher):
                 logger.debug(f"Unable to verify Timestamp with CA {certificate.subject}: {e}")
                 continue
     
-        return None
+        raise ValueError(f"No valid root certificate found in {trusted_root_path}.")
 
     def sign_data(self, tsa_url: str, bytes_data: bytes) -> TimeStampResponse:
         # see https://github.com/sigstore/sigstore-python/blob/99948d5b80525a5a104e904ffea58169dc6e0629/sigstore/_internal/timestamp.py#L84-L121
@@ -173,19 +183,31 @@ class TimestampingEnricher(Enricher):
     
     def tst_certs(self, tsp_response: TimeStampResponse):
         signed_data: SignedData = tsp_response.signed_data
-        return [x509.load_der_x509_certificate(c) for c in signed_data.certificates]
+        certs = [x509.load_der_x509_certificate(c) for c in signed_data.certificates]
+        # reorder the certs to be in the correct order
+        ordered_certs = []
+        while(len(ordered_certs) < len(certs)):
+            if len(ordered_certs) == 0:
+                for cert in certs:
+                    if not [c for c in certs if c.subject == cert.issuer]:
+                        ordered_certs.append(cert)
+                        break
+            else:
+                for cert in certs:
+                    if cert.issuer == ordered_certs[-1].subject:
+                        ordered_certs.append(cert)
+                        break
+        return ordered_certs
 
-    
-    def save_certificate(self, tsp_response: TimeStampResponse) -> list[Media]:
+    def save_certificate(self, tsp_response: TimeStampResponse, verified_root_cert: x509.Certificate) -> list[Media]:
         # returns the leaf certificate URL, fails if not set
 
-        certificates = self.tst_certs(tsp_response)
+        certificates = self.tst_certs(tsp_response) + [verified_root_cert]
 
