Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by woojoo666 | Hacker News Reader

Full thread

woojoo666·

I still haven't found a FOSS tool capable of signing pdfs (like docusign)

View on HN

PDFBox can do this but to have to build the CLI tool yourself from this example:

https://github.com/apache/pdfbox/blob/5b00807463279f1002e245...

Everything about PDF signatures is maddeningly complex.

If you're looking for a GUI, the Okular document viewer (by KDE) can sign them just fine, as can LibreOffice (but I don't like how it handles key storage on Linux). For something much more powerful (where you can tweak every possible signature parameter), take a look at jsignpdf - the UI isn't exactly friendly, but it works more reliably than anything else and I've never seen a reader that didn't accept its signature (Adobe Reader likes to sometimes ignore signatures from other tools for no good reason, but never jsignpdf).

As for libraries, you can use jsignpdf from the CLI, PyHanko for Python and probably even more that I don't know.

Also a simple tool to check signatures, if they are valid etc.

BTW pdfsig from the poppler tools is mentioned in the list of tools.

Okular has recently gotten improved support for verifying cryptographic signatures in PDF files.

https://tsdgeos.blogspot.com/2022/03/okular-signature-suppor...

Verifying digital signatures is quite hard. Yeah, checking whether the stored hash is valid is simple but all the other things are hard, for example, whether the additions done to a signed PDF are actually allowed or not.

Or whether the signature is correct in all the small details, e.g. used algorithm, the included information.

And then it sometimes depends on the environment. For example, sometimes a digital signature is only considered valid if all the revocation information and all the certificates are included in the PDF.

not foss, but foxit reader on linux supports signatures

Reply on news.ycombinator.com