PDF Digital Signature

[FrankIT60]

it would be nice to have this feature too. I think it would make the product even better.
Thank you so much for this tool
:-)

[hhrutter]

Agreed.
Thank you for using pdfcpu 💚

[philhug]

I'm working on this.
Trying to add PAdES Long Term validation profile.

[hhrutter]

I have not had the time to look at this topic in detail
but the way I see it first we should get a pdfcpu sign abc.pdfcommand
going in the simplest way possible.

Once we have that, we can add support for various standards.

Having the right plan for this is key and ensures we do not have to throw away
a first cut implementation.

[philhug]

The basic signature works the same for all standards, so I'll start with this.
I'll add an API first, as signing is not trivial from the CLI, because you might need to connect to a signing service or have access to various kind of key material format.

Basic process looks like this:

• Add all necessary information to document depending on signature standard (ideally by appending to the pdf)
• Prepare a dummy signature large enough to hold the actual signature
• Update the ByteRange to exclude the signature itself
• Write this to disk/temp or make sure it can be re-created bit-identical
• Create signature (using external service or local key material)
• Copy signature into document without modifing anything else, leaving the unusued parts of the signature fields as zeros
• Write out signed pdf

So this two-stage process is the tricky part and can be re-used for all types of signatures.

[hhrutter]

Hi Philipp,

I agree it makes sense to focus on the api first.

Also - without going into the details you laid out because I haven't yet read up about the involved steps - creating the signature is an important step.

if there are two ways to create the signature (local or remote) then the api has to provide for that
and If I am not wrong usually there are two ways to ship the signature - either included in the PDF or detached, so we would need to provide for that as well.

I am going to get back to you with more feedback about your bullet points and unless you want to keep all of this in your fork and you do want to contribute to pdfcpu I think we should get into a discussion about the design of this maybe on the #pdfcpu slack channel at some point - top down from the api preferably.

Thank you for using pdfcpu 💚

[FrankIT60]

Ciao, if you need a tester, I'm here 2020-06-23 12:17 GMT+02:00, Horst Rutter <notifications@github.com>:

…

Hi Philipp, I agree it makes sense to focus on the api first. Also - without going into the details you laid out because I haven't yet read up about the involved steps - creating the signature is an important step. if there are two ways to create the signature (local or remote) then the api has to provide for that and If I am not wrong usually there are two ways to ship the signature - either included in the PDF or detached, so we would need to provide for that as well. I am going to get back to you with more feedback about your bullet points and unless you want to keep all of this in your fork and you do want to contribute to pdfcpu I think we should get into a discussion about the design of this maybe on the #pdfcpu slack channel at some point - top down from the api preferably. Thank you for using pdfcpu 💚 -- You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub: #168 (comment)

[philhug]

@hhrutter I'm in the slack. you can ping me when you're online

[hhrutter]

I am also ready and online in Slack

[dotsoftcn]

https://www.adobe.com/devnet-docs/etk_deprecated/tools/DigSig/Acrobat_DigitalSignatures_in_PDF.pdf

[hhrutter]

Thank you so much for that link - Very useful!

[dotsoftcn]

https://github.com/go-pdf-sign/go-pdf-sign

Found an open source project based on pdfcpu to implement PDF Signing, Who is interested in studying, haha

[hhrutter]

Yes, I am involved with that.
It's ongoing work and based on a special branch to get going.

[philhug]

@dotsoftcn: yes, I'm working on this with @hhrutter to bring PDF signing into pdfcpu.

[beeing]

Hi @hhrutter @philhug, just wondering if this is still WIP or stale?

Thanks in advance.

[hhrutter]

I consider this work in progress.
I am planning to spend more time on this in the near future.
Definitely not stale.

[philhug]

@beeing still WIP, not ready for use yet.

[beeing]

Thanks guys for the quick response. Looking forward for testing this.

[ross-spencer]

Putting my hand-up as interested. I am not sure if identifying the existence of a signature and returning information on it would be in the first use case, but this would be invaluable. Trying to find tooling to provide information about Docusign, e.g. created through their demo site, is proving difficult. The link for generating samples may be useful for future development around this.

