search

MatthiasValvekens / pyHanko

pyHanko: sign and stamp PDF files
MIT License
457 stars 68 forks source link

Signature invisible in Adobe Reader but visible in other viewers #416

Open rfabbri opened 3 months ago

rfabbri commented 3 months ago

Describe the bug When I create a visible signature, I can see it in Preview and Skim, but not o Adobe Reader. The visible signature display should be about halfway down, centralized in the page.

To Reproduce

pyhanko sign addsig  --field 1/500,530,100,485/Signature1 pkcs12 in.pdf out.pdf cert.pfx

Open in Skim and Preview, the signature is visible, but Acrobat Reader does not display it.

Expected behavior I expect all PDF viewers to display the visible part of the signature. The pyhanko signature validates digitally, but it might pose bureaucratic impediments if the officer cannot see any visual mark.

Environment (please complete the following information):

MatthiasValvekens commented 3 months ago

Hi, this kind of problem is unfortunately impossible to diagnose without a copy of the specific input document that's giving you issues. Can you provide one?

I'm also assuming that the actual configuration you're using to populate the visible field is somewhere in your configuration file, can you share that as well?

Salamek commented 3 months ago

I have encountered this behavior when AcroForm ->NeedAppearances is present and set to 'true', when document is not signed PDF acrobat reader displays signature field ok, but when i sign it using pyhanko, NeedAppereances is copied over with signature to this block:

<ORIGINAL_PDF>
%%EOF
2 0 obj
<<
/Producer (WeasyPrint 61\0562\073 pyHanko 0\05623\0561)
/ModDate (D\07220240408220437\05302\04700\047)
>>
endobj
3 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/AcroForm <<
/Fields [ 7 0 R ]
/DR 4 0 R
/NeedAppearances true
/SigFlags 3
>>
<REST_OF_SIGNATURE>

And signature field become invisible, it also disappear from list of signatures... (So PDF in PDF acrobat reader looks like unsigned)

All other PDF readers are fine, just PDF acrobat reader is doing this..., when i remove NeedAppearances or set it to false in unsigned PDF and sign it using pyhanko all is well in PDF acrobat reader...

From my testing it looks like /NeedAppearances true carried over to signature block is the issue?

I'm also attaching my testing PDFs:

signed-61.2-need-app-false.pdf signed-61.2-need-app-removed.pdf signed-61.2-uncompressed.pdf unsigned-61.2-uncompressed.pdf unsigned-54.2.pdf signed-54.2.pdf signed-61.2-uncompressed-app-removed-from-sig.pdf

54.2 means PDF generated using Weasyprint 54.2 61.2 means PDF generated using Weasyprint 61.2 (I was dissecting missing signatures in PDF acrobat reader after weasyprint update)

MatthiasValvekens commented 3 months ago

Huh, interesting. If NeedAppearances is the culprit, that kind of tracks. It's deprecated in PDF 2.0 and probably ignored by all non-Acrobat processors anyhow. The PDF 2.0 requirement is that all fields need to supply appearance streams, so NeedAppearances is pretty much obsolete.

Nonetheless, I would assume that NeedAppearances only kicks in on fields that don't already have an appearance stream... The fact that that's not what you observe is indeed strange.

If systematically removing NeedAppearances solves the problem, I'm happy to do that (or perhaps hiding it behind a toggle). I don't really have the energy to hunt down all the quirks of Acrobat these days :)

Salamek commented 3 months ago

Hmm i'm going to check if AP is set for signature field...

Salamek commented 3 months ago

Ok affected field does have AP specified...

Salamek commented 2 months ago

@MatthiasValvekens i think that not passing NeedAppearances to signature block after EOF as a option should do the trick (not sure what should be the default behavior tho, up to you)

MatthiasValvekens commented 2 months ago

Thanks for that analysis. I think removing NeedAppearances by default is probably a sane thing to do. I plan to cut a release later this month, this can probably be squeezed in.