https://bugs.kde.org/show_bug.cgi?id=496490
Bug ID: 496490
Summary: Okular "corrupts" (QES-)signed documents
Classification: Applications
Product: okular
Version: 23.08.5
Platform: openSUSE
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: PDF backend
Assignee: okular-devel@kde.org
Reporter: michae...@rocketmail.com
Target Milestone: ---
(Correctly) QES-signed pdf files are shown as "changed after signature" when
opened in Okular.
FYI: Adobe Acrobat Reader (rolling release, Win11) shows same files as
"signature valid/correct"
Seems to be specific for some pdf of unknown (technical) source
STEPS TO REPRODUCE
1. Took (source) pdf from https://hapkido-muyedo.de/Anmeldung.shtml, concretely
https://hapkido-muyedo.de/pdf/Aufnahmeantrag00.pdf
2. Filled, and signed with my "ID Austria" (Austrian eID) QES, via app
"PDF-Over" (https://github.com/a-sit/PDF-Over)
3. Opened signed doc in Okular
OBSERVED RESULT
4. Okular says in header "doc is digitally signed, changes since last signing"
-> Which is WRONG
5. Tested also with pdf https://hapkido-muyedo.de/pdf/Satzung00.pdf, which is a
static pdf, no form data. Okluar also says "doc is digitally signed, changes
since last signing"
6. Tested also with a pdf from totally different source: cups-pdf print of an
email, signed, opened in Okular: Signature fine, no issue
Means IMHO, that buggy behaviour of Okular is related to these specific pdfs.,
Will try to find out with the creator what might be special, and add here
later, if meaningful.
EXPECTED RESULT
QES-signed pdf files MUST NOT be changed by Okular WITHOUT user interaction, in
any cases.
SOFTWARE/OS VERSIONS
Linux/KDE Plasma: OpenSUSE Leap 15.6, all current patches
KDE Plasma Version: 5.27.11
KDE Frameworks Version: 5.115.0
Qt Version: 5.15.12
ADDITIONAL INFORMATION
It's a "speciality" that pdf files with form data could be changed after
signature anyway. But all pdf readers I'm aware are allowing this, but they
100% correctly shows the file as "changed" if changed, and "fine" if unchanged
or changes reverted.
Discussed all of the above with the maintainer of PDF-Over here:
https://github.com/a-sit/PDF-Over/issues/128
He suspects a potential incorrect handling of "validation/auto-fill" rule by
Okular here:
https://github.com/a-sit/PDF-Over/issues/128#issuecomment-2485192603
Last Remark: If helpful, I of course could provide signed example pdfs if
needed/helpful. But as I'm using an "anonymous" login for all my publicly
visible internet activities, for good reasons, just attaching would NOT be an
appropriate way, as the QES of course identifies me. So maybe there are other
ways to share with you?
--
You are receiving this mail because:
You are the assignee for the bug.