 
         cert_chain = []
-        for cert in certificates:
-            cert_fn = os.path.join(self.tmp_dir, f"{str(cert.serial_number)[:20]}.crt")
-            print(cert_fn)
+        for i, cert in enumerate(certificates):
+            cert_fn = os.path.join(self.tmp_dir, f"{i+1} – {str(cert.serial_number)[:20]}.crt")
             with open(cert_fn, "wb") as f:
                 f.write(cert.public_bytes(encoding=serialization.Encoding.PEM))
             cert_chain.append(Media(filename=cert_fn).set("subject", cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)[0].value))
diff --git a/tests/data/timestamp_token_digicert_com.crt b/tests/data/timestamp_token_digicert_com.crt
deleted file mode 100644
index 592edf4ae0e96057379dd362f8671e6385a8a8d4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5964
zcmchbc|6qX+sDmfmwn4Rb{flf#!l9;hGgGDvea0z%tEqGvZPX3LSZHfkx)@~4$2nU
zMI>9Ihzg0GQ8`EFcb?~*-|Kn3&ipmkeP8!=U-!)Y`M$r`1rWH5sAvzw8pW>d15tyC
z1TIy8z@-QVK@d#9J}TN{u|^<I2owyWqyVC`sOW!s(lUdf#ORCA=<`5y92f-p;TXH+
zOAP`Le_98H1t+sr&z96$UKkm7@1TdT;cDC)`HUG(9L~(?$6e@A0kcpHr|I)d2&IQi
z-y$r9o`1~4&4dJyiU0zsf|N%pA`~3KFq8<zuyzrAx$<ZYiNV7h<vNnhWs~u?G?%Tx
zTi_&vACbTY0SHtz00Ejugn&U{Ff)CLSB+y;WNKXN#yoUN9=em+&l7;?$tQA0&;zto
z5F02J8`#DQ!3A*a7<6omdgv2qlxGlD8fJXTT^6AZsP0Ta*pRyuFzX;32J7hoGgN?C
zTInbNs!A{`BORoo63iOy=V^s?^9w+qIsrrJ00Lb5kmPx!67c=w$hA*i5rIG|BIOlT
z6;&Mp-CvVn0hoRyL9@FT0tN{D*q&>5==&y^olRim-$?-=fQ9#-jr?yx2w)}(@;Dus
z00vRid1G=urwSFN0aZ?Zvktir-)vnG<Zg~v_s*EQ)wo3mz)-ApG|gCp;QGXcyNH?7
ze#Z80@DlmNo^1M_&{RV^c@y=1)D8V5O&VSFCKj*WF1bWve1FMLc0sJ=#g^_prIYzm
zkiPn@h|6rR_|WE~ZN$u|(r?^V?EVp!;ck;tq0a>I^U|hgZe_oyb(ptsNUAfn`p}g*
z3VUGR9v0J4)jMd>Bk5>YcQH0(Z4tq37HJVO7#4Fj{Y?DK(wFt2o_j3kjEW<QmCcY(
zlAK5;CF!omN3_@<k@DBZtHK5B-WqWwg{s<z7+Nn~q>_TD8{e`N#EwGiS>A+keWFD3
z;JQ=t^(L2%axUv|;v(RX4|)Up;Dz?dz7HLQ3##gbL|?KZ5Ai6v3U$CB3E_c{4<15e
zaKj-in=K`&W?2g=7?*^E;SCp&0ess=j<ZOsTVd;2zPBRNB;sV^O?UqB<9=)C*~O<W
z*-U+u(@~?EG)qnB25&39kmMzyw^U;IY)YD^aOd8%uxI;v-#u2*mSwry)-Dm~lqAx?
z6EA*KJosgoA@9q9{6ga?7d`!kYF}#x{TlD$7HuW*dxM9S=9G}^or%gqin{Yh4pGcI
zy?9q^M<e*~9`ERZ<8Q;0I=3Wj-uiNyOQd$BMT(nra%S{&++Z1sP6*o0LdC{N&TN1o
zAPP_}0h9<3Kyd&g`8M%0fk5A&Pzabh3Sii=*>-F&Kml;>SYkUC13*Vb1E&H}Qc^=`
z0NBnr47wlS0%)kHPDC?+$nNxel`pvCAp+$FIHTCBI7j@<&dFh<@R@SB3*NA#?5F+!
z|BeGAloQIHV<!y>W|ZW(>~+iC<-Pe;K|Ik3aNL;|gjxX>fH~2OXcB9D5{nH`laq4~
z@|BnMAZyZ{tVvmSe?PfhA^en~p~6oQ{?OoF38Hjl$;*N0%ezMbfuPZ6f#@hebaw;*
z#d81L$=@9l@XJns{qJ7jSkv8n+;$Sd{NniEri9%qSn|V&ELaeQ#$5qHe1_AMN(`&v
z2<pmbmeK2nY51Q@ns@h&oryLPcPR?#O}ujLwEJeWFv<47xTI9m{Us_d=MtM}f1Ra5
z4TT%l*9e|)hFnWsQZhdMN$J-*ncKI_{0`Wv_fv6Ece2So5QyuVcfpl5bsp{Sh~V(P
zKUZ_EsL&AxKXhRQ>=yU!4udugcB%bJT(O+!fEpp>v|2Sm%bFeh$+9}(fb|@$?S&D;
z6bt{a-N8#q+-7gNtkzn5hHb@YWjp=qsOzr->a$U<94Xgvh16p2qOB3}`>kv)ybUWI
zJ<~T2B{oKw7oi`t>`Q%PX;|I4E)!foQR^{7*Y(jF6jT1xIK856KCS25e$THV&pxJg
z+029LJzj<S-<G{@u_O$?Rgk5Zx*#$mPhHfIX8zU3sXE|%YM(^T>)8zUX|qs$m^St;
zZlw625RDsTv)R`H8t<HWiuYV12ZU7N2+?;dpl9Hl&osyNox9wXn5xtnM6!H#iZ9sU
z4G**T`;7x4PH~2s=ZY-3-YH$tosQ^Xxzrhx7gWqu{kSvFsWOvpCc2b!o$vJ(jw54t
z)A<|o;tLvH(>zjPn(np*mkk?1ac`*=uv^#gD5%!8=(32>$W<z3LM7iewth>|BUI}|
zhJoyA0P5irYW|>`z8zX^fs^|%9>f*?_7EGeNi~}Da8t2b9+_VyWPYXn<QKJ)a;2zs
z*sx*omZaAK7pFg68Q}P@=->d@$O<C!i(ywDJNQD76}vM`&&C`a9Q@0jMF;^qnk9pc
z`}Y;QV6*i1$CByx9bZU59x49^zLd!(au;9!3Pb;nZ>_P4RL1ukHG+&SY@UcgnpdtU
z7hba<4fdXWo^5*5k67AycEj;A3rUYd*EKJG_2ifE)f)-)ky(P-O!9(9*yzPEX@2W=
z1>o>4)PtB8EFUms_us>#V$KV5Pb|F9Xy%G6+7H*%9XoO9t%b(&pl$!0q|8EJ*+bl%
zAeHCE6sf+EMfAkT<v0V1GoyMs31ea2cA?A4r*oW(JKn^2Jg{8B8?L#X-T%_{fi=C*
z$y3Tg)!N0b<>QCKpM6qgJ+Z`i%iVYSb_;)((!Qeuv%Ce39$4-ChM<<J!-8cG?afYa
z4<%uei=|ax-!d9pE=8~v+DWBJ$bO2uopcz_VIv-pE*?qbF@&L}Q0`G@aHk~1E~l%h
zu-yOrIeS*!X)$_Sn0<tB;K|i`;`o&2P0W`$K}X+|70Xl>xII=|vIv8EHgSl==cCdh
zwc36s4WoN9r^4WVmRjxr<W>Fh&4cZ_W86lO><ZnzrbSEFHMSWac^vqHlN8l?r&~{X
z!^_z6$VZD+C1bNhSg*95;%Runs{XMWk&E_gV{YTg+o}y4<-je|q51Sf_L_Z=`0e{i
zeJ&<=R*U4e3k>Q`=Y<Oz#c4L!nOPy>t|HYQQ|_;BPilT{!j@|Z(Bc=1oDFcVkLB9a
zf+Q&zW31mln|FTd0<hK^WIyb~KkjAp$zbS}f6!I7%Qt5--y8te9gckG84W;11{wLm
zx(7XfNv6H%S{#}p^aeV6m`=!^(3-1CFX3Y{|CO1b*zZc?7yA<;gLhd$W{eMj{)dFo
z*<A&IV-^1k!t5y2P=QQ0EP&cMu^{vypa!TAm52(l$lW-9N6z1a`2GXH|N8p;omk-x
zml~2Q{L>5dgh3HrgTq3)lcn6U%w}xefYq~l?#(AhoL`$rZ3dj*cSj2S72Vj)Pd%@B
z?CCK5%u%Nyzql_kFfj$hiLMIPH2>x!rpNgiXb1(IwS~6b9GHtBVX<eaXf4Cw%^)oM
z(6=J<^U|S3=ekg??~Ya6F~8!KEuH=9eDTcIg&Gg>INz(aSz$c^bYV*cH8}Gs$F)M{
za_9MPlGX{!1Lp(ro-aC=gK|Z_G)NHiN-`vPi$n#)8!N{TEPT!`JDm}oYa3fcr{6Zw
ze33YpzPWijE9hSHlg38xz>!wADB9+VoUXVy(Q5Nt<Hx~XS3U&Ym^T4i<|{`eTNSJG
z(-<?Qbg72E{3hm}At9}y<&*!x>o=V)^9t?jLPFX-m29G2WBeg%)7f`t6audfiTg~e
zV2W;o%xksOL++a1-E2-h^N!9{UNuf9BvfVo#^g(pEq=+qCmU}*q`Pjyha*-DvT)J@
z64K(M{v2ln_9rSmO75Rs;mUAm4_H>NPp6oGkzf5bkDcHoc~!l%X;71jElnrF-=*qQ
zsts_YBOV;5WumK%9%0+A&wIXVH&O%rLKsI*KogcJx}2LfdPE{A=%?{u@sVXuyzXtO
zI9fyaY$Q+KIi|1aX`gMZ;et_L8dezLGlQFja(Wzx=GYkdN0n80Nbt|^2E)Dr1j>tK
zV&Q%gi}5=5rHvk$xuww~uW7Wo9rqH8fn0HU{(p%j3JCuo7Vq!G(!pSGLF7`*SP%9c
zT0d(pB%ngBMSrik5C{ah2>V%c{Ttx?J7(3-UdEgpuby^3bPx~*(DI8-`C_tdLK-XQ
zhaH+GrSdiGi}0CUC1-eJ_B8{7tGszCoC~(C*Zla4%1^Jfv-D284pJVpWU>@&&E~ij
zQI}I_$LU}bbnj$xKvQ`YF2fsxOnJ_%$1FQRSf!4c#j5)SzLsI&eGeOGgYmmd$vj(h
zIs7zvUC8aa!UAQh%c2uc%|csuSFwV&Ygwq*`{1WW1zvV`Io9@<7~qxW`M`+n`}Q-=
zQ+M0UU1k*L5FIa)UB)gYMZKuFlCFLE^lu?gD$1H4dULBlm@f|ZE9c2lhR1&*Xfj_3
zD6%2wAcsbwm;<M-fWm}K`)f*gAvos{uMstbUZ%WuJ<X7#abDAGA@Rh^Jc$~Tx#~j}
zd#*LnqXtPHYmMl5d^%pk!C4m{mv9XoYP9_7CM&O3CboUtL|~55y=1n3>FQOrY>hFB
zX??MTicG!z@Q8+#2fc273-Ti^6DClK&Tzie-;&mZ%F9_Qt0PwiE(A#H9J^EI&aIcq
zgFhbeIjVH?jmK^I=Lyu4wUx7|Jnl!ggF%x_DGWmV<<?SS3BEIomKKKCI`QHP9o%?m
zvFk;xwwgX27FMSj<|7M;mi8b{VcLl>Q=FFjqL6Dd%)-aNtSC0oylGJ1H4FBYB+$~3
zbh9jiPCVn&G+Hj5U*^+DVLAT{?=G{{$jnmuUiAN979{{7Giwj9{*p&~fu+B2^WMj+
z9R!4oMPh!wP}Zv7Q>Om_*6Cf!klEx1`20gQp>|i1*`&P7l>e*x`6)(Yy&Wljuf4E<
z{tr570%SfB$$W}c*p2kR(&<0L_yR0DVPH@?fJ}8NDETYJpPnud0tiGAK&(d{wV6|K
zCFWvzH7YoV*6Qu3Ycq>Uang(DTnc%rh1cVF(AL85^5TR2YI)c{vK<PQlc`i$`uHvC
z@j7X3C1_l<#uD=MaL<A9FEX~>8z0w-fzZsva+m(@=P14FD4~V4Ad=C8jE*exd@2ZA
zu!LU!T;v;vg5`QS`rGp>3I`Y0AWz~7dQG+WD;jvCtxF$~Y%eY54QRY68{6U={uu0d
z)cS(|66uJ>S3K>>m>mE1QP@SrV|-vp2duQ%p2(=}-jXidSnlx2#;04N$QS?2Uqt3(
zM4-2bkMK9vN7gbD5yNUD%N22HTTai97IXh*mV>DT73SF8aglueI0Zp~-~j?8h}@L}
zg8!8c*I)P9_H+)3(a!;%-#c%#5X8P;8i@ekA9IulCUU!MZ{rVu?{Nk*Aou_tfZSn#
zvXAzidw+biSM$vD=Rl()aiRmUPWph{AEBTKVJK`W|4W*MqWr5OfR0&d{dGG<>OF6@
zG?JcbLDlH64+j^Zyf?ZWLJ|-M$cTZ$@c5j96?Zv76up`VP%>zX+aAJ<QVx1Prc6#p
zC1sB8y?W$!8<YU1Fuj~OnLoN>&0^EuXn(E}+b8DD@i0ZWDPUCdBs(J~MQhd+Ax@f+
zeoj1KD<f<00uOHsheJ4z@c4~}d_Kwycbn!ff`hvBht)ik9$tNd>^F8~$2q--khCbX
zMrY_MN{P)ZmpjvcIn>GqIv#Eit}D>%b`x#i`*HXi&xf0twq@tX;5gKJrvD=YiX)&|
ziMq;;49dGUxD3bIPwmJqo`c7-n^qUEN|tflsgr2$T}s(*a<#-fD2eLa$|l_{UuWn=
z80DtHksM2{OWWMudbNyGc4J@_gkzn=M|37!xzdEXRfFAi;J0zJypG(%;WUizHIrS@
zQz;^lX!Xr)i=ztm8~FW??D!gC^4$xcuBmy-Za;Ee*u3s!D6?LUPK_#o<v^)Tu99xK
zew&OrbvpF(dW)j)8z;XGt)_;s3NhlVf@Z%p22YTwT<k)vVLBV5y5^mAxcSJjN~`yQ
z$=l8J&kZo_-R-5VDc2efiWb%TuhNk=14j-8sdeE--64~OH^)k_$^I)NYGb#3@4fGz
zKdm}+m*3R9zC@#|JkYxerqe=K)Zd+N6VX;BDBbB-9qE>vt3I`1&Pr#=VevwBV|WgT
zzZ2(huQlE`;H1X22~W<m2E1+J<H!3qf9r2e^{MBbDO09yvl^b}e?Gt*d8W|D1*hs%
Omw3OCN}2hU%l`m)5jkc6

