+ +

Apache™ FOP: PDF/A (ISO 19005)¶

Overview¶

PDF/A is a standard which turns PDF into an "electronic document file format for long-term preservation". PDF/A-1 is the first part of the standard and is documented in ISO 19005-1:2005(E). Work on PDF/A-2 is in progress at AIIM.

Design documentation on PDF/A can be found on FOP's Wiki on the PDFAConformanceNotes page.

Implementation Status¶

PDF/A-1b is implemented to the degree that FOP supports the creation of the elements described in ISO 19005-1.

Tests have been performed against jHove and Adobe Acrobat 7.0.7 (Preflight function). FOP does not validate completely against Apago's PDF Appraiser. Reasons unknown due to lack of a full license to get a detailed error protocol.

PDF/A-1a is based on PDF-A-1b and adds accessibility features (such as Tagged PDF). This format is available within the limitation described on the Accessibility page.

PDF/A-2 supports new features added with PDF 1.5, 1.6 and 1.7

PDF/A-3 allows embedding of arbitrary file formats

PDF/A-1b, PDF/A-2b and PDF/A-3b does not require accessibility to be enabled

PDF/A-1a, PDF/A-2a and PDF/A-3a require accessibility to be enabled

PDF/A-2u and PDF/A-3u require unicode to be used and accessibility to be enabled

Modes¶

PDF/A-1a
PDF/A-1b
PDF/A-2a
PDF/A-2b
PDF/A-2u
PDF/A-3a
PDF/A-3b
PDF/A-3u

Usage (fop.xconf)¶

Add section to pdf renderer with pdfa mode and pdf version.

<fop version="1.0">
+  <accessibility>true</accessibility>
+  <renderers>
+    <renderer mime="application/pdf">
+      <pdf-a-mode>PDF/A-1a</pdf-a-mode>
+      <version>1.4</version>
+    </renderer>
+  </renderers>
+</fop>
+

+ + +

Usage (command line)¶

To activate PDF/A-1b from the command-line, specify "-pdfprofile PDF/A-1b" as a parameter. If there is a violation of one of the validation rules for PDF/A, an error message is presented and the processing stops.

PDF/A-1a is enabled by specifying "-pdfprofile PDF/A-1a".

Usage (embedded)¶

When FOP is embedded in another Java application you can set a special option on the renderer options in the user agent to activate the PDF/A-1b profile. Here's an example:

userAgent.getRendererOptions().put("pdf-a-mode", "PDF/A-1b");
+Fop fop = fopFactory.newFop(MimeConstants.MIME_PDF, userAgent);
+[..]
+

+ + +

If one of the validation rules of PDF/A is violated, an PDFConformanceException (descendant of RuntimeException) is thrown.

For PDF/A-1a, just use the string "PDF/A-1a" instead of "PDF/A-1b".

PDF/A in Action¶

There are a number of things that must be looked after if you activate a PDF/A profile. If you receive a PDFConformanceException, have a look at the following list (not necessarily comprehensive):

+
Make sure all (!) fonts are embedded. If you use base 14 fonts (like Helvetica) you need to obtain a license for them and embed them like any other font.
+
+
Don't use PDF encryption. PDF/A doesn't allow it.
+
+
Don't use CMYK images without an ICC color profile. PDF/A doesn't allow mixing color spaces and FOP currently only properly supports the sRGB color space. Please note that FOP embeds a standard sRGB ICC profile (sRGB IEC61966-2.1) as the primary output intent for the PDF if no other output intent has been specified in the configuration.
+
+
Don't use non-RGB colors in SVG images. Same issue as with CMYK images.
+
+
Don't use EPS graphics with fo:external-graphic. Embedding EPS graphics in PDF is deprecated since PDF 1.4 and prohibited by PDF/A.
+
+
PDF is forced to version 1.4 if PDF/A-1 is activated.
+
+
No filter must be specified explicitely for metadata objects. Metadata must be embedded in clear text so non-PDF-aware applications can extract the XMP metadata.
+

There are additional requirements if you want to enabled PDF/A-1a (Tagged PDF). This is particularly the specification of the natural language and alternative descriptions for images. Please refer to the Accessibility page for details.

PDF profile compatibility¶

The PDF profiles "PDF/X-3:2003" and "PDF/A-1b" (or "PDF/A-1a") are compatible and can both be activated at the same time.

