Extend debug logging beyond TSA: signing certificate, chain, and CRL/OCSP requests

[kwart]

Fixes #452.

CapturingTspSource already traced the TSA leg at FINE, but the rest of the pipeline had nothing comparable: certificate problems surfaced only as DSS's C-<SHA-256 hex> token ids, and the AIA / CRL / OCSP traffic was invisible because DSS logs through SLF4J, which JSignPdf does not wire to its java.util.logging console. A failed signature showed that revocation data was missing, never why.

Changes

• CertificateInfo (engines/api) — describes an X.509 certificate: subject, issuer, serial, validity (flagging (EXPIRED) / (NOT YET VALID)), the DSS token id, key usage, QC statements (ETSI OIDs resolved to EN 319 412-5 names), and the AIA caIssuers / OCSP and CRL distribution-point URLs. Best-effort throughout — an unparseable extension is omitted, never fatal. Hooked into KeyStoreUtils.getPkInfo, so both engines dump the signer chain.
• LoggingDataLoader / LoggingRevocationSource / LoggingAIASource — pass-through decorators wired into DssTrustConfigurer.buildVerifier(). One line per call: role, URL, response size, elapsed time, or the failure reason; the revocation layer adds the certificate it was for, the status, and thisUpdate / nextUpdate. Every wrap(...) returns the delegate unchanged when FINE is off, so a non-debug run pays nothing. LoggingRevocationSource implements RevocationSourceAlternateUrlsSupport and forwards, preserving DSS's trusted-list alternate-URL path.
• DssTrustConfigurer — logs the anchors each configured trust source contributed plus the total, which separates "nothing is trusted at all" from "the anchors loaded but this CA is not among them".
• CapturingTspSource — dumps the timestamp chain once the TSA answers.
• DssUntrustedChainReporter — reuses CertificateInfo instead of its own duplicate token-id / DN helpers.

Sample output

Real trace from the new end-to-end test (embedded CA + TSA, PAdES LT):

Signing certificate chain (2 certificates)
  [0] subject=O=JSignPdf Test,CN=JSignPdf Test Signer
      issuer=O=JSignPdf Test,CN=JSignPdf Test Root CA
      serial=2, validity=2026-07-23 07:24:28 UTC .. 2027-07-24 07:24:28 UTC
      id=C-958E99061FA999181718D8FE3E6D70ECC4EF46DD78FC76E76AD348214E7AD6EE
      keyUsage=digitalSignature,nonRepudiation
      CRL DP=http://127.0.0.1:45635/crl
Trust source trust.certFiles=/tmp/.../ca.crt: 1 anchor(s)
Trust anchors loaded: 2 from 2 configured source(s)
TSA response <- http://127.0.0.1:43391/tsa: 1458 bytes, genTime=..., certs=1, elapsed=279ms
Timestamp certificate chain (1 certificate)
  [0] subject=O=JSignPdf Test,CN=Test TSA
      ...
OCSP lookup for JSignPdf Test Signer (C-958E99...): no OCSP data (no access point on the certificate, or none usable), elapsed=0ms
CRL GET http://127.0.0.1:45635/crl: 503 bytes, elapsed=18ms
CRL lookup for JSignPdf Test Signer (C-958E99...): status=GOOD, source=http://127.0.0.1:45635/crl, thisUpdate=..., nextUpdate=..., elapsed=27ms

Notes

• Everything is at FINE, matching the existing TSA tracing. Since logging.properties sets net.sf.jsignpdf.level=FINE, this output appears in normal runs; -q silences it along with the rest of the progress output.
• The chain dump lives in engines/api and is triggered from KeyStoreUtils, so the OpenPDF engine gets it too (verified with a real CLI signing run). The revocation / AIA tracing is DSS-only.

Tests

CertificateInfoTest (8) and DssDebugTracingTest (6, covering pass-through and rethrow guarantees), plus DssSigningEngineTest.ltSigningTracesCertificatesAndRevocationFetchesAtFine — an end-to-end LT signing against the embedded CA/TSA asserting the whole trace. Full build green: 298 tests, 0 failures.

Docs

New Troubleshooting → Reading the signing diagnostics section in JSignPdf.adoc with annotated samples, cross-referenced from the LT/LTA trust section. Also adds distribution/doc/release-notes/3.2.0.md (validated through update-metainfo-release.py + appstreamcli validate), which additionally covers the already-merged aspect-ratio and Recent-files changes.

🤖 Generated with Claude Code