diff --git a/tests/data/timestamping/intermediate.crt b/tests/data/timestamping/intermediate.crt
new file mode 100644
index 0000000..a9242f9
--- /dev/null
+++ b/tests/data/timestamping/intermediate.crt
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHuDCCBaCgAwIBAgIQQAF/lJAVu6kSuFeWPUTs7jANBgkqhkiG9w0BAQsFADBK
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVu
+VHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwHhcNMjIwMzE2MjEwOTA1WhcNMzMw
+NjEyMjEwOTA1WjBFMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MSIw
+IAYDVQQDExlUcnVzdElEIFRpbWVzdGFtcGluZyBDQSAzMIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAqGL0RYFG7mL0RgSXLynLNWhEVrhsKhrVL4rSG+NA
+p4v8TbAP2YXsqWB8yZgj9DQ55AECnmQ2Uo/BqQSsI/AOr9ctqZykItmca/nGjKez
+l1kZS2YoNc4Zjj+7QO9iNunclA06fBhI+iQHAam7isQLK3CwXRDLzKkMs7TisMoG
+QOSd0M8P6YY/QOGYv/+tCxmfvUz2GjWzQQemgiuLjvGhPwo+hrcNzays9j0G7QtA
+LkJ0KfvJS+guvCvSuEfDzt3BaPIpD2q6GYK+MUiNis3uwwngauyL4r048wdvUSsf
+92Kyr6T1pAfjjPyVDNazf/w/BjzA6ewNevFVLNfE0DhQkXMmsNVGBzY5Phhlp5fb
+TwsrD19K0FPgbGO/l/Zp2dheeiCbe09bxbhdeahSBtTVPca4Vu3Ljz+PRZjFodq7
++lziqqpqqCP/ikEnmK/QkxjCG7AkX384dxg7yb5jjtXOnP5Yv4SXuV4SNNVVUBJf
+bLXyYAf3Q0Dal85ZxNQd0QNPQIsYWv9ttTMVc6sVErdfTBPw355St6bHz91LUoDD
+0S/GjUif8LYhVlZGXlwjYmVZOb2Z7+DAamzjwVrSsrxGCJ66Coy1rKapJuHVsfGA
+W44p2ioIEZT3s6nQJkCt7te4ab1iWzaydZGAYyBao0K7kfK3vSp4AXsE5t5y6dpH
+Yo0CAwEAAaOCAp0wggKZMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQD
+AgGGMIGJBggrBgEFBQcBAQR9MHswMAYIKwYBBQUHMAGGJGh0dHA6Ly9jb21tZXJj
+aWFsLm9jc3AuaWRlbnRydXN0LmNvbTBHBggrBgEFBQcwAoY7aHR0cDovL3ZhbGlk
+YXRpb24uaWRlbnRydXN0LmNvbS9yb290cy9jb21tZXJjaWFscm9vdGNhMS5wN2Mw
+HwYDVR0jBBgwFoAU7UQZwNPwBovupHu+QucmVMiONnYwggFEBgNVHSAEggE7MIIB
+NzAIBgZngQwBBAIwDQYLYIZIAYb5LwAGDQMwggEaBgtghkgBhvkvAAYNATCCAQkw
+SgYIKwYBBQUHAgEWPmh0dHBzOi8vc2VjdXJlLmlkZW50cnVzdC5jb20vY2VydGlm
+aWNhdGVzL3BvbGljeS90cy9pbmRleC5odG1sMIG6BggrBgEFBQcCAjCBrQyBqlRo
+aXMgVHJ1c3RJRCBDZXJ0aWZpY2F0ZSBoYXMgYmVlbiBpc3N1ZWQgaW4gYWNjb3Jk
+YW5jZSB3aXRoIElkZW5UcnVzdCdzIFRydXN0SUQgQ2VydGlmaWNhdGUgUG9saWN5
+IGZvdW5kIGF0IGh0dHBzOi8vc2VjdXJlLmlkZW50cnVzdC5jb20vY2VydGlmaWNh
+dGVzL3BvbGljeS90cy9pbmRleC5odG1sMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6
+Ly92YWxpZGF0aW9uLmlkZW50cnVzdC5jb20vY3JsL2NvbW1lcmNpYWxyb290Y2Ex
+LmNybDAdBgNVHQ4EFgQUyjLwNnzHKtqRtXyHihG9uCJsvwkwEwYDVR0lBAwwCgYI
+KwYBBQUHAwgwDQYJKoZIhvcNAQELBQADggIBACtnO4f6QB6v2yDFeld3Pa1H7Bmb
+y2tSwzQ/5dB5WXmTZHlV433s7BDkpwGzK4fGBuTcx814uPUWWSwcL+f8bpfozBv6
+p855j/AlKul1EiPMKkMlLtwdiK6sWT2x8qaTm4fMGbcpgUbQnxOo4BnzVUmgs3ep
+m9/qXf9GaWXRz4maSWl4z3apD3X/5oMrriGWIiW6ivCq8bmOBUdm0I9quhW9Snk2
+JAaqkVCjs06rqE3rRblyNdrSypGzo5eBT498aCfcvDPJX2/q2PMkLvkKoXtVJ1g4
+sEwDQxm2sg8QMEd2GKo+X7TqOeF8An7KOPDq9v0xtSsF4+ufFrl43vl6v4uMey68
+wOHv6VmaGpCtWk1e6lSq9jLQqRBBg8CMwpw6niVyvkrdh4Tvu+5HLrareZBp98PJ
+2cQzrHk1SiPcyDxSlhbXRks/TgKXTicUm3pZsKZcTvCXHcqulN1eoQ3z9azMIuR7
+RtdECz2RJUI6Xg//6ZdMMgaDnktMALgAyo9GgGGVimx4E2/aM5r0cm+RCrk956BT
+qahEdiGLWjgjq8dAJe4XfLtp6EmGvsw650uBbDA0Mg9nlSCFdGTMFBKlw65o2oJa
+enMysAvE/VC39ZIEOBfk2IOj2GTYlOgHi0iIBIZf7SqdjhTAtoW7U9TTZj8SHRen
+/EEe1WEcfTawcOhJ
+-----END CERTIFICATE-----
diff --git a/tests/data/timestamping/leaf.crt b/tests/data/timestamping/leaf.crt
new file mode 100644
index 0000000..539ae6e
--- /dev/null
+++ b/tests/data/timestamping/leaf.crt
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIG4zCCBMugAwIBAgIQQAGSoSzKR+4rZmhPudMJdjANBgkqhkiG9w0BAQsFADBF
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MSIwIAYDVQQDExlUcnVz
+dElEIFRpbWVzdGFtcGluZyBDQSAzMB4XDTI0MTAxODE5NDg0MFoXDTI2MDExNzE5
+NDgzOVowRzELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUlkZW5UcnVzdDEkMCIGA1UE
