Digitally Sign PDF Files - Python Sample Code

1//
2// Copyright (c) 2001-2024 by Apryse Software Inc. All Rights Reserved.
3//
4
5//----------------------------------------------------------------------------------------------------------------------
6// This sample demonstrates the basic usage of the high-level digital signatures API in PDFNet.
7//
8// The following steps reflect typical intended usage of the digital signatures API:
9//
10//	0.	Start with a PDF with or without form fields in it that one would like to lock (or, one can add a field, see (1)).
11//	
12//	1.	EITHER: 
13//		(a) Call doc.CreateDigitalSignatureField, optionally providing a name. You receive a DigitalSignatureField.
14//		-OR-
15//		(b) If you didn't just create the digital signature field that you want to sign/certify, find the existing one within the 
16//		document by using PDFDoc.DigitalSignatureFieldIterator or by using PDFDoc.GetField to get it by its fully qualified name.
17//	
18//	2.	Create a signature widget annotation, and pass the DigitalSignatureField that you just created or found. 
19//		If you want it to be visible, provide a Rect argument with a non-zero width or height, and don't set the
20//		NoView and Hidden flags. [Optionally, add an appearance to the annotation when you wish to sign/certify.]
21//		
22//	[3. (OPTIONAL) Add digital signature restrictions to the document using the field modification permissions (SetFieldPermissions) 
23//		or document modification permissions functions (SetDocumentPermissions) of DigitalSignatureField. These features disallow 
24//		certain types of changes to be made to the document without invalidating the cryptographic digital signature once it
25//		is signed.]
26//		
27//	4. 	Call either CertifyOnNextSave or SignOnNextSave. There are three overloads for each one (six total):
28//		a.	Taking a PKCS #12 keyfile path and its password
29//		b.	Taking a buffer containing a PKCS #12 private keyfile and its password
30//		c.	Taking a unique identifier of a signature handler registered with the PDFDoc. This overload is to be used
31//			in the following fashion: 
32//			i)		Extend and implement a new SignatureHandler. The SignatureHandler will be used to add or 
33//					validate/check a digital signature.
34//			ii)		Create an instance of the implemented SignatureHandler and register it with PDFDoc with 
35//					pdfdoc.AddSignatureHandler(). The method returns a SignatureHandlerId.
36//			iii)	Call SignOnNextSaveWithCustomHandler/CertifyOnNextSaveWithCustomHandler with the SignatureHandlerId.
37//		NOTE: It is only possible to sign/certify one signature per call to the Save function.
38//	
39//	5.	Call pdfdoc.Save(). This will also create the digital signature dictionary and write a cryptographic signature to it.
40//		IMPORTANT: If there are already signed/certified digital signature(s) in the document, you must save incrementally
41//		so as to not invalidate the other signature(s). 
42//
43// Additional processing can be done before document is signed. For example, UseSignatureHandler() returns an instance
44// of SDF dictionary which represents the signature dictionary (or the /V entry of the form field). This can be used to
45// add additional information to the signature dictionary (e.g. Name, Reason, Location, etc.).
46//
47// Although the steps above describes extending the SignatureHandler class, this sample demonstrates the use of
48// StdSignatureHandler (a built-in SignatureHandler in PDFNet) to sign a PDF file.
49//----------------------------------------------------------------------------------------------------------------------
50
51// In order to use .NET Framework's Cryptography library, define "USE_DOTNET_CRYPTO" and then add System.Security to
52// references list.
53
54using System;
55using System.Collections.Generic;
56using System.IO;
57#if USE_DOTNET_CRYPTO
58using System.Security.Cryptography;
59using System.Security.Cryptography.Pkcs;
60using System.Security.Cryptography.X509Certificates;
61#endif // USE_DOTNET_CRYPTO
62
63using pdftron;
64using pdftron.Common;
65using pdftron.PDF;
66using pdftron.PDF.Annots;
67using pdftron.SDF;
68using pdftron.Crypto;
69
70namespace DigitalSignaturesTestCS
71{
72	//////////////////// Here follows an example of how to implement a custom signature handler. //////////
73#if USE_DOTNET_CRYPTO
74	class DotNetCryptoSignatureHandler : SignatureHandler
75	{
76		private List<byte> m_data;
77		private string m_signingCert;
78		private string m_certPassword;
79
80		public DotNetCryptoSignatureHandler(string signingCert, string password)
81		{
82			m_signingCert = signingCert;
83			m_certPassword = password;
84			m_data = new List<byte>();
85		}
86
87		public override void AppendData(byte[] data)
88		{
89			m_data.AddRange(data);
90		}
91
92		public override bool Reset()
93		{
94			m_data.Clear();
95			return (true);
96		}
97
98		public override byte[] CreateSignature()
99		{
100			try {
101				ContentInfo ci = new ContentInfo(m_data.ToArray());
102				SignedCms sc = new SignedCms(ci, true);
103				X509Certificate2 cert = new X509Certificate2(m_signingCert, m_certPassword);
104				CmsSigner cs = new CmsSigner();
105				cs.Certificate = cert;
106				cs.DigestAlgorithm = new Oid("2.16.840.1.101.3.4.2.1");//SHA256
107				sc.ComputeSignature(cs);
108				byte[] sig = sc.Encode();
109				return (sig);
110			}
111			catch (Exception e) {
112				Console.Error.WriteLine(e);
113			}
114			return (null);
115		}
116
117		public override string GetName()
118		{
119			return ("Adobe.PPKLite");
120		}
121	}
122#endif // USE_DOTNET_CRYPTO
123	////////// End of the DotNetCryptoSignatureHandler custom handler code. ////////////////////
124
125	class Class1
126	{
127		static string input_path = "../../../../TestFiles/";
128		static string output_path = "../../../../TestFiles/Output/";
129
130		static bool VerifySimple (string in_docpath, string in_public_key_file_path)
131		{
132			using (PDFDoc doc = new PDFDoc(in_docpath))
133			{
134				Console.WriteLine("==========");
135				VerificationOptions opts = new VerificationOptions(VerificationOptions.SignatureVerificationSecurityLevel.e_compatibility_and_archiving);
136
137				// Add trust root to store of trusted certificates contained in VerificationOptions.
138				opts.AddTrustedCertificate(in_public_key_file_path, 
139					(ushort)(VerificationOptions.CertificateTrustFlag.e_default_trust | VerificationOptions.CertificateTrustFlag.e_certification_trust));
140
141				PDFDoc.SignaturesVerificationStatus result = doc.VerifySignedDigitalSignatures(opts);
142				switch (result)
143				{
144					case PDFDoc.SignaturesVerificationStatus.e_unsigned:
145						Console.WriteLine("Document has no signed signature fields.");
146						return false;
147					/* e_failure == bad doc status, digest status, or permissions status
148					(i.e. does not include trust issues, because those are flaky due to being network/config-related) */
149					case PDFDoc.SignaturesVerificationStatus.e_failure:
150						Console.WriteLine("Hard failure in verification on at least one signature.");
151						return false;
152					case PDFDoc.SignaturesVerificationStatus.e_untrusted:
153						Console.WriteLine("Could not verify trust for at least one signature.");
154						return false;
155					case PDFDoc.SignaturesVerificationStatus.e_unsupported:
156						/* If necessary, call GetUnsupportedFeatures on VerificationResult to check which
157						unsupported features were encountered (requires verification using 'detailed' APIs) */
158						Console.WriteLine("At least one signature contains unsupported features.");
159						return false;
160					// unsigned sigs skipped; parts of document may be unsigned (check GetByteRanges on signed sigs to find out)
161					case PDFDoc.SignaturesVerificationStatus.e_verified:
162						Console.WriteLine("All signed signatures in document verified.");
163						return true;
164					default:
165						throw new Exception("unrecognized document verification status");
166				}
167			}
168		}   
169			 
170		static bool VerifyAllAndPrint(string in_docpath, string in_public_key_file_path)
171		{
172			using (PDFDoc doc = new PDFDoc(in_docpath))
173			{
174				Console.WriteLine("==========");
175				VerificationOptions opts = new VerificationOptions(VerificationOptions.SignatureVerificationSecurityLevel.e_compatibility_and_archiving);
176
177				// Add trust root to store of trusted certificates contained in VerificationOptions.
178				opts.AddTrustedCertificate(in_public_key_file_path, 
179					(ushort) (VerificationOptions.CertificateTrustFlag.e_default_trust | VerificationOptions.CertificateTrustFlag.e_certification_trust));
180
181				// Iterate over the signatures and verify all of them.
