<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - Sign PDF with digital signature" href="https://bugs.freedesktop.org/show_bug.cgi?id=99416#c41">Comment # 41</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - Sign PDF with digital signature" href="https://bugs.freedesktop.org/show_bug.cgi?id=99416">bug 99416</a> from <a class="email" href="mailto:huj@froreich-bioscientia.de" title="Hans-Ulrich Jüttner <huj@froreich-bioscientia.de>"> Hans-Ulrich Jüttner</a> <pre>(In reply to Albert Astals Cid from <a href="show_bug.cgi?id=99416#c40">comment #40</a>) > (In reply to Adrian Johnson from <a href="show_bug.cgi?id=99416#c37">comment #37</a>) > > (In reply to Albert Astals Cid from <a href="show_bug.cgi?id=99416#c33">comment #33</a>) > > > (In reply to Adrian Johnson from <a href="show_bug.cgi?id=99416#c30">comment #30</a>) > > > > Created <a href="attachment.cgi?id=134043" name="attach_134043" title="Return timezone in timeToDateString">attachment 134043</a> <a href="attachment.cgi?id=134043&action=edit" title="Return timezone in timeToDateString">[details]</a> <a href='page.cgi?id=splinter.html&bug=99416&attachment=134043'>[review]</a> [review] [review] [review] [review] > > > > Return timezone in timeToDateString > > > > > > > > Here's the fix to make timeToDateString include the time zone in a portable > > > > way. > > > > > > Adrian, does this mean you're relatively happy with the patch? > > > > I'm not sure which patch you are referring to. > > All of them :D > > > Current patch status is: > > > > 1) Added signing of PDF documents via Qt5 interface and with pdfsig > > > > I have a number of major issues with this patch. I have fixed these issues > > in (3). > > So you're "happy with conditions" :D > > > > > 2) pdfsig: add -nssdi option v2 > > > > Updated documentation based on your feedback. > > > > 3) write document then update byte offsets and sig on disk v2 > > > > This fixes all the issues I had with (1). > > > > 4) Return timezone in timeToDateString > > > > In <a href="show_bug.cgi?id=99416#c15">comment 15</a> I requested that the patch use the timeToDateString(). I noted > > that this function currently does not include the timezone. This patch adds > > the time zone. Patch (3) has already changed the signing code to use > > timeToDateString(). > > This looks good to me. Hans-Ulrich do patches 2) 3) and 4) also look good > for you? Patch (2), <a href="attachment.cgi?id=134080" name="attach_134080" title="pdfsig: add -nssdi option v2">attachment #134080</a> <a href="attachment.cgi?id=134080&action=edit" title="pdfsig: add -nssdi option v2">[details]</a> <a href='page.cgi?id=splinter.html&bug=99416&attachment=134080'>[review]</a>, looks good to me except for the help message for option -nssdir: + {"-nssdir", argGooString, &nssDir, 0, + "don't perform certificate validation"}, should be + {"-nssdir", argGooString, &nssDir, 0, + "database directory containing the certificate and key database files"}, Patch (4), <a href="attachment.cgi?id=134043" name="attach_134043" title="Return timezone in timeToDateString">attachment #134043</a> <a href="attachment.cgi?id=134043&action=edit" title="Return timezone in timeToDateString">[details]</a> <a href='page.cgi?id=splinter.html&bug=99416&attachment=134043'>[review]</a>, is fine. I have a little conceptual problem with patch (3), <a href="attachment.cgi?id=134081" name="attach_134081" title="write document then update byte offsets and sig on disk v2">attachment #134081</a> <a href="attachment.cgi?id=134081&action=edit" title="write document then update byte offsets and sig on disk v2">[details]</a> <a href='page.cgi?id=splinter.html&bug=99416&attachment=134081'>[review]</a>. Calling method sign() from qt5 interface now writes directly to disk with the file name as new first parameter of that method. But this leaves the document in memory with an invalid signature and invalid ByteRange parameters. Poppler::PDFConverter::convert() called afterwards would write this invalid document to disk and Poppler::FormFieldSignature::validate() called after signing would tell us that the signature is invalid. This behaviour can be argued as signing should always be the last thing to do before writing the signed document to disk. But I think that should be clearly documented in the header file qt5/src/poppler-form.h saying that the document has to be reread from disk before doing anything with it after signing. Moreover, the new parameter saveFilename of method sign() should be added to the documentation of that method with an @param line just as it was done for the other parameters.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> <li>You are on the CC list for the bug.</li> </ul> </body> </html>