Interoperability¶

There has been some confusion about the namespace for the PDF/A indicator in the XMP metadata. At least three variants have been seen in the wild:

+ + + + + + + + + + + + + +

http://www.aiim.org/pdfa/ns/id.html	obsolete, from an early draft of ISO-19005-1, used by Adobe Acrobat 7.x
http://www.aiim.org/pdfa/ns/id/	correct, found in the technical corrigendum 1 of ISO 19005-1:2005

If you get an error validating a PDF/A file in Adobe Acrobat 7.x it doesn't mean that FOP did something wrong. It's Acrobat that is at fault. This is fixed in Adobe Acrobat 8.x which uses the correct namespace as described in the technical corrigendum 1.

Metadata example¶

See this page for more info

[..]
+</fo:layout-master-set>
+<fo:declarations>
+  <x:xmpmeta xmlns:x="adobe:ns:meta/">
+    <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+      <rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/">
+        <dc:title><rdf:Alt><rdf:li xml:lang="x-default">title</rdf:li></rdf:Alt></dc:title>
+        <dc:creator><rdf:Seq><rdf:li>Document author</rdf:li></rdf:Seq></dc:creator>
+        <dc:description><rdf:Alt><rdf:li xml:lang="x-default">Document subject</rdf:li></rdf:Alt></dc:description>
+      </rdf:Description>
+    </rdf:RDF>
+  </x:xmpmeta>
+</fo:declarations>
+

+ +

Apache™ FOP: PDF encryption.¶

Overview¶

Apache™ FOP supports encryption of PDF output, thanks to Patrick C. Lankswert and others. This feature is commonly used to prevent unauthorized viewing, printing, editing, copying text from the document and doing annotations. It is also possible to ask the user for a password in order to view the contents. Note that there already exist third party applications which can decrypt an encrypted PDF without effort and allow the aforementioned operations, therefore the degree of protection is limited.

For further information about features and restrictions regarding PDF encryption, look at the documentation coming with Adobe Acrobat or the technical documentation on the Adobe web site.

Usage (fop.xconf)¶

<renderer mime="application/pdf">
+    <encryption-params>
+        <user-password>testuserpass</user-password>
+        <owner-password>testownerpass</owner-password>
+        <noprint/>
+        <nocopy/>
+        <noedit/>
+        <noannotations/>
+        <encryption-length>128</encryption-length>
+        <encrypt-metadata>false</encrypt-metadata>
+    </encryption-params>
+</renderer>
+

+ + +

Usage (command line)¶

Encryption is enabled by supplying any of the encryption related options.

An owner password is set with the -o option. This password is actually used as encryption key. Many tools for PDF processing ask for this password to disregard any restriction imposed on the PDF document.

If no owner password has been supplied but FOP was asked to apply some restrictions, a random password is used. In this case it is obviously impossiible to disregard restrictions in PDF processing tools.

A user password, supplied with the -u option, will cause the PDF display software to ask the reader for this password in order to view the contents of the document. If no user password was supplied, viewing the content is not restricted.

Further restrictions can be imposed by using the following command-line options:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Option	Description
`-noprint`	disable printing
`-nocopy`	disable copy/paste of content
`-noedit`	disable editing in Adobe Acrobat
`-noannotations`	disable editing of annotations
`-nofillinforms`	disable filling in forms
`-noaccesscontent`	disable text and graphics extraction for accessibility purposes
`-noassembledoc`	disable assembling documents
`-noprinthq`	disable high quality printing

Usage (embedded)¶

When FOP is embedded in another Java application you need to set an options map on the renderer. These are the supported options:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Option	Description	Values	Default
encryption-length	The encryption length in bit	Any multiple of 8 between 40 and 128, or 256	128
ownerPassword	The owner password	String
userPassword	The user password	String
allowPrint	Allows/disallows printing of the PDF	"TRUE" or "FALSE"	"TRUE"
allowCopyContent	Allows/disallows copy/paste of content	"TRUE" or "FALSE"	"TRUE"
allowEditContent	Allows/disallows editing in Adobe Acrobat	"TRUE" or "FALSE"	"TRUE"
allowEditAnnotations	Allows/disallows editing of annotations	"TRUE" or "FALSE"	"TRUE"
allowFillInForms	Allows/disallows filling in forms	"TRUE" or "FALSE"	"TRUE"
allowAccessContent	Allows/disallows text and graphics extraction for accessibility purposes	"TRUE" or "FALSE"	"TRUE"
allowAssembleDocument	Allows/disallows assembling document	"TRUE" or "FALSE"	"TRUE"
allowPrintHq	Allows/disallows high quality printing	"TRUE" or "FALSE"	"TRUE"
encrypt-metadata	Whether to encrypt the Metadata stream	"TRUE" or "FALSE"	"TRUE"

Encryption is enabled as soon as one of these options is set.

