From dabb7b7a0d71abdbecb1f40e6d2a049b46a77cf9 Mon Sep 17 00:00:00 2001
From: Nathan Delhaye <the@red.cat>
Date: Fri, 4 Sep 2026 04:26:01 +0200
Subject: [PATCH] fix: increase signature placeholder size when a timestamp
 authority is configured (#3328)

---
 packages/signing/index.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/signing/index.ts b/packages/signing/index.ts
index d5f6c2f9b..acb1c00bb 100644
--- a/packages/signing/index.ts
+++ b/packages/signing/index.ts
@@ -49,6 +49,11 @@ export const signPdf = async ({ pdf }: SignOptions) => {
     timestampAuthority: tsa ?? undefined,
     longTermValidation: !!tsa,
     archivalTimestamp: !!tsa,
+    // A B-LTA signature (signer chain + RFC 3161 timestamp token + LTV
+    // revocation data) can exceed the 12288-byte default placeholder,
+    // depending on the signing certificate chain and the TSA responder.
+    // The unused portion is zero-padding, so over-reserving is cheap.
+    estimatedSize: tsa ? 32768 : undefined,
   });
 
   return bytes;