java.lang.Object
- org.bouncycastle.cert.plants.MTCContentSigner

All Implemented Interfaces:

ContentSigner
```
public class MTCContentSigner
extends java.lang.Object
implements ContentSigner
```
Issuer-side ContentSigner that emits an MTC signatureValue (an encoded MTCProof) for an EE Merkle Tree certificate per Section 6.2 of draft-ietf-plants-merkle-tree-certs.
The signer is plugged into the standard X509v3CertificateBuilder.build(ContentSigner) flow. As the TBSCertificate DER bytes stream out of the builder into getOutputStream(), this class captures them; when getSignature() is invoked it:
1. Takes the entry's index from the serial number the builder wrote (serial = (log_number << 48) | index, Section 6.2), checking the log number is that of the supplied MTCLog.
2. Derives the MerkleTreeCertEntry leaf hash via MerkleTreeCertificateValidator.computeEntryHash(byte[], MerkleTreeHash) and evaluates the supplied inclusion proof for that index within the log's subtree [start, end) (Section 4.3.2) to obtain the subtree hash.
3. Delegates to MTCCosigner.cosignSubtree(org.bouncycastle.cert.plants.MTCLog, byte[]) to produce the cosigner's MTCSignature.
4. Wraps the inclusion proof and the cosigner signature in an MTCProof and returns its TLS wire encoding.
This is the single-cosigner binding used by the worked examples: a standalone certificate (Section 6.3 of the draft) carrying one cosigner signature and no log-entry extensions. Issuers with multiple cosigners or extensions should compose the MTCCosigner, MTCProof and MerkleTreeHash primitives directly; landmark-relative certificates (Section 6.4, no signatures) are built via LandmarkCertificateManager.buildLandmarkCertificate(long, long, org.bouncycastle.asn1.x509.TBSCertificateLogEntry, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo, org.bouncycastle.cert.plants.MerkleTreePrimitives.SubtreeInfo, java.util.List<byte[]>, org.bouncycastle.cert.plants.MerkleTreeHash).

Constructor Summary

Constructors
Constructor	Description
`MTCContentSigner(MTCLog log, byte[] inclusionProof, MTCCosigner cosigner)`	The cosigner's identity is taken from `MTCCosigner.getCosignerId()` — the CA-as-cosigner case is just a `MTCCosigner` constructed with `log.getCa().getCaId()` as its cosigner ID (Section 5.3 of the draft).

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`org.bouncycastle.asn1.x509.AlgorithmIdentifier`	`getAlgorithmIdentifier()`	Return the algorithm identifier describing the signature algorithm and parameters this signer generates.
`java.io.OutputStream`	`getOutputStream()`	Returns a stream that will accept data for the purpose of calculating a signature.
`byte[]`	`getSignature()`	Returns a signature based on the current data written to the stream, since the start or the last call to getSignature().

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - MTCContentSigner
```
public MTCContentSigner(MTCLog log,
                        byte[] inclusionProof,
                        MTCCosigner cosigner)
```
    The cosigner's identity is taken from MTCCosigner.getCosignerId() — the CA-as-cosigner case is just a MTCCosigner constructed with log.getCa().getCaId() as its cosigner ID (Section 5.3 of the draft). Witnesses, regulators, federated peers or any other entity with a distinct trust anchor ID work via the same constructor by constructing the cosigner with their own ID.
    
    Parameters:
    
    log - issuance log + subtree window [log.getStart(), log.getEnd()) — also supplies the CA (via MTCLog.getCa()) and therefore the hash function and log ID
    
    inclusionProof - the subtree inclusion proof (Section 4.3) for the EE's entry, as the concatenated sibling hashes from the leaf up to the subtree root — the same bytes that land in the resulting MTCProof (a single sibling hash for a two-entry subtree)
    
    cosigner - cosigner driver bound to its trust anchor ID, signature algorithm and key
- Method Detail
  - getAlgorithmIdentifier
```
public org.bouncycastle.asn1.x509.AlgorithmIdentifier getAlgorithmIdentifier()
```
    Description copied from interface: ContentSigner
    
    Return the algorithm identifier describing the signature algorithm and parameters this signer generates.
    
    Specified by:
    
    getAlgorithmIdentifier in interface ContentSigner
    
    Returns:
    
    algorithm oid and parameters.
  - getOutputStream
```
public java.io.OutputStream getOutputStream()
```
    Description copied from interface: ContentSigner
    
    Returns a stream that will accept data for the purpose of calculating a signature. Use org.bouncycastle.util.io.TeeOutputStream if you want to accumulate the data on the fly as well.
    
    Specified by:
    
    getOutputStream in interface ContentSigner
    
    Returns:
    
    an OutputStream
  - getSignature
```
public byte[] getSignature()
```
    Description copied from interface: ContentSigner
    
    Returns a signature based on the current data written to the stream, since the start or the last call to getSignature().
    
    Specified by:
    
    getSignature in interface ContentSigner
    
    Returns:
    
    bytes representing the signature.

Class MTCContentSigner

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Constructor Detail

MTCContentSigner

Method Detail

getAlgorithmIdentifier

getOutputStream

getSignature