182				DigitalSignatureFieldIterator digsig_fitr = doc.GetDigitalSignatureFieldIterator();
183				bool verification_status = true;
184				for (; digsig_fitr.HasNext(); digsig_fitr.Next())
185				{
186					DigitalSignatureField curr = digsig_fitr.Current();
187					VerificationResult result = curr.Verify(opts);
188					if (result.GetVerificationStatus())
189					{
190						Console.Write("Signature verified, ");
191					}
192					else
193					{
194						Console.Write("Signature verification failed, ");
195						verification_status = false;
196					}
197					Console.WriteLine("objnum: {0}", curr.GetSDFObj().GetObjNum());
198
199					switch (result.GetDigestAlgorithm())
200					{
201						case DigestAlgorithm.Type.e_sha1:
202							Console.WriteLine("Digest algorithm: SHA-1");
203							break;
204						case DigestAlgorithm.Type.e_sha256:
205							Console.WriteLine("Digest algorithm: SHA-256");
206							break;
207						case DigestAlgorithm.Type.e_sha384:
208							Console.WriteLine("Digest algorithm: SHA-384");
209							break;
210						case DigestAlgorithm.Type.e_sha512:
211							Console.WriteLine("Digest algorithm: SHA-512");
212							break;
213						case DigestAlgorithm.Type.e_ripemd160:
214							Console.WriteLine("Digest algorithm: RIPEMD-160");
215							break;
216						case DigestAlgorithm.Type.e_unknown_digest_algorithm:
217							Console.WriteLine("Digest algorithm: unknown");
218							break;
219						default:
220							throw new Exception("unrecognized digest algorithm");
221					}
222					Console.WriteLine("Detailed verification result: \n\t{0}\n\t{1}\n\t{2}\n\t{3}", 
223						result.GetDocumentStatusAsString(),
224						result.GetDigestStatusAsString(),
225						result.GetTrustStatusAsString(),
226						result.GetPermissionsStatusAsString());
227
228
229					DisallowedChange[] changes = result.GetDisallowedChanges();
230					foreach (DisallowedChange it2 in changes)
231					{
232						Console.WriteLine("\tDisallowed change: {0}, objnum: {1}", it2.GetTypeAsString(), it2.GetObjNum());
233					}
234
235					// Get and print all the detailed trust-related results, if they are available.
236					if (result.HasTrustVerificationResult())
237					{
238						TrustVerificationResult trust_verification_result = result.GetTrustVerificationResult();
239						Console.WriteLine(trust_verification_result.WasSuccessful() ? "Trust verified." : "Trust not verifiable.");
240						Console.WriteLine(trust_verification_result.GetResultString());
241
242						long time_of_verification = trust_verification_result.GetTimeOfTrustVerification();
243						switch (trust_verification_result.GetTimeOfTrustVerificationEnum())
244						{
245							case VerificationOptions.TimeMode.e_current:
246								Console.WriteLine("Trust verification attempted with respect to current time (as epoch time): {0}", time_of_verification);
247								break;
248							case VerificationOptions.TimeMode.e_signing:
249								Console.WriteLine("Trust verification attempted with respect to signing time (as epoch time): {0}", time_of_verification);
250								break;
251							case VerificationOptions.TimeMode.e_timestamp:
252								Console.WriteLine("Trust verification attempted with respect to secure embedded timestamp (as epoch time): {0}", time_of_verification);
253								break;
254							default:
255								throw new Exception("unrecognized time enum value");
256						}
257
258						if (trust_verification_result.GetCertPath().Length == 0)
259						{
260							Console.WriteLine("Could not print certificate path.");
261						}
262						else
263						{
264							Console.WriteLine("Certificate path:");
265							X509Certificate[] cert_path = trust_verification_result.GetCertPath();
266							for (int j = 0; j < cert_path.Length; j++)
267							{
268								Console.WriteLine("\tCertificate:");
269								X509Certificate full_cert = cert_path[j];
270								Console.WriteLine("\t\tIssuer names:");
271								X501AttributeTypeAndValue[] issuer_dn = full_cert.GetIssuerField().GetAllAttributesAndValues();
272								for (int i = 0; i < issuer_dn.Length; i++)
273								{
274									Console.WriteLine("\t\t\t" + issuer_dn[i].GetStringValue());
275								}
276								Console.WriteLine("\t\tSubject names:");
277								X501AttributeTypeAndValue[] subject_dn = full_cert.GetSubjectField().GetAllAttributesAndValues();
278								for (int i = 0; i < subject_dn.Length; i++)
279								{
280									Console.WriteLine("\t\t\t" + subject_dn[i].GetStringValue());
281								}
282								Console.WriteLine("\t\tExtensions:");
283								for (int i = 0; i < full_cert.GetExtensions().Length; i++)
284								{
285									Console.WriteLine("\t\t\t" + full_cert.GetExtensions()[i].ToString());
286								}
287							}
288						}
289					}
290					else
291					{
292						Console.WriteLine("No detailed trust verification result available.");
293					}
294
295					string[] unsupported_features = result.GetUnsupportedFeatures();
296					if (unsupported_features.Length > 0)
297					{
298						Console.WriteLine("Unsupported features:");
299
300						for (int i = 0; i < unsupported_features.Length; i++)
301						{
302							Console.WriteLine("\t" + unsupported_features[i]);
303						}
304					}
305					Console.WriteLine("==========");
306				}
307
308				return verification_status;
309			}
310		}
311
312		static void CertifyPDF(string in_docpath,
313			string in_cert_field_name,
314			string in_private_key_file_path,
315			string in_keyfile_password,
316			string in_appearance_image_path,
317			string in_outpath)
318		{
319			Console.Out.WriteLine("================================================================================");
320			Console.Out.WriteLine("Certifying PDF document");
321
322			// Open an existing PDF
323			using (PDFDoc doc = new PDFDoc(in_docpath))
324			{
325				Console.Out.WriteLine("PDFDoc has " + (doc.HasSignatures() ? "signatures" : "no signatures"));
326
327				Page page1 = doc.GetPage(1);
328
329				// Create a text field that we can lock using the field permissions feature.
330				TextWidget annot1 = TextWidget.Create(doc, new Rect(143, 440, 350, 460), "asdf_test_field");
331				page1.AnnotPushBack(annot1);
332
333				/* Create a new signature form field in the PDFDoc. The name argument is optional;
334				leaving it empty causes it to be auto-generated. However, you may need the name for later.
335				Acrobat doesn't show digsigfield in side panel if it's without a widget. Using a
336				Rect with 0 width and 0 height, or setting the NoPrint/Invisible flags makes it invisible. */
337				DigitalSignatureField certification_sig_field = doc.CreateDigitalSignatureField(in_cert_field_name);
338				SignatureWidget widgetAnnot = SignatureWidget.Create(doc, new Rect(143, 287, 219, 306), certification_sig_field);
339				page1.AnnotPushBack(widgetAnnot);
340
341				// (OPTIONAL) Add an appearance to the signature field.
342				Image img = Image.Create(doc, in_appearance_image_path);
343				widgetAnnot.CreateSignatureAppearance(img);
344
345				// Prepare the document locking permission level. It will be applied upon document certification.
346				Console.Out.WriteLine("Adding document permissions.");
347				certification_sig_field.SetDocumentPermissions(DigitalSignatureField.DocumentPermissions.e_annotating_formfilling_signing_allowed);
348				
349				// Prepare to lock the text field that we created earlier.
350				Console.Out.WriteLine("Adding field permissions.");
351				string[] fields_to_lock = new string[1];
352				fields_to_lock[0] = "asdf_test_field";
353				certification_sig_field.SetFieldPermissions(DigitalSignatureField.FieldPermissions.e_include, fields_to_lock);
354
355			#if USE_DOTNET_CRYPTO
356				DotNetCryptoSignatureHandler sigHandler = new DotNetCryptoSignatureHandler(in_private_key_file_path, in_keyfile_password);
357				SignatureHandlerId sigHandlerId = doc.AddSignatureHandler(sigHandler);
358				certification_sig_field.CertifyOnNextSaveWithCustomHandler(sigHandlerId);
359				/* Add to the digital signature dictionary a SubFilter name that uniquely identifies the signature format 
360				for verification tools. As an example, the custom handler defined in this file uses the CMS/PKCS #7 detached format, 
361				so we embed one of the standard predefined SubFilter values: "adbe.pkcs7.detached". It is not necessary to do this 
362				when using the StdSignatureHandler. */
363				Obj f_obj = certification_sig_field.GetSDFObj();
364				f_obj.FindObj("V").PutName("SubFilter", "adbe.pkcs7.detached");
365			#else
366				certification_sig_field.CertifyOnNextSave(in_private_key_file_path, in_keyfile_password);
367			#endif
368
369				// (OPTIONAL) Add more information to the signature dictionary.
370				certification_sig_field.SetLocation("Vancouver, BC");
371				certification_sig_field.SetReason("Document certification.");
372				certification_sig_field.SetContactInfo("www.pdftron.com");
373
374				// Save the PDFDoc. Once the method below is called, PDFNet will also sign the document using the information provided.
375				doc.Save(in_outpath, 0);
376			}
377
378			Console.Out.WriteLine("================================================================================");
379		}
380
381		static void SignPDF(string in_docpath,
382			string in_approval_field_name,
383			string in_private_key_file_path,
384			string in_keyfile_password,
385			string in_appearance_img_path,
386			string in_outpath)
387		{
388			Console.Out.WriteLine("================================================================================");
389			Console.Out.WriteLine("Signing PDF document");
390
391			// Open an existing PDF
392			using (PDFDoc doc = new PDFDoc(in_docpath))
393			{
394				// Retrieve the unsigned approval signature field.
395				Field found_approval_field = doc.GetField(in_approval_field_name);
396				DigitalSignatureField found_approval_signature_digsig_field = new DigitalSignatureField(found_approval_field);
397				
398				// (OPTIONAL) Add an appearance to the signature field.
399				Image img = Image.Create(doc, in_appearance_img_path);
400				SignatureWidget found_approval_signature_widget = new SignatureWidget(found_approval_field.GetSDFObj());
401				found_approval_signature_widget.CreateSignatureAppearance(img);
402
403				// Prepare the signature and signature handler for signing.
