option for adding timestamps to signatures

command_sign.go

@@ -42,15 +42,27 @@ func commandSign() {
 		faile(err, "failed to read message from stdin")
 	}
 
-	var der []byte
-	if *detachSignFlag {
-		der, err = cms.SignDetached(dataBuf.Bytes(), chain, signer)
-	} else {
-		der, err = cms.Sign(dataBuf.Bytes(), chain, signer)
-	}
+	sd, err := cms.NewSignedData(dataBuf.Bytes())
 	if err != nil {
+		faile(err, "failed to create signed data")
+	}
+	if err := sd.Sign(chain, signer); err != nil {
 		faile(err, "failed to sign message")
 	}
+	if *detachSignFlag {
+		sd.Detached()
+	}
+
+	if len(*tsaOpt) > 0 {
+		if err = sd.AddTimestamps(*tsaOpt); err != nil {
+			faile(err, "failed to add timestamp")
+		}
+	}
+
+	der, err := sd.ToDER()
+	if err != nil {
+		faile(err, "failed to serialize signature")
+	}
 
 	emitSigCreated(chain[0], *detachSignFlag)
 

main.go

@@ -10,6 +10,10 @@ import (
 )
 
 var (
+	// default timestamp authority URL. This can be set at build time by running
+	// go build -ldflags "-X main.defaultTSA=${https://whatever}"
+	defaultTSA = ""
+
 	// Action flags
 	helpFlag     = getopt.BoolLong("help", 'h', "print this help message")
 	signFlag     = getopt.BoolLong("sign", 's', "make a signature")
@@ -20,8 +24,9 @@ var (
 	localUserOpt   = getopt.StringLong("local-user", 'u', "", "use USER-ID to sign", "USER-ID")
 	detachSignFlag = getopt.BoolLong("detach-sign", 'b', "make a detached signature")
 	armorFlag      = getopt.BoolLong("armor", 'a', "create ascii armored output")
-	statusFdOpt    = getopt.IntLong("status-fd", 0, -1, "Write special status strings to the file descriptor n.", "n")
-	keyFormatOpt   = getopt.EnumLong("keyid-format", 0, []string{"long"}, "long", "Select  how  to  display key IDs.", "{long}")
+	statusFdOpt    = getopt.IntLong("status-fd", 0, -1, "write special status strings to the file descriptor n.", "n")
+	keyFormatOpt   = getopt.EnumLong("keyid-format", 0, []string{"long"}, "long", "select  how  to  display key IDs.", "{long}")
+	tsaOpt         = getopt.StringLong("timestamp-authority", 't', defaultTSA, "URL of RFC3161 timestamp authority to use for timestamping")
 	fileArgs       []string
 
 	idents []certstore.Identity