[BUG] PDF file gets corrupted when digitally signed and encrypted

[ByZer0]

Description

UniPDF supports both digital signing of PDf files and password encryption. But it's impossible to apply both to the same file. Please note that this works fine in Adobe Acrobat, so PDF format itself allows using both methods on the same file, there is no limitation.

Expected Behavior

Single file can be both signed and encrypted.

Actual Behavior

Steps to reproduce the behavior:

1. Use PdfAppender.Sign() to apply digital signature.
2. Use PdfWriter.Encrypt() to password protect the same file.
3. Open result file in Adobe Reader (or any other reader that supports verifying signatures).
4. See that signature is invalid. For example Adobe Reader shows the following message

   There are errors in the formatiing or information contained in this signature (support information: SigDict /Contents illegal data)

Attachments

See playground here that reproduces the bug. Or download corrupted pdf.

[github-actions[bot]]

Welcome! Thanks for posting your first issue. The way things work here is that while customer issues are prioritized, other issues go into our backlog where they are assessed and fitted into the roadmap when suitable. If you need to get this done, consider buying a license which also enables you to use it in your commercial products. More information can be found on https://unidoc.io/

[gunnsth]

Hi @ByZer0 Can you clarify your use case a bit better?

Encrypting a signed file will certainly break previous revisions. In general opening a signed file and re-writing it (without the appender) will break signatures as it changes everything into one single revision and the hashes of the previous byte ranges are broken.

[ByZer0]

Thanks @gunnsth. I understand why it's broken. But the thing is that it works fine in native Adobe Acrobat. I don't know technical details how they do it, but single PDf file can be signed and encrypted.

Use case is the following.

• When digital prescription is generated it must be signed using doctor's signature. So signature is required.
• Prescription then can be sent to many people using different channels (emailed for example). But some of recipients that receive message with attached file should only have permission to read the message, and not have permission to view the attachment. That's where encryption comes into play, that allows to open file only to people who know password.

So our problem is that flow can be implemented manually creating files using Adobe Acrobat, but can't be automated using unipdf library.

[gunnsth]

@ByZer0 Can you share an example of such files? I.e. one that has been prepared before, and then signed, after? This would help us to understand what the process is and what features are used for this.

[gunnsth]

Fixed in https://github.com/unidoc/unipdf/releases/tag/v3.29.0 See also new example https://github.com/unidoc/unipdf-examples/blob/master/signatures/pdf_sign_and_encrypt_pdf.go