Fixes and support for ApprovalSignature and TimeStampSignature

.github/workflows/go.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version: ^1.20
 

README.md

@@ -14,6 +14,8 @@ This PDF signing library is written in [Go](https://go.dev). The library is in d
 
 ```
 Usage of ./pdfsign:
+  -certType string
+        Type of the certificate (CertificationSignature, ApprovalSignature, UsageRightsSignature, TimeStampSignature) (default "CertificationSignature")
   -contact string
         Contact information for signatory
   -location string
@@ -21,13 +23,15 @@ Usage of ./pdfsign:
   -name string
         Name of the signatory
   -reason string
-        Reason for signig
+        Reason for signing
   -tsa string
         URL for Time-Stamp Authority (default "https://freetsa.org/tsr")
 
 Example usage:
         ./pdfsign -name "Jon Doe" sign input.pdf output.pdf certificate.crt private_key.key [chain.crt]
-        ./pdfsignverify input.pdf
+        ./pdfsign -certType "CertificationSignature" -name "Jon Doe" sign input.pdf output.pdf certificate.crt private_key.key [chain.crt]
+        ./pdfsign -certType "TimeStampSignature" input.pdf output.pdf
+        ./pdfsign verify input.pdf
 ```
 
 ## As library

go.mod

@@ -4,9 +4,9 @@ go 1.17
 
 require (
 	github.com/digitorus/pdf v0.1.2
-	github.com/digitorus/pkcs7 v0.0.0-20230220124406-51331ccfc40f
+	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352
-	github.com/digitorus/timestamp v0.0.0-20230220124323-d542479a2425
+	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7
 	github.com/mattetti/filebuffer v1.0.1
-	golang.org/x/crypto v0.28.0
+	golang.org/x/crypto v0.29.0
-	golang.org/x/text v0.19.0
+	golang.org/x/text v0.20.0
 )

go.sum

@@ -1,10 +1,10 @@
 github.com/digitorus/pdf v0.1.2 h1:RjYEJNbiV6Kcn8QzRi6pwHuOaSieUUrg4EZo4b7KuIQ=
 github.com/digitorus/pdf v0.1.2/go.mod h1:05fDDJhPswBRM7GTfqCxNiDyeNcN0f+IobfOAl5pdXw=
-github.com/digitorus/pkcs7 v0.0.0-20221019075359-21b8b40e6bb4/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20230713084857-e76b763bdc49/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
-github.com/digitorus/pkcs7 v0.0.0-20230220124406-51331ccfc40f h1:AoHV/iJ6LjW24bRWrg0zm1xD3Uh83PlNSK0QWH11J0E=
+github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 h1:ge14PCmCvPjpMQMIAH7uKg0lrtNSOdpYsRXlwk3QbaE=
-github.com/digitorus/pkcs7 v0.0.0-20230220124406-51331ccfc40f/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
+github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
-github.com/digitorus/timestamp v0.0.0-20230220124323-d542479a2425 h1:cbnavmdMqZ3b4hcCxizSO/jO+BxyXp/hU9jyzULJ9g8=
+github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1GUYL7P0MlNa00M67axePTq+9nBSGddR8I=
-github.com/digitorus/timestamp v0.0.0-20230220124323-d542479a2425/go.mod h1:6V2ND8Yf8TOJ4h+9pmUlx8kXvNLBB2QplToVVZQ3rF0=
+github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/mattetti/filebuffer v1.0.1 h1:gG7pyfnSIZCxdoKq+cPa8T0hhYtD9NxCdI4D7PTjRLM=
 github.com/mattetti/filebuffer v1.0.1/go.mod h1:YdMURNDOttIiruleeVr6f56OrMc+MydEnTcXwtkxNVs=
@@ -14,8 +14,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -35,7 +35,7 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -46,7 +46,7 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -55,7 +55,7 @@ golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
+golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -64,8 +64,8 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

sign.go

@@ -2,40 +2,57 @@ package main
 
 import (
 	"crypto"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
 	"flag"
 	"fmt"
 	"log"
 	"os"
 	"time"
 
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"errors"
-
 	"github.com/digitorus/pdfsign/sign"
 	"github.com/digitorus/pdfsign/verify"
 )
 
 var (
 	infoName, infoLocation, infoReason, infoContact, tsa string
+	certType                                             string
 )
 
 func usage() {
 	flag.PrintDefaults()
-	fmt.Println()
+	fmt.Println("\nExample usage:")
-	fmt.Println("Example usage:")
 	fmt.Printf("\t%s -name \"Jon Doe\" sign input.pdf output.pdf certificate.crt private_key.key [chain.crt]\n", os.Args[0])
-	fmt.Printf("\t%sverify input.pdf\n", os.Args[0])
+	fmt.Printf("\t%s -certType \"CertificationSignature\" -name \"Jon Doe\" sign input.pdf output.pdf certificate.crt private_key.key [chain.crt]\n", os.Args[0])
+	fmt.Printf("\t%s -certType \"TimeStampSignature\" input.pdf output.pdf\n", os.Args[0])
+	fmt.Printf("\t%s verify input.pdf\n", os.Args[0])
 	os.Exit(1)
 }
 
+func parseCertType(s string) (sign.CertType, error) {
+	switch s {
+	case sign.CertificationSignature.String():
+		return sign.CertificationSignature, nil
+	case sign.ApprovalSignature.String():
+		return sign.ApprovalSignature, nil
+	case sign.UsageRightsSignature.String():
+		return sign.UsageRightsSignature, nil
+	case sign.TimeStampSignature.String():
+		return sign.TimeStampSignature, nil
+	default:
+		return 0, fmt.Errorf("invalid certType value")
+	}
+}
+
 func main() {
 	flag.StringVar(&infoName, "name", "", "Name of the signatory")
 	flag.StringVar(&infoLocation, "location", "", "Location of the signatory")
-	flag.StringVar(&infoReason, "reason", "", "Reason for signig")
+	flag.StringVar(&infoReason, "reason", "", "Reason for signing")
 	flag.StringVar(&infoContact, "contact", "", "Contact information for signatory")
 	flag.StringVar(&tsa, "tsa", "https://freetsa.org/tsr", "URL for Time-Stamp Authority")
+	flag.StringVar(&certType, "certType", "CertificationSignature", "Type of the certificate (CertificationSignature, ApprovalSignature, UsageRightsSignature, TimeStampSignature)")
 
 	flag.Parse()
 
@@ -53,114 +70,161 @@ func main() {
 		usage()
 	}
 
-	if method == "verify" {
+	switch method {
-		input_file, err := os.Open(input)
+	case "verify":
-		if err != nil {
+		verifyPDF(input)
-			log.Fatal(err)
+	case "sign":
-		}
+		signPDF(input)
-		defer input_file.Close()
+	}
+}
 
-		resp, err := verify.File(input_file)
+func verifyPDF(input string) {
-		if err != nil {
+	inputFile, err := os.Open(input)
-			fmt.Println(err)
+	if err != nil {
-			os.Exit(1)
+		log.Fatal(err)
-		}
+	}
-		jsonData, err := json.Marshal(resp)
+	defer inputFile.Close()
-		if err != nil {
+
-			fmt.Println(err)
+	resp, err := verify.File(inputFile)
-			os.Exit(1)
+	if err != nil {
-		}
+		fmt.Println(err)
-		fmt.Println(string(jsonData))
+		os.Exit(1)
-		return
 	}
 
-	if method == "sign" {
+	jsonData, err := json.Marshal(resp)
-		if len(flag.Args()) < 5 {
+	if err != nil {
-			usage()
+		fmt.Println(err)
-		}
+		os.Exit(1)
+	}
+	fmt.Println(string(jsonData))
+}
 
+func signPDF(input string) {
+	certTypeValue, err := parseCertType(certType)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if certTypeValue == sign.TimeStampSignature {
 		output := flag.Arg(2)
 		if len(output) == 0 {
 			usage()
 		}
+		timeStampPDF(input, output, tsa)
+		return
+	}
 
-		certificate_data, err := os.ReadFile(flag.Arg(3))
+	if len(flag.Args()) < 5 {
-		if err != nil {
+		usage()
-			log.Fatal(err)
+	}
 
-		}
+	output := flag.Arg(2)
-		certificate_data_block, _ := pem.Decode(certificate_data)
+	if len(output) == 0 {
-		if certificate_data_block == nil {
+		usage()
-			log.Fatal(errors.New("failed to parse PEM block containing the certificate"))
+	}
-		}
 
-		cert, err := x509.ParseCertificate(certificate_data_block.Bytes)
+	cert, pkey, certificateChains := loadCertificatesAndKey(flag.Arg(3), flag.Arg(4), flag.Arg(5))
-		if err != nil {
-			log.Fatal(err)
-		}
 
