[jira] [Created] (PDFBOX-5139) Signing PDF with empty fields multiple times breaks signature

["Fabricio (Jira)" <ji...@apache.org>]

Fabricio created PDFBOX-5139:
--------------------------------

             Summary: Signing PDF with empty fields multiple times breaks signature
                 Key: PDFBOX-5139
                 URL: https://issues.apache.org/jira/browse/PDFBOX-5139
             Project: PDFBox
          Issue Type: Bug
    Affects Versions: 2.0.23
            Reporter: Fabricio
         Attachments: 1.4.pdf, 1.4.signed.signed.pdf, 1.5.itext.signed.signed.pdf, 1.5.pdf, 1.5.signed.signed.pdf, 1.6.pdf, 1.6.signed.signed.pdf, 1.7.itext.signed.signed.pdf, 1.7.pdf, 1.7.signed.signed.pdf

Hi!

I apologize if there is already a similar report.


We have a PDF document with multiple empty signature fields. We are currently preparing the document and adding the fields with the javascript library PSPDFKit.


Our signature implementation with PDFBOX is based on https://apache.googlesource.com/pdfbox/+/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature2.java

 

When signing the document more than one time, the first signature is invalidated for some PDF Spec versions. We tried adding the new signatures in the existing fields, and in new ones, but the results is the same.

The multiple signature works well with PDF versions 1.4 and 1.6. It does not work with versions 1.5 and 1.7. The first signature is invalidated by the second one.


Initially, i had the doubt if this problem was related to PSDPFKit or PDF-Box. While investigating, we tried to sign the 1.5 spec version document multiple times using iText and it worked ok.

I'm attaching 10 pdfs:
 * For each spec version, one PDF with the empty signature fields, and another one with 2 signatures made by Apache PDF-Box. 
 * Specs 1.5 and 1.7 signed 2 times by itext.

Thank you for your help.


Fabricio



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org