404			#if USE_DOTNET_CRYPTO
405				DotNetCryptoSignatureHandler sigHandler = new DotNetCryptoSignatureHandler(in_private_key_file_path, in_keyfile_password);
406				SignatureHandlerId sigHandlerId = doc.AddSignatureHandler(sigHandler);
407				found_approval_signature_digsig_field.SignOnNextSaveWithCustomHandler(sigHandlerId);
408				/* Add a SubFilter name that uniquely identifies the signature format for verification tools. As an 
409				example, the custom handler defined in this file uses the CMS/PKCS #7 detached format, so we embed 
410				one of the standard predefined SubFilter values: "adbe.pkcs7.detached". It is not necessary to do this 
411				when using the StdSignatureHandler.*/
412				Obj f_obj = found_approval_signature_digsig_field.GetSDFObj();
413				f_obj.FindObj("V").PutName("SubFilter", "adbe.pkcs7.detached");
414			#else
415				found_approval_signature_digsig_field.SignOnNextSave(in_private_key_file_path, in_keyfile_password);
416			#endif
417
418				// The actual approval signing will be done during the following incremental save operation.
419				doc.Save(in_outpath, SDFDoc.SaveOptions.e_incremental);
420			}
421			Console.Out.WriteLine("================================================================================");
422		}
423
424		static void ClearSignature(string in_docpath,
425			string in_digsig_field_name,
426			string in_outpath)
427		{
428			Console.Out.WriteLine("================================================================================");
429			Console.Out.WriteLine("Clearing certification signature");
430
431			using (PDFDoc doc = new PDFDoc(in_docpath))
432			{
433				DigitalSignatureField digsig = new DigitalSignatureField(doc.GetField(in_digsig_field_name));
434				
435				Console.Out.WriteLine("Clearing signature: " + in_digsig_field_name);
436				digsig.ClearSignature();
437
438				if (!digsig.HasCryptographicSignature())
439				{
440					Console.Out.WriteLine("Cryptographic signature cleared properly.");
441				}
442
443				// Save incrementally so as to not invalidate other signatures from previous saves.
444				doc.Save(in_outpath, SDFDoc.SaveOptions.e_incremental);
445			}
446
447			Console.Out.WriteLine("================================================================================");
448		}
449
450		static void PrintSignaturesInfo(string in_docpath)
451		{
452			Console.Out.WriteLine("================================================================================");
453			Console.Out.WriteLine("Reading and printing digital signature information");
454
455			using (PDFDoc doc = new PDFDoc(in_docpath))
456			{
457				if (!doc.HasSignatures())
458				{
459					Console.Out.WriteLine("Doc has no signatures.");
460					Console.Out.WriteLine("================================================================================");
461					return;
462				}
463				else
464				{
465					Console.Out.WriteLine("Doc has signatures.");
466				}
467
468				
469				for (FieldIterator fitr = doc.GetFieldIterator(); fitr.HasNext(); fitr.Next())
470				{
471					if (fitr.Current().IsLockedByDigitalSignature())
472					{
473						Console.Out.WriteLine("==========\nField locked by a digital signature");
474					}
475					else
476					{
477						Console.Out.WriteLine("==========\nField not locked by a digital signature");
478					}
479
480					Console.Out.WriteLine("Field name: " + fitr.Current().GetName());
481					Console.Out.WriteLine("==========");
482				}
483
484				Console.Out.WriteLine("====================\nNow iterating over digital signatures only.\n====================");
485
486				DigitalSignatureFieldIterator digsig_fitr = doc.GetDigitalSignatureFieldIterator();
487				for (; digsig_fitr.HasNext(); digsig_fitr.Next())
488				{
489					Console.Out.WriteLine("==========");
490					Console.Out.WriteLine("Field name of digital signature: " + new Field(digsig_fitr.Current().GetSDFObj()).GetName());
491
492					DigitalSignatureField digsigfield = digsig_fitr.Current();
493					if (!digsigfield.HasCryptographicSignature())
494					{
495						Console.Out.WriteLine("Either digital signature field lacks a digital signature dictionary, " +
496							"or digital signature dictionary lacks a cryptographic Contents entry. " +
497							"Digital signature field is not presently considered signed.\n" +
498							"==========");
499						continue;
500					}
501
502					int cert_count = digsigfield.GetCertCount();
503					Console.Out.WriteLine("Cert count: " + cert_count);
504					for (int i = 0; i < cert_count; ++i)
505					{
506						byte[] cert = digsigfield.GetCert(i);
507						Console.Out.WriteLine("Cert #" + i + " size: " + cert.Length);
508					}
509
510					DigitalSignatureField.SubFilterType subfilter = digsigfield.GetSubFilter();
511
512					Console.Out.WriteLine("Subfilter type: " + (int)subfilter);
513
514					if (subfilter != DigitalSignatureField.SubFilterType.e_ETSI_RFC3161)
515					{
516						Console.Out.WriteLine("Signature's signer: " + digsigfield.GetSignatureName());
517
518						Date signing_time = digsigfield.GetSigningTime();
519						if (signing_time.IsValid())
520						{
521							Console.Out.WriteLine("Signing time is valid.");
522						}
523
524						Console.Out.WriteLine("Location: " + digsigfield.GetLocation());
525						Console.Out.WriteLine("Reason: " + digsigfield.GetReason());
526						Console.Out.WriteLine("Contact info: " + digsigfield.GetContactInfo());
527					}
528					else
529					{
530						Console.Out.WriteLine("SubFilter == e_ETSI_RFC3161 (DocTimeStamp; no signing info)\n");
531					}
532
533					Console.Out.WriteLine(((digsigfield.HasVisibleAppearance()) ? "Visible" : "Not visible"));
534
535					DigitalSignatureField.DocumentPermissions digsig_doc_perms = digsigfield.GetDocumentPermissions();
536					string[] locked_fields = digsigfield.GetLockedFields();
537					foreach (string field_name in locked_fields)
538					{
539						Console.Out.WriteLine("This digital signature locks a field named: " + field_name);
540					}
541
542					switch (digsig_doc_perms)
543					{
544					case DigitalSignatureField.DocumentPermissions.e_no_changes_allowed:
545						Console.Out.WriteLine("No changes to the document can be made without invalidating this digital signature.");
546						break;
547					case DigitalSignatureField.DocumentPermissions.e_formfilling_signing_allowed:
548						Console.Out.WriteLine("Page template instantiation, form filling, and signing digital signatures are allowed without invalidating this digital signature.");
549						break;
550					case DigitalSignatureField.DocumentPermissions.e_annotating_formfilling_signing_allowed:
551						Console.Out.WriteLine("Annotating, page template instantiation, form filling, and signing digital signatures are allowed without invalidating this digital signature.");
552						break;
553					case DigitalSignatureField.DocumentPermissions.e_unrestricted:
554						Console.Out.WriteLine("Document not restricted by this digital signature.");
555						break;
556					default:
557						throw new Exception("Unrecognized digital signature document permission level.");
558					}
559					Console.Out.WriteLine("==========");
560				}
561			}
562
563			Console.Out.WriteLine("================================================================================");
564		}
565 
566		static void CustomSigningAPI(string doc_path,
567			string cert_field_name,
568			string private_key_file_path,
569			string keyfile_password,
570			string public_key_file_path,
571			string appearance_image_path,
572			DigestAlgorithm.Type digest_algorithm_type,
573			bool PAdES_signing_mode,
574			string output_path)
575		{
576			Console.Out.WriteLine("================================================================================");
577			Console.Out.WriteLine("Custom signing PDF document");
578			using (PDFDoc doc = new PDFDoc(doc_path))
579			{
580				Page page1 = doc.GetPage(1);
581
582				DigitalSignatureField digsig_field = doc.CreateDigitalSignatureField(cert_field_name);
583				SignatureWidget widgetAnnot = SignatureWidget.Create(doc, new Rect(143, 287, 219, 306), digsig_field);
584				page1.AnnotPushBack(widgetAnnot);
585
586				// (OPTIONAL) Add an appearance to the signature field.
587				Image img = Image.Create(doc, appearance_image_path);
588				widgetAnnot.CreateSignatureAppearance(img);
589
590				// Create a digital signature dictionary inside the digital signature field, in preparation for signing.
591				digsig_field.CreateSigDictForCustomSigning("Adobe.PPKLite",
592					PAdES_signing_mode ? DigitalSignatureField.SubFilterType.e_ETSI_CAdES_detached : DigitalSignatureField.SubFilterType.e_adbe_pkcs7_detached,
593					7500); // For security reasons, set the contents size to a value greater than but as close as possible to the size you expect your final signature to be, in bytes.
594						   // ... or, if you want to apply a certification signature, use CreateSigDictForCustomCertification instead.
595
596				// (OPTIONAL) Set the signing time in the signature dictionary, if no secure embedded timestamping support is available from your signing provider.
597				Date current_date = new Date();
598				current_date.SetCurrentTime();
599				digsig_field.SetSigDictTimeOfSigning(current_date);
600
601				doc.Save(output_path, SDFDoc.SaveOptions.e_incremental);
602
603				// Digest the relevant bytes of the document in accordance with ByteRanges surrounding the signature.
604				byte[] pdf_digest = digsig_field.CalculateDigest(digest_algorithm_type);
605
606				X509Certificate signer_cert = new X509Certificate(public_key_file_path);
607
608				// Optionally, you can add a custom signed attribute at this point, such as one of the PAdES ESS attributes.
609				// The function we provide takes care of generating the correct PAdES ESS attribute depending on your digest algorithm.
610				byte[] pades_versioned_ess_signing_cert_attribute = DigitalSignatureField.GenerateESSSigningCertPAdESAttribute(signer_cert, digest_algorithm_type);
611
612				// Generate the signedAttrs component of CMS, passing any optional custom signedAttrs (e.g. PAdES ESS).