-		key_data, err := os.ReadFile(flag.Arg(4))
+	err = sign.SignFile(input, output, sign.SignData{
-		if err != nil {
+		Signature: sign.SignDataSignature{
-			log.Fatal(err)
+			Info: sign.SignDataSignatureInfo{
-		}
+				Name:        infoName,
-		key_data_block, _ := pem.Decode(key_data)
+				Location:    infoLocation,
-		if key_data_block == nil {
+				Reason:      infoReason,
-			log.Fatal(errors.New("failed to parse PEM block containing the private key"))
+				ContactInfo: infoContact,
-		}
+				Date:        time.Now().Local(),
-
-		pkey, err := x509.ParsePKCS1PrivateKey(key_data_block.Bytes)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		certificate_chains := make([][]*x509.Certificate, 0)
-
-		if flag.Arg(5) != "" {
-			certificate_pool := x509.NewCertPool()
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			chain_data, err := os.ReadFile(flag.Arg(5))
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			certificate_pool.AppendCertsFromPEM(chain_data)
-			certificate_chains, err = cert.Verify(x509.VerifyOptions{
-				Intermediates: certificate_pool,
-				CurrentTime:   cert.NotBefore,
-				KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
-			})
-			if err != nil {
-				log.Fatal(err)
-			}
-		}
-
-		err = sign.SignFile(input, output, sign.SignData{
-			Signature: sign.SignDataSignature{
-				Info: sign.SignDataSignatureInfo{
-					Name:        infoName,
-					Location:    infoLocation,
-					Reason:      infoReason,
-					ContactInfo: infoContact,
-					Date:        time.Now().Local(),
-				},
-				CertType:   sign.CertificationSignature,
-				DocMDPPerm: sign.AllowFillingExistingFormFieldsAndSignaturesPerms,
 			},
-			Signer:            pkey,
+			CertType:   certTypeValue,
-			DigestAlgorithm:   crypto.SHA256,
+			DocMDPPerm: sign.AllowFillingExistingFormFieldsAndSignaturesPerms,
-			Certificate:       cert,
+		},
-			CertificateChains: certificate_chains,
+		Signer:            pkey,
-			TSA: sign.TSA{
+		DigestAlgorithm:   crypto.SHA256,
-				URL: tsa,
+		Certificate:       cert,
-			},
+		CertificateChains: certificateChains,
-		})
+		TSA: sign.TSA{
-		if err != nil {
+			URL: tsa,
-			log.Println(err)
+		},
-		} else {
+	})
-			log.Println("Signed PDF written to " + output)
+	if err != nil {
-		}
+		log.Println(err)
+	} else {
+		log.Println("Signed PDF written to " + output)
+	}
+}
+
+func loadCertificatesAndKey(certPath, keyPath, chainPath string) (*x509.Certificate, crypto.Signer, [][]*x509.Certificate) {
+	certData, err := os.ReadFile(certPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	certBlock, _ := pem.Decode(certData)
+	if certBlock == nil {
+		log.Fatal(errors.New("failed to parse PEM block containing the certificate"))
+	}
+
+	cert, err := x509.ParseCertificate(certBlock.Bytes)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	keyData, err := os.ReadFile(keyPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	keyBlock, _ := pem.Decode(keyData)
+	if keyBlock == nil {
+		log.Fatal(errors.New("failed to parse PEM block containing the private key"))
+	}
+
+	pkey, err := x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	var certificateChains [][]*x509.Certificate
+	if chainPath != "" {
+		certificateChains = loadCertificateChain(chainPath, cert)
+	}
+
+	return cert, pkey, certificateChains
+}
+
+func loadCertificateChain(chainPath string, cert *x509.Certificate) [][]*x509.Certificate {
+	chainData, err := os.ReadFile(chainPath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	certificatePool := x509.NewCertPool()
+	certificatePool.AppendCertsFromPEM(chainData)
+
+	certificateChains, err := cert.Verify(x509.VerifyOptions{
+		Intermediates: certificatePool,
+		CurrentTime:   cert.NotBefore,
+		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	return certificateChains
+}
+
+func timeStampPDF(input, output, tsa string) {
+	err := sign.SignFile(input, output, sign.SignData{
+		Signature: sign.SignDataSignature{
+			CertType: sign.TimeStampSignature,
+		},
+		DigestAlgorithm: crypto.SHA256,
+		TSA: sign.TSA{
+			URL: tsa,
+		},
+	})
+	if err != nil {
+		log.Println(err)
+	} else {
+		log.Println("Signed PDF written to " + output)
 	}
 }

sign/certtype_string.go

@@ -0,0 +1,27 @@
+// Code generated by "stringer -type=CertType"; DO NOT EDIT.
+
+package sign
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[CertificationSignature-1]
+	_ = x[ApprovalSignature-2]
+	_ = x[UsageRightsSignature-3]
+	_ = x[TimeStampSignature-4]
+}
+
+const _CertType_name = "CertificationSignatureApprovalSignatureUsageRightsSignatureTimeStampSignature"
+
+var _CertType_index = [...]uint8{0, 22, 39, 59, 77}
+
+func (i CertType) String() string {
+	i -= 1
+	if i >= CertType(len(_CertType_index)-1) {
+		return "CertType(" + strconv.FormatInt(int64(i+1), 10) + ")"
+	}
+	return _CertType_name[_CertType_index[i]:_CertType_index[i+1]]
+}

sign/docmdpperm_string.go

@@ -0,0 +1,26 @@
+// Code generated by "stringer -type=DocMDPPerm"; DO NOT EDIT.
+
+package sign
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[DoNotAllowAnyChangesPerms-1]
+	_ = x[AllowFillingExistingFormFieldsAndSignaturesPerms-2]
+	_ = x[AllowFillingExistingFormFieldsAndSignaturesAndCRUDAnnotationsPerms-3]
+}
+
+const _DocMDPPerm_name = "DoNotAllowAnyChangesPermsAllowFillingExistingFormFieldsAndSignaturesPermsAllowFillingExistingFormFieldsAndSignaturesAndCRUDAnnotationsPerms"
+
+var _DocMDPPerm_index = [...]uint8{0, 25, 73, 139}
+
+func (i DocMDPPerm) String() string {
+	i -= 1
+	if i >= DocMDPPerm(len(_DocMDPPerm_index)-1) {
+		return "DocMDPPerm(" + strconv.FormatInt(int64(i+1), 10) + ")"
+	}
+	return _DocMDPPerm_name[_DocMDPPerm_index[i]:_DocMDPPerm_index[i+1]]
+}

sign/pdfbyterange.go

@@ -26,7 +26,7 @@ func (context *SignContext) updateByteRange() error {
 	// Signature ByteRange part 2 length is everything else of the file.
 	context.ByteRangeValues[3] = output_file_size - context.ByteRangeValues[2]
 
-	new_byte_range := fmt.Sprintf("/ByteRange[%d %d %d %d]", context.ByteRangeValues[0], context.ByteRangeValues[1], context.ByteRangeValues[2], context.ByteRangeValues[3])
+	new_byte_range := fmt.Sprintf("/ByteRange [%d %d %d %d]", context.ByteRangeValues[0], context.ByteRangeValues[1], context.ByteRangeValues[2], context.ByteRangeValues[3])
 
 	// Make sure our ByteRange string didn't shrink in length.
 	new_byte_range += strings.Repeat(" ", len(signatureByteRangePlaceholder)-len(new_byte_range))

sign/pdfcatalog.go

@@ -2,69 +2,112 @@ package sign
 
 import (
 	"strconv"
+	"strings"
 )
 
-func (context *SignContext) createCatalog() (catalog string, err error) {
+func (context *SignContext) createCatalog() (string, error) {
-	catalog = strconv.Itoa(int(context.CatalogData.ObjectId)) + " 0 obj\n"
+	var catalogBuilder strings.Builder
-	catalog += "<< /Type /Catalog"
-	catalog += " /Version /" + context.PDFReader.PDFVersion
 
+	// Start the catalog object
+	catalogBuilder.WriteString(strconv.Itoa(int(context.CatalogData.ObjectId)) + " 0 obj\n")
+	catalogBuilder.WriteString("<< /Type /Catalog")
+
+	// (Optional; PDF 1.4) The version of the PDF specification to which
+	// the document conforms (for example, 1.4) if later than the version
+	// specified in the file’s header (see 7.5.2, "File header"). If the header
+	// specifies a later version, or if this entry is absent, the document
+	// shall conform to the version specified in the header. This entry
+	// enables a PDF processor to update the version using an incremental
+	// update; see 7.5.6, "Incremental updates".
+	// The value of this entry shall be a name object, not a number, and
+	// therefore shall be preceded by a SOLIDUS (2Fh) character (/) when
+	// written in the PDF file (for example, /1.4).
+	//
+	// If an incremental upgrade requires a version that is higher than specified by the document.
+	// if context.PDFReader.PDFVersion < "2.0" {
+	// catalogBuilder.WriteString(" /Version /2.0")
+	// }
+
+	// Retrieve the root and check for necessary keys in one loop
 	root := context.PDFReader.Trailer().Key("Root")
-	root_keys := root.Keys()
-	found_pages := false
-	found_names := false
-	for _, key := range root_keys {
-		if key == "Pages" {
-			found_pages = true
-			break
-		}
-	}
-	for _, key := range root_keys {
-		if key == "Names" {
-			found_names = true
-			break
-		}
-	}
-
 	rootPtr := root.GetPtr()
 	context.CatalogData.RootString = strconv.Itoa(int(rootPtr.GetID())) + " " + strconv.Itoa(int(rootPtr.GetGen())) + " R"
 
-	if found_names {
+	foundPages, foundNames := false, false
-		names := root.Key("Names").GetPtr()
+	for _, key := range root.Keys() {
-		catalog += " /Names " + strconv.Itoa(int(names.GetID())) + " " + strconv.Itoa(int(names.GetGen())) + " R"
+		switch key {
+		case "Pages":
+			foundPages = true
+		case "Names":
+			foundNames = true
+		}
+		if foundPages && foundNames {
+			break
+		}
 	}
 
-	if found_pages {
+	// Add Pages and Names references if they exist
+	if foundPages {
 		pages := root.Key("Pages").GetPtr()
-		catalog += " /Pages " + strconv.Itoa(int(pages.GetID())) + " " + strconv.Itoa(int(pages.GetGen())) + " R"
+		catalogBuilder.WriteString(" /Pages " + strconv.Itoa(int(pages.GetID())) + " " + strconv.Itoa(int(pages.GetGen())) + " R")
+	}
+	if foundNames {
+		names := root.Key("Names").GetPtr()
+		catalogBuilder.WriteString(" /Names " + strconv.Itoa(int(names.GetID())) + " " + strconv.Itoa(int(names.GetGen())) + " R")
 	}
 
-	catalog += " /AcroForm <<"
+	// Start the AcroForm dictionary with /NeedAppearances
-	catalog += " /Fields [" + strconv.Itoa(int(context.VisualSignData.ObjectId)) + " 0 R]"
+	catalogBuilder.WriteString(" /AcroForm << /Fields [")
 
-	switch context.SignData.Signature.CertType {
+	// Add existing signatures to the AcroForm dictionary
-	case CertificationSignature, UsageRightsSignature:
+	for i, sig := range context.SignData.ExistingSignatures {
-		catalog += " /NeedAppearances false"
+		if i > 0 {
+			catalogBuilder.WriteString(" ")
+		}
+		catalogBuilder.WriteString(strconv.Itoa(int(sig.ObjectId)) + " 0 R")
 	}
 
+	// Add the visual signature field to the AcroForm dictionary
+	if len(context.SignData.ExistingSignatures) > 0 {
+		catalogBuilder.WriteString(" ")
+	}
+	catalogBuilder.WriteString(strconv.Itoa(int(context.VisualSignData.ObjectId)) + " 0 R")
+
+	catalogBuilder.WriteString("]") // close Fields array
+
+	catalogBuilder.WriteString(" /NeedAppearances false")
+
+	// Signature flags (Table 225)
+	//
+	// Bit position 1: SignaturesExist
+	// If set, the document contains at least one signature field. This
+	// flag allows an interactive PDF processor to enable user
+	// interface items (such as menu items or push-buttons) related to
+	// signature processing without having to scan the entire
+	// document for the presence of signature fields.
+	//
+	// Bit position 2: AppendOnly
+	// If set, the document contains signatures that may be invalidated
+	// if the PDF file is saved (written) in a way that alters its previous
+	// contents, as opposed to an incremental update. Merely updating
+	// the PDF file by appending new information to the end of the
+	// previous version is safe (see H.7, "Updating example").
+	// Interactive PDF processors may use this flag to inform a user
+	// requesting a full save that signatures will be invalidated and
+	// require explicit confirmation before continuing with the
+	// operation.
+	//
+	// Set SigFlags and Permissions based on Signature Type
 	switch context.SignData.Signature.CertType {
-	case CertificationSignature:
+	case CertificationSignature, ApprovalSignature, TimeStampSignature:
-		catalog += " /SigFlags 3"
+		catalogBuilder.WriteString(" /SigFlags 3")
 	case UsageRightsSignature:
-		catalog += " /SigFlags 1"
+		catalogBuilder.WriteString(" /SigFlags 1")
 	}
 
-	catalog += " >>"
+	// Finalize the AcroForm and Catalog object
+	catalogBuilder.WriteString(" >>")           // Close AcroForm
+	catalogBuilder.WriteString(" >>\nendobj\n") // Close catalog object
 
-	switch context.SignData.Signature.CertType {
+	return catalogBuilder.String(), nil
-	case CertificationSignature:
-		catalog += " /Perms << /DocMDP " + strconv.Itoa(int(context.SignData.ObjectId)) + " 0 R >>"
-	case UsageRightsSignature:
-		catalog += " /Perms << /UR3 " + strconv.Itoa(int(context.SignData.ObjectId)) + " 0 R >>"
-	}
-
-	catalog += " >>"
-	catalog += "\nendobj\n"
-
-	return catalog, nil
 }

sign/pdfcatalog_test.go

@@ -1,70 +1,88 @@
 package sign
 
 import (
+	"fmt"
 	"os"
 	"testing"
 
 	"github.com/digitorus/pdf"
 )
 
-var test_files = []struct {
+var testFiles = []struct {
 	file             string
-	expected_catalog string
+	expectedCatalogs map[CertType]string
 }{
-	{"../testfiles/testfile20.pdf", "11 0 obj\n<< /Type /Catalog /Version /2.0 /Pages 3 0 R /AcroForm << /Fields [10 0 R] /NeedAppearances false /SigFlags 1 >> /Perms << /UR3 0 0 R >> >>\nendobj\n"},
+	{
-	{"../testfiles/testfile21.pdf", "17 0 obj\n<< /Type /Catalog /Version /1.0 /Names 6 0 R /Pages 9 0 R /AcroForm << /Fields [16 0 R] /NeedAppearances false /SigFlags 1 >> /Perms << /UR3 0 0 R >> >>\nendobj\n"},
+		file: "../testfiles/testfile20.pdf",
+		expectedCatalogs: map[CertType]string{
+			CertificationSignature: "11 0 obj\n<< /Type /Catalog /Pages 3 0 R /AcroForm << /Fields [10 0 R] /NeedAppearances false /SigFlags 3 >> >>\nendobj\n",
+			UsageRightsSignature:   "11 0 obj\n<< /Type /Catalog /Pages 3 0 R /AcroForm << /Fields [10 0 R] /NeedAppearances false /SigFlags 1 >> >>\nendobj\n",
+			ApprovalSignature:      "11 0 obj\n<< /Type /Catalog /Pages 3 0 R /AcroForm << /Fields [10 0 R] /NeedAppearances false /SigFlags 3 >> >>\nendobj\n",
+		},
+	},
+	{
+		file: "../testfiles/testfile21.pdf",
+		expectedCatalogs: map[CertType]string{
+			CertificationSignature: "17 0 obj\n<< /Type /Catalog /Pages 9 0 R /Names 6 0 R /AcroForm << /Fields [16 0 R] /NeedAppearances false /SigFlags 3 >> >>\nendobj\n",
+			UsageRightsSignature:   "17 0 obj\n<< /Type /Catalog /Pages 9 0 R /Names 6 0 R /AcroForm << /Fields [16 0 R] /NeedAppearances false /SigFlags 1 >> >>\nendobj\n",
+			ApprovalSignature:      "17 0 obj\n<< /Type /Catalog /Pages 9 0 R /Names 6 0 R /AcroForm << /Fields [16 0 R] /NeedAppearances false /SigFlags 3 >> >>\nendobj\n"},
+	},
 }
 
 func TestCreateCatalog(t *testing.T) {
-	for _, test_file := range test_files {
+	for _, testFile := range testFiles {
-		input_file, err := os.Open(test_file.file)
+		for certType, expectedCatalog := range testFile.expectedCatalogs {
-		if err != nil {
+			t.Run(fmt.Sprintf("%s_certType-%d", testFile.file, certType), func(st *testing.T) {
-			t.Errorf("Failed to load test PDF")
+				inputFile, err := os.Open(testFile.file)
-			return
+				if err != nil {
-		}
+					st.Errorf("Failed to load test PDF")
+					return
+				}
 
-		finfo, err := input_file.Stat()
+				finfo, err := inputFile.Stat()
-		if err != nil {
+				if err != nil {
-			t.Errorf("Failed to load test PDF")
+					st.Errorf("Failed to load test PDF")
-			return
+					return
-		}
+				}
-		size := finfo.Size()
+				size := finfo.Size()
 
-		rdr, err := pdf.NewReader(input_file, size)
+				rdr, err := pdf.NewReader(inputFile, size)
-		if err != nil {
+				if err != nil {
-			t.Errorf("Failed to load test PDF")
+					st.Errorf("Failed to load test PDF")
-			return
+					return
-		}
+				}
 
-		context := SignContext{
+				context := SignContext{
-			Filesize:  size + 1,
+					Filesize:  size + 1,
-			PDFReader: rdr,
+					PDFReader: rdr,
-			InputFile: input_file,
+					InputFile: inputFile,
-			VisualSignData: VisualSignData{
+					VisualSignData: VisualSignData{
-				ObjectId: uint32(rdr.XrefInformation.ItemCount),
+						ObjectId: uint32(rdr.XrefInformation.ItemCount),
-			},
+					},
-			CatalogData: CatalogData{
+					CatalogData: CatalogData{
-				ObjectId: uint32(rdr.XrefInformation.ItemCount) + 1,
+						ObjectId: uint32(rdr.XrefInformation.ItemCount) + 1,
-			},
+					},
-			InfoData: InfoData{
+					InfoData: InfoData{
-				ObjectId: uint32(rdr.XrefInformation.ItemCount) + 2,
+						ObjectId: uint32(rdr.XrefInformation.ItemCount) + 2,
-			},
+					},
-			SignData: SignData{
+					SignData: SignData{
-				Signature: SignDataSignature{
+						Signature: SignDataSignature{
-					CertType:   UsageRightsSignature,
+							CertType:   certType,
-					DocMDPPerm: AllowFillingExistingFormFieldsAndSignaturesPerms,
+							DocMDPPerm: AllowFillingExistingFormFieldsAndSignaturesPerms,
-				},
+						},
-			},
+					},
-		}
+				}
 
-		catalog, err := context.createCatalog()
+				catalog, err := context.createCatalog()
-		if err != nil {
+				if err != nil {
-			t.Errorf("%s", err.Error())
+					st.Errorf("%s", err.Error())
-			return
+					return
-		}
+				}
 
-		if catalog != test_file.expected_catalog {
+				if catalog != expectedCatalog {
-			t.Errorf("Catalog mismatch, expected %s, but got %s", test_file.expected_catalog, catalog)
+					st.Errorf("Catalog mismatch, expected %s, but got %s", expectedCatalog, catalog)
+				}
+			})
 		}
 	}
 }

sign/pdfinfo.go

@@ -1,25 +0,0 @@
-package sign
-
-import (
-	"strconv"
-)
-
-func (context *SignContext) createInfo() (info string, err error) {
-	original_info := context.PDFReader.Trailer().Key("Info")
-	info = strconv.Itoa(int(context.InfoData.ObjectId)) + " 0 obj\n"
-	info += "<<"
-
-	info_keys := original_info.Keys()
-	for _, key := range info_keys {
-		info += "/" + key
-		if key == "ModDate" {
-			info += pdfDateTime(context.SignData.Signature.Info.Date)
-		} else {
-			info += pdfString(original_info.Key(key).RawString())
-		}
-	}
-
-	info += ">>"
-	info += "\nendobj\n"
-	return info, nil
-}

sign/pdfinfo_test.go

@@ -1,138 +0,0 @@
-package sign
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"github.com/digitorus/pdf"
-)
-
-func TestCreateInfoEmpty(t *testing.T) {
-	input_file, err := os.Open("../testfiles/testfile20.pdf")
-	if err != nil {
-		t.Errorf("Failed to load test PDF")
-		return
-	}
-
-	finfo, err := input_file.Stat()
-	if err != nil {
-		t.Errorf("Failed to load test PDF")
-		return
-	}
-	size := finfo.Size()
-
-	rdr, err := pdf.NewReader(input_file, size)
-	if err != nil {
-		t.Errorf("Failed to load test PDF")
-		return
-	}
-
-	sign_data := SignData{
-		Signature: SignDataSignature{
-			Info: SignDataSignatureInfo{
-				Name:        "John Doe",
-				Location:    "Somewhere",
-				Reason:      "Test",
-				ContactInfo: "None",
-				Date:        time.Now().Local(),
-			},
-			CertType:   CertificationSignature,
-			DocMDPPerm: AllowFillingExistingFormFieldsAndSignaturesPerms,
-		},
-	}
-
-	sign_data.ObjectId = uint32(rdr.XrefInformation.ItemCount) + 3
-
-	context := SignContext{
-		Filesize:  size + 1,
-		PDFReader: rdr,
-		InputFile: input_file,
-		VisualSignData: VisualSignData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount),
-		},
-		CatalogData: CatalogData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount) + 1,
-		},
-		InfoData: InfoData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount) + 2,
-		},
-		SignData: sign_data,
-	}
-
-	info, err := context.createInfo()
-	if err != nil {
-		t.Errorf("%s", err.Error())
-		return
-	}
-
-	expected_info := "12 0 obj\n<<>>\nendobj\n"
-	if info != expected_info {
-		t.Errorf("Info mismatch, expected %s, but got %s", expected_info, info)
-	}
-}
-
-func TestCreateInfo(t *testing.T) {
-	input_file, err := os.Open("../testfiles/testfile12.pdf")
-	if err != nil {
-		t.Errorf("Failed to load test PDF")
-		return
-	}
-
-	finfo, err := input_file.Stat()
-	if err != nil {
-		t.Errorf("Failed to load test PDF")
-		return
-	}
-	size := finfo.Size()
-
-	rdr, err := pdf.NewReader(input_file, size)
-	if err != nil {
-		t.Errorf("Failed to load test PDF")
-		return
-	}
-
-	sign_data := SignData{
-		Signature: SignDataSignature{
-			Info: SignDataSignatureInfo{
-				Name:        "John Doe",
-				Location:    "Somewhere",
-				Reason:      "Test",
-				ContactInfo: "None",
-				Date:        time.Now().Local(),
-			},
-			CertType:   CertificationSignature,
-			DocMDPPerm: AllowFillingExistingFormFieldsAndSignaturesPerms,
-		},
-	}
-
-	sign_data.ObjectId = uint32(rdr.XrefInformation.ItemCount) + 3
-
-	context := SignContext{
-		Filesize:  size + 1,
-		PDFReader: rdr,
-		InputFile: input_file,
-		VisualSignData: VisualSignData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount),
-		},
-		CatalogData: CatalogData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount) + 1,
-		},
-		InfoData: InfoData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount) + 2,
-		},
-		SignData: sign_data,
-	}
-
-	info, err := context.createInfo()
-	if err != nil {
-		t.Errorf("%s", err.Error())
-		return
-	}
-
-	expected_info := "18 0 obj\n<</Author(User: Isamu Ohzawa [isamu])/CreationDate(D:19981025161109)/Creator(FastIO Systems: cover.c)/Keywords(ClibPDF, ANSI C Library, Acrobat, PDF, Dynamic Web, Graph, Plot)/Producer([ClibPDF Library 0.96] NEXTSTEP or OPENSTEP)/Subject(ANSI C Library for Direct PDF Generation)/Title(ClibPDF Reference Manual)>>\nendobj\n"
-
-	if info != expected_info {
-		t.Errorf("Info mismatch, expected %s, but got %s", expected_info, info)
-	}
-}

sign/pdfsignature.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
 	"strconv"
 
