Skip to content

v1.8.3 — verify-manifest: check a signed extraction offline, no account

Choose a tag to compare

View all tags
@NameetP NameetP released this 27 Jul 08:03
v1.8.3
6547dda

pdfmux verify-manifest — check a signed extraction offline, with no account.

pdfmux verify-manifest manifest.json      # free, MIT, offline — no network call

pdfmux Cloud returns an Ed25519-signed manifest over an extraction. This command verifies that signature locally, against the published public key at api.pdfmux.com/.well-known/pdfmux-manifest-pubkey — no pdfmux account, no network round-trip, no trust in us.

Verification is free and open (MIT) forever; only generation is paid. The asymmetry is deliberate: you should never need our permission to check our work.

Fixed

  • Dead link shipped in the CLI. pdfmux convert and pdfmux audit printed verifiedextraction.org, which does not resolve (NXDOMAIN). Every interactive user was handed a broken URL. Both lines now point at live surfaces.
  • The cloud pointer oversold a dashboard. It offered "a free dashboard", which is not a reason to leave your terminal. It now names the real difference: a third-party-verifiable signed attestation, which a local install definitionally cannot produce.

Fixed (previously unreleased)

  • The extraction timeout now hard-terminates a wedged extractor. PDFMUX_TIMEOUT (default 300s) raised on schedule but could still hang the caller: a ThreadPoolExecutor cannot cancel a thread that is already running, and its context-exit blocks on shutdown(wait=True) until the native call returns — for a wedged PyMuPDF / OCR / Docling page, possibly never. Extraction now runs under pdfmux._timeout.run_with_timeout: on Linux it forks a child and escalates SIGTERM→SIGKILL at the deadline, so the extractor is actually killed and its memory reclaimed. On macOS / Windows, where forking after native libraries load is unsafe, it falls back to a daemon thread so the caller is freed immediately and process exit is never blocked. Override with PDFMUX_TIMEOUT_ISOLATION (auto | process | thread | off). Still surfaces as the existing OCRTimeoutError.

Known issue

This release reports its own version as 1.8.2 (pyproject.toml was bumped, the literal in __init__.py was not). Fixed in v1.8.4 — install 1.8.4 instead.

Full notes in CHANGELOG.md. Published to PyPI: https://pypi.org/project/pdfmux/1.8.3/

Assets 2
Loading