Fix verification result on timestamp failure

NEWS.md

@@ -4,6 +4,7 @@
 
 - fixed Cygwin compilation by not passing ELF-specific linker flags
 - fixed MSI MsiDigitalSignatureEx digest ordering during signing and verification
+- fixed verification to report failure when timestamp verification fails
 
 ### 2.14 (2026.07.20)
 

cmake/CMakeTest.cmake

@@ -467,6 +467,37 @@ if(Python3_FOUND AND NOT cryptography_error)
             list(APPEND ALL_TESTS "verify_ts_cert_${ext}")
         endforeach(ext ${extensions_all})
 
+        # Verify with untrusted Time-Stamp Authority
+        # This test is expected to fail
+        foreach(ext ${extensions_all})
+            add_test(NAME "verify_ts_untrusted_${ext}"
+                COMMAND ${Python3_EXECUTABLE} ${EXEC} ${OSSLSIGNCODE} "verify"
+                "-time" "1567296000" # Signature verification time: Sep 1 00:00:00 2019 GMT
+                "-CAfile" "${CERTS}/CACert.pem"
+                "-TSA-CAfile" "${CERTS}/CACert.pem" # Use an unrelated CA to make TSA verification fail
+                "-in" "${FILES}/ts_cert.${ext}")
+            set_tests_properties("verify_ts_untrusted_${ext}" PROPERTIES
+                ENVIRONMENT "HTTP_PROXY=;http_proxy=;"
+                DEPENDS "sign_ts_cert_${ext}"
+                WILL_FAIL TRUE)
+            list(APPEND ALL_TESTS "verify_ts_untrusted_${ext}")
+        endforeach(ext ${extensions_all})
+
+        # Verify with untrusted Time-Stamp Authority and ignored timestamp
+        foreach(ext ${extensions_all})
+            add_test(NAME "verify_ts_untrusted_ignore_${ext}"
+                COMMAND ${Python3_EXECUTABLE} ${EXEC} ${OSSLSIGNCODE} "verify"
+                "-time" "1567296000" # Signature verification time: Sep 1 00:00:00 2019 GMT
+                "-ignore-timestamp"
+                "-CAfile" "${CERTS}/CACert.pem"
+                "-TSA-CAfile" "${CERTS}/CACert.pem" # Use an unrelated CA to make TSA verification fail
+                "-in" "${FILES}/ts_cert.${ext}")
+            set_tests_properties("verify_ts_untrusted_ignore_${ext}" PROPERTIES
+                ENVIRONMENT "HTTP_PROXY=;http_proxy=;"
+                DEPENDS "sign_ts_cert_${ext}")
+            list(APPEND ALL_TESTS "verify_ts_untrusted_ignore_${ext}")
+        endforeach(ext ${extensions_all})
+
         # Signature verification time: Jan  1 00:00:00 2035 GMT
         foreach(ext ${extensions_all})
             add_test(NAME "verify_ts_future_${ext}"

osslsigncode.c

@@ -3220,7 +3220,7 @@ static int verify_content(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
  */
 static int verify_signature(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
 {
-    int leafok, verok;
+    int leafok, verok, timeok = 1;
     STACK_OF(X509) *signers;
     X509 *signer;
     CMS_ContentInfo *timestamp = NULL;
@@ -3259,7 +3259,7 @@ static int verify_signature(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
             printf("\nTimestamp Server Signature verification is disabled\n");
             time = INVALID_TIME;
         } else {
-            int timeok = verify_timestamp(ctx, p7, timestamp, time);
+            timeok = verify_timestamp(ctx, p7, timestamp, time);
             printf("\nTimestamp Server Signature verification: %s\n", timeok ? "ok" : "failed");
             if (!timeok) {
                 time = INVALID_TIME;
@@ -3271,7 +3271,7 @@ static int verify_signature(FILE_FORMAT_CTX *ctx, PKCS7 *p7)
         printf("\nTimestamp is not available\n\n");
     verok = verify_authenticode(ctx, p7, time, signer);
     printf("Signature verification: %s\n\n", verok ? "ok" : "failed");
-    if (!verok)
+    if (!timeok || !verok)
         return 1; /* FAILED */
 
     return 0; /* OK */