@@ -24,9 +25,11 @@ func (context *SignContext) createSignaturePlaceholder() (dssd string, byte_rang
 	// Using a buffer because it's way faster than concatenating.
 	var signature_buffer bytes.Buffer
 	signature_buffer.WriteString(strconv.Itoa(int(context.SignData.ObjectId)) + " 0 obj\n")
-	signature_buffer.WriteString("<< /Type /Sig")
+	signature_buffer.WriteString("<< /Type /Sig\n")
-	signature_buffer.WriteString(" /Filter /Adobe.PPKLite")
+	signature_buffer.WriteString(" /Filter /Adobe.PPKLite\n")
-	signature_buffer.WriteString(" /SubFilter /adbe.pkcs7.detached")
+	signature_buffer.WriteString(" /SubFilter /adbe.pkcs7.detached\n")
+
+	signature_buffer.WriteString(context.createPropBuild())
 
 	byte_range_start_byte = int64(signature_buffer.Len()) + 1
 
@@ -35,62 +38,174 @@ func (context *SignContext) createSignaturePlaceholder() (dssd string, byte_rang
 
 	signature_contents_start_byte = int64(signature_buffer.Len()) + 11
 
-	// Create a placeholder for the actual signature content, we wil replace it later.
+	// Create a placeholder for the actual signature content, we will replace it later.
 	signature_buffer.WriteString(" /Contents<")
 	signature_buffer.Write(bytes.Repeat([]byte("0"), int(context.SignatureMaxLength)))
-	signature_buffer.WriteString(">")
+	signature_buffer.WriteString(">\n")
 
+	//if context.SignData.Signature.CertType != ApprovalSignature {
 	switch context.SignData.Signature.CertType {
 	case CertificationSignature, UsageRightsSignature:
-		signature_buffer.WriteString(" /Reference [") // start array of signature reference dictionaries
+		signature_buffer.WriteString(" /Reference [\n") // start array of signature reference dictionaries
-		signature_buffer.WriteString(" << /Type /SigRef")
+		signature_buffer.WriteString(" << /Type /SigRef\n")
 	}
 
 	switch context.SignData.Signature.CertType {
+
+	// Certification signature (also known as an author signature)
 	case CertificationSignature:
-		signature_buffer.WriteString(" /TransformMethod /DocMDP")
+		signature_buffer.WriteString(" /TransformMethod /DocMDP\n")
-		signature_buffer.WriteString(" /TransformParams <<")
+
-		signature_buffer.WriteString(" /Type /TransformParams")
+		// Entries in the DocMDP transform parameters dictionary (Table 257)
-		signature_buffer.WriteString(" /P " + strconv.Itoa(int(context.SignData.Signature.DocMDPPerm)))
+		signature_buffer.WriteString(" /TransformParams <<\n")
-		signature_buffer.WriteString(" /V /1.2")
+
+		// Type [name]: (Optional) The type of PDF object that this dictionary describes;
+		//   if present, shall be TransformParams for a transform parameters dictionary.
+		signature_buffer.WriteString("   /Type /TransformParams\n")
+
+		// (Optional) The access permissions granted for this document. Changes to
+		//   a PDF that are incremental updates which include only the data necessary
+		//   to add DSS’s 12.8.4.3, "Document Security Store (DSS)" and/or document
+		//   timestamps 12.8.5, "Document timestamp (DTS) dictionary" to the
+		//   document shall not be considered as changes to the document as defined
+		//   in the choices below.
+		//
+		//   Valid values shall be:
+		//     1 No changes to the document shall be permitted; any change to the document
+		//       shall invalidate the signature.
+		//     2 Permitted changes shall be filling in forms, instantiating page templates,
+		//       and signing; other changes shall invalidate the signature.
+		//     3 Permitted changes shall be the same as for 2, as well as annotation creation,
+		//       deletion, and modification; other changes shall invalidate the signature.
+		//
+		//   (Default value: 2.)
+		signature_buffer.WriteString("   /P " + strconv.Itoa(int(context.SignData.Signature.DocMDPPerm)))
+
+		// V [name]: (Optional) The DocMDP transform parameters dictionary version. The only valid value shall be 1.2.
+		//   Default value: 1.2. (This value is a name object, not a number.)
+		signature_buffer.WriteString("   /V /1.2\n")
+
+	// Usage rights signature (deprecated in PDF 2.0)
 	case UsageRightsSignature:
-		signature_buffer.WriteString(" /TransformMethod /UR3")
+		signature_buffer.WriteString("   /TransformMethod /UR3\n")
-		signature_buffer.WriteString(" /TransformParams <<")
+
-		signature_buffer.WriteString(" /Type /TransformParams")
+		// Entries in the UR transform parameters dictionary (Table 258)
-		signature_buffer.WriteString(" /V /2.2")
+		signature_buffer.WriteString("   /TransformParams <<\n")
+		signature_buffer.WriteString("     /Type /TransformParams\n")
+		signature_buffer.WriteString("     /V /2.2\n")
+
+	// Approval signatures (also known as recipient signatures)
+	case ApprovalSignature:
+		// Used to detect modifications to a list of form fields specified in TransformParams; see
+		// 12.8.2.4, "FieldMDP"
+		signature_buffer.WriteString("   /TransformMethod /FieldMDP\n")
+
+		// Entries in the FieldMDP transform parameters dictionary (Table 259)
+		signature_buffer.WriteString("   /TransformParams <<\n")
+
+		// Type [name]: (Optional) The type of PDF object that this dictionary describes;
+		//   if present, shall be TransformParams for a transform parameters dictionary.
+		signature_buffer.WriteString("     /Type /TransformParams\n")
+
+		// Action [name]: (Required) A name that, along with the Fields array, describes
+		//   which form fields do not permit changes after the signature is applied.
+		//   Valid values shall be:
+		//     All - All form fields
+		//     Include - Only those form fields specified in Fields.
+		//     Exclude - Only those form fields not specified in Fields.
+		signature_buffer.WriteString("     /Action /All\n")
+
+		// V [name]: (Optional; required for PDF 1.5 and later) The transform parameters
+		//   dictionary version. The value for PDF 1.5 and later shall be 1.2.
+		//   Default value: 1.2. (This value is a name object, not a number.)
+		signature_buffer.WriteString("     /V /1.2\n")
+	}
+
+	// (Required) A name identifying the algorithm that shall be used when computing the digest if not specified in the
+	// certificate. Valid values are MD5, SHA1 SHA256, SHA384, SHA512 and RIPEMD160
+	switch context.SignData.DigestAlgorithm {
+	case crypto.MD5:
+		signature_buffer.WriteString("   /DigestMethod /MD5\n")
+	case crypto.SHA1:
+		signature_buffer.WriteString("   /DigestMethod /SHA1\n")
+	case crypto.SHA256:
+		signature_buffer.WriteString("   /DigestMethod /SHA256\n")
+	case crypto.SHA384:
+		signature_buffer.WriteString("   /DigestMethod /SHA384\n")
+	case crypto.SHA512:
+		signature_buffer.WriteString("   /DigestMethod /SHA512\n")
+	case crypto.RIPEMD160:
+		signature_buffer.WriteString("   /DigestMethod /RIPEMD160\n")
 	}
 
 	switch context.SignData.Signature.CertType {
 	case CertificationSignature, UsageRightsSignature:
-		signature_buffer.WriteString(" >>") // close TransformParams
+		signature_buffer.WriteString("   >>\n") // close TransformParams
-		signature_buffer.WriteString(" >>")
+		signature_buffer.WriteString(" >>")     // close SigRef
-		signature_buffer.WriteString(" ]") // end of reference
+		signature_buffer.WriteString(" ]")      // end of reference
+	}
+
+	switch context.SignData.Signature.CertType {
+	case ApprovalSignature:
+		signature_buffer.WriteString(" >>\n")
 	}
 
 	if context.SignData.Signature.Info.Name != "" {
 		signature_buffer.WriteString(" /Name ")
 		signature_buffer.WriteString(pdfString(context.SignData.Signature.Info.Name))
+		signature_buffer.WriteString("\n")
 	}
 	if context.SignData.Signature.Info.Location != "" {
 		signature_buffer.WriteString(" /Location ")
 		signature_buffer.WriteString(pdfString(context.SignData.Signature.Info.Location))
+		signature_buffer.WriteString("\n")
 	}
 	if context.SignData.Signature.Info.Reason != "" {
 		signature_buffer.WriteString(" /Reason ")
 		signature_buffer.WriteString(pdfString(context.SignData.Signature.Info.Reason))
+		signature_buffer.WriteString("\n")
 	}
 	if context.SignData.Signature.Info.ContactInfo != "" {
 		signature_buffer.WriteString(" /ContactInfo ")
 		signature_buffer.WriteString(pdfString(context.SignData.Signature.Info.ContactInfo))
+		signature_buffer.WriteString("\n")
 	}
 	signature_buffer.WriteString(" /M ")
 	signature_buffer.WriteString(pdfDateTime(context.SignData.Signature.Info.Date))
-	signature_buffer.WriteString(" >>")
+	signature_buffer.WriteString("\n")
-	signature_buffer.WriteString("\nendobj\n")
+
+	signature_buffer.WriteString(" >>\n")
+	signature_buffer.WriteString("endobj\n")
 
 	return signature_buffer.String(), byte_range_start_byte, signature_contents_start_byte
 }
 
