Major Description
It seems PDFBox make disallowed changes when signing a document containing a signature with visual appearance. Using the signing example org.apache.pdfbox.examples.signature.CreateSignature (modified to use BC 1.52) I signed (invisible signature) a document (acrosigned.pdf) containing signature with visual appearance. After signing Adobe Acrobat for the resulted pdf (acrosigned_signed.pdf) shows an error for the first signature:
1 Page(s) Modified
Signature is invalid:
Document has been altered or corrupted since it was signed.
The first revision is intact after signing, but it seems PDFBox made some disallowed changes to the document. Adobe in its technical white paper Adobe Acrobat 9 Digital Signatures, Changes and Improvements disallows such changes for the signed document:
- Adding form fields other than signature fields
- Changing page content
Unfortunately, I could not identify the changes which caused this error, though I notice these changes in structure after signing:
- Default resources (/DR) were droped from AcroForm dictionary;
- An array of annotation dictionaries (value of /Annots in page object) became direct;
And probably there are more...
I thought the first change was fundamental, noticed that PDDocument#addSignature() method removes /DR key for invisible signatures. Tried to disable it in 1.8.10-SNAPSHOT sources, but unfortunately it didn't help. Didn't tried to reuse the same array object for /Annots yet.