613				// The signedAttrs are certain attributes that become protected by their inclusion in the signature.
614				byte[] signedAttrs = DigitalSignatureField.GenerateCMSSignedAttributes(pdf_digest, pades_versioned_ess_signing_cert_attribute);
615
616				// Calculate the digest of the signedAttrs (i.e. not the PDF digest, this time).
617				byte[] signedAttrs_digest = DigestAlgorithm.CalculateDigest(digest_algorithm_type, signedAttrs);
618
619				//////////////////////////// custom digest signing starts ////////////////////////////
620				// At this point, you can sign the digest (for example, with HSM). We use our own SignDigest function instead here as an example,
621				// which you can also use for your purposes if necessary as an alternative to the handler/callback APIs (i.e. Certify/SignOnNextSave).
622				byte[] signature_value = DigestAlgorithm.SignDigest(
623					signedAttrs_digest,
624					digest_algorithm_type,
625					private_key_file_path,
626					keyfile_password);
627				//////////////////////////// custom digest signing ends //////////////////////////////
628
629				// Then, load all your chain certificates into a container of X509Certificate.
630				X509Certificate[] chain_certs = {};
631
632				// Then, create ObjectIdentifiers for the algorithms you have used.
633				// Here we use digest_algorithm_type (usually SHA256) for hashing, and RSAES-PKCS1-v1_5 (specified in the private key) for signing.
634				ObjectIdentifier digest_algorithm_oid = new ObjectIdentifier(digest_algorithm_type);
635				ObjectIdentifier signature_algorithm_oid = new ObjectIdentifier(ObjectIdentifier.Predefined.e_RSA_encryption_PKCS1);
636
637				// Then, put the CMS signature components together.
638				byte[] cms_signature = DigitalSignatureField.GenerateCMSSignature(
639					signer_cert, chain_certs, digest_algorithm_oid, signature_algorithm_oid,
640					signature_value, signedAttrs);
641
642				// Write the signature to the document.
643				doc.SaveCustomSignature(cms_signature, digsig_field, output_path);
644			}
645			Console.Out.WriteLine("================================================================================");
646		}
647
648		static bool TimestampAndEnableLTV(string doc_path, 
649			string tsa_url,
650			string trusted_cert_path, 
651			string appearance_img_path,
652			string output_path)
653		{
654			using (PDFDoc doc = new PDFDoc(doc_path))
655			{
656				DigitalSignatureField doctimestamp_signature_field = doc.CreateDigitalSignatureField();
657				TimestampingConfiguration tst_config = new TimestampingConfiguration(tsa_url);
658				VerificationOptions opts = new VerificationOptions(VerificationOptions.SignatureVerificationSecurityLevel.e_compatibility_and_archiving);
659				/* It is necessary to add to the VerificationOptions a trusted root certificate corresponding to 
660				the chain used by the timestamp authority to sign the timestamp token, in order for the timestamp
661				response to be verifiable during DocTimeStamp signing. It is also necessary in the context of this 
662				function to do this for the later LTV section, because one needs to be able to verify the DocTimeStamp 
663				in order to enable LTV for it, and we re-use the VerificationOptions opts object in that part. */
664				opts.AddTrustedCertificate(trusted_cert_path);
665				/* By default, we only check online for revocation of certificates using the newer and lighter 
666				OCSP protocol as opposed to CRL, due to lower resource usage and greater reliability. However, 
667				it may be necessary to enable online CRL revocation checking in order to verify some timestamps
668				(i.e. those that do not have an OCSP responder URL for all non-trusted certificates). */
669				opts.EnableOnlineCRLRevocationChecking(true);
670
671				SignatureWidget widgetAnnot = SignatureWidget.Create(doc, new Rect(0, 100, 200, 150), doctimestamp_signature_field);
672				doc.GetPage(1).AnnotPushBack(widgetAnnot);
673				Obj widgetObj = widgetAnnot.GetSDFObj();
674
675				// (OPTIONAL) Add an appearance to the signature field.
676				Image img = Image.Create(doc, appearance_img_path);
677				widgetAnnot.CreateSignatureAppearance(img);
678
679				Console.WriteLine("Testing timestamping configuration.");
680				TimestampingResult config_result = tst_config.TestConfiguration(opts);
681				if (config_result.GetStatus())
682				{
683					Console.WriteLine("Success: timestamping configuration usable. Attempting to timestamp.");
684				}
685				else
686				{
687					// Print details of timestamping failure.
688					Console.WriteLine(config_result.GetString());
689					if (config_result.HasResponseVerificationResult())
690					{
691						EmbeddedTimestampVerificationResult tst_result = config_result.GetResponseVerificationResult();
692						Console.WriteLine("CMS digest status: {0}\n", tst_result.GetCMSDigestStatusAsString());
693						Console.WriteLine("Message digest status:{0}\n", tst_result.GetMessageImprintDigestStatusAsString());
694						Console.WriteLine("Trust status: {0}\n", tst_result.GetTrustStatusAsString());
695					}
696					return false;
697				}
698
699				doctimestamp_signature_field.TimestampOnNextSave(tst_config, opts);
700
701				// Save/signing throws if timestamping fails.
702				doc.Save(output_path, SDFDoc.SaveOptions.e_incremental);
703
704				Console.WriteLine("Timestamping successful. Adding LTV information for DocTimeStamp signature.");
705
706				// Add LTV information for timestamp signature to document.
707				VerificationResult timestamp_verification_result = doctimestamp_signature_field.Verify(opts);
708				if (!doctimestamp_signature_field.EnableLTVOfflineVerification(timestamp_verification_result))
709				{
710					Console.WriteLine("Could not enable LTV for DocTimeStamp.");
711					return false;
712				}
713				doc.Save(output_path, SDFDoc.SaveOptions.e_incremental);
714				Console.WriteLine("Added LTV information for DocTimeStamp signature successfully.");
715
716				return true;
717			}
718		}
719		
720		private static pdftron.PDFNetLoader pdfNetLoader = pdftron.PDFNetLoader.Instance();
721		static Class1() {}
722
723		/// <summary>
724		/// The main entry point for the application.
725		/// </summary>
726		[STAThread]
727		static void Main(string[] args)
728		{
729			// Initialize PDFNetC
730			PDFNet.Initialize(PDFTronLicense.Key);
731
732			bool result = true;
733
734			//////////////////// TEST 0: 
735			/* Create an approval signature field that we can sign after certifying.
736			(Must be done before calling CertifyOnNextSave/SignOnNextSave/WithCustomHandler.) */
737			try
738			{
739				using (PDFDoc doc = new PDFDoc(input_path + "waiver.pdf")) 
740				{
741					DigitalSignatureField approval_signature_field = doc.CreateDigitalSignatureField("PDFTronApprovalSig");
742					SignatureWidget widgetAnnotApproval = SignatureWidget.Create(doc, new Rect(300, 287, 376, 306), approval_signature_field);
743					Page page1 = doc.GetPage(1);
744					page1.AnnotPushBack(widgetAnnotApproval);
745					doc.Save(output_path + "waiver_withApprovalField_output.pdf", SDFDoc.SaveOptions.e_remove_unused);
746				}				
747			}
748			catch (Exception e)
749			{
750				Console.Error.WriteLine(e);
751				result = false;
752			}
753
754			//////////////////// TEST 1: certify a PDF.
755			try
756			{
757				CertifyPDF(input_path + "waiver_withApprovalField.pdf",
758					"PDFTronCertificationSig",
759					input_path + "pdftron.pfx",
760					"password",
761					input_path + "pdftron.bmp",
762					output_path + "waiver_withApprovalField_certified_output.pdf");
763				PrintSignaturesInfo(output_path + "waiver_withApprovalField_certified_output.pdf");
764			}
765			catch (Exception e)
766			{
767				Console.Error.WriteLine(e);
768				result = false;
769			}
770
771			//////////////////// TEST 2: approval-sign an existing, unsigned signature field in a PDF that already has a certified signature field.
772			try
773			{
774				SignPDF(input_path + "waiver_withApprovalField_certified.pdf",
775					"PDFTronApprovalSig",
776					input_path + "pdftron.pfx",
777					"password",
778					input_path + "signature.jpg",
779					output_path + "waiver_withApprovalField_certified_approved_output.pdf");
780				PrintSignaturesInfo(output_path + "waiver_withApprovalField_certified_approved_output.pdf");
781			}
782			catch (Exception e)
783			{
784				Console.Error.WriteLine(e);
785				result = false;
786			}
787
788			//////////////////// TEST 3: Clear a certification from a document that is certified and has an approval signature.
789			try
790			{
791				ClearSignature(input_path + "waiver_withApprovalField_certified_approved.pdf",
792					"PDFTronCertificationSig",
793					output_path + "waiver_withApprovalField_certified_approved_certcleared_output.pdf");
794				PrintSignaturesInfo(output_path + "waiver_withApprovalField_certified_approved_certcleared_output.pdf");
795			}
796			catch (Exception e)
797			{
798				Console.Error.WriteLine(e);
799				result = false;
800			}
801
802			//////////////////// TEST 4: Verify a document's digital signatures.
803			try
804			{
805				if (!VerifyAllAndPrint(input_path + "waiver_withApprovalField_certified_approved.pdf",
806						input_path + "pdftron.cer"))
807				{
808					result = false;
809				}
810			}
811			catch (Exception e)
812			{
813				Console.Error.WriteLine(e);
814				result = false;
815			}
816			//////////////////// TEST 5: Verify a document's digital signatures in a simple fashion using the document API.