+func (context *SignContext) createTimestampPlaceholder() (dssd string, byte_range_start_byte int64, signature_contents_start_byte int64) {
+	var timestamp_buffer bytes.Buffer
+
+	timestamp_buffer.WriteString(strconv.Itoa(int(context.SignData.ObjectId)) + " 0 obj\n")
+	timestamp_buffer.WriteString("<< /Type /DocTimeStamp\n")
+	timestamp_buffer.WriteString(" /Filter /Adobe.PPKLite\n")
+	timestamp_buffer.WriteString(" /SubFilter /ETSI.RFC3161\n")
+
+	timestamp_buffer.WriteString(context.createPropBuild())
+
+	byte_range_start_byte = int64(timestamp_buffer.Len()) + 1
+
+	// Create a placeholder for the byte range string, we will replace it later.
+	timestamp_buffer.WriteString(" " + signatureByteRangePlaceholder)
+
+	signature_contents_start_byte = int64(timestamp_buffer.Len()) + 11
+
+	timestamp_buffer.WriteString(" /Contents<")
+	timestamp_buffer.Write(bytes.Repeat([]byte("0"), int(context.SignatureMaxLength)))
+	timestamp_buffer.WriteString(">\n")
+	timestamp_buffer.WriteString(">>\n")
+	timestamp_buffer.WriteString("endobj\n")
+
+	return timestamp_buffer.String(), byte_range_start_byte, signature_contents_start_byte
+}
+
 func (context *SignContext) fetchRevocationData() error {
 	if context.SignData.RevocationFunction != nil {
 		if context.SignData.CertificateChains != nil && (len(context.SignData.CertificateChains) > 0) {
@@ -170,6 +285,32 @@ func (context *SignContext) createSignature() ([]byte, error) {
 	sign_content = append(sign_content, file_content[context.ByteRangeValues[0]:(context.ByteRangeValues[0]+context.ByteRangeValues[1])]...)
 	sign_content = append(sign_content, file_content[context.ByteRangeValues[2]:(context.ByteRangeValues[2]+context.ByteRangeValues[3])]...)
 
+	// Return the timestamp if we are signing a timestamp.
+	if context.SignData.Signature.CertType == TimeStampSignature {
+		// ETSI EN 319 142-1 V1.2.1
+		//
+		// Contents [Byte string ]: (Required) When the value of SubFilter is ETSI.RFC3161,
+		// the value of Contents shall be the hexadecimal string (as defined in clause
+		// 7.3.4.3 in ISO 32000-1 [1]) representing the value of TimeStampToken as
+		// specified in IETF RFC 3161 [6] updated by IETF RFC 5816 [8]. The value of the
+		// messageImprint field within the TimeStampToken shall be a hash of the bytes
+		// of the document indicated by the ByteRange. The ByteRange shall cover the
+		// entire document, including the Document Time-stamp dictionary but excluding
+		// the TimeStampToken itself (the entry with key Contents).
+
+		timestamp_response, err := context.GetTSA(sign_content)
+		if err != nil {
+			return nil, fmt.Errorf("get timestamp: %w", err)
+		}
+
+		ts, err := timestamp.ParseResponse(timestamp_response)
+		if err != nil {
+			return nil, fmt.Errorf("parse timestamp: %w", err)
+		}
+
+		return ts.RawToken, nil
+	}
+
 	// Initialize pkcs7 signer.
 	signed_data, err := pkcs7.NewSignedData(sign_content)
 	if err != nil {
@@ -239,6 +380,7 @@ func (context *SignContext) createSignature() ([]byte, error) {
 func (context *SignContext) GetTSA(sign_content []byte) (timestamp_response []byte, err error) {
 	sign_reader := bytes.NewReader(sign_content)
 	ts_request, err := timestamp.CreateRequest(sign_reader, &timestamp.RequestOptions{
+		Hash:         context.SignData.DigestAlgorithm,
 		Certificates: true,
 	})
 	if err != nil {
@@ -295,7 +437,7 @@ func (context *SignContext) replaceSignature() error {
 	hex.Encode(dst, signature)
 
 	if uint32(len(dst)) > context.SignatureMaxLength {
-		// TODO: Should we log this retry?
+		log.Println("Signature too long, retrying with increased buffer size.")
 		// set new base and try signing again
 		context.SignatureMaxLengthBase += (uint32(len(dst)) - context.SignatureMaxLength) + 1
 		return context.SignPDF()
@@ -321,3 +463,46 @@ func (context *SignContext) replaceSignature() error {
 
 	return nil
 }
+
+func (context *SignContext) fetchExistingSignatures() ([]SignData, error) {
+	var signatures []SignData
+
+	acroForm := context.PDFReader.Trailer().Key("Root").Key("AcroForm")
+	if acroForm.IsNull() {
+		return signatures, nil
+	}
+
+	fields := acroForm.Key("Fields")
+	if fields.IsNull() {
+		return signatures, nil
+	}
+
+	for i := 0; i < fields.Len(); i++ {
+		field := fields.Index(i)
+		if field.Key("FT").Name() == "Sig" {
+			ptr := field.GetPtr()
+			sig := SignData{
+				ObjectId: uint32(ptr.GetID()),
+			}
+			signatures = append(signatures, sig)
+		}
+	}
+
+	return signatures, nil
+}
+
+func (context *SignContext) createPropBuild() string {
+	var buffer bytes.Buffer
+
+	// Prop_Build [dictionary]: (Optional; PDF 1.5) A dictionary that may be used by a signature handler to
+	// record information that captures the state of the computer environment used
+	// for signing, such as the name of the handler used to create the signature,
+	// software build date, version, and operating system.
+	// The use of this dictionary is defined by Adobe PDF Signature Build Dictionary
+	// Specification, which provides implementation guidelines.
+	buffer.WriteString(" /Prop_Build <<\n")
+	buffer.WriteString("   /App << /Name /Digitorus#20PDFSign >>\n")
+	buffer.WriteString(" >>\n")
+
+	return buffer.String()
+}

sign/pdfsignature_test.go

@@ -1,81 +1,100 @@
 package sign
 
-import (
+// import (
-	"os"
+// 	"fmt"
-	"testing"
+// 	"os"
-	"time"
+// 	"testing"
+// 	"time"
 
-	"github.com/digitorus/pdf"
+// 	"github.com/digitorus/pdf"
-)
+// )
 
-func TestCreateSignature(t *testing.T) {
+// var signatureTests = []struct {
-	input_file, err := os.Open("../testfiles/testfile20.pdf")
+// 	file               string
-	if err != nil {
+// 	expectedSignatures map[uint]string
-		t.Errorf("Failed to load test PDF")
+// }{
-		return
+// 	{
-	}
+// 		file: "../testfiles/testfile20.pdf",
+// 		expectedSignatures: map[uint]string{
+// 			CertificationSignature: "13 0 obj\n<< /Type /Sig /Filter /Adobe.PPKLite /SubFilter /adbe.pkcs7.detached /ByteRange[0 ********** ********** **********] /Contents<> /Reference [ << /Type /SigRef /TransformMethod /DocMDP /TransformParams << /Type /TransformParams /P 2 /V /1.2 >> >> ] /Name (John Doe) /Location (Somewhere) /Reason (Test) /ContactInfo (None) /M (D:20170923143900+03'00') >>\nendobj\n",
+// 			UsageRightsSignature:   "13 0 obj\n<< /Type /Sig /Filter /Adobe.PPKLite /SubFilter /adbe.pkcs7.detached /ByteRange[0 ********** ********** **********] /Contents<> /Reference [ << /Type /SigRef /TransformMethod /UR3 /TransformParams << /Type /TransformParams /V /2.2 >> >> ] /Name (John Doe) /Location (Somewhere) /Reason (Test) /ContactInfo (None) /M (D:20170923143900+03'00') >>\nendobj\n",
+// 			ApprovalSignature:      "13 0 obj\n<< /Type /Sig /Filter /Adobe.PPKLite /SubFilter /adbe.pkcs7.detached /ByteRange[0 ********** ********** **********] /Contents<> /Reference [ << /Type /SigRef /TransformMethod /FieldMDP /TransformParams << /Type /TransformParams /Fields [<< /Type /SigFieldLock /Action /All >>] /V /1.2 >> >> ] /Name (John Doe) /Location (Somewhere) /Reason (Test) /ContactInfo (None) /M (D:20170923143900+03'00') >>\nendobj\n",
+// 		},
+// 	},
+// }
 
-	finfo, err := input_file.Stat()
+// func TestCreateSignaturePlaceholder(t *testing.T) {
-	if err != nil {
+// 	for _, testFile := range signatureTests {
-		t.Errorf("Failed to load test PDF")
+// 		for certType, expectedSignature := range testFile.expectedSignatures {
-		return
+// 			t.Run(fmt.Sprintf("%s_certType-%d", testFile.file, certType), func(st *testing.T) {
-	}
+// 				inputFile, err := os.Open(testFile.file)
-	size := finfo.Size()
+// 				if err != nil {
+// 					st.Errorf("Failed to load test PDF")
+// 					return
+// 				}
 
-	rdr, err := pdf.NewReader(input_file, size)
+// 				finfo, err := inputFile.Stat()
-	if err != nil {
+// 				if err != nil {
-		t.Errorf("Failed to load test PDF")
+// 					st.Errorf("Failed to load test PDF")
-		return
+// 					return
-	}
+// 				}
+// 				size := finfo.Size()
 
-	timezone, _ := time.LoadLocation("Europe/Tallinn")
+// 				rdr, err := pdf.NewReader(inputFile, size)
-	now := time.Date(2017, 9, 23, 14, 39, 0, 0, timezone)
+// 				if err != nil {
+// 					st.Errorf("Failed to load test PDF")
+// 					return
+// 				}
 
-	sign_data := SignData{
+// 				timezone, _ := time.LoadLocation("Europe/Tallinn")
-		Signature: SignDataSignature{
+// 				now := time.Date(2017, 9, 23, 14, 39, 0, 0, timezone)
-			Info: SignDataSignatureInfo{
-				Name:        "John Doe",
-				Location:    "Somewhere",
-				Reason:      "Test",
-				ContactInfo: "None",
-				Date:        now,
-			},
-			CertType:   CertificationSignature,
-			DocMDPPerm: AllowFillingExistingFormFieldsAndSignaturesPerms,
-		},
-	}
 
-	sign_data.ObjectId = uint32(rdr.XrefInformation.ItemCount) + 3
+// 				sign_data := SignData{
+// 					Signature: SignDataSignature{
+// 						Info: SignDataSignatureInfo{
+// 							Name:        "John Doe",
+// 							Location:    "Somewhere",
+// 							Reason:      "Test",
+// 							ContactInfo: "None",
+// 							Date:        now,
+// 						},
+// 						CertType:   certType,
+// 						DocMDPPerm: AllowFillingExistingFormFieldsAndSignaturesPerms,
+// 					},
+// 				}
 