+AxMbVHJ1c3RJRCBUaW1lc3RhbXAgQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEA27BXl6MHeJwySCub5fd8rD4bWC2yOQE4hWDkw6YjMHMl
+mKQVPIqD2+ezxhIK5GmwwNxDopo1ovsTMrF/KFsTExw0l4ZguJ+xs5W6qLrRVm7Z
+TnkB6wMKaxR8+fdxtq9lnqRDnHtrGiGEQGOqVvUpAhnzioYa/5qWmqhRhdf7bRpI
+1D71LC4UtWm1YG0PmJVSsE2ZqjB4rP7baj6hAlQxe0bvNwL/Bqy6D0QHNk2Xf2Vk
+w7BLN7knh/SngAlzfumBg0cQff0C5DQgeyCQoM5/XBAyYZUQc//t2XVZPYiGUvOj
+QNjLCbqOpRQf9JBaU/gh9Mf6Mbs6xh5qn4gKHpxOUMy+QfYAU+RiLhV4X0/brdqc
+UOqRHte9gcv8yU4mqyMzbmHn5y09SkuhPOIhYE5Fd72XHeR8RnC9CI9V5NjVW370
+iNZuO2R2hw3dwtlWFxJPM+jortoxO3BPoxmppp/EdEH60p5Sk12eeyx86zieLb1E
+JS5gEvu+jYWwKKjCf3visWC4OJNzbknGr3WRVOI6UvjyKrck3hpCuOjLXST+pEiB
+XJzbiHCR5UJn8mXJnPAvKabgCGk7/trqrqB3Rkd2l5rce7maoyn265r/3IRLZisf
+QdBsfzQv6RAP/zBFQkzcE2Yl12M25k2B6kFZMLsTT60jBTt1W6utXM2T7DbOwO8C
+AwEAAaOCAcswggHHMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1Ud
+JQEB/wQMMAoGCCsGAQUFBwMIMIGFBggrBgEFBQcBAQR5MHcwMAYIKwYBBQUHMAGG
+JGh0dHA6Ly9jb21tZXJjaWFsLm9jc3AuaWRlbnRydXN0LmNvbTBDBggrBgEFBQcw
+AoY3aHR0cDovL3ZhbGlkYXRpb24uaWRlbnRydXN0LmNvbS9jZXJ0cy90aW1lc3Rh
+bXBpbmczLnA3YzAfBgNVHSMEGDAWgBTKMvA2fMcq2pG1fIeKEb24Imy/CTB/BgNV
+HSAEeDB2MAgGBmeBDAEEAjANBgtghkgBhvkvAAYNATBbBgtghkgBhvkvAAYNAzBM
+MEoGCCsGAQUFBwIBFj5odHRwczovL3NlY3VyZS5pZGVudHJ1c3QuY29tL2NlcnRp
+ZmljYXRlcy9wb2xpY3kvdHMvaW5kZXguaHRtbDBGBgNVHR8EPzA9MDugOaA3hjVo
+dHRwOi8vdmFsaWRhdGlvbi5pZGVudHJ1c3QuY29tL2NybC90aW1lc3RhbXBpbmcz
+LmNybDAdBgNVHQ4EFgQUIYBfL7FSq7kLBlpOTWDaRGHtFgEwDQYJKoZIhvcNAQEL
+BQADggIBAFIczKS3kFMFeX2WIC1uUj4Nvt+W2/kPNhuKukF2pOC+VcxrbbsTugTx
+oO+X8J5JVX5sNP74p7YrkSY+dVPFQ+8rfJJeshSvJEQnt9DgsXPTRcU982OPmJCQ
+QZY2Ux7xYfoEuWytuigyhMMoh+g5IzipQ56UCDY/sHY40SdLpSXg69RMy6y/L2Zm
+9f4YPFrXPy7q3hGTemQHo+jmshg/hU/zIEjjfWx7uG223r0M5Ez9ks4y/EmtdT5l
+KkF9RGALpKEBWIQaL+yi8X8NHRM1Qfs91GvEZe5wPri/5R9YvhiHWjizqxvDlqVW
+ka6Mu13zbovM2vMppHJWYlvBTZ4z8vZBdNzN7fiTAdcd3lAl0A3wmpBIqrvFChhY
+DX0Su1/3kA3X2PAJrbaZ7RNQ+Zjuz31T8QK0d1PyzHOZ/jK76f7Nb5Ic8fbALKzs
+S+Yg3O4fmLqC0kERtL96xA/y+Y9oAJYMOOvrpBvpe1TdGZ5s3nRpLhWT4NEddkGg
+AWodbBA3W0x5iKRWXAo+sATHTNXB6RGTIuF1/PC3R4fjbTMvpHXyW+bP+k8m+uIu
+XLDMJ+XW5TZ01g6UGfg62ti4ohS0PyEHbnuEQDQogcqtqF0d8oihfcbDXOm/YgId
+vhdRXJC/UZ0Q6Q6jtuj5uV76fvNU4j4FYKnXZqutzlCxeKn1odHN
+-----END CERTIFICATE-----
diff --git a/tests/data/timestamping/rfc3161-client-issue-104.tsr b/tests/data/timestamping/rfc3161-client-issue-104.tsr
new file mode 100644
index 0000000000000000000000000000000000000000..eae5900c888b2a83e96c1084f4da305c7d904e6c
GIT binary patch
literal 4775
zcmb`Kc|6o>`^U{<>=BYRV@rtnj%6CjzVEV~Y+1%&%680<HD(eH6_O=nIb>H#_G~GR
zC6r`MLS^5V$l;mkS3S;o`n`I+p6C4exxe>vUElk@uJ?5TB-R`N0tQh5B-T_Iop^*!
z#1<2X2AoA=jUf+3f<X`@Gr$C+bBNFZVIfd3h?)u@=D`@g&ZJ`jL9>WSP+|f=j01x}
zFb2xRh;0NFj0pmqJ-8A=O$Aj+`}L)8z0;b%UDB%yeY1*qWZLH^zcCgKPrTg{;c`8b
zFC^45ly<k7FF3HvlfC-cFryYm+g8f<^w_!={_$9oI+#TTlo;;nKRDMn-p6K6D=y5*
zEDcD@0WwG=fR>X6(AHpD-<EO#y_U?nEYhJIfCQTaNYKtKvXfxS>YLdoJG2)iT-=On
z`sn;927Yw~#6WgU6UhM3!5|h;7#rBa49N<xPy{_2ovt(1)7-}wPe2L+aLO2jjq8in
z)qtDhJg|6zqlY)n(-p3+3YP(n9c7Z1MFL1PQeGA<3s{pS3P2)HQKXE#HK6_TV}t?0
z|2u}~KaPQ``V!o{d~k#SfCLsi=mPn6AS5s|`8L7yU=sOSN6LOl&Y|&7m)4O;d%qQ2
zqQrAf@}WEkebr&AB~J*zi=^ZpITL+l<YRd&EBzF%tZ7vJ_f)yxKeI_c2t8rL#>Oj~
z9N|!%`Jg<pwxITfrRR`Q0B8<Ee~~?Sd+XQA``C<J_4J^N+ydb$m?Fy!F)-I!bOiT)
zYEo*!*{cJeJ-BsVDQ%pTVz0neICwCpB$}2P-Yx?COZG-CC}o4qkwIEZr@;HLl3HdB
z8kAvjDAu{9O#f7kXykf+7#;rd4DpIKOUR$#DOq?BJT9v{)RslsF_8tozcA!$r5F`q
zx|X9d*hyD=<1Rb@dYrY{CxP|09c10<)?*hkqv(&N8<})9sBTi3O*u&&@wYb~DIHEX
znT<a-P*3dKZ8thzEF|OU`0=BpqMm;CnF#?0Bh5?o$$V46THf`vu@+N<{Wh1^qh5O|
zIQvC1y?HWZd6d;yW_tSGFjB$WIESk+FY_rub?0S<X@Xrw(8=IAbcSTThKQ5{>*t2+
zSIbTmJP8e&c;HZtPQZKWw%+%RH=j6d`e{|XN_dQ0t$MoCPIxa@hiIEV66GELUd?qC
z+n&CR5X&2<#VPC!&)&<rq^0eboH`m*lbR#8IhVRW8m{jm!LQou9x98NVPW0}G}R17
z*<3^hFsKiP#937<ppMPBRES!^*QU7C_IbiQs=H|k3;|Jra!8;~fCOp-7|Ab+j|~Lc
