Signature box is invalid when signing PDF

[ridgey-dev]

Input PDF: input.pdf

Undesired result: output.pdf

When signing the document twice (so user can see multiple signature boxes on different pages) the result is that the only the last created signature box is valid. The first one has message "Document has been altered or corrupted since it was signed.".

Note that the input.pdf contains unsigned signature boxes, and it has been made using phpunite.

Code:

$document = PDFDoc::from_string($content);
$document->sign_document($certfile);
$content = $document->to_pdf_file_s();

$document = PDFDoc::from_string($content);
$document->sign_document($certfile);
$content = $document->to_pdf_file_s();

file_put_contents('output.pdf', $content);

[ridgey-dev]

Is there already some progress on this that could be shared?

[ridgey-dev]

I don't have a fix for it. I was kinda hoping a contributor could look into it to have some insights why it's working like this for this document.

The workaround for me right now is that I create a new PDF by loading the file into QPDF. Signing the output of that won't generate an error. This is of course not very helpful for a fix in this package, but maybe it could help finding the root problem.

[dealfonso]

hi,

I am trying to get into this issue, but I do not know exactly what is the issue... are you using sapp to sign an existing signature placeholder?

[angeljqv]

I am trying to get into this issue, but I do not know exactly what is the issue... are you using sapp to sign an existing signature placeholder?

Exactly, a PDF can have one or more placeholders that indicate the position where each signature should be placed.

• On #90 you can select the placeholder, and sign it, but when you try to do the same with the second, you are modifying what was already signed on the first, and then the signature is invalidated. (#96, #89)
• If you sign without taking into account the placeholder, the PDF is also invalidated.

Also, it would be great to be able to create the placeholders with this library, it is the same format as the signed one, but without the signature, just empty.

• Duplicate of #88