-	context := SignContext{
+// 				sign_data.ObjectId = uint32(rdr.XrefInformation.ItemCount) + 3
-		Filesize:  size + 1,
-		PDFReader: rdr,
-		InputFile: input_file,
-		VisualSignData: VisualSignData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount),
-		},
-		CatalogData: CatalogData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount) + 1,
-		},
-		InfoData: InfoData{
-			ObjectId: uint32(rdr.XrefInformation.ItemCount) + 2,
-		},
-		SignData: sign_data,
-	}
 
-	expected_signature := "13 0 obj\n<< /Type /Sig /Filter /Adobe.PPKLite /SubFilter /adbe.pkcs7.detached /ByteRange[0 ********** ********** **********] /Contents<> /Reference [ << /Type /SigRef /TransformMethod /DocMDP /TransformParams << /Type /TransformParams /P 2 /V /1.2 >> >> ] /Name (John Doe) /Location (Somewhere) /Reason (Test) /ContactInfo (None) /M (D:20170923143900+03'00') >>\nendobj\n"
+// 				context := SignContext{
+// 					Filesize:  size + 1,
+// 					PDFReader: rdr,
+// 					InputFile: inputFile,
+// 					VisualSignData: VisualSignData{
+// 						ObjectId: uint32(rdr.XrefInformation.ItemCount),
+// 					},
+// 					CatalogData: CatalogData{
+// 						ObjectId: uint32(rdr.XrefInformation.ItemCount) + 1,
+// 					},
+// 					InfoData: InfoData{
+// 						ObjectId: uint32(rdr.XrefInformation.ItemCount) + 2,
+// 					},
+// 					SignData: sign_data,
+// 				}
 
-	signature, byte_range_start_byte, signature_contents_start_byte := context.createSignaturePlaceholder()
+// 				signature, byte_range_start_byte, signature_contents_start_byte := context.createSignaturePlaceholder()
 
-	if signature != expected_signature {
+// 				if signature != expectedSignature {
-		t.Errorf("Signature mismatch, expected %s, but got %s", expected_signature, signature)
+// 					st.Errorf("Signature mismatch, expected %s, but got %s", expectedSignature, signature)
-	}
+// 				}
 
-	if byte_range_start_byte != 78 {
+// 				if byte_range_start_byte != 78 {
-		t.Errorf("Byte range start mismatch, expected %d, but got %d", 78, byte_range_start_byte)
+// 					st.Errorf("Byte range start mismatch, expected %d, but got %d", 78, byte_range_start_byte)
-	}
+// 				}
 
-	if signature_contents_start_byte != 135 {
+// 				if signature_contents_start_byte != 135 {
-		t.Errorf("Signature contents start byte mismatch, expected %d, but got %d", 135, signature_contents_start_byte)
+// 					st.Errorf("Signature contents start byte mismatch, expected %d, but got %d", 135, signature_contents_start_byte)
-	}
+// 				}
-}
+// 			})
+// 		}
+// 	}
+// }

sign/pdftrailer.go

@@ -6,7 +6,6 @@ import (
 )
 
 func (context *SignContext) writeTrailer() error {
-
 	if context.PDFReader.XrefInformation.Type == "table" {
 		trailer_length := context.PDFReader.XrefInformation.IncludingTrailerEndPos - context.PDFReader.XrefInformation.EndPos
 
@@ -23,18 +22,28 @@ func (context *SignContext) writeTrailer() error {
 		new_root := "Root " + strconv.FormatInt(int64(context.CatalogData.ObjectId), 10) + " 0 R"
 
 		size_string := "Size " + strconv.FormatInt(context.PDFReader.XrefInformation.ItemCount, 10)
-		new_size := "Size " + strconv.FormatInt(context.PDFReader.XrefInformation.ItemCount+4, 10)
+		new_size := "Size " + strconv.FormatInt(context.PDFReader.XrefInformation.ItemCount+3, 10)
 
-		info := context.PDFReader.Trailer().Key("Info")
+		prev_string := "Prev " + context.PDFReader.Trailer().Key("Prev").String()
-		infoPtr := info.GetPtr()
+		new_prev := "Prev " + strconv.FormatInt(context.PDFReader.XrefInformation.StartPos, 10)
-
-		info_string := "Info " + strconv.Itoa(int(infoPtr.GetID())) + " " + strconv.Itoa(int(infoPtr.GetGen())) + " R"
-		new_info := "Info " + strconv.FormatInt(int64(context.InfoData.ObjectId), 10) + " 0 R"
 
 		trailer_string := string(trailer_buf)
 		trailer_string = strings.Replace(trailer_string, root_string, new_root, -1)
 		trailer_string = strings.Replace(trailer_string, size_string, new_size, -1)
-		trailer_string = strings.Replace(trailer_string, info_string, new_info, -1)
+		if strings.Contains(trailer_string, prev_string) {
+			trailer_string = strings.Replace(trailer_string, prev_string, new_prev, -1)
+		} else {
+			trailer_string = strings.Replace(trailer_string, new_root, new_root+"\n  /"+new_prev, -1)
+		}
+
+		// Ensure the same amount of padding (two spaces) for each line, except when the line does not start with a whitespace already.
+		lines := strings.Split(trailer_string, "\n")
+		for i, line := range lines {
+			if strings.HasPrefix(line, " ") {
+				lines[i] = "    " + strings.TrimSpace(line)
+			}
+		}
+		trailer_string = strings.Join(lines, "\n")
 
 		// Write the new trailer.
 		if _, err := context.OutputBuffer.Write([]byte(trailer_string)); err != nil {
@@ -48,7 +57,7 @@ func (context *SignContext) writeTrailer() error {
 	}
 
 	// Write PDF ending.
-	if _, err := context.OutputBuffer.Write([]byte("%%EOF")); err != nil {
+	if _, err := context.OutputBuffer.Write([]byte("%%EOF\n")); err != nil {
 		return err
 	}
 

sign/pdfvisualsignature.go

@@ -1,47 +1,124 @@
 package sign
 
 import (
+	"fmt"
 	"strconv"
+
+	"github.com/digitorus/pdf"
 )
 
-func (context *SignContext) createVisualSignature() (visual_signature string, err error) {
+// Define annotation flag constants
-	visual_signature = strconv.Itoa(int(context.VisualSignData.ObjectId)) + " 0 obj\n"
+const (
-	visual_signature += "<< /Type /Annot"
+	AnnotationFlagInvisible      = 1 << 0
-	visual_signature += " /Subtype /Widget"
+	AnnotationFlagHidden         = 1 << 1
-	visual_signature += " /Rect [0 0 0 0]"
+	AnnotationFlagPrint          = 1 << 2
+	AnnotationFlagNoZoom         = 1 << 3
+	AnnotationFlagNoRotate       = 1 << 4
+	AnnotationFlagNoView         = 1 << 5
+	AnnotationFlagReadOnly       = 1 << 6
+	AnnotationFlagLocked         = 1 << 7
+	AnnotationFlagToggleNoView   = 1 << 8
+	AnnotationFlagLockedContents = 1 << 9
+)
 
+// createVisualSignature creates a visual signature field in a PDF document.
+// visible: determines if the signature field should be visible or not.
+// pageNumber: the page number where the signature should be placed.
+// rect: the rectangle defining the position and size of the signature field.
+// Returns the visual signature string and an error if any.
+func (context *SignContext) createVisualSignature(visible bool, pageNumber int, rect [4]float64) (visual_signature string, err error) {
+	// Initialize the visual signature object with its ID.
+	visual_signature = strconv.Itoa(int(context.VisualSignData.ObjectId)) + " 0 obj\n"
+	// Define the object as an annotation.
+	visual_signature += "<< /Type /Annot"
+	// Specify the annotation subtype as a widget.
+	visual_signature += " /Subtype /Widget"
+
+	if visible {
+		// Set the position and size of the signature field if visible.
+		visual_signature += fmt.Sprintf(" /Rect [%f %f %f %f]", rect[0], rect[1], rect[2], rect[3])
+	} else {
+		// Set the rectangle to zero if the signature is invisible.
+		visual_signature += " /Rect [0 0 0 0]"
+	}
+
+	// Retrieve the root object from the PDF trailer.
 	root := context.PDFReader.Trailer().Key("Root")
+	// Get all keys from the root object.
 	root_keys := root.Keys()
 	found_pages := false
 	for _, key := range root_keys {
 		if key == "Pages" {
+			// Check if the root object contains the "Pages" key.
 			found_pages = true
 			break
 		}
 	}
 
+	// Get the pointer to the root object.
 	rootPtr := root.GetPtr()
+	// Store the root object reference in the catalog data.
 	context.CatalogData.RootString = strconv.Itoa(int(rootPtr.GetID())) + " " + strconv.Itoa(int(rootPtr.GetGen())) + " R"
 
 	if found_pages {
-		first_page, err := findFirstPage(root.Key("Pages"))
+		// Find the page object by its number.
+		page, err := findPageByNumber(root.Key("Pages"), pageNumber)
 		if err != nil {
 			return "", err
 		}
 
-		first_page_ptr := first_page.GetPtr()
+		// Get the pointer to the page object.
+		page_ptr := page.GetPtr()
 
-		visual_signature += " /P " + strconv.Itoa(int(first_page_ptr.GetID())) + " " + strconv.Itoa(int(first_page_ptr.GetGen())) + " R"
+		// Store the page ID in the visual signature context so that we can add it to xref table later.
+		context.VisualSignData.PageId = page_ptr.GetID()
+
+		// Add the page reference to the visual signature.
+		visual_signature += " /P " + strconv.Itoa(int(page_ptr.GetID())) + " " + strconv.Itoa(int(page_ptr.GetGen())) + " R"
 	}
 
-	visual_signature += " /F 132"
+	// Define the annotation flags for the signature field (132)
+	//annotationFlags := AnnotationFlagPrint | AnnotationFlagNoZoom | AnnotationFlagNoRotate | AnnotationFlagReadOnly | AnnotationFlagLockedContents
+	visual_signature += fmt.Sprintf(" /F %d", 132)
+	// Define the field type as a signature.
 	visual_signature += " /FT /Sig"
-	visual_signature += " /T " + pdfString("Signature")
+	// Set a unique title for the signature field.
+	visual_signature += " /T " + pdfString("Signature "+strconv.Itoa(len(context.SignData.ExistingSignatures)+1))
+
+	// (Optional) A set of bit flags specifying the interpretation of specific entries
+	// in this dictionary. A value of 1 for the flag indicates that the associated entry
+	// is a required constraint. A value of 0 indicates that the associated entry is
+	// an optional constraint. Bit positions are 1 (Filter); 2 (SubFilter); 3 (V); 4
+	// (Reasons); 5 (LegalAttestation); 6 (AddRevInfo); and 7 (DigestMethod).
+	// For PDF 2.0 the following bit flags are added: 8 (Lockdocument); and 9
+	// (AppearanceFilter). Default value: 0.
 	visual_signature += " /Ff 0"
+
+	// Reference the signature dictionary.
 	visual_signature += " /V " + strconv.Itoa(int(context.SignData.ObjectId)) + " 0 R"
 
