pdfcer v0.42.0

pdfcer v0.42.0 — certify a document, sign into the author's field, bold that just works

Portable Windows x64 CLI. Unzip anywhere and run pdfcer.exe; nothing is installed and no registry is touched. SHA-256 of the zip is in the .sha256 file beside it.

New

• Certification (author) signatures — pdfcer sign --certify [--mdp-level none|form-fill|annotate] writes the DocMDP permission every reader enforces on later changes (P=2 "form fill-in and signing" is the standard's default and is printed as such). One per document, and it must be the first signature — both refused by name. verify-signatures reports certification: DocMDP P=n (…). (Pass 10.12)
• Sign into a pre-placed signature field — --field-name <existing empty field> signs into the "sign here" box a form author placed: its rectangle and page place the signature; a /Lock on the field becomes a /FieldMDP lock; the field's seed-value constraints (/SV) are enforced in full — a required constraint this request does not meet, or one pdfcer cannot evaluate (certificate constraints, a required timestamp), is refused by name, never skipped; recommended ones are printed as notes. (Pass 10.13)
• A visible signature now shows who signed — the box carries "Digitally signed by …", the date, and --reason/--location when given, in Helvetica shrunk to fit; a box too small for the text is refused rather than clipped. Also: signing hardened with tamper tests against OpenSSL, a foreign (pyHanko) signature fixture in both directions, ECDSA P-384 end to end. (Pass 10.14)
• Bold and italic are automatic — pdfcer format-text --find … --bold (and --italic) binds a real face already on the page if one can show the text, else the standard-14 sibling of the run's own family (Helvetica → Helvetica-Bold, nothing embedded), else synthesises — and says which. Per axis: a real Bold may bind while Italic is synthesised. --bold-synthetic stays as the explicit override; --style-policy refuse stops at synthesis and names the override. (Pass 179.0)

Not in this build, stated plainly

• Signature level is still B-B: no timestamp (a field that REQUIRES one is refused), no embedded revocation data.
• /SV /Cert certificate constraints are refused, not evaluated; signature fields with widgets under /Kids are refused (merged fields only).
• format-text --set-font to a face neither on the page nor standard-14 is still refused (embedding a donor face into existing text is open).

Verification

cargo test --workspace green; every gate green on the release tree; CI green at the tag. No dependency changes since v0.41.0. The CI filing gate now pins hash abbreviation to 7 characters (git's auto length crossed to 8 on a fresh clone and reported every filed commit as unfiled — fixed in this release).