byterange problem

[cuneytm]

Hi, I'm trying to sign a pdf file and keep getting "this document has been altered or corrupted....since it was signed" it seems that signed pdf file does not include byterange and i think pyhanko could not set values properly. Timestamp signature's ok, stamp figure's ok on the first page of pdf file. The only issue is user signature on the signed pdf file.

def sign_pdf(input_pdf_path, output_pdf_path, user_cert_pem, signature_bytes, validation_context):
cert_store = SimpleCertificateStore()
user_cert_der = pem_to_der(user_cert_pem)
user_cert_asn1 = asn1_x509.Certificate.load(user_cert_der)

tsa_url = 'hidden'
username = 'hidden'
password = 'hidden'


timestamper = timestamps.HTTPTimeStamper(tsa_url,auth=(username, password)) 

with open(input_pdf_path, 'rb') as inf:
    w = IncrementalPdfFileWriter(inf)
    fields.append_signature_field(
        w, sig_field_spec=fields.SigFieldSpec(
            'Signature', box=(100, 100, 200, 150), on_page = 0,
           
        )
        
    )

    # Log annotation details
    sig_annot = w.root['/Pages']['/Kids'][0]['/Annots'][-1]
    print("Signature Annotation:")
    for key, value in sig_annot.items():
        print(f"  {key}: {value}")

    z = signers.ExternalSigner

    pdf_signer = signers.PdfSigner(
    signers.PdfSignatureMetadata(
        field_name='Signature', embed_validation_info=True, use_pades_lta=True,
        subfilter=fields.SigSeedSubFilter.PADES,
        validation_context=validation_context,
        md_algorithm='sha256',
        signer_key_usage={'digital_signature'}
        
    ),
    timestamper=timestamper,
    signer=signers.ExternalSigner(
        signing_cert=user_cert_asn1,
        signature_value=signature_bytes,
        cert_registry=cert_store
    ),
    stamp_style=stamp.TextStampStyle(
        stamp_text='Bu dokuman mobil imza ile imzalanmistir!\nImzalayan: %(signer)s\nTarih: %(ts)s',
        text_box_style=text.TextBoxStyle(
            font=opentype.GlyphAccumulatorFactory('/usr/src/app/fonts/Arial.ttf')
        ),
        background=images.PdfImage('/usr/src/app/static/hidden.png')
    ),
)

    with open(output_pdf_path, 'wb') as outf:
        pdf_signer.sign_pdf(w,output=outf)

The other script output which is comparing the original file and signed pdf file: Comparing PDFs:
Comparing Page 1:
Differences found on Page 1:
Page 1 Structure:
{'/Contents': {'/Filter': "'/FlateDecode'"}, '/Parent': {'/Count': '1', '/Kids': ['... (depth limit reached)'], '/MediaBox': ['... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)'], '/Type': "'/Pages'"}, '/Resources': {'/Font': {'/F1': '... (depth limit reached)'}, '/ProcSet': ['... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)']}, '/Type': "'/Page'", '/MediaBox': ''}
Page 2 Structure:
{'/Contents': {'/Filter': "'/FlateDecode'"}, '/Parent': {'/Count': '1', '/Kids': ['... (depth limit reached)'], '/MediaBox': ['... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)'], '/Type': "'/Pages'"}, '/Resources': {'/Font': {'/F1': '... (depth limit reached)'}, '/ProcSet': ['... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)', '... (depth limit reached)']}, '/Type': "'/Page'", '/Annots': [{'/FT': '... (depth limit reached)', '/T': '... (depth limit reached)', '/Type': '... (depth limit reached)', '/Subtype': '... (depth limit reached)', '/F': '... (depth limit reached)', '/Rect': '... (depth limit reached)', '/P': '... (depth limit reached)', '/AP': '... (depth limit reached)', '/V': '... (depth limit reached)'}, {'/FT': '... (depth limit reached)', '/T': '... (depth limit reached)', '/Type': '... (depth limit reached)', '/Subtype': '... (depth limit reached)', '/F': '... (depth limit reached)', '/Rect': '... (depth limit reached)', '/P': '... (depth limit reached)', '/TU': '... (depth limit reached)', '/V': '... (depth limit reached)'}], '/MediaBox': ''}
Signature Annotation Structure: {'/FT': '/Sig', '/T': 'Signature', '/Type': '/Annot', '/Subtype': '/Widget', '/F': 132, '/Rect': [100, 100, 200, 150], '/P': IndirectObject(3, 0, 139928584042880), '/AP': {'/N': IndirectObject(21, 0, 139928584042880)}, '/V': IndirectObject(22, 0, 139928584042880)}
Byte range not found.

[MatthiasValvekens]

I'm confused by what you are trying to do here. You are calling pdf_signer.sign_pdf with a precomputed signature and ExternalSigner? That for sure can't work: ExternalSigner is intended specifically for use with the interrupted signing flow, to resume an existing signing process with an externally computed signature. By contrast sign_pdf is a high-level API that doesn't give you the degree of fine-grained control needed to be able to use ExternalSigner.

Here's why it can't work in a nutshell: PDF signatures are not computed over the input document, but over a "just-in-time" hash based on a "transient" state of the document right before injecting the cryptographic signature. In particular, this happens after all the relevant annotations have been computed. Ordinarily, pyHanko takes control of this process end-to-end (that's what sign_pdf does), but as an "escape hatch" for performance optimisations when dealing with slow remote signers in a high-volume environment, it also gives you the option to interrupt the signing process partway through. That workflow requires using ExternalSigner in a very specific way.

If you precompute a signature and then go through the regular, high-level API from the start, the underlying document will change and you end up putting a wrong signature into the document. Word of advice: try and get your workflow up and running without using interrupted signing first, i.e. just by subclassing Signer if you need to interface with a remote API and calling sign_pdf. Once you have that set up, refactor to use interrupted signing for performance if your use case requires it. The latter requires a great deal more care.