[jira] [Commented] (PDFBOX-5139) Signing PDF with empty fields multiple times breaks signature

["Tilman Hausherr (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PDFBOX-5139?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17307997#comment-17307997 ] 

Tilman Hausherr commented on PDFBOX-5139:
-----------------------------------------

I tried only 1.5 and signed with CreateSignature which is kindof minimal. First signature brings problem when using SigUtils.setMDPPermission() ?! When not using it, it worked. But then second signature brings the problem. I looked into the result file and have no clue what Adobe considers "changed". I even tried a modified PDFBox version that doesn't update the catalog and had the same result.

But what is this in the trailer?
{code:java}
<</DecodeParms<</Columns 4/Predictor 12>>/Info 11 0 R /Root 4 0 R /Type/XRef/Size 24
{code}
/XRef is for crossreference streams but that isn't one. You have a "Cross-Reference Table".

I "whitened" that part to
{noformat}
<< /Info 11 0 R /Root 4 0 R
{noformat}
but it still didn't work. But who knows what else is wrong?

> Signing PDF with empty fields multiple times breaks signature
> -------------------------------------------------------------
>
>                 Key: PDFBOX-5139
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-5139
>             Project: PDFBox
>          Issue Type: Bug
>    Affects Versions: 2.0.23
>            Reporter: Fabricio
>            Priority: Major
>         Attachments: 1.4.pdf, 1.4.signed.signed.pdf, 1.5.itext.signed.signed.pdf, 1.5.pdf, 1.5.signed.signed.pdf, 1.6.pdf, 1.6.signed.signed.pdf, 1.7.itext.signed.signed.pdf, 1.7.pdf, 1.7.signed.signed.pdf
>
>
> Hi!
> I apologize if there is already a similar report.
> We have a PDF document with multiple empty signature fields. We are currently preparing the document and adding the fields with the javascript library PSPDFKit.
> Our signature implementation with PDFBOX is based on [https://apache.googlesource.com/pdfbox/+/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/CreateVisibleSignature2.java]
> When signing the document more than one time, the first signature is invalidated for some PDF Spec versions. We tried adding the new signatures in the existing fields, and in new ones, but the results is the same.
> The multiple signature works well with PDF versions 1.4 and 1.6. It does not work with versions 1.5 and 1.7. The first signature is invalidated by the second one.
> Initially, I had the doubt if this problem was related to PSDPFKit or PDF-Box. While investigating, we tried to sign the 1.5 spec version document multiple times using iText and it worked ok.
> I'm attaching 10 pdfs:
>  * For each spec version, one PDF with the empty signature fields, and another one with 2 signatures made by Apache PDF-Box.
>  * Specs 1.5 and 1.7 signed 2 times by itext.
> Thank you for your help.
> Fabricio
> Edit 1: We are not using the certify functionality (SigUtils.setMDPPermission).
>  



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org