An example to enable PDF encryption in Java code:

import org.apache.fop.pdf.PDFEncryptionParams;
+
+[..]
+
+FOUserAgent userAgent = fopFactory.newFOUserAgent();
+userAgent.getRendererOptions().put("encryption-params", new PDFEncryptionParams(
+    null, "password", false, false, true, true, true));
+Fop fop = fopFactory.newFop(MimeConstants.MIME_PDF, userAgent);
+[..]
+

+ + +

The parameters for the constructor of PDFEncryptionParams are:

+
userPassword: String, may be null
+
+
ownerPassword: String, may be null
+
+
allowPrint: true if printing is allowed
+
+
allowCopyContent: true if copying content is allowed
+
+
allowEditContent: true if editing content is allowed
+
+
allowEditAnnotations: true if editing annotations is allowed
+
+
allowFillInForms: true if filling in forms is allowed.
+
+
allowAccessContent: true if extracting text and graphics is allowed
+
+
allowAssembleDocument: true if assembling document is allowed
+
+
allowPrintHq: true if printing to high quality is allowed
+
+
encryptMetadata: true if the Metadata stream should be encrypted
+

Alternatively, you can set each value separately in the Map provided by FOUserAgent.getRendererOptions() by using the following keys:

+
user-password: String
+
+
owner-password: String
+
+
noprint: Boolean or "true"/"false"
+
+
nocopy: Boolean or "true"/"false"
+
+
noedit: Boolean or "true"/"false"
+
+
noannotations: Boolean or "true"/"false"
+
+
nofillinforms: Boolean or "true"/"false"
+
+
noaccesscontent: Boolean or "true"/"false"
+
+
noassembledoc: Boolean or "true"/"false"
+
+
noprinthq: Boolean or "true"/"false"
+
+
encrypt-metadata: Boolean or "true"/"false"
+

The password length is restricted to a maximum of 32 bytes if the encryption-length is 128 or less, and to a maximum of 127 bytes if the encryption-length is 256 (longer passwords will be truncated to the maximum allowed).

Environment¶

The PDF encryption implemented in FOP does not need external libraries to perform encryption. A recent JDK (1.5+) is sufficient. However, encryption using keys with 256 bits requires the installation of the JCE Unlimited Strength Jurisdiction Policy files from Oracle.

Apache™ FOP¶

Resources¶

Project¶

Versions¶

FOP Trunk (dev)¶

Using Apache™ FOP¶

Features¶

FOP 2.2¶

Using Apache FOP 2.2¶

Features¶

FOP 2.1¶

Using Apache FOP 2.1¶

Features¶

FOP 2.0¶

Using Apache FOP 2.0¶

Features¶

FOP 1.1¶

Using Apache FOP 1.1¶

Features¶

FOP 1.0¶

Using Apache FOP 1.0¶

Features¶

FOP Development¶

Design¶

Core Process¶

Miscellaneous¶

Develop¶

Test¶

Deploy¶

Resources¶

SubPackages¶

Apache™ XML Graphics¶

Project Overview¶

Sub Projects¶

Search Apache XML Graphics¶

ApacheCon N. America¶

ApacheCon Europe¶

The Apache™ FOP Project

Apache™ FOP: PDF/A (ISO 19005)¶

Overview¶

Implementation Status¶

Modes¶

Usage (fop.xconf)¶

Usage (command line)¶

Usage (embedded)¶

PDF/A in Action¶

PDF profile compatibility¶

Interoperability¶

Metadata example¶

Apache™ FOP¶

Resources¶

Project¶

Versions¶

FOP Trunk (dev)¶

Using Apache™ FOP¶

Features¶

FOP 2.2¶

Using Apache FOP 2.2¶

Features¶

FOP 2.1¶

Using Apache FOP 2.1¶

Features¶

FOP 2.0¶

Using Apache FOP 2.0¶

Features¶

FOP 1.1¶

Using Apache FOP 1.1¶

Features¶

FOP 1.0¶

Using Apache FOP 1.0¶

Features¶

FOP Development¶

Design¶

Core Process¶

Miscellaneous¶

Develop¶

Test¶

Deploy¶

Resources¶

SubPackages¶