Unable to do multiple signatures on a single PDF document

[Vishwamithra37]

Hey,
So, I tried making two different signatures with different certificates ad keys onto the same PDF file using pyHanko. For some reason, it is overwriting on top of the existing signature field done by pyHano. Does anyone know how to solve this? Thanks for your help

[MatthiasValvekens]

First off, pyHanko should never attempt to overwrite the value of a signature field. When in doubt, it should throw an error before signing. If it ends up clobbering the previous signature, then it's probably a bug, and I'd like to see your code so I can figure out what's triggering that behaviour.

While applying multiple signatures to a PDF document is certainly possible (and pyHanko supports that use case) there are a couple of things you need to be careful with:

• Give your signature fields distinct names
• Ensure you're signing in append mode, i.e. using IncrementalPdfFileWriter (this one is critical)
• Preferably, create all your (empty) signature fields before putting in the first signature. This makes your signatures more straightforward to validate.

Here's a toy example from the test suite (note that it doesn't follow the advice in point 3, but the rest applies):

pyHanko/pyhanko_tests/test_diff_analysis.py

Lines 96 to 112 in ab55604

	def test_double_sig_add_field(file_ix):
	w = IncrementalPdfFileWriter(BytesIO(DOUBLE_SIG_TESTDATA_FILES[file_ix]))
	out = signers.sign_pdf(
	w, signers.PdfSignatureMetadata(field_name='Sig1'),
	signer=FROM_CA,
	)
	# create a new signature field after signing
	w = IncrementalPdfFileWriter(out)
	# throw in an /Info update for good measure
	dt = generic.pdf_date(datetime(2020, 10, 10, tzinfo=pytz.utc))
	info = generic.DictionaryObject({pdf_name('/CreationDate'): dt})
	w.set_info(info)
	out = signers.sign_pdf(
	w, signers.PdfSignatureMetadata(field_name='SigNew'), signer=FROM_CA,
	)

.
Does that help with figuring out where the problem might be? If not, please post the code.

[Vishwamithra37]

`from attr import fields
from config import *
from pyhanko import stamp
from pyhanko.sign import fields
from pyhanko.pdf_utils import text, images
from pyhanko.pdf_utils.font import opentype
from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
from pyhanko.sign import signers

signer = signers.SimpleSigner.load(key_file='./example3.key',cert_file='./example3.crt')
with open('template2.pdf', 'rb') as inf:
    w = IncrementalPdfFileWriter(inf)
    # Get pdf dimenstions.
    fields.append_signature_field(pdf_out=w,
        sig_field_spec=fields.SigFieldSpec(
            # 'Signature', box=(120, 700, 370, 770),on_page=0
            'Signature2', box=(80, 700, 250, 770),on_page=0
            # Move the ur-x and ll-x equal distance to move left or right.
            # Move the ur-y and ll-y equal distance to move up or down.
        )
    )


    meta = signers.PdfSignatureMetadata(field_name='Signature2',location="indonesia",reason="Non-repudation")
    pdf_signer = signers.PdfSigner(
        meta, signer=signer, stamp_style=stamp.QRStampStyle(
            # the 'signer' and 'ts' parameters will be interpolated by pyHanko, if present
            border_width=1,
            qr_position=stamp.QRPosition.RIGHT_OF_TEXT,
            stamp_text=' Time: %(ts)s\n \n Signed by: %(signer)s\n \n Authorized-By: 54541',
            background_opacity=0,
                    # margins=layout.Margins.uniform(0),
            text_box_style=text.TextBoxStyle(
                font=opentype.GlyphAccumulatorFactory('./NotoSans-bold.ttf'),
                # font_size=13,
            ),
            background=images.PdfImage('whitebox.png')
        ),
    )
    with open('document-signed.pdf', 'wb') as outf:
        pdf_signer.sign_pdf(w, output=outf, appearance_text_params={'url': ' https://galam.in/Aboutme'})

        
`

This is basically how I'm signing my documents. And I am testing by changing the field_name. WHich is probably wrong. But yes, When I do this, it basically keeps overwriting the signature.
I will try the one above. It definetely is not throwing out an error.

[MatthiasValvekens]

Before we proceed, since you're using hard-coded file names, here's an obvious question: are you sure you're re-signing the correct input file, and writing to the correct output? For your second signature, you'd need to sign document-signed.pdf, and also take care to write the output to a different file (e.g. document-signed-2.pdf). Unless you have the file open in rb+ mode and tell pyHanko to sign in-place, but that works a little differently.

[Vishwamithra37]

OOOOOOOOOOOOOO
Now I feel like a fking idiot. :) Thanks for the help. IT works!

[MatthiasValvekens]

No worries, happens to the best of us ;)