zhk^kr;1ESIQxp^erU?T$C|ZP~83B42tpp52O-%!#1&CL_2@nVx09*oqZyEqa2)hvo
z-lq`=jF*Q8)(3-gbeHnN;Ju}A<ai-a;zf%51yKLK0vvJb>k2<dcbu~$0q5oU*U1PB
z)`x&c5Do;DjFk5&48TvZPYB8haD=gUNH3#;+r)?CD}p1V57$=<x;N4Rp_B=5s6XHb
z(86G@L`D$VPo{$@2?W?2ln}rG(EDZ@7{sAOF%3`l29L$~`e1)x7tRHTaU@{z2yZWU
z93}ukHWcUSjP;jtBY3z2S`-8Lp~`?FppYe>bt*#cr@s2Q|IJg3k2}Ce+2;_H1IjKC
zW{-GaT3o{bvo<nx7}juH-~b&Acyi7n2Rw+%l(#FlD$a~LAS4Mc>1nFO)bKWGWSbeq
z6J4w7mpk5I(RI<Ij;$8DlC_k)oS|!R*<E(;Q+}mH{Bb2;vuEl{62UjmKV-iztRY&}
zJN^LQr}<2A4HKIZ7pIzpGCQ{7xC5<mFReWx9o}*xa#~&pU8tUMix#C^=7)YEs()8x
zeD0M&XGtT%#bslU^NjU?vefL@;e<eEnw;qm4>^^u8n3~1CPUnVsy!;l>KUgD{=C^O
zy{lX5tArI-4bgC5$jt_w3+G16|GpB+#K$J5`dRVS#i!UsZ>8$S_x$G?I3umm<;6TL
zNp~&d?_I02Tl0+R8eS92^|5raX*SG|S>046j6PrZlmHsw8#58<Wm-;+(<!QZM$dVU
zDTKAoek+b?U~rkPwDR@>o5^;{Vo!+K3i#0_v(+yA?LFzbnZ4&;H+fe!n@*O@>wkcc
zF7l_;l3uDFe$*KFlzDYK){QEO5j{7T%QF*X{)Q{VeT;yUI+8H{g3nJi3v_|co#m8`
zK|oZlr7gWu8MMuyzj@|xg5W#f-Q_Cn$Vm?wM6U0u&4->H<KsIMQnqDXqVHe7M-g5h
zy2bVB^zdNy@9dA11!z2j!c}BX5Iaf>?D$rrvO`*1Y-bvsz<doy&)UW{p1s2|b10{B
zdb{TQ&gC`p2_<TW!U31!(r%Ln{)HRaFP;M=nreVVo%J1ap||3W)D^N;|B|GrF~9h?
zCj;pHoIj#~2>BI~F?Z}c`rzu{gB)(^<wc;d4*7+3(q#Ukq>+F;AV+4Mj0}K6N`ICA
z6jFaix&o(lO`_JK)4CQk86nmw=cZv<?JmyUkBENBGpUjvvujw!Jal!w&>^@zMQB}C
zehLK6a7LNNHWxxmgq9E8ACN3e&lMa>zqs9cEx$b3ic8<+gj_e*4dptOB`4I(=q;wx
z!JIlf!Ze`5y6C4265eHYES+72jOC9e$~s^wQ+IlMm}erCRo<mE?w2xfW!4*Pa?6#g
z(&UjOVs5NtE7L1QR53j-DcMwnEikA^sS(6Jx9d+!J(hS`t=-c7rrB*(jQK(>7pVcM
zb3OX`Vhi2)h549?dh{BN*I5bvEvJX~b2oBnCa>)#GQKVk-BpI2X_}d53S6-`Iq<X>
zZ4!?^Ue>QggOXR`#O5cD7&AyP+w1k3jk{wSlQ(fggXaU`X+g#|&#LVL3QS?I`W0KN
zEf+dtm18wio@Ec$?buEf6<sJ0+K*NhO}XEj!1;uyOxQjYeTh?{y#aHhzdL>JTw{20
z&3RVYehU*;d-sY}2bwK)mEq)WtEaE{UO<dhVmPh$Jt}05;ERv2R@ob{Ex*k$t;%cb
zd82O{*75?;dR-@Txl+K=QtP~}kQ3HQzW(;oc+&;<$!6=94<BpMX4KMOt0>7UJpQi#
z!Ah9T4Y6Ty+QYZD$_smstCTJdRO9NMY)}t<<HIm;>m0SZ_|>X<aeq({^uw6X%&@l8
z^{=D@-yzpNw*gj42K_=hS^!2y8l}Sh3-3S?0P(kPsh`ZX5FqHk;F|Wg9RP5I!q0NO
z4>@G;2S7>D7)RuPux&wutEq1p7PFWe)S&k9xcMJ9P<~{5YfxN*LrEY7vN-ks5e`EB
z$bFD;Ao2j+KT0`b?KiK%V1QW4NGvjU!{OoI%2ahSzQ1A;?&gSxJ7KY&a2y`*i*<(M
zJmHQQjF*qIqbCLnzl0;W!M|r0(I0PN@&&YT7cXB=XSgE){y!pGkMbA!q3VDtpq!<c
zr4S+ivuh&*`3INwS4{t~9ATpzCGxjo>aYFA7j{dyDn#z69J@aPe-`-5CB;(hd9Jk1
zi>58I%I|vvtO63811u&(=I2?a@<HVik*%<)(YELQ)f*gECwUPccRiD*yLfi;y8~jE
zMZ{-(S%td9)kUO6`J(QXSSdbO%}Yp&?Bc2tBWm?#vK5STty$=1m0v1Mdpm2luZ6?D
z==m*G7w6yOSIF$U|KW<nJ%J=ak=p3xqLrE()Y>k+u@`EO)awPHgkeSTCOPFs#RZ0Q
znl(Oh!!JAH%X5;6#<9U}qN9&x+U>n&2iJt9w&}BjEJV+t%M2juT$K-*SpaQ6&LSoI
zN3-(pg29(N(95%%e<CX+s3+$#IcogJwgVeut_4XwZhE&gW0lGsS88o|e%8EbQ@Xd1
zMfFP4wI}JPGemqE^xi~<FV!t-OH~#J#NoDD+J~OXlmy7>361`7#x#jzKucfQ2%Kyr
z%AOWzRhDOKw4BV>aqrff^Vv*m8zo(WQ$bn-8Vri@B5J44Gw;tN8%V>hWat}ERa14u
zYK1u_M!Wm7c@4{?uKRe!)7L0|%rYx1(C`z8u|^9Ox2cFM9u2O;P3uN9be;aFPjm-l
zrI}q5;a3UHUF@uPTkg3HldJ>r(q#-!|1_!ExCuocof^E7Gw3{cYnmoTCkh&2zaW0+
z276QG)jG3ReJ;wZd`I(lRgd*M@`j+wyr*@MBnUr1g7A>rXTa(o!sU-U-2+X07BL0j
z{@(l2L6GD+`9Mz(@c#Q7HIkX!zaDI{0f_^X!Hh^=fEyr}<xqC|I0?J68zK&OA(%h%
z>4dC-Cuc$d#J{(KA_bvv`SiOlB4<;OC+0_jX(N+m==w)!gajmAC4@XgJPgcn2a6SQ
zLklH=sVa?z>k9GOnuHwQL^N(#PrxCO`$(7A*ob+5cQY`v%y#(YS{O2irf~XVma^$)
zPbRUcfgzxv^;f4TMk}LUwB=FFvu1dfShK!QOILG#?QCG#Xd(za7d@o61T((w!x)b@
zxj#1r&ln7pQnktFs2R%9soa$D*tKhSGHHK(VrUN$8d^?Yd#?KhD{l<dnAsXfl)@5+
z-JWZk(<1v?^DDk0OSNIcbCLs%{HgcGJDqFf^6r#({=(ZM>6XfGt?P+ll%H^D{;>T}
zl4Zg>eD8)>s!O5fxCQ#0TX<jdvBtHiv;LJ6YE`6pOPFZN<e=#Ln-#USiyRABtsF76
z<m0kduJ1y7Zgoh$8ov2P5m9L|>VdxwiZOPpBCVd{!g;TL65U!kUl7rGdyac<6x4$<
z5>HROmDFeMj@BbRqHimYRl9;kPb}OS64H2EagvSOzIpzk21+Dx;ciwq-~KMbVC(Vo
zCKdJGZPkxj>Lyf2!UI^Q->C_tUb)?SXI?i3-A2dmJ^5H)#w2qF=(wWDy4AIVlQzWr
zeKa;O_#7H0JH{QS>&za1d~dq=b9TX4%-L>!=wj*OMf~dz7hCVIXq_}NFzHE`v~4$L
zXGu$uy5v0bX5B^oy7T*rHN<p&j_~eV(co=BeEv<$<|aaAHGt#Ej*TE<f(J#tFL?}Z
GZv8K=`FWH8

