Still confuse with how configuration pyhanko.yml work

[mjaddid]

So i have pyhanko.yml like this

default-validation-context: setup-a
validation-contexts:
    setup-a:
        trust: signerCA.pem
        trust-replace: true
        # other-certs: some-cert.pem.cert

and i try to sign my pdf with this command

py -m pyhanko sign addsig --field Sig1 --timestamp-url http://timestamp.digicert.com --with-validation-info pemder --key Key.key --cert Cert.pem in.pdf out.pdf

So i have certificate cert.pem which issued with signerCA.pem and my goal is when i validating the out.pdf pyhanko can trust that certificate but when i sign with that command I got output like this :

2021-11-13 02:08:39,797 - pyhanko.cli - ERROR - Configuration problem. Are you sure that the style 'None' is properly defined in the configuration file?
Traceback (most recent call last):
  File "C:\Users\Mujaddid\AppData\Roaming\Python\Python39\site-packages\pyhanko\config.py", line 113, in get_stamp_style
    style_config = dict(self.stamp_styles[name])
TypeError: 'TextStampStyle' object is not iterable

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\Mujaddid\AppData\Roaming\Python\Python39\site-packages\pyhanko\cli.py", line 299, in _select_style
    style = cli_config.get_stamp_style(style_name)
  File "C:\Users\Mujaddid\AppData\Roaming\Python\Python39\site-packages\pyhanko\config.py", line 119, in get_stamp_style
    raise ConfigurationError(e)
pyhanko.pdf_utils.config_utils.ConfigurationError: 'TextStampStyle' object is not iterable
Error: Configuration problem. Are you sure that the style 'None' is properly defined in the configuration file?

so where is my mistake?

btw thank a lot for developing library like this really helped me doing my project

[MatthiasValvekens]

Oops, that seems to be a bug in the code that processes the configuration file: it fails to load the default stamp style if the configuration doesn't override it, but this bug is only triggered if a configuration file is present at all. Apparently it's been in there since the very first release... Thanks a lot for reporting it!

I've dealt with the underlying issue and added a regression test (see commit 0839602), so this will be fixed in the next release. In the meantime, you can work around the bug by inserting the following snippet into your config file:

stamp-styles:
  default:
    background: __stamp__
    stamp-text: "Digitally signed by %(signer)s.\nTimestamp: %(ts)s."

This matches the default style that you would've gotten without supplying any config.

Since there's a simple workaround, I don't believe a patch release is necessary to fix just this issue, but the fix will most certainly be present in the next release. :)

Thanks again for the report!

[mjaddid]

Thank for you answer, I have tried your instructions and it worked

[mjaddid]

I have more question, can we use key and cert file from URL ? so the key any cert not in the disk

[MatthiasValvekens]

I'm not sure I fully understand your question. Are you asking whether it's possible to use pyHanko with a remote signing service? Because the answer is almost certainly "yes", but you will have to write some code of your own. All remote signing services operate in slightly different ways.

Or am I missing the point of your question?

[mjaddid]

Thank you for your answer, I have found the solution to my previous problem. But I have new problem about timestamping with SDK, so when i try to run the code i get error like this

Traceback (most recent call last):
  File "D:\KULIAH\TUGAS AKHIR\DigCert\simpleCA\SDK\testSDK.py", line 33, in <module>
    pdf_signer.sign_pdf(w, output=outf)
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko\sign\signers\pