Version 3.1.0
Packaging-focused release: the fat jar is gone and every supported platform ships a native installer with its own bundled Java runtime. Also introduces a pluggable signing-engine architecture with a new EU DSS (PAdES) engine.
- Per-platform native installers built with
jpackageand a bundled Zulu+FX 21 runtime, so no system Java is required: Windows MSI, Linux DEB and RPM, and macOS DMG, each alongside a portable ZIP. Flatpak bundles are published for Linux x64 and aarch64. - Two cross-platform ZIPs for users who already have Java 21: a
fullZIP carrying JavaFX natives for all platforms (with a Swing fallback when none match) and aminimalZIP without JavaFX for headless/CLI signing and downstream packagers. - Fat jar dropped — the shaded all-in-one jar is no longer produced; the cross-platform ZIPs use
bin/jsignpdf.shandbin\jsignpdf.cmdlaunchers instead. The library jar published to Maven Central is unchanged. - Pluggable signing engines selectable with the new
--list-enginesand-eng/--engineoptions or the Engine selector in Preferences. JSignPdf ships OpenPDF as the default engine. - New EU DSS (PAdES) engine (id
dss) producing PAdES signatures at the ETSI baseline levels B, T, LT, and LTA, which the OpenPDF engine cannot create. - Default hash algorithm is now SHA-256 (was SHA-1) for signing that relies on the implicit default. An explicit or saved
hash.algorithmis untouched, and SHA-1 stays selectable for the OpenPDF engine. - CLI signatures now append by default, matching the GUI. Use the new
--overwriteflag to replace existing signatures; the legacy--append/-aflag is kept as a no-op. - Signed Windows installers — the Windows MSI installers are Authenticode-signed via SignPath, so they install without an unknown-publisher warning. Pre-release builds ship unsigned.
- Configurable default output suffix — the
_signedmarker appended to the output file name can now be changed with the newoutput.suffixkey inadvanced.properties, so non-English users can localize it (e.g._firmado). It feeds both GUIs and the default for the CLI-os/--out-suffixoption. - Checksums for every artifact — a
jsignpdf-<version>-SHA256SUMS.txtfile now covers all published release assets.