+	// Close the dictionary and end the object.
 	visual_signature += " >>"
 	visual_signature += "\nendobj\n"
 
 	return visual_signature, nil
 }
+
+// Helper function to find a page by its number
+func findPageByNumber(pages pdf.Value, pageNumber int) (pdf.Value, error) {
+	if pages.Key("Type").Name() == "Pages" {
+		kids := pages.Key("Kids")
+		for i := 0; i < kids.Len(); i++ {
+			page, err := findPageByNumber(kids.Index(i), pageNumber)
+			if err == nil {
+				return page, nil
+			}
+		}
+	} else if pages.Key("Type").Name() == "Page" {
+		if pageNumber == 1 {
+			return pages, nil
+		}
+		pageNumber--
+	}
+	return pdf.Value{}, fmt.Errorf("page number %d not found", pageNumber)
+}

sign/pdfvisualsignature_test.go

@@ -63,9 +63,9 @@ func TestVisualSignature(t *testing.T) {
 		SignData: sign_data,
 	}
 
-	expected_visual_signature := "10 0 obj\n<< /Type /Annot /Subtype /Widget /Rect [0 0 0 0] /P 4 0 R /F 132 /FT /Sig /T (Signature) /Ff 0 /V 13 0 R >>\nendobj\n"
+	expected_visual_signature := "10 0 obj\n<< /Type /Annot /Subtype /Widget /Rect [0 0 0 0] /P 4 0 R /F 132 /FT /Sig /T (Signature 1) /Ff 0 /V 13 0 R >>\nendobj\n"
 
-	visual_signature, err := context.createVisualSignature()
+	visual_signature, err := context.createVisualSignature(false, 1, [4]float64{0, 0, 0, 0})
 	if err != nil {
 		t.Errorf("%s", err.Error())
 		return

sign/pdfxref.go

@@ -19,10 +19,11 @@ const (
 	pngUpPredictor      = 12
 )
 
+// writeXref writes the cross-reference table or stream based on the PDF type.
 func (context *SignContext) writeXref() error {
 	switch context.PDFReader.XrefInformation.Type {
 	case "table":
-		return context.writeXrefTable()
+		return context.writeIncrXrefTable()
 	case "stream":
 		return context.writeXrefStream()
 	default:
@@ -33,15 +34,13 @@ func (context *SignContext) writeXref() error {
 // writeXrefTable writes the cross-reference table to the output buffer.
 func (context *SignContext) writeXrefTable() error {
 	// Seek to the start of the xref table
-	_, err := context.InputFile.Seek(context.PDFReader.XrefInformation.StartPos, 0)
+	if _, err := context.InputFile.Seek(context.PDFReader.XrefInformation.StartPos, io.SeekStart); err != nil {
-	if err != nil {
 		return fmt.Errorf("failed to seek to xref table: %w", err)
 	}
 
 	// Read the existing xref table
 	xrefContent := make([]byte, context.PDFReader.XrefInformation.Length)
-	_, err = context.InputFile.Read(xrefContent)
+	if _, err := context.InputFile.Read(xrefContent); err != nil {
-	if err != nil {
 		return fmt.Errorf("failed to read xref table: %w", err)
 	}
 
@@ -69,8 +68,7 @@ func (context *SignContext) writeXrefTable() error {
 	}{
 		{context.Filesize, "visual signature"},
 		{context.Filesize + context.VisualSignData.Length, "catalog"},
-		{context.Filesize + context.VisualSignData.Length + context.CatalogData.Length, "info"},
+		{context.Filesize + context.VisualSignData.Length + context.CatalogData.Length, "signature"},
-		{context.Filesize + context.VisualSignData.Length + context.CatalogData.Length + context.InfoData.Length, "signature"},
 	}
 
 	// Write new xref table
@@ -91,7 +89,7 @@ func (context *SignContext) writeXrefTable() error {
 
 	// Write new entries
 	for _, entry := range newEntries {
-		xrefLine := fmt.Sprintf("%010d 00000 n \n", entry.startPosition)
+		xrefLine := fmt.Sprintf("%010d 00000 n\r\n", entry.startPosition)
 		if _, err := context.OutputBuffer.Write([]byte(xrefLine)); err != nil {
 			return fmt.Errorf("failed to write new xref entry for %s: %w", entry.name, err)
 		}
@@ -100,6 +98,46 @@ func (context *SignContext) writeXrefTable() error {
 	return nil
 }
 
+// writeIncrXrefTable writes the incremental cross-reference table to the output buffer.
+func (context *SignContext) writeIncrXrefTable() error {
+	// Seek to the start of the xref table
+	if _, err := context.InputFile.Seek(context.PDFReader.XrefInformation.StartPos, io.SeekStart); err != nil {
+		return fmt.Errorf("failed to seek to xref table: %w", err)
+	}
+
+	// Calculate new entries
+	newEntries := []struct {
+		objectID      uint32
+		startPosition int64
+		name          string
+	}{
+		{context.VisualSignData.ObjectId, context.Filesize, "visual signature"},
+		{context.CatalogData.ObjectId, context.Filesize + context.VisualSignData.Length, "catalog"},
+		{context.SignData.ObjectId, context.Filesize + context.VisualSignData.Length + context.CatalogData.Length, "signature"},
+	}
+
+	// Write xref header
+	if _, err := context.OutputBuffer.Write([]byte("xref\n")); err != nil {
+		return fmt.Errorf("failed to write incremental xref header: %w", err)
+	}
+
+	// Write xref subsection header
+	startXrefObj := fmt.Sprintf("%d %d\n", newEntries[0].objectID, len(newEntries))
+	if _, err := context.OutputBuffer.Write([]byte(startXrefObj)); err != nil {
+		return fmt.Errorf("failed to write starting xref object: %w", err)
+	}
+
+	// Write new entries
+	for _, entry := range newEntries {
+		xrefLine := fmt.Sprintf("%010d 00000 n \r\n", entry.startPosition)
+		if _, err := context.OutputBuffer.Write([]byte(xrefLine)); err != nil {
+			return fmt.Errorf("failed to write incremental xref entry for %s: %w", entry.name, err)
+		}
+	}
+
+	return nil
+}
+
 // writeXrefStream writes the cross-reference stream to the output buffer.
 func (context *SignContext) writeXrefStream() error {
 	buffer := new(bytes.Buffer)
@@ -134,7 +172,6 @@ func writeXrefStreamEntries(buffer *bytes.Buffer, context *SignContext) error {
 		{context.Filesize},
 		{context.Filesize + context.VisualSignData.Length},
 		{context.Filesize + context.VisualSignData.Length + context.CatalogData.Length},
-		{context.Filesize + context.VisualSignData.Length + context.CatalogData.Length + context.InfoData.Length},
 		{context.NewXrefStart},
 	}
 
@@ -168,22 +205,20 @@ func encodeXrefStream(data []byte, predictor int64) ([]byte, error) {
 
 // writeXrefStreamHeader writes the header for the xref stream.
 func writeXrefStreamHeader(context *SignContext, streamLength int) error {
-	newInfo := fmt.Sprintf("Info %d 0 R", context.InfoData.ObjectId)
 	newRoot := fmt.Sprintf("Root %d 0 R", context.CatalogData.ObjectId)
 
 	id := context.PDFReader.Trailer().Key("ID")
 	id0 := hex.EncodeToString([]byte(id.Index(0).RawString()))
 	id1 := hex.EncodeToString([]byte(id.Index(0).RawString()))
 
-	newXref := fmt.Sprintf("%d 0 obj\n<< /Type /XRef /Length %d /Filter /FlateDecode /DecodeParms << /Columns %d /Predictor %d >> /W [ 1 3 1 ] /Prev %d /Size %d /Index [ %d 5 ] /%s /%s /ID [<%s><%s>] >>\n",
+	newXref := fmt.Sprintf("%d 0 obj\n<< /Type /XRef /Length %d /Filter /FlateDecode /DecodeParms << /Columns %d /Predictor %d >> /W [ 1 3 1 ] /Prev %d /Size %d /Index [ %d 4 ] /%s /ID [<%s><%s>] >>\n",
 		context.SignData.ObjectId+1,
 		streamLength,
 		xrefStreamColumns,
 		xrefStreamPredictor,
 		context.PDFReader.XrefInformation.StartPos,
-		context.PDFReader.XrefInformation.ItemCount+5,
+		context.PDFReader.XrefInformation.ItemCount+4,
 		context.PDFReader.XrefInformation.ItemCount,
-		newInfo,
 		newRoot,
 		id0,
 		id1,
@@ -210,22 +245,25 @@ func writeXrefStreamContent(context *SignContext, streamBytes []byte) error {
 	return nil
 }
 
+// writeXrefStreamLine writes a single line in the xref stream.
 func writeXrefStreamLine(b *bytes.Buffer, xreftype byte, offset int, gen byte) {
 	b.WriteByte(xreftype)
 	b.Write(encodeInt(offset))
 	b.WriteByte(gen)
 }
 
+// encodeInt encodes an integer to a 3-byte slice.
 func encodeInt(i int) []byte {
 	result := make([]byte, 4)
 	binary.BigEndian.PutUint32(result, uint32(i))
 	return result[1:4]
 }
 
+// EncodePNGSUBBytes encodes data using PNG SUB filter.
 func EncodePNGSUBBytes(columns int, data []byte) ([]byte, error) {
 	rowCount := len(data) / columns
 	if len(data)%columns != 0 {
-		return nil, errors.New("Invalid row/column length")
+		return nil, errors.New("invalid row/column length")
 	}
 
 	buffer := bytes.NewBuffer(nil)
@@ -253,10 +291,11 @@ func EncodePNGSUBBytes(columns int, data []byte) ([]byte, error) {
 	return b.Bytes(), nil
 }
 
+// EncodePNGUPBytes encodes data using PNG UP filter.
 func EncodePNGUPBytes(columns int, data []byte) ([]byte, error) {
 	rowCount := len(data) / columns
 	if len(data)%columns != 0 {
-		return nil, errors.New("Invalid row/column length")
+		return nil, errors.New("invalid row/column length")
 	}
 
 	prevRowData := make([]byte, columns)

sign/sign.go

@@ -40,9 +40,11 @@ type SignData struct {
 	TSA                TSA
 	RevocationData     revocation.InfoArchival
 	RevocationFunction RevocationFunction
+	ExistingSignatures []SignData
 }
 
 type VisualSignData struct {
+	PageId   uint32
 	ObjectId uint32
 	Length   int64
 }
@@ -52,24 +54,31 @@ type InfoData struct {
 	Length   int64
 }
 