817			try
818			{
819				if (!VerifySimple(input_path + "waiver_withApprovalField_certified_approved.pdf",
820				input_path + "pdftron.cer"))
821				{
822					result = false;
823				}
824			}
825			catch (Exception e)
826			{
827				Console.Error.WriteLine(e);
828				result = false;
829			}
830
831			//////////////////// TEST 6: Custom signing API.
832			// The Apryse custom signing API is a set of APIs related to cryptographic digital signatures
833			// which allows users to customize the process of signing documents. Among other things, this
834			// includes the capability to allow for easy integration of PDF-specific signing-related operations
835			// with access to Hardware Security Module (HSM) tokens/devices, access to cloud keystores, access
836			// to system keystores, etc.
837			try
838			{
839				CustomSigningAPI(input_path + "waiver.pdf",
840					"PDFTronApprovalSig",
841					input_path + "pdftron.pfx",
842					"password",
843					input_path + "pdftron.cer",
844					input_path + "signature.jpg",
845					DigestAlgorithm.Type.e_sha256,
846					true,
847					output_path + "waiver_custom_signed.pdf");
848			}
849			catch (Exception e)
850			{
851				Console.Error.WriteLine(e);
852				result = false;
853			}
854
855			//////////////////// TEST 7: Timestamp a document, then add Long Term Validation (LTV) information for the DocTimeStamp.
856			// try
857			// {
858			// 	// Replace YOUR_URL_OF_TSA with the timestamp authority (TSA) URL to use during timestamping.
859			// 	// For example, as of July 2024, http://timestamp.globalsign.com/tsa/r6advanced1 was usable.
860			// 	// Note that this url may not work in the future. A reliable solution requires using your own TSA.
861			// 	string tsa_url = "YOUR_URL_OF_TSA";
862			// 	if (tsa_url == "YOUR_URL_OF_TSA")
863			// 	{
864			// 		throw new Exception("Error: The URL of your timestamp authority was not specified.");
865			// 	}
866			//
867			// 	// Replace YOUR_CERTIFICATE with the trusted root certificate corresponding to the chain used by the timestamp authority.
868			// 	// For example, as of July 2024, https://secure.globalsign.com/cacert/gstsacasha384g4.crt was usable.
869			// 	// Note that this certificate may not work in the future. A reliable solution requires using your own TSA certificate.
870			// 	string trusted_cert_path = "YOUR_CERTIFICATE";
871			// 	if (trusted_cert_path == "YOUR_CERTIFICATE")
872			// 	{
873			// 		throw new Exception("Error: The path to your timestamp authority trusted root certificate was not specified.");
874			// 	}
875			//
876			// 	if (!TimestampAndEnableLTV(input_path + "waiver.pdf",
877			// 		tsa_url,
878			// 		trusted_cert_path,
879			// 		input_path + "signature.jpg",
880			// 		output_path+ "waiver_DocTimeStamp_LTV.pdf"))
881			// 	{
882			// 		result = false;
883			// 	}
884			// }
885			// catch (Exception e)
886			// {
887			// 	Console.Error.WriteLine(e);
888			// 	result = false;
889			// }
890
891			//////////////////// End of tests. ////////////////////
892			PDFNet.Terminate();
893			if (result)
894			{
895				Console.Out.WriteLine("Tests successful.\n==========");
896			}
897			else
898			{
899				Console.Out.WriteLine("Tests FAILED!!!\n==========");
900			}
901		}
902	}
903}

1//---------------------------------------------------------------------------------------
2// Copyright (c) 2001-2024 by Apryse Software Inc. All Rights Reserved.
3// Consult LICENSE.txt regarding license information.
4//---------------------------------------------------------------------------------------
5
6////----------------------------------------------------------------------------------------------------------------------
7//// This sample demonstrates the basic usage of the high-level digital signatures API in PDFNet.
8////
9//// The following steps reflect typical intended usage of the digital signatures API:
10////
11////  0.  Start with a PDF with or without form fields in it that one would like to lock (or, one can add a field, see (1)).
12////  
13////  1.  EITHER: 
14////      (a) Call doc.CreateDigitalSignatureField, optionally providing a name. You receive a DigitalSignatureField.
15////      -OR-
16////      (b) If you didn't just create the digital signature field that you want to sign/certify, find the existing one within the 
17////      document by using PDFDoc.DigitalSignatureFieldIterator or by using PDFDoc.GetField to get it by its fully qualified name.
18////  
19////  2.  Create a signature widget annotation, and pass the DigitalSignatureField that you just created or found. 
20////      If you want it to be visible, provide a Rect argument with a non-zero width or height, and don't set the
21////      NoView and Hidden flags. [Optionally, add an appearance to the annotation when you wish to sign/certify.]
22////      
23////  [3. (OPTIONAL) Add digital signature restrictions to the document using the field modification permissions (SetFieldPermissions) 
24////      or document modification permissions functions (SetDocumentPermissions) of DigitalSignatureField. These features disallow 
25////      certain types of changes to be made to the document without invalidating the cryptographic digital signature once it
26////      is signed.]
27////      
28////  4.  Call either CertifyOnNextSave or SignOnNextSave. There are three overloads for each one (six total):
29////      a.  Taking a PKCS //12 keyfile path and its password
30////      b.  Taking a buffer containing a PKCS //12 private keyfile and its password
31////      c.  Taking a unique identifier of a signature handler registered with the PDFDoc. This overload is to be used
32////          in the following fashion: 
33////          i)      Extend and implement a new SignatureHandler. The SignatureHandler will be used to add or 
34////                  validate/check a digital signature.
35////          ii)     Create an instance of the implemented SignatureHandler and register it with PDFDoc with 
36////                  pdfdoc.AddSignatureHandler(). The method returns a SignatureHandlerId.
37////          iii)    Call SignOnNextSaveWithCustomHandler/CertifyOnNextSaveWithCustomHandler with the SignatureHandlerId.
38////      NOTE: It is only possible to sign/certify one signature per call to the Save function.
39////  
40////  5.  Call pdfdoc.Save(). This will also create the digital signature dictionary and write a cryptographic signature to it.
41////      IMPORTANT: If there are already signed/certified digital signature(s) in the document, you must save incrementally
42////      so as to not invalidate the other signature(s). 
43////
44//// Additional processing can be done before document is signed. For example, UseSignatureHandler() returns an instance
45//// of SDF dictionary which represents the signature dictionary (or the /V entry of the form field). This can be used to
46//// add additional information to the signature dictionary (e.g. Name, Reason, Location, etc.).
47////
48//// Although the steps above describes extending the SignatureHandler class, this sample demonstrates the use of
49//// StdSignatureHandler (a built-in SignatureHandler in PDFNet) to sign a PDF file.
50////----------------------------------------------------------------------------------------------------------------------
51
52package main
53import (
54    "fmt"
55    "strconv"
56    "flag"
57    "testing"
58    . "github.com/ApryseSDK/pdftron-go/v2"
59)
60
61var licenseKey string
62var modulePath string
63
64func init() {
65    flag.StringVar(&licenseKey, "license", "", "License key for Apryse SDK")
66    flag.StringVar(&modulePath, "modulePath", "", "Module path for Apryse SDK")
67}
68
69func VerifySimple(inDocpath string, inPublicKeyFilePath string) bool{
70    doc := NewPDFDoc(inDocpath)
71    fmt.Println("==========")
72    opts := NewVerificationOptions(VerificationOptionsE_compatibility_and_archiving)
73
74    // Add trust root to store of trusted certificates contained in VerificationOptions.
75    opts.AddTrustedCertificate(inPublicKeyFilePath, uint16(VerificationOptionsE_default_trust | VerificationOptionsE_certification_trust))
76
77    result := doc.VerifySignedDigitalSignatures(opts)
78        
79    if result == PDFDocE_unsigned{
80        fmt.Println("Document has no signed signature fields.")
81        return false
82        // e_failure == bad doc status, digest status, or permissions status
83        // (i.e. does not include trust issues, because those are flaky due to being network/config-related)
84    }else if result == PDFDocE_failure{
85        fmt.Println("Hard failure in verification on at least one signature.")
86        return false
87    }else if result == PDFDocE_untrusted{
88        fmt.Println("Could not verify trust for at least one signature.")
89        return false
90    }else if result == PDFDocE_unsupported{
91        // If necessary, call GetUnsupportedFeatures on VerificationResult to check which
92        // unsupported features were encountered (requires verification using 'detailed' APIs)
93        fmt.Println("At least one signature contains unsupported features.")
94        return false
95        // unsigned sigs skipped; parts of document may be unsigned (check GetByteRanges on signed sigs to find out)
96    }else if result == PDFDocE_verified{
97        fmt.Println("All signed signatures in document verified.")
98        return true
99    }else{
100        fmt.Println("unrecognized document verification status")
101        return false
102    }
103}
104
105func VerifyAllAndPrint(inDocpath string, inPublicKeyFilePath string) bool{
106    doc := NewPDFDoc(inDocpath)
107    fmt.Println("==========")
108    opts := NewVerificationOptions(VerificationOptionsE_compatibility_and_archiving)
109    
110    // Trust the public certificate we use for signing.