literal 0
HcmV?d00001

diff --git a/tests/data/timestamping/root.crt b/tests/data/timestamping/root.crt
new file mode 100644
index 0000000..de6f07d
--- /dev/null
+++ b/tests/data/timestamping/root.crt
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIQCgFCgAAAAUUjyES1AAAAAjANBgkqhkiG9w0BAQsFADBK
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVu
+VHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwHhcNMTQwMTE2MTgxMjIzWhcNMzQw
+MTE2MTgxMjIzWjBKMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScw
+JQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQCnUBneP5k91DNG8W9RYYKyqU+PZ4ldhNlT
+3Qwo2dfw/66VQ3KZ+bVdfIrBQuExUHTRgQ18zZshq0PirK1ehm7zCYofWjK9ouuU
++ehcCuz/mNKvcbO0U59Oh++SvL3sTzIwiEsXXlfEU8L2ApeN2WIrvyQfYo3fw7gp
+S0l4PJNgiCL8mdo2yMKi1CxUAGc1bnO/AljwpN3lsKImesrgNqUZFvX9t++uP0D1
+bVoE/c40yiTcdCMbXTMTEl3EASX2MN0CXZ/g1Ue9tOsbobtJSdifWwLziuQkkORi
+T0/Br4sOdBeo0XKIanoBScy0RnnGF7HamB4HWfp1IYVl3ZBWzvurpWCdxJ35UrCL
+vYf5jysjCiN2O/cz4ckA82n5S6LgTrx+kzmEB/dEcH7+B1rlsazRGMzyNeVJSQjK
+Vsk9+w8YfYs7wRPCTY/JTw436R+hDmrfYi7LNQZReSzIJTj0+kuniVyc0uMNOYZK
+dHzVWYfCP04MXFL0PfdSgvHqo6z9STQaKPNBiDoT7uje/5kdX7rL6B7yuVBgwDHT
+c+XvvqDtMwt0viAgxGds8AgDelWAf0ZOlqf0Hj7h9tgJ4TNkK2PXMl6f+cB7D3hv
+l7yTmvmcEpB4eoCHFddydJxVdHixuuFucAS6T6C6aMN7/zHwcz09lCqxC0EOoP5N
+iGVreTO01wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQU7UQZwNPwBovupHu+QucmVMiONnYwDQYJKoZIhvcNAQELBQAD
+ggIBAA2ukDL2pkt8RHYZYR4nKM1eVO8lvOMIkPkp165oCOGUAFjvLi5+U1KMtlwH
+6oi6mYtQlNeCgN9hCQCTrQ0U5s7B8jeUeLBfnLOic7iPBZM4zY0+sLj7wM+x8uwt
+LRvM7Kqas6pgghstO8OEPVeKlh6cdbjTMM1gCIOQ045U8U1mwF10A0Cj7oV+wh93
+nAbowacYXVKV7cndJZ5t+qntozo00Fl72u1Q8zW/7esUTTHHYPTa8Yec4kjixsU3
++wYQ+nVZZjFHKdp2mhzpgq7vmrlR94gjmmmVYjzlVYA211QC//G5Xc7UI2/YRYRK
+W2XviQzdFKcgyxilJbQN+QHwotL0AMh0jqEqSI5l2xPE4iUXfeu+h1sXIFRRk0pT
+AwvsXcoz7WL9RccvW9xYoIA55vrX/hMUpu09lEpCdNTDd1lzzY9GvlU47/rokTLq
+l1gEIt44w8y8bckzOmoKaT+gyOpyj4xjhiO9bTyWnpXgSUyqorkqG5w2gXjtw+hG
+4iZZRHUe2XWJUc0QhJ1hYMtd+ZciTY6Y5uN/9lu7rs3KSoFrXgvzUeF0K+l+J6fZ
+mUlO+KWA2yUPHGNiiskzZ2s8EIPGrd6ozRaOjfAHN3Gf8qv8QfXBi+wAN10J5U6A
+7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7RcGzM7vRX+Bi6hG6H
+-----END CERTIFICATE-----
diff --git a/tests/data/timestamping/timestamp_response.tsr b/tests/data/timestamping/timestamp_response.tsr
new file mode 100644
index 0000000000000000000000000000000000000000..1ec90aca1c1d269df13c84de4baadf5c748c5f7c
GIT binary patch
literal 4776
zcmb`Kby$?!_Q#oEXa@-iMTU-%;T<}pkuE_v5>mq;qeI9HND2%oC?N`nNC?s(ijopa
zsDxr5?Lj~Z=>}2mj6d~q&h_{BJolbIzx&;>*1PvwpS1uIOCA6LgQx%!%MBQvc$8k$
z1`~(|oK0f6L>`I(gCJ-)zyzanjM4*PAy6=gnhFRjfH8cZNyiL=W{0Ih!>$5hNnj8N
z#z2`EwIxXfV}bz3_pXFcQ$f`~pUbDp^2}LPzC%1i*NIX5Glct%$47z0h~O()mjp^y
z*BF?_mma_G#;-E9HEE91nm^GV=@i!;Z5i8yu?TdzfSJ`n*CM)yLA2$*WeGsPbS@`c
z3XqZoq|s<JAR{fSU<0P3TJg#O=5!`vvPt`L0TOH+AVE8`$zFmf%dg}d>Cl}=y1JRx
zzNYh~Soqx+5Chq_V`v6|4hFG=!dStU7HAfLnIh;}>GWN&9w)qg2t+hLfS`;)Sh>Dw
zeQm@EoI934baMB?d7MUQX&|J5!yHUfGH3v;fL4@IkO6GSQVu|)<tb8H(FV}{{V{?7
z|Nk9x@IQ`0X!sD_JiT#5e}Dw$-|GVTdLSe)oP3>NdN7H6uR|4oq~_B2Wk~5EZ+zGY
zDpfsrQsSN>NFma3q9tDdAPA-9u^){MADXOeXQ7|KRWuK4-Ab3e^_f-bZiuKYE9)Vd
z)F{WAth<%h>I&;#T6qkZ_=7${=+CkRZEc*Zx`WNk)5-`u%gq;|jw!ZU69aRt#71%N
zrl+JA9*^w%?9Q$CMs@87itPdJfulP-?V5Ro@%3WBuk`EC8Py!{33Q;&f;@N^R$2$w
zrjavF4Z*s!R2a(FibSs#gwhc%OoxT*G6#PFPsktw5sBH)L+qHPoUSnwcIO6stW{#7
z%vW;N`#b6C;%~F@t|r=8Z1Sx>*+$nZwI4o{6+?eG!^EtsQDdFTV!|24?&n}SR5qAl
zHj{L?uOX~+=b4FciGZ|+)8wRtih*Iy(J?+plVj%_Qh6qVbi5j96D%kCdu=bQ#=P}V
zcJYm78hJcm#ld1KJvCK6h*tJ8&E+b}&uS%VY`@AhPd=3ycqHhPLZ(E6wh+pZ<#XfZ
z$O_TI$031ZcO7dKk_jIA?RR{VPK+s;Z!U{h3%=vlteNUOCHOT@FU&4uD8?)4gXZaF
z?6ZtTNwNG<TAcFN!I|>x^E$e|sp-RkwduKH>z~qhha(JKk-Qo`_z)S%X=eB?a7@!^
znAKIN4<q-{IBZ748mMPAEfb(t_OUG~v+GWtm3!X20EU35K)EDPCqM!{0T{_IiiZ^h
