[PDFBOX-5549] Invisible signature field is not referenced from /Annots dictionary of a Page

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.27
• Fix Version/s: 2.0.28, 3.0.0 PDFBox
• Component/s: Signing
• Assignee: Tilman Hausherr
• Reporter: Aleksandr Beliakov
• Created: 28/Nov/22 13:06
• Updated: 13/Apr/23 14:54
• Resolved: 05/Dec/22 08:29

Description

Hello,

 

Recently we received a complain about not adding a reference to the newly created signature field to the /Annots array of a page dictionary.

After analyzing the code, we found that PdfBox dependency used in our project, skips binding of an invisible signature field from a page dictionary. See PDDocument.java#L455:

if (visualSignature == null) 
{
    prepareNonVisibleSignature(firstWidget);
    return;
} 

while adding the signature widget to the given page for visible signature after.

 

After analyzing ISO 32000-1/2 I was not able to conclude what is the expected behavior in case of invisible signature. While /Annots array within a page dictionary is optional and shall contain references to annotations associated with a page, the chapter "12.5.2 Annotation dictionaries" also tells "A given annotation dictionary shall be referenced from the Annots array of only one page.", which is also ambiguous.

After checking OpenPDF library, it seems like they associate an invisible signature field with a first page explicitly by providing the reference within /Annots array.

 

Could you please give us information about the rational for skipping the invisible signature field from adding into a page's /Annots dictionary and confirm whether the behavior is correct?

 

Thank you!

 

Best regards,

Aleksandr.