Signatures

Signatures

Validate digital signature integrity (certificate path, digest, revocation via CRL/OCSP) and remove signatures.

Command line

pdfcpu2 signatures validate in.pdf
pdfcpu2 signatures validate --all in.pdf     # certified, approval, usage rights, timestamps
pdfcpu2 signatures validate --full in.pdf    # chains, revocation status, problems
pdfcpu2 signatures remove in.pdf out.pdf
cat signed.pdf | pdfcpu2 signatures validate -

Related configuration parameters (see Configuration): timeoutCRL, timeoutOCSP, preferredCertRevocationChecker. Trusted certificates come from the certificate store — see Certificates.

Go API

package main

import (
	"context"
	"fmt"

	"github.com/huzpsb/pdfcpu2/pkg/api"
	"github.com/huzpsb/pdfcpu2/pkg/pdfcpu/model"
)

func main() {
	ctx := context.Background()
	conf := model.NewDefaultConfiguration()

	// Human-readable report lines
	ss, err := api.ValidateSignaturesFile(ctx, "signed.pdf", false, false, conf)
	if err != nil {
		panic(err)
	}
	for _, s := range ss {
		fmt.Println(s)
	}

	// Structured results for programmatic evaluation
	results, err := api.ValidateSignatures(ctx, "signed.pdf", true, conf)
	if err != nil {
		panic(err)
	}
	for _, r := range results {
		fmt.Println(r.Signer.Name, r.SignatureValid)
	}

	// Strip signatures
	err = api.RemoveSignaturesFile(ctx, "signed.pdf", "unsigned.pdf", conf)
	_ = err
}

merge and optimize invalidate signatures by rewriting files — both offer --rmsig to strip them explicitly; see Merge / Optimize.