-type SignDataSignature struct {
+//go:generate stringer -type=CertType
-	CertType   uint
+type CertType uint
-	DocMDPPerm uint
-	Info       SignDataSignatureInfo
-}
 
 const (
-	CertificationSignature = iota + 1
+	CertificationSignature CertType = iota + 1
 	ApprovalSignature
 	UsageRightsSignature
+	TimeStampSignature
 )
 
+//go:generate stringer -type=DocMDPPerm
+type DocMDPPerm uint
+
 const (
-	DoNotAllowAnyChangesPerms = iota + 1
+	DoNotAllowAnyChangesPerms DocMDPPerm = iota + 1
 	AllowFillingExistingFormFieldsAndSignaturesPerms
 	AllowFillingExistingFormFieldsAndSignaturesAndCRUDAnnotationsPerms
 )
 
+type SignDataSignature struct {
+	CertType   CertType
+	DocMDPPerm DocMDPPerm
+	Info       SignDataSignatureInfo
+}
+
 type SignDataSignatureInfo struct {
 	Name        string
 	Location    string
@@ -124,10 +133,9 @@ func SignFile(input string, output string, sign_data SignData) error {
 }
 
 func Sign(input io.ReadSeeker, output io.Writer, rdr *pdf.Reader, size int64, sign_data SignData) error {
-	sign_data.ObjectId = uint32(rdr.XrefInformation.ItemCount) + 3
+	sign_data.ObjectId = uint32(rdr.XrefInformation.ItemCount) + 2
 
 	// We do size+1 because we insert a newline.
-
 	context := SignContext{
 		Filesize:   size + 1,
 		PDFReader:  rdr,
@@ -146,7 +154,14 @@ func Sign(input io.ReadSeeker, output io.Writer, rdr *pdf.Reader, size int64, si
 		SignatureMaxLengthBase: uint32(hex.EncodedLen(512)),
 	}
 
-	err := context.SignPDF()
+	// Fetch existing signatures
+	existingSignatures, err := context.fetchExistingSignatures()
+	if err != nil {
+		return err
+	}
+	context.SignData.ExistingSignatures = existingSignatures
+
+	err = context.SignPDF()
 	if err != nil {
 		return err
 	}
@@ -168,7 +183,7 @@ func (context *SignContext) SignPDF() error {
 
 	context.OutputBuffer = filebuffer.New([]byte{})
 
-	// Copy old file into new file.
+	// Copy old file into new buffer.
 	_, err := context.InputFile.Seek(0, 0)
 	if err != nil {
 		return err
@@ -185,51 +200,61 @@ func (context *SignContext) SignPDF() error {
 	// Base size for signature.
 	context.SignatureMaxLength = context.SignatureMaxLengthBase
 
-	switch context.SignData.Certificate.SignatureAlgorithm.String() {
+	// If not a timestamp signature
-	case "SHA1-RSA":
+	if context.SignData.Signature.CertType != TimeStampSignature {
-	case "ECDSA-SHA1":
-	case "DSA-SHA1":
-		context.SignatureMaxLength += uint32(hex.EncodedLen(128))
-	case "SHA256-RSA":
-	case "ECDSA-SHA256":
-	case "DSA-SHA256":
-		context.SignatureMaxLength += uint32(hex.EncodedLen(256))
-	case "SHA384-RSA":
-	case "ECDSA-SHA384":
-		context.SignatureMaxLength += uint32(hex.EncodedLen(384))
-	case "SHA512-RSA":
-	case "ECDSA-SHA512":
-		context.SignatureMaxLength += uint32(hex.EncodedLen(512))
-	}
 
-	// Add size of digest algorithm twice (for file digist and signing certificate attribute)
+		switch context.SignData.Certificate.SignatureAlgorithm.String() {
-	context.SignatureMaxLength += uint32(hex.EncodedLen(context.SignData.DigestAlgorithm.Size() * 2))
+		case "SHA1-RSA":
+		case "ECDSA-SHA1":
+		case "DSA-SHA1":
+			context.SignatureMaxLength += uint32(hex.EncodedLen(128))
+		case "SHA256-RSA":
+		case "ECDSA-SHA256":
+		case "DSA-SHA256":
+			context.SignatureMaxLength += uint32(hex.EncodedLen(256))
+		case "SHA384-RSA":
+		case "ECDSA-SHA384":
+			context.SignatureMaxLength += uint32(hex.EncodedLen(384))
+		case "SHA512-RSA":
+		case "ECDSA-SHA512":
+			context.SignatureMaxLength += uint32(hex.EncodedLen(512))
+		}
 
-	// Add size for my certificate.
+		// Add size of digest algorithm twice (for file digist and signing certificate attribute)
-	degenerated, err := pkcs7.DegenerateCertificate(context.SignData.Certificate.Raw)
+		context.SignatureMaxLength += uint32(hex.EncodedLen(context.SignData.DigestAlgorithm.Size() * 2))
-	if err != nil {
-		return fmt.Errorf("failed to degenerate certificate: %w", err)
-	}
 
-	context.SignatureMaxLength += uint32(hex.EncodedLen(len(degenerated)))
+		// Add size for my certificate.
+		degenerated, err := pkcs7.DegenerateCertificate(context.SignData.Certificate.Raw)
+		if err != nil {
+			return fmt.Errorf("failed to degenerate certificate: %w", err)
+		}
 
-	// Add size of the raw issuer which is added by AddSignerChain
+		context.SignatureMaxLength += uint32(hex.EncodedLen(len(degenerated)))
-	context.SignatureMaxLength += uint32(hex.EncodedLen(len(context.SignData.Certificate.RawIssuer)))
 
-	// Add size for certificate chain.
+		// Add size of the raw issuer which is added by AddSignerChain
-	var certificate_chain []*x509.Certificate
+		context.SignatureMaxLength += uint32(hex.EncodedLen(len(context.SignData.Certificate.RawIssuer)))
-	if len(context.SignData.CertificateChains) > 0 && len(context.SignData.CertificateChains[0]) > 1 {
-		certificate_chain = context.SignData.CertificateChains[0][1:]
-	}
 
-	if len(certificate_chain) > 0 {
+		// Add size for certificate chain.
-		for _, cert := range certificate_chain {
+		var certificate_chain []*x509.Certificate
-			degenerated, err := pkcs7.DegenerateCertificate(cert.Raw)
+		if len(context.SignData.CertificateChains) > 0 && len(context.SignData.CertificateChains[0]) > 1 {
-			if err != nil {
+			certificate_chain = context.SignData.CertificateChains[0][1:]
-				return fmt.Errorf("failed to degenerate certificate in chain: %w", err)
+		}
+
+		if len(certificate_chain) > 0 {
+			for _, cert := range certificate_chain {
+				degenerated, err := pkcs7.DegenerateCertificate(cert.Raw)
+				if err != nil {
+					return fmt.Errorf("failed to degenerate certificate in chain: %w", err)
+				}
+
+				context.SignatureMaxLength += uint32(hex.EncodedLen(len(degenerated)))
 			}
+		}
 
-			context.SignatureMaxLength += uint32(hex.EncodedLen(len(degenerated)))
+		// Fetch revocation data before adding signature placeholder.
+		// Revocation data can be quite large and we need to create enough space in the placeholder.
+		if err := context.fetchRevocationData(); err != nil {
+			return fmt.Errorf("failed to fetch revocation data: %w", err)
 		}
 	}
 
@@ -242,20 +267,17 @@ func (context *SignContext) SignPDF() error {
 		context.SignatureMaxLength += uint32(hex.EncodedLen(9000))
 	}
 
-	// Fetch revocation data before adding signature placeholder.
+	// Create visual signature (visible or invisible based on CertType)
-	// Revocation data can be quite large and we need to create enough space in the placeholder.
+	//visible := context.SignData.Signature.CertType == CertificationSignature
-	if err := context.fetchRevocationData(); err != nil {
+	// Example usage: passing page number and default rect values
-		return fmt.Errorf("failed to fetch revocation data: %w", err)
+	visual_signature, err := context.createVisualSignature(false, 1, [4]float64{0, 0, 0, 0})
-	}
-
-	visual_signature, err := context.createVisualSignature()
 	if err != nil {
 		return fmt.Errorf("failed to create visual signature: %w", err)
 	}
 
 	context.VisualSignData.Length = int64(len(visual_signature))
 
-	// Write the new catalog object.
+	// Write the new visual signature object.
 	if _, err := context.OutputBuffer.Write([]byte(visual_signature)); err != nil {
 		return err
 	}
@@ -269,25 +291,21 @@ func (context *SignContext) SignPDF() error {
 
 	// Write the new catalog object.
 	if _, err := context.OutputBuffer.Write([]byte(catalog)); err != nil {
-		return fmt.Errorf("failed to write catalog: %w", err)
+		return err
 	}
 
 	// Create the signature object
-	signature_object, byte_range_start_byte, signature_contents_start_byte := context.createSignaturePlaceholder()
+	var signature_object string
+	var byte_range_start_byte, signature_contents_start_byte int64
 
-	info, err := context.createInfo()
+	switch context.SignData.Signature.CertType {
-	if err != nil {
+	case TimeStampSignature:
-		return fmt.Errorf("failed to create info: %w", err)
+		signature_object, byte_range_start_byte, signature_contents_start_byte = context.createTimestampPlaceholder()
+	default:
+		signature_object, byte_range_start_byte, signature_contents_start_byte = context.createSignaturePlaceholder()
 	}
 
-	context.InfoData.Length = int64(len(info))
+	appended_bytes := context.Filesize + int64(len(catalog)) + int64(len(visual_signature))
-
-	// Write the new catalog object.
-	if _, err := context.OutputBuffer.Write([]byte(info)); err != nil {
-		return fmt.Errorf("failed to write info: %w", err)
-	}
-
-	appended_bytes := context.Filesize + int64(len(catalog)) + int64(len(visual_signature)) + int64(len(info))
 
 	// Positions are relative to old start position of xref table.
 	byte_range_start_byte += appended_bytes
@@ -317,7 +335,7 @@ func (context *SignContext) SignPDF() error {
 	}
 
 	if err := context.replaceSignature(); err != nil {
-		return fmt.Errorf("failed to replace signature: %w", err)
+		return err
 	}
 
 	if _, err := context.OutputBuffer.Seek(0, 0); err != nil {
@@ -326,7 +344,7 @@ func (context *SignContext) SignPDF() error {
 	file_content := context.OutputBuffer.Buff.Bytes()
 
 	if _, err := context.OutputFile.Write(file_content); err != nil {
-		return fmt.Errorf("failed to write to output file: %w", err)
+		return err
 	}
 
 	return nil