[hhrutter]

Hi!
Yes, checking for existing signatures and returning their content is part of it.
Thanks for the link 👍

[elucidsoft]

This is my primary feature request. For us this is the only current gap with this tool. Would be awesome if this was added.

[ross-spencer]

Some additional reference files may be found in the Govdocs selected corpus (or Govdocs). Information on those documents that are digitally signed here: https://gist.github.com/ross-spencer/ad51e6b29d8aa63440993aec07f2e307 (the list may ultimately prove not be exhaustive, but has been QA'd)

[hhrutter]

This will be implemented after form creation is completed including #124 and #42.

[mario-imperato]

Hi there, I was looking for a way to check if a document has been digitally signed. Actually the need is a check and not requires signature info extraction. Is there any feature in PDFCPU that can be used for the purpose?
Thank you
M.

[mario-imperato]

Looking at the info command I can see an information about signature existence. (SignaturesExist: Yes)
Is that information a reliable way to determine the case or does it depend on the type of signature (sorry if the question might sound naive)

............................................ Tagged: No Hybrid: No Linearized: No Using XRef streams: No Using object streams: No Watermarked: No Thumbnails: No Acroform: Yes SignaturesExist: Yes AppendOnly: Yes ............................................

Thank you
M.

[hhrutter]

Hi there!

SignaturesExist simply reflects any existing AcroForm SigFlags of a PDF.

Thank you for using pdfcpu 💚

[mario-imperato]

I see. But i guess the SigFlags is optional and in case it is not present is there a way to determine the presence of fields of field type /Sig?
I got a 1.4 PDF with some sort of biometric signature in there with a form like:

... /F 4/FT /Sig/P 10 0 R/Rect [84.405 282.733 234.405 372.733]/Subtype /Widget/T (28a7e805-833e-436c-814f-bca258260e11)/Type /Annot/V 89 0 R>>

Noticing the /Annot I tried annot list command to got as response:

`
Page 1:

Widget:
obj# rect id content
=====================================
59 ( 82, 87, 232, 177)

Page 3:

Widget:
obj# rect id content
=====================================
70 ( 84, 346, 234, 436)
81 ( 84, 283, 234, 373)
`

I think matching the /Sig fields in there..... Dunno if there is a way to check....
Thx.
M.

Note: understand that the biometric signature is something different...... didn't specify because of my knowledge 'limits'...

[hhrutter]

Again, the SigFlags AcroForm dict entry is the indicator for existing Signature fields:

Please open a separate issue for any follow up since this is getting off topic.

Thank you for using pdfcpu 💚

[G-haoyu]

Here's another example of digitally signing a pdf, but it's an invisible signature, and it doesn't support signing a pdf that has been encrypted (again, it doesn't support encrypting and signing at the same time). But I still think it might be useful for current feature development. https://github.com/digitorus/pdfsign

[VishalDalwadi]

Hi. I really need this feature. It is one of the only things that is a blocker for me. I see it is still in development on the sign branch. I would love to help develop this feature and expedite its release.

Additionally, I have a very specific requirement. I want to just embed a existing signature, instead of signing a pdf. I would love to develop out this feature.

Thanks.

[Insua]

Is it still in progress?

[hhrutter]

This is work in progress!

[giovanni-orciuolo]

What's the ETA for this feature?

[hhrutter]

I am about to cut a release, meanwhile work on digital signature handling is ongoing.
That is as much I can and will tell until the release is out.
Watch out for teasers on social media..

[lublak]

I currently use https://github.com/intoolswetrust/jsignpdf which works fine.
It also has a command line option: https://intoolswetrust.github.io/jsignpdf/docs/guide#command-line-batch-mode
Perhaps it can serve as a help. Really useful is the function to determine the position of the signature field yourself via llx, lly, urx, ury.
And for visbile signatures there is: https://sr.ht/~sbinet/gg/ (a active fork of gg)

[olekukonko]

@hhrutter well done on the implementation, do you think this will be out before the new year?

[hhrutter]

work is ongoing.

[olekukonko]

4 years in making.