Interrupted signing

[anhbq97]

Hi, i'm newbie in digital signature, before i change to python, i used c# the code in this image and it work

But now i changed to use python with pyhanko lib like this

async def prep_document(fname, signing_cert: x509.Certificate):
with open(fname, 'rb') as doc:
ext_signer = RemoteSigning.instantiate_external_signer(bytes(256), signing_cert)

        pdf_signer = signers.PdfSigner(
            signature_meta=signers.PdfSignatureMetadata(
                field_name='Signature2', 
                #embed_validation_info=True, 
                use_pades_lta=False,
                subfilter=fields.SigSeedSubFilter.PADES,
                #validation_context=vc,
                md_algorithm='sha256',
                reason="Reason to Signing",
                location="Location signing"
            ),
            stamp_style=stamp.TextStampStyle(
                stamp_text='This is custom text!\nSigned by: %(signer)s\nTime: %(ts)s',
                text_box_style=text.TextBoxStyle(
                    font=opentype.GlyphAccumulatorFactory(pathFont),
                    box_layout_rule = SimpleBoxLayoutRule(x_align = AxisAlignment.ALIGN_MID, y_align = AxisAlignment.ALIGN_MID, inner_content_scaling=1, margins = Margins(2,2,2,2)),
                ),
                inner_content_layout = SimpleBoxLayoutRule(x_align = AxisAlignment.ALIGN_MIN, y_align = AxisAlignment.ALIGN_MID, inner_content_scaling = 3),
                background=images.PdfImage(pathImageSigned),
                background_opacity = 0.2,						
                border_width = 1,
            ),
            signer=ext_signer,
            #timestamper=timestamps.HTTPTimeStamper('http://tsa.example.com')
        )
        
        w = IncrementalPdfFileWriter(doc)
        prep_digest, tbs_document, output = await pdf_signer.async_digest_doc_for_signing(w, bytes_reserved=11186)
        
        psi          = tbs_document.post_sign_instructions

        signed_attrs = await ext_signer.signed_attrs(
            prep_digest.document_digest, 'sha256', use_pades = True
        )
        return prep_digest, signed_attrs, psi, output

async def getRemoteHash(data_to_hash):
hashed_data = hashlib.sha256(data_to_hash).digest()
data_to_be_sign = str(base64.b64encode(hashed_data))

    # sent to service remote signing and they return base64 signature
    response_sig_value = "DtJvnN2W988lA0ikh7YM1BOoTiEzT1XifJpBKMNljMf8MNsaX5zin+XuN++c2nA33WZMRsEwe/I3tj8aSATlEq0UpwDvFAylVr7aDg2n9IMQVhXV9z8gQRLk5bt6aBW6zuyfCkniKkq5w7Soq9h2/MoveDBnVOehIRL/rZeIn9BrKJJfAr9966xT1kadYmygsZw9cFOy6ClKUV8MJPkLp+aL2m2v1h7JlMA0zf7wYsY3XO2lq7C8jpc5XODmxcFLILd5LqIvameHIFODix23lQ3aDn589MvKs51lSzcSNwLyAN5k4ibg97Iq5HKlnSq8NRiC9D49teTJmre1YHhHcA=="
    sig_value = base64.b64decode(sig_value)
    
    return sig_value

async def signPdf(sig_value: bytes, prep_digest, signed_attrs, psi, output_handle, signing_cert):
ext_signer = RemoteSigning.instantiate_external_signer(sig_value, signing_cert)
sig_cms = await ext_signer.async_sign_prescribed_attributes(
'sha256',
signed_attrs=signed_attrs,
dry_run=True
)

    der_encoding = sig_cms.dump()

    # Convert DER encoding to hexadecimal string
    hex_string = der_encoding.hex()
    print(hex_string)

    prep_digest.fill_with_cms(output_handle, sig_cms)

    return output_handle

but i have error when open file pdf on adobe acrobat reader with message "the document has been altered or corrupted since the signature was applied

I spent several days trying to find a solution, but couldn't figure out any way.
Let me know your answer soon, thank you.

[MatthiasValvekens]

Hello, I'm currently travelling so there might be some time between replies, but can you please post the entire code sample in a code block? As it is now, it is pretty much impossible to read. In particular, it is unclear where and how you are calling getRemoteHash, which is probably key here.

It would also help if you could post an example output file.

[anhbq97]

Thank you for your response. I now understand where my issue lies. I thought that 'signed_attrs' would be the same if the PDF files had similar content. Therefore, the first time I called 'getRemoteHash' and obtained 'response_sig_value' for subsequent 'async_sign_prescribed_attributes' calls.

[MatthiasValvekens]

Thank you for your response. I now understand where my issue lies. I thought that 'signed_attrs' would be the same if the PDF files had similar content. Therefore, the first time I called 'getRemoteHash' and obtained 'response_sig_value' for subsequent 'async_sign_prescribed_attributes' calls.

Aha, that would do it ;). In fact, they're often even different if the underlying PDFs are identical, because of things like timestamps being included, and the signature appearance generation. So don't assume that ;).