z+J%AvDqtT)!6^y~0n>y62Pj&Iq8R~t7%dV8qNb*S&;ntRKLiK_^#{%azz+?8q6FQD
zL@y;tNsOnvJJuV6bHbxMF$6CZjvOyUO1z-RUjVJ2E5K3m-&goL;c+fbM4YF`Unfgq
zu--(1BymqrNu#{vF#s>cJ^?5va3GYeLuyej=!y7X(u1Jr*!>MP{P-q1AcQgj0rdlX
z0a_UBbQmLu>?hOSoCE@F_euz01Q`4<4GcP<N->Q<_J)AP_;_P~VHeI7hjAie36fr(
zcpS!Gl58l>!v*VyawEFq0Ue3~yihej1yIgb%$ARm{jIOw_`i9I@x}u@lzsL=4?x-Y
zLLDUUnwQivz-&y69S60Y<_>`N20S@ukpmt?WqznDuR76!+CMl2A>m=J%GCI0%Fq^E
z?qF=4hHu_zqh;4w_j=Yk=u-AV>SCt8<psRV*Uf?|WRkF|k42l-0y5}|{XMojg4!b0
zJ)?ICuaC8<tY8w-5)(C2<SY&^Ic-C0@nv<QQV}hp(Nl^73PoC(S83(cDtr}QiWuG&
z8vXRfsI#<5($#hCE9X(0J~h<LyZy-lE;PAQAMbIhMVhW4^u~knfi><`?;02<jJ{lX
zF14dy=A()g*9g{jWXQ__os8g?oV~Ra!o<TWtMOUo&DmD$yq9WC(+A#@jhxXo3Y8@X
zTT*UYC6!;QKegf!*EP5zmgjBdZ2QPKQ+jz_gE-thx0wv;<9TN$)Wfuxo~Tz`-$u`Q
zk|~&_-eDt=sjq*LuB__%9IM$@+Wd=PizV>=^A^ipgzI0W>ZiYUdtN!TwBCHAbk^`A
zVtAf6t&a3cWB>i8fL8eOR)QN<3ZufOPk9HY15b=_W#ZovaVYlW(U&~F8rh&TJa}e#
zTO<FNJS#hT)e7hnquxi;`;+<K`|K=M>qd{eOH1bYEZcs3v27~6J%+NY=o0zx_JbVp
z?Y^sAn@WTIHMiLAtMSoz1V*UKh=z5P6`tZ*j>!pbZ?T(hat8A>avZlyY&w3Ed3s-N
z)znt4{q}{G6Jx5>jzxX0C1uae?)nw2<-F_$NHjG7i8}iy=0dI}vey@})cld6qCGqR
zw<iM_{GLA|fDri=k}-GqC;AXtKZ6`$?&(RSunzr=by8#i%SoXDML?F!I%#P@4lVUv
z{!>W(9q9_4SC571%sa2@KvN~fI%VCot!nV%+`W>quMUo@7sTxtSHK4%XNw$zo}~$_
z$|z2Nz?m*`<_V9Aprrzf`|k8f6lLV`4`iI(YQI!anQF~t=qf7voGV_fUVXt?ZhH7C
zlTr|;-nJkOsHi@+l>zBhaf-RKtBA4k{#Zo^Onu^J&kOi;l$!ecw5HuM2Cl3IqjhfC
zN)4KP5;87+DMyW7HL9AayR>v&1vbZ^j?yHGeST&*g?fm5RioSTeB_bavKahK9T%w)
zt#>)Ld%lHk^vrDBScAd}jpuPB?}qceJ9%q)G~<_ct}(u?4B1hG9c`YTWeQlbJkr<N
zqhOXq5U%Lep^;Nm<-``G4w*6_;SL5p7NdAfQ|dZypx-_KaU;;wwyoxrf1x?-O|MFO
zjn!Odf?C3{w6>hV`fa<h;^H%f0=uyqB58Mek~tqAtPpevQ8>@3{HzfZ-}^k{>&d2w
z)LMHMnO;jX76<%;Wk;F~E%m|F=hm%ncwRzG)#EsAcHJLHvlB|#S*jh3SQr1yG_THo
z@?yl$JhbJdWcy{kti>umD=Qs)I{{~`wPM5dh0*3S`0+<JukJn6q0OwLzx1FqzexCf
z@7<+P+jy}-aoYV?H!6#Igw@OD`)Y6v&bD&*e3C*j2%B8Z`lRLR25~=7AoSxq@99BZ
z=gZ$o2fj(JeXav6lnnZfbhH4Bj5JD#`xoAUqJXfAKT<!LYr#O^f5A1~A3FfxDCOVf
zdT(;b5cYtQqA^bB|6tpkHdpiOMOfT?USOl<r0|KS@p8Uod}~u&LO@9%WwMa}{|E;m
zf8^fFI1qV&?jNOGSlth=!C)Y)j4`bEgd2{4_)(^6k@5W<lL$8_0>T-K^+4bV1Rtym
z0_TBn!eBhTU7S2HSj2f8(GBr4yNLXH3$t&aMYwwUc(@>(h=~6Y(FT;i$P3j1Gyt`1
zm2BlG#ot{U8OXo5w7+8dm*og6<tU-Q6;prhH@>kOd0IJoTmA5zAw*liALmudbZ5D4
zbe=VDkx~25<8SSs?BZ`Z9y~kCJW&9uL`Jv6CWfDM`_-%+us(7~a&pHbb*k&&cENN1
zghe6oX&-WzB(5cd8s>>9FSS;=yPThVBf5*LS}aVbCyTXklxxLOKfCgL(TzW6PVMU8
zurFU+OxMTxz3?r9`|N%UN0#%Y@C((&E*3A<##8IM_9UFCV{b6<mlK2)Cz<6|nv@h8
ze>zs{Ej#$CBdIbsHOw?2$W3JUq4YBc&zb%eLDUv~PN1d8Nreg{h!$7XJvcL<>&scJ
z>TrKX@qG~ZLWjcQ%=#Df10?nMr>q0De($ydn&K`6q8>KCUzoN|=T0oMF}9yMQM@kI
zQ^c$h-hAnChEk@GccZ~bbi_jaye_J$#6J<Y(eiAdRl3w))<9tR=~45P1ARJ%Y9`=R
z6A`u>0oE1yb|#CdJRRj%N9=Q$R@O?p_$LB&`m`BTl7uvs?BTo9sYX(;@JvG^sv4?}
z1f5W)Yq5AgR?k7{^i^-qB>GyF$!v?FLTz8ZI2#3lk|*jy^Bh6-xGDXp#xA8v!!SG`
zBLzQw4G~Fn>0)EK-BRv0NU{kaNL4Vjele?Fy8>0<nCK7B?RV+FIz<zw7XyuQm=nJl
z&(>TOS#R;?wW}Hn4@bd{#^GM4L&0(tUQ_yL5`-5ZK@O7pXTbU&!sV|!-924=c32v~
z{j>L_gP_TE@}8z1IP~vt)Mz-lf8E<-1IRs-!Hnob05?D`%b{%aiO5sO*MuBzLoiPZ
z=mczl$45f|$$xJJMe{=u5-K;c9`iG>UsyMo)Fbw_oAk!hC55ht#z*e=SBp)Q-dn7Y
z8(Js{Oyv+08ig7%3^LEbnto`PTTL~UQBGQny(o)6DevieJ><as>r1Rxrj2axvd?Ed
z^*(}JIF_yc=A;nq<JN)2Wc3+81CN5!X-hPv+%HF@OIHLkDl0d`C1NfVw2GI8=lBYx
z#fh3s6%`93&EFkzj4wQ8(D}C8DA~7Hdvg23Me(MXi|3$bPMo1Lxf3{H{X;9bh(P!i
z4x_Wt7TW?lZCj6`QTCzD1giDw;84TKD#idROB6Dbjn1%CB3?7A)WTy^AT?n%m;**z
zI5YG#z*s`tr>m>TlXNa^v|L_CQQ&9+yF0Qb{snV9rc@;1!b48TG;$;~tym)7Dep_;
zcJspvbDW5jfcC8oofma-&{6Mw9T^$s<#|W^qk2B*Q2(LAa^1&EMM>%sC+GbKRX&m&
z8>hpCbsdP2xevj7#}!wK9eHIkniurPj=363OkEzzx^1_5c!-m$jh*#E$GiTXV9Cld
z(>I$UUT}l!GWDLq!WhK{LW6lb8`c=MImsb1Y<EZWDJj3=-Z>rGqIs@$M>Z4+f0g!V
zo3p=2WX)Nvr)#2Ck7!{lkdYm8rU>NMZ2HSi8A-?#_OieMxL(QGxIFceo5K4shyb(M
za4}&odlH}a`tURNw89}OeOlSx2l@zl^?l+k#n&`%DXiPnZ3!>Dwo$gE9<UdDnr#`Q
HRP^{?w7_Zv