111    trustedCertFile := NewMappedFile(inPublicKeyFilePath)
112    fileSz := trustedCertFile.FileSize()
113    fileReader := NewFilterReader(trustedCertFile)
114    trustedCertBuf := fileReader.Read(fileSz)
115    trustedCertBytes := make([]byte, int(trustedCertBuf.Size()))
116    for i := 0; i < int(trustedCertBuf.Size()); i ++ {
117        trustedCertBytes[i] = trustedCertBuf.Get(i)
118    }
119    opts.AddTrustedCertificate(&trustedCertBytes[0], int64(len(trustedCertBytes)), uint16(VerificationOptionsE_default_trust | VerificationOptionsE_certification_trust))
120
121    // Iterate over the signatures and verify all of them.
122    digsigFitr := doc.GetDigitalSignatureFieldIterator()
123    verificationStatus := true
124    for (digsigFitr.HasNext()){
125        curr := digsigFitr.Current()
126        result := curr.Verify(opts)
127        if result.GetVerificationStatus(){
128            fmt.Printf("Signature verified, objnum: %d\n", curr.GetSDFObj().GetObjNum())
129        }else{
130            fmt.Printf("Signature verification failed, objnum: %d\n", curr.GetSDFObj().GetObjNum())
131            verificationStatus = false
132        }
133        digest_algorithm := result.GetDigestAlgorithm()
134        if digest_algorithm == DigestAlgorithmE_SHA1{
135            fmt.Println("Digest algorithm: SHA-1")
136        }else if digest_algorithm == DigestAlgorithmE_SHA256{
137            fmt.Println("Digest algorithm: SHA-256")
138        }else if digest_algorithm == DigestAlgorithmE_SHA384{
139            fmt.Println("Digest algorithm: SHA-384")
140        }else if digest_algorithm == DigestAlgorithmE_SHA512{
141            fmt.Println("Digest algorithm: SHA-512")
142        }else if digest_algorithm == DigestAlgorithmE_RIPEMD160{
143            fmt.Println("Digest algorithm: RIPEMD-160")
144        }else if digest_algorithm == DigestAlgorithmE_unknown_digest_algorithm{
145            fmt.Println("Digest algorithm: unknown")
146        }else{
147            //unrecognized document status
148        }
149        fmt.Printf("Detailed verification result: \n\t%s\n\t%s\n\t%s\n\t%s\n", 
150            result.GetDocumentStatusAsString(),
151            result.GetDigestStatusAsString(),
152            result.GetTrustStatusAsString(),
153            result.GetPermissionsStatusAsString())
154            
155        changes := result.GetDisallowedChanges()
156        for i := 0; i < int(changes.Size()); i++ {
157            fmt.Printf("\tDisallowed change: %s, objnum: %d\n", changes.Get(i).GetTypeAsString(), changes.Get(i).GetObjNum())
158        }
159
160        // Get and print all the detailed trust-related results, if they are available.
161        if result.HasTrustVerificationResult(){
162            trustVerificationResult := result.GetTrustVerificationResult()
163            var msg string
164            if trustVerificationResult.WasSuccessful(){
165                msg = "Trust verified."
166            } else {
167                msg = "Trust not verifiable."
168            }
169            fmt.Println(msg)
170            fmt.Println(trustVerificationResult.GetResultString())
171            
172            tmpTimeTv := trustVerificationResult.GetTimeOfTrustVerification()
173            
174            trustVerificationTimeEnum := trustVerificationResult.GetTimeOfTrustVerificationEnum()
175            
176            if trustVerificationTimeEnum == VerificationOptionsE_current{
177                fmt.Println("Trust verification attempted with respect to current time (as epoch time): " + strconv.Itoa(int(tmpTimeTv)))
178            }else if trustVerificationTimeEnum == VerificationOptionsE_signing{
179                fmt.Println("Trust verification attempted with respect to signing time (as epoch time): " + strconv.Itoa(int(tmpTimeTv)))
180            }else if trustVerificationTimeEnum == VerificationOptionsE_timestamp{
181                fmt.Println("Trust verification attempted with respect to secure embedded timestamp (as epoch time): " + strconv.Itoa(int(tmpTimeTv)))
182            }else{
183                //unrecognized time enum value
184            }
185
186            if trustVerificationResult.GetCertPath().Size() == 0{
187                fmt.Println("Could not print certificate path.")
188            }else{
189                fmt.Println("Certificate path:")
190                certPath := trustVerificationResult.GetCertPath()
191                for i := 0; i < int(certPath.Size()); i ++{
192                    fmt.Println("\tCertificate:")
193                    fmt.Println("\t\tIssuer names:")
194                    issuerDn := certPath.Get(i).GetIssuerField().GetAllAttributesAndValues()
195                    for j := 0; j < int(issuerDn.Size()); j ++{ 
196                        fmt.Println("\t\t\t" + issuerDn.Get(j).GetStringValue())
197                    }
198                    fmt.Println("\t\tSubject names:")
199                    subjectDn := certPath.Get(i).GetSubjectField().GetAllAttributesAndValues()
200                    for k := 0; k < int(subjectDn.Size()); k ++{
201                        fmt.Println("\t\t\t" + subjectDn.Get(k).GetStringValue())
202                    }
203                    fmt.Println("\t\tExtensions:")
204                    for m := 0; m < int(certPath.Get(i).GetExtensions().Size()); m ++{
205                        fmt.Println("\t\t\t" + certPath.Get(i).GetExtensions().Get(m).ToString())
206                    }
207                }
208            }        
209        }else{
210            fmt.Println("No detailed trust verification result available.")
211        
212            unsupportedFeatures := result.GetUnsupportedFeatures()
213            if unsupportedFeatures.Size() > 0 {
214                fmt.Println("Unsupported features:")
215                for i := 0; i < int(unsupportedFeatures.Size()); i ++{
216                    fmt.Println("\t" + unsupportedFeatures.Get(i))
217                }
218            }
219        }
220        fmt.Println("==========")
221        
222        digsigFitr.Next()
223    }
224    return verificationStatus
225}
226
227func CertifyPDF(inDocpath string,
228    inCertFieldName string ,
229    inPrivateKeyFilePath string,
230    inKeyfilePassword string,
231    inAppearanceImagePath string,
232    inOutpath string){
233    
234    fmt.Println("================================================================================")
235    fmt.Println("Certifying PDF document")
236
237    // Open an existing PDF
238    doc := NewPDFDoc(inDocpath)
239
240    if doc.HasSignatures(){
241        fmt.Println("PDFDoc has signatures")
242    }else{
243        fmt.Println("PDFDoc has no signatures")
244    }
245    page1 := doc.GetPage(1)
246
247    // Create a text field that we can lock using the field permissions feature.
248    annot1 := TextWidgetCreate(doc, NewRect(143.0, 440.0, 350.0, 460.0), "asdf_test_field")
249    page1.AnnotPushBack(annot1)
250
251    // Create a new signature form field in the PDFDoc. The name argument is optional;
252    // leaving it empty causes it to be auto-generated. However, you may need the name for later.
253    // Acrobat doesn"t show digsigfield in side panel if it's without a widget. Using a
254    // Rect with 0 width and 0 height, or setting the NoPrint/Invisible flags makes it invisible. 
255    certificationSigField := doc.CreateDigitalSignatureField(inCertFieldName)
256    widgetAnnot := SignatureWidgetCreate(doc, NewRect(143.0, 287.0, 219.0, 306.0), certificationSigField)
257    page1.AnnotPushBack(widgetAnnot)
258
259    // (OPTIONAL) Add an appearance to the signature field.
260    img := ImageCreate(doc.GetSDFDoc(), inAppearanceImagePath)
261    widgetAnnot.CreateSignatureAppearance(img)
262
263    // Add permissions. Lock the random text field.
264    fmt.Println("Adding document permissions.")
265    certificationSigField.SetDocumentPermissions(DigitalSignatureFieldE_annotating_formfilling_signing_allowed)
266    
267    // Prepare to lock the text field that we created earlier.
268    fmt.Println("Adding field permissions.")
269    testField := NewVectorString()
270    testField.Add("asdf_test_field")
271    certificationSigField.SetFieldPermissions(DigitalSignatureFieldE_include, testField)
272
273    certificationSigField.CertifyOnNextSave(inPrivateKeyFilePath, inKeyfilePassword)
274
275    // (OPTIONAL) Add more information to the signature dictionary.
276    certificationSigField.SetLocation("Vancouver, BC")
277    certificationSigField.SetReason("Document certification.")
278    certificationSigField.SetContactInfo("www.pdftron.com")
279
280    // Save the PDFDoc. Once the method below is called, PDFNet will also sign the document using the information provided.
281    doc.Save(inOutpath, uint(0))
282
283    fmt.Println("================================================================================")
284}
285
286func SignPDF(inDocpath string, 
287    inApprovalFieldName string, 
288    inPrivateKeyFilePath string, 
289    inKeyfilePassword string, 
290    inAppearanceImgPath string, 
291    inOutpath string){
292    
293    fmt.Println("================================================================================")
294    fmt.Println("Signing PDF document")
295
296    // Open an existing PDF
297    doc := NewPDFDoc(inDocpath)
298
299    // Retrieve the unsigned approval signature field.
300    foundApprovalField := doc.GetField(inApprovalFieldName)
301    foundApprovalSignatureDigsigField := NewDigitalSignatureField(foundApprovalField)
302    
303    // (OPTIONAL) Add an appearance to the signature field.
304    img := ImageCreate(doc.GetSDFDoc(), inAppearanceImgPath)
305    foundApprovalSignatureWidget := NewSignatureWidget(foundApprovalField.GetSDFObj())
306    foundApprovalSignatureWidget.CreateSignatureAppearance(img)
307
308    // Prepare the signature and signature handler for signing.
