pdfbox-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tilman Hausherr (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (PDFBOX-3017) Improve document signing
Date Sat, 13 Oct 2018 09:40:00 GMT

    [ https://issues.apache.org/jira/browse/PDFBOX-3017?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16648851#comment-16648851
] 

Tilman Hausherr commented on PDFBOX-3017:
-----------------------------------------

I added the certificate chain verification code from Apache CXF. It is from
https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.9/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/

and it was removed in 2011 in
https://svn.apache.org/viewvc?view=revision&revision=1189820
because they no longer needed it. I couldn't find the discussion on their dev@ mailing list,
but it is possible that they didn't mention it specifically.

That code is quite popular, I found it mentioned a few times on stackoverflow and also here
http://www.nakov.com/blog/2009/12/01/x509-certificate-validation-in-java-build-and-verify-chain-and-verify-clr-with-bouncy-castle/
without Apache header (but maybe this was the original author).

> Improve document signing
> ------------------------
>
>                 Key: PDFBOX-3017
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-3017
>             Project: PDFBox
>          Issue Type: Improvement
>          Components: AcroForm, Signing
>    Affects Versions: 2.0.0, 3.0.0 PDFBox
>            Reporter: Tilman Hausherr
>            Priority: Major
>             Fix For: 3.0.0 PDFBox
>
>         Attachments: PDFBOX-3017_certificate_chain.diff, PDFBOX-3017_certificate_chain_Screenshot.png,
pdfa_signed_insivible.pdf
>
>
> Improve signing code:
> - incremental save only works for signatures and doesn't respect certificates such as
Adobe Extended Usage Rights
> - -{{prepareNonVisualSignature}} clears the AcroForm DR {{acroForm.setDefaultResources(null)}}
which is not good if there are other form fields-
> - visual/nonVisualSignature should move into the {{interactive.forms}} package and be
handled within the signature field
> - -verify signature (to have tests that go full circle)- done June 2016
> - document or refactor / rewrite visible labyrinthine signature code
> - why is it not possible to pass only the signatureField to addSignature, instead having
to create a COSDocument with a page and annotations that has the signature field, and that
must be searched for in {{prepareVisibleSignature()}}?
> - support rotated pages (see https://stackoverflow.com/questions/34012293/pdfbox-sign-landscape-file-error/34359956#34359956
)
> - -make sure that signed PDF/A files are still PDF/A (see http://www.pdfa.org/wp-content/uploads/2011/08/tn0006_digital_signatures_in_pdfa-1_2008-03-14.pdf
); /ID possibly not OK; /Annots is possibly required ([~tilman] removed this for invisible
signatures); test signed files with PDF-Tools and with preflight- tested, they are OK with
PDF-Tools and preflight
> - test whether "bad" signatures are detected by preflight (search in old issues)
> - -PDFBOX-3363 - why is the stream cached in a file? Should it be done in memory?- done
on July 15, 2016
> - remove {{setVisualSignature(PDVisibleSigProperties visSignatureProperties)}} from SignatureOptions.java,
all it does is to call {{visSignatureProperties.getVisibleSignature()}} which returns an {{InputStream}},
and this is already available
> - {{checkSignatureField}} violates the "do one thing" rule
> - decide whether the whole certificate chain should be passed in the sample code, instead
of only the first one
> - check certificate chain, revocation lists, etc, only if needed by users, code [here|https://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.1/distribution/src/main/release/samples/sts_issue_operation/src/main/java/demo/sts/provider/cert/]
> - deprecate / remove all PDVisibleSignDesigner constructors except those with a PDDocument
object, to avoid a file being opened twice
> - ... your ideas...



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org


Mime
View raw message