Keyfactor / signserver-ce

SignServer – Open source, PKI-based signing software to sign code, documents, timestamps and more.
https://www.signserver.org
GNU Lesser General Public License v2.1
304 stars 32 forks source link

Recommended way of integrating client-side hashing for signing PDFs #88

Open ralienpp opened 2 months ago

ralienpp commented 2 months ago

I'd like to use the client-side hashing feature for signing PDFs (currently this is only achievable by sending the entire file to the server).

What would be the criteria for integrating a pull request that provides this functionality? Specifically, what kind of external dependencies would be acceptable?

For example, there is this library that has signing functionality, which could hypothetically be used to do the client-side part of forming the data to be signed, and then taking care of embedding the signature into the PDF. While this could make signclient more versatile, it would also begin to turn it into a "kitchen sink".

What would be the recommended way of adding this functionality, but without having to invent a PDF parser from scratch? Is it possible to rely on this external dependency as an optional feature?