309    foundApprovalSignatureDigsigField.SignOnNextSave(inPrivateKeyFilePath, inKeyfilePassword)
310
311    // The actual approval signing will be done during the following incremental save operation.
312    doc.Save(inOutpath, uint(SDFDocE_incremental))
313
314    fmt.Println("================================================================================")
315}
316
317func ClearSignature(inDocpath string,
318    inDigsigFieldName string,
319    inOutpath string){
320
321    fmt.Println("================================================================================")
322    fmt.Println("Clearing certification signature")
323
324    doc := NewPDFDoc(inDocpath)
325
326    digsig := NewDigitalSignatureField(doc.GetField(inDigsigFieldName))
327    
328    fmt.Println("Clearing signature: " + inDigsigFieldName)
329    digsig.ClearSignature()
330
331    if !digsig.HasCryptographicSignature(){
332        fmt.Println("Cryptographic signature cleared properly.")
333    }
334    // Save incrementally so as to not invalidate other signatures from previous saves.
335    doc.Save(inOutpath, uint(SDFDocE_incremental))
336
337    fmt.Println("================================================================================")
338}
339
340func PrintSignaturesInfo(inDocpath string){
341    fmt.Println("================================================================================")
342    fmt.Println("Reading and printing digital signature information")
343
344    doc := NewPDFDoc(inDocpath)
345    if !doc.HasSignatures(){
346        fmt.Println("Doc has no signatures.")
347        fmt.Println("================================================================================")
348        return
349    }else{
350        fmt.Println("Doc has signatures.")
351    }
352
353    fitr := doc.GetFieldIterator()
354    for fitr.HasNext(){
355        current := fitr.Current()
356        if (current.IsLockedByDigitalSignature()){
357            fmt.Println("==========\nField locked by a digital signature")
358        }else{
359            fmt.Println("==========\nField not locked by a digital signature")
360        }
361        fmt.Println("Field name: " + current.GetName())
362        fmt.Println("==========")
363        
364        fitr.Next()
365    }
366
367    fmt.Println("====================\nNow iterating over digital signatures only.\n====================")
368
369    digsigFitr := doc.GetDigitalSignatureFieldIterator()
370    for digsigFitr.HasNext(){
371        current := digsigFitr.Current()
372        fmt.Println("==========")
373        fmt.Println("Field name of digital signature: " + NewField(current.GetSDFObj()).GetName())
374
375        digsigfield := current
376        if !digsigfield.HasCryptographicSignature(){
377            fmt.Println("Either digital signature field lacks a digital signature dictionary, " +
378                "or digital signature dictionary lacks a cryptographic Contents entry. " +
379                "Digital signature field is not presently considered signed.\n" +
380                "==========")
381            digsigFitr.Next()
382            continue
383        }
384        certCount := digsigfield.GetCertCount()
385        fmt.Println("Cert count: " + strconv.Itoa(int(certCount)))
386        for i := uint(0); i < certCount; i ++{
387            cert := digsigfield.GetCert(i)
388            fmt.Println("Cert //" + strconv.Itoa(int(i)) + " size: " + strconv.Itoa(int(cert.Size())))
389        }
390        subfilter := digsigfield.GetSubFilter()
391
392        fmt.Println("Subfilter type: " + strconv.Itoa(int(subfilter)))
393
394        if subfilter != DigitalSignatureFieldE_ETSI_RFC3161{
395            fmt.Println("Signature's signer: " + digsigfield.GetSignatureName())
396
397            signingTime := digsigfield.GetSigningTime()
398            if signingTime.IsValid(){
399                fmt.Println("Signing time is valid.")
400            }
401            fmt.Println("Location: " + digsigfield.GetLocation())
402            fmt.Println("Reason: " + digsigfield.GetReason())
403            fmt.Println("Contact info: " + digsigfield.GetContactInfo())
404        }else{
405            fmt.Println("SubFilter == e_ETSI_RFC3161 (DocTimeStamp; no signing info)")
406        }
407        if digsigfield.HasVisibleAppearance(){
408            fmt.Println("Visible")
409        }else{
410            fmt.Println("Not visible")
411        }
412        digsigDocPerms := digsigfield.GetDocumentPermissions()
413        lockedFields := digsigfield.GetLockedFields()
414        for i := 0; i < int(lockedFields.Size()); i ++{
415            fmt.Println("This digital signature locks a field named: " + lockedFields.Get(i))
416        }
417        if digsigDocPerms == DigitalSignatureFieldE_no_changes_allowed{
418            fmt.Println("No changes to the document can be made without invalidating this digital signature.")
419        }else if digsigDocPerms == DigitalSignatureFieldE_formfilling_signing_allowed{
420            fmt.Println("Page template instantiation, form filling, and signing digital signatures are allowed without invalidating this digital signature.")
421        }else if digsigDocPerms == DigitalSignatureFieldE_annotating_formfilling_signing_allowed{
422            fmt.Println("Annotating, page template instantiation, form filling, and signing digital signatures are allowed without invalidating this digital signature.")
423        }else if digsigDocPerms == DigitalSignatureFieldE_unrestricted{
424            fmt.Println("Document not restricted by this digital signature.")
425        }else{
426            fmt.Println("Unrecognized digital signature document permission level.")
427        }
428        fmt.Println("==========")
429        digsigFitr.Next()
430    }
431
432    fmt.Println("================================================================================")
433}
434
435func CustomSigningAPI(doc_path string,
436        cert_field_name string,
437        private_key_file_path string,
438        keyfile_password string,
439        public_key_file_path string,
440        appearance_image_path string,
441        digest_algorithm_type PdftronCryptoDigestAlgorithmType,
442        PAdES_signing_mode bool,
443        output_path string){
444    fmt.Println("================================================================================")
445    fmt.Println("Custom signing PDF document")
446
447    doc := NewPDFDoc(doc_path)
448
449    page1 := doc.GetPage(1)
450
451    digsig_field := doc.CreateDigitalSignatureField(cert_field_name)
452    widgetAnnot := SignatureWidgetCreate(doc, NewRect(143.0, 287.0, 219.0, 306.0), digsig_field)
453    page1.AnnotPushBack(widgetAnnot)
454
455    // (OPTIONAL) Add an appearance to the signature field.
456    img := ImageCreate(doc.GetSDFDoc(), appearance_image_path)
457    widgetAnnot.CreateSignatureAppearance(img)
458
459    signing_mode := DigitalSignatureFieldE_adbe_pkcs7_detached
460    if PAdES_signing_mode{
461    signing_mode = DigitalSignatureFieldE_ETSI_CAdES_detached
462    }
463    // Create a digital signature dictionary inside the digital signature field, in preparation for signing.
464    digsig_field.CreateSigDictForCustomSigning("Adobe.PPKLite",
465        &signing_mode,
466        7500) // For security reasons, set the contents size to a value greater than but as close as possible to the size you expect your final signature to be, in bytes.
467                // ... or, if you want to apply a certification signature, use CreateSigDictForCustomCertification instead.
468
469    // (OPTIONAL) Set the signing time in the signature dictionary, if no secure embedded timestamping support is available from your signing provider.
470    current_date := NewDate()
471    current_date.SetCurrentTime()
472    digsig_field.SetSigDictTimeOfSigning(current_date)
473
474    doc.Save(output_path, uint(SDFDocE_incremental))
475
476    // Digest the relevant bytes of the document in accordance with ByteRanges surrounding the signature.
477    pdf_digest := digsig_field.CalculateDigest(digest_algorithm_type)
478
479    signer_cert := NewX509Certificate(public_key_file_path)
480
481    // Optionally, you can add a custom signed attribute at this point, such as one of the PAdES ESS attributes.
482    // The function we provide takes care of generating the correct PAdES ESS attribute depending on your digest algorithm.
483    pades_versioned_ess_signing_cert_attribute := DigitalSignatureFieldGenerateESSSigningCertPAdESAttribute(signer_cert, digest_algorithm_type)
484
485    // Generate the signedAttrs component of CMS, passing any optional custom signedAttrs (e.g. PAdES ESS).
486    // The signedAttrs are certain attributes that become protected by their inclusion in the signature.
487    signedAttrs := DigitalSignatureFieldGenerateCMSSignedAttributes(pdf_digest, pades_versioned_ess_signing_cert_attribute)
488
489    // Calculate the digest of the signedAttrs (i.e. not the PDF digest, this time).
490    signedAttrs_digest := DigestAlgorithmCalculateDigest(digest_algorithm_type, signedAttrs)
491
492    ///////////////////////////// custom digest signing starts ////////////////////////////
493    // At this point, you can sign the digest (for example, with HSM). We use our own SignDigest function instead here as an example,
494    // which you can also use for your purposes if necessary as an alternative to the handler/callback APIs (i.e. Certify/SignOnNextSave).
495    signature_value := DigestAlgorithmSignDigest(
496        signedAttrs_digest,
497        digest_algorithm_type,
498        private_key_file_path,
499        keyfile_password)
500    ///////////////////////////// custom digest signing ends ///////////////////////////////
501
502    // Then, load all your chain certificates into a container of X509Certificate.
503    chain_certs := NewVectorX509Certificate()
504
505    // Then, create ObjectIdentifiers for the algorithms you have used.
506    // Here we use digest_algorithm_type (usually SHA256) for hashing, and RSAES-PKCS1-v1_5 (specified in the private key) for signing.
507    digest_algorithm_oid := NewObjectIdentifier(digest_algorithm_type)
508    signature_algorithm_oid := NewObjectIdentifier(ObjectIdentifierE_RSA_encryption_PKCS1)
509
510    // Then, put the CMS signature components together.