literal 0
HcmV?d00001

diff --git a/tests/enrichers/test_timestamping_enricher.py b/tests/enrichers/test_timestamping_enricher.py
index 369610b..b5c6b77 100644
--- a/tests/enrichers/test_timestamping_enricher.py
+++ b/tests/enrichers/test_timestamping_enricher.py
@@ -1,7 +1,6 @@
 import pytest
 from auto_archiver.modules.timestamping_enricher.timestamping_enricher import TimestampingEnricher
 from rfc3161_client import (
-    TimestampRequestBuilder,
     TimeStampResponse,
     decode_timestamp_response,
 )
@@ -9,12 +8,17 @@ from rfc3161_client import (
 from cryptography import x509
 
 @pytest.fixture
-def digicert():
-    with open("tests/data/timestamp_token_digicert_com.crt", "rb") as f:
-        return f.read()
+def timestamp_response() -> TimeStampResponse:
+    with open("tests/data/timestamping/timestamp_response.tsr", "rb") as f:
+        return decode_timestamp_response(f.read())
+
+@pytest.fixture
+def wrong_order_timestamp_response() -> TimeStampResponse:
+    with open("tests/data/timestamping/rfc3161-client-issue-104.tsr", "rb") as f:
+        return decode_timestamp_response(f.read())
 
 @pytest.mark.download
-def test_sign_data(setup_module):
+def test_download_tsr(setup_module):
     tsa_url = "http://timestamp.identrust.com"
     tsp: TimestampingEnricher = setup_module("timestamping_enricher")
 
@@ -22,27 +26,36 @@ def test_sign_data(setup_module):
     result: TimeStampResponse = tsp.sign_data(tsa_url, data)
     assert isinstance(result, TimeStampResponse)
 
-    root_cert: x509.Certificate = tsp.verify_signed(result, data)
-    assert root_cert.subject.rfc4514_string() == "CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US"
+    verified_root_cert = tsp.verify_signed(result, data)
+    assert verified_root_cert.subject.rfc4514_string() == "CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US"
 
     # test downloading the cert
-    cert_chain = tsp.save_certificate(result)
-    assert len(cert_chain) == 2
-
-def test_tsp_enricher_download_syndication(setup_module, digicert):
-    tsp: TimestampingEnricher = setup_module("timestamping_enricher")
-
-    cert_chain = tsp.download_and_verify_certificate(digicert)
+    cert_chain = tsp.save_certificate(result, verified_root_cert)
     assert len(cert_chain) == 3
-    assert cert_chain[0].filename == f"{tsp.tmp_dir}/74515005589773707779.crt"
-    assert cert_chain[1].filename == f"{tsp.tmp_dir}/95861100433808324400.crt"
-    assert cert_chain[2].filename == f"{tsp.tmp_dir}/15527051335772373346.crt"
 
-
-def test_tst_cert_valid(setup_module, digicert):
+def test_verify_save(setup_module, timestamp_response):
     tsp: TimestampingEnricher = setup_module("timestamping_enricher")
-    
-    try:
-        tsp.verify_signed(digicert, b"4b7b4e39f12b8c725e6e603e6d4422500316df94211070682ef10260ff5759ef")
-    except Exception as e:
-        pytest.fail(f"Verification failed: {e}") 
\ No newline at end of file
+
+    verified_root_cert = tsp.verify_signed(timestamp_response, b"4b7b4e39f12b8c725e6e603e6d4422500316df94211070682ef10260ff5759ef")
+    assert verified_root_cert.subject.rfc4514_string() == "CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US"
+
+    cert_chain = tsp.save_certificate(timestamp_response, verified_root_cert)
+    assert len(cert_chain) == 3
+
+    assert cert_chain[0].filename == f"{tsp.tmp_dir}/1 – 85078371663472981624.crt"
+    assert cert_chain[1].filename == f"{tsp.tmp_dir}/2 – 85078758028491331763.crt"
+    assert cert_chain[2].filename == f"{tsp.tmp_dir}/3 – 13298821034946342390.crt"
+
+
+def test_order_crt_correctly(setup_module, wrong_order_timestamp_response):
+    # reference: https://github.com/trailofbits/rfc3161-client/issues/104#issuecomment-2711244010
+    tsp: TimestampingEnricher = setup_module("timestamping_enricher")
+
+    # get the certificates, make sure the reordering is working:
+
+    ordered_certs = tsp.tst_certs(wrong_order_timestamp_response)
+    assert len(ordered_certs) == 2
+    assert ordered_certs[0].subject.rfc4514_string() == "CN=TrustID Timestamping CA 3,O=IdenTrust,C=US"
+    assert ordered_certs[1].subject.rfc4514_string() == "CN=TrustID Timestamp Authority,O=IdenTrust,C=US"
+
+