Signature invisible in Adobe Reader but visible in other viewers

[rfabbri]

Describe the bug
When I create a visible signature, I can see it in Preview and Skim, but not o Adobe Reader.
The visible signature display should be about halfway down, centralized in the page.

To Reproduce

pyhanko sign addsig  --field 1/500,530,100,485/Signature1 pkcs12 in.pdf out.pdf cert.pfx

Open in Skim and Preview, the signature is visible, but Acrobat Reader does not display it.

Expected behavior
I expect all PDF viewers to display the visible part of the signature.
The pyhanko signature validates digitally, but it might pose bureaucratic impediments if the officer cannot see any visual mark.

Environment (please complete the following information):

• OS: Mac OS 12.6.6 Monterey
• Adobe Reader 2024.001.20615

[MatthiasValvekens]

Hi, this kind of problem is unfortunately impossible to diagnose without a copy of the specific input document that's giving you issues. Can you provide one?

I'm also assuming that the actual configuration you're using to populate the visible field is somewhere in your configuration file, can you share that as well?

[Salamek]

I have encountered this behavior when AcroForm ->NeedAppearances is present and set to 'true', when document is not signed PDF acrobat reader displays signature field ok, but when i sign it using pyhanko, NeedAppereances is copied over with signature to this block:

<ORIGINAL_PDF>
%%EOF
2 0 obj
<<
/Producer (WeasyPrint 61\0562\073 pyHanko 0\05623\0561)
/ModDate (D\07220240408220437\05302\04700\047)
>>
endobj
3 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/AcroForm <<
/Fields [ 7 0 R ]
/DR 4 0 R
/NeedAppearances true
/SigFlags 3
>>
<REST_OF_SIGNATURE>

And signature field become invisible, it also disappear from list of signatures... (So PDF in PDF acrobat reader looks like unsigned)

All other PDF readers are fine, just PDF acrobat reader is doing this..., when i remove NeedAppearances or set it to false in unsigned PDF and sign it using pyhanko all is well in PDF acrobat reader...

From my testing it looks like /NeedAppearances true carried over to signature block is the issue?

I'm also attaching my testing PDFs:

• signed-61.2-need-app-false.pdf: Signed PDF where NeedAppearances was set to 'false' before signing (Work ok in PDF acrobat reader)
• signed-61.2-need-app-removed.pdf: Signed PDF where NeedAppearances was removed before signing (Work ok in PDF acrobat reader)
• signed-61.2-uncompressed.pdf: Signed PDF where NeedAppearances was set to 'true' (default behavior of my PDF * generator) this is broken in PDF acrobat reader
• unsigned-61.2-uncompressed.pdf: Unsigned PDF where NeedAppearances was set to 'true' (default behavior of my PDF generator) this is displayed correctly in PDF acrobat reader
• unsigned-54.2.pdf: Unsigned PDF where NeedAppearances is missing (Work ok in PDF acrobat reader)
• signed-54.2.pdf: Signed PDF where NeedAppearances is missing (Work ok in PDF acrobat reader)
• signed-61.2-uncompressed-app-removed-from-sig.pdf: Signed PDF where NeedAppearances was manually removed from signature block, signature is displayed correctly in PDF acrobat reader but PDF is corrupted (i did simple delete in text editor)

signed-61.2-need-app-false.pdf
signed-61.2-need-app-removed.pdf
signed-61.2-uncompressed.pdf
unsigned-61.2-uncompressed.pdf
unsigned-54.2.pdf
signed-54.2.pdf
signed-61.2-uncompressed-app-removed-from-sig.pdf

54.2 means PDF generated using Weasyprint 54.2
61.2 means PDF generated using Weasyprint 61.2
(I was dissecting missing signatures in PDF acrobat reader after weasyprint update)

[MatthiasValvekens]

Huh, interesting. If NeedAppearances is the culprit, that kind of tracks. It's deprecated in PDF 2.0 and probably ignored by all non-Acrobat processors anyhow. The PDF 2.0 requirement is that all fields need to supply appearance streams, so NeedAppearances is pretty much obsolete.

Nonetheless, I would assume that NeedAppearances only kicks in on fields that don't already have an appearance stream... The fact that that's not what you observe is indeed strange.

If systematically removing NeedAppearances solves the problem, I'm happy to do that (or perhaps hiding it behind a toggle). I don't really have the energy to hunt down all the quirks of Acrobat these days :)

[Salamek]

Hmm i'm going to check if AP is set for signature field...

[Salamek]

Ok affected field does have AP specified...

[Salamek]

@MatthiasValvekens i think that not passing NeedAppearances to signature block after EOF as a option should do the trick (not sure what should be the default behavior tho, up to you)

[MatthiasValvekens]

Thanks for that analysis. I think removing NeedAppearances by default is probably a sane thing to do. I plan to cut a release later this month, this can probably be squeezed in.