511    cms_signature := DigitalSignatureFieldGenerateCMSSignature(
512        signer_cert, chain_certs, digest_algorithm_oid, signature_algorithm_oid,
513        signature_value, signedAttrs)
514
515    // Write the signature to the document.
516    doc.SaveCustomSignature(cms_signature, digsig_field, output_path)
517
518    fmt.Println("================================================================================")
519}
520
521func TimestampAndEnableLTV(inDocpath string,
522    inTsaUrl string,
523    inTrustedCertPath string, 
524    inAppearanceImgPath string,
525    inOutpath string) bool{
526    doc := NewPDFDoc(inDocpath)
527    doctimestampSignatureField := doc.CreateDigitalSignatureField()
528    tstConfig := NewTimestampingConfiguration(inTsaUrl)
529    opts := NewVerificationOptions(VerificationOptionsE_compatibility_and_archiving)
530//   It is necessary to add to the VerificationOptions a trusted root certificate corresponding to 
531//   the chain used by the timestamp authority to sign the timestamp token, in order for the timestamp
532//   response to be verifiable during DocTimeStamp signing. It is also necessary in the context of this 
533//   function to do this for the later LTV section, because one needs to be able to verify the DocTimeStamp 
534//   in order to enable LTV for it, and we re-use the VerificationOptions opts object in that part.
535
536    opts.AddTrustedCertificate(inTrustedCertPath)
537//       By default, we only check online for revocation of certificates using the newer and lighter 
538//   OCSP protocol as opposed to CRL, due to lower resource usage and greater reliability. However, 
539//   it may be necessary to enable online CRL revocation checking in order to verify some timestamps
540//   (i.e. those that do not have an OCSP responder URL for all non-trusted certificates).
541
542    opts.EnableOnlineCRLRevocationChecking(true)
543
544    widgetAnnot := SignatureWidgetCreate(doc, NewRect(0.0, 100.0, 200.0, 150.0), doctimestampSignatureField)
545    doc.GetPage(1).AnnotPushBack(widgetAnnot)
546
547    // (OPTIONAL) Add an appearance to the signature field.
548    img := ImageCreate(doc.GetSDFDoc(), inAppearanceImgPath)
549    widgetAnnot.CreateSignatureAppearance(img)
550
551    fmt.Println("Testing timestamping configuration.")
552    configResult := tstConfig.TestConfiguration(opts)
553    if configResult.GetStatus(){
554        fmt.Println("Success: timestamping configuration usable. Attempting to timestamp.")
555    }else{
556        // Print details of timestamping failure.
557        fmt.Println(configResult.GetString())
558        if configResult.HasResponseVerificationResult(){
559            tstResult := configResult.GetResponseVerificationResult()
560            fmt.Println("CMS digest status: "+ tstResult.GetCMSDigestStatusAsString())
561            fmt.Println("Message digest status: " + tstResult.GetMessageImprintDigestStatusAsString())
562            fmt.Println("Trust status: " + tstResult.GetTrustStatusAsString())
563        }
564        return false
565    }
566
567    doctimestampSignatureField.TimestampOnNextSave(tstConfig, opts)
568
569    // Save/signing throws if timestamping fails.
570    doc.Save(inOutpath, uint(SDFDocE_incremental))
571
572    fmt.Println("Timestamping successful. Adding LTV information for DocTimeStamp signature.")
573
574    // Add LTV information for timestamp signature to document.
575    timestampVerificationResult := doctimestampSignatureField.Verify(opts)
576    if !doctimestampSignatureField.EnableLTVOfflineVerification(timestampVerificationResult){
577        fmt.Println("Could not enable LTV for DocTimeStamp.")
578        return false
579    }
580    doc.Save(inOutpath, uint(SDFDocE_incremental))
581    fmt.Println("Added LTV information for DocTimeStamp signature successfully.")
582
583    return true
584}
585
586func TestDigitalSignatures(t *testing.T){
587    // Initialize PDFNet
588    PDFNetInitialize(licenseKey)
589    
590    result := true
591    inputPath := "../TestFiles/"
592    outputPath := "../TestFiles/Output/"
593    
594    //////////////////////////////////////// TEST 0:
595    // Create an approval signature field that we can sign after certifying.
596    // (Must be done before calling CertifyOnNextSave/SignOnNextSave/WithCustomHandler.)
597    // Open an existing PDF
598    doc := NewPDFDoc(inputPath + "waiver.pdf")
599    widgetAnnotApproval := SignatureWidgetCreate(doc, NewRect(300.0, 287.0, 376.0, 306.0), "PDFTronApprovalSig")
600    page1 := doc.GetPage(1)
601    page1.AnnotPushBack(widgetAnnotApproval)
602    doc.Save(outputPath + "waiver_withApprovalField_output.pdf", uint(SDFDocE_remove_unused))
603
604    //////////////////////////////////////// TEST 1: certify a PDF.
605    CertifyPDF(inputPath + "waiver_withApprovalField.pdf",
606            "PDFTronCertificationSig",
607            inputPath + "pdftron.pfx",
608            "password",
609            inputPath + "pdftron.bmp",
610            outputPath + "waiver_withApprovalField_certified_output.pdf")
611    PrintSignaturesInfo(outputPath + "waiver_withApprovalField_certified_output.pdf")
612
613    //////////////////////////////////////// TEST 2: approval-sign an existing, unsigned signature field in a PDF that already has a certified signature field.
614    SignPDF(inputPath + "waiver_withApprovalField_certified.pdf",
615            "PDFTronApprovalSig",
616            inputPath + "pdftron.pfx",
617            "password",
618            inputPath + "signature.jpg",
619            outputPath + "waiver_withApprovalField_certified_approved_output.pdf")
620    PrintSignaturesInfo(outputPath + "waiver_withApprovalField_certified_approved_output.pdf")
621
622    //////////////////////////////////////// TEST 3: Clear a certification from a document that is certified and has an approval signature.
623    ClearSignature(inputPath + "waiver_withApprovalField_certified_approved.pdf",
624            "PDFTronCertificationSig",
625            outputPath + "waiver_withApprovalField_certified_approved_certcleared_output.pdf")
626    PrintSignaturesInfo(outputPath + "waiver_withApprovalField_certified_approved_certcleared_output.pdf")
627
628    //////////////////////////////////////// TEST 4: Verify a document's digital signatures.
629    if !VerifyAllAndPrint(inputPath + "waiver_withApprovalField_certified_approved.pdf", inputPath + "pdftron.cer"){
630        result = false
631    }
632
633    //////////////////////////////////////// TEST 5: Verify a document's digital signatures in a simple fashion using the document API.
634    if !VerifySimple(inputPath + "waiver_withApprovalField_certified_approved.pdf", inputPath + "pdftron.cer"){
635       result = false
636    }
637
638    //////////////////// TEST 6: Custom signing API.
639    // The Apryse custom signing API is a set of APIs related to cryptographic digital signatures
640    // which allows users to customize the process of signing documents. Among other things, this
641    // includes the capability to allow for easy integration of PDF-specific signing-related operations
642    // with access to Hardware Security Module (HSM) tokens/devices, access to cloud keystores, access
643    // to system keystores, etc.
644    CustomSigningAPI(inputPath + "waiver.pdf",
645            "PDFTronApprovalSig",
646            inputPath + "pdftron.pfx",
647            "password",
648            inputPath + "pdftron.cer",
649            inputPath + "signature.jpg",
650            DigestAlgorithmE_SHA256,
651            true,
652            outputPath + "waiver_custom_signed.pdf")
653
654    //////////////////////////////////////// TEST 7: Timestamp a document, then add Long Term Validation (LTV) information for the DocTimeStamp.
655    
656    // // Replace YOUR_URL_OF_TSA with the timestamp authority (TSA) URL to use during timestamping.
657    // // For example, as of July 2024, http://timestamp.globalsign.com/tsa/r6advanced1 was usable.
658    // // Note that this url may not work in the future. A reliable solution requires using your own TSA.
659    // tsaUrl := "YOUR_URL_OF_TSA"
660    //
661    // // Replace YOUR_CERTIFICATE with the trusted root certificate corresponding to the chain used by the timestamp authority.
662    // // For example, as of July 2024, https://secure.globalsign.com/cacert/gstsacasha384g4.crt was usable.
663    // // Note that this certificate may not work in the future. A reliable solution requires using your own TSA certificate.
664    // trustedCertPath := "YOUR_CERTIFICATE";
665    //
666    // if tsaUrl == "YOUR_URL_OF_TSA" {
667    //     fmt.Println("Error: The URL of your timestamp authority was not specified.")
668    //     result = false
669    // } else if trustedCertPath == "YOUR_CERTIFICATE" {
670    //     fmt.Println("Error: The path to your timestamp authority trusted root certificate was not specified.")
671    //     result = false
672    // } else if !TimestampAndEnableLTV(inputPath + "waiver.pdf",
673    //    tsaUrl,
674    //    trustedCertPath,
675    //    inputPath + "signature.jpg",
676    //    outputPath + "waiver_DocTimeStamp_LTV.pdf") {
677    //    result = false
678    // }
679     
680    //////////////////////////////////////// End of tests. ////////////////////////////////////////
681
682    if !result{
683        fmt.Println("Tests FAILED!!!\n==========")
684        PDFNetTerminate()
685        return
686    }
687    PDFNetTerminate()
688    fmt.Println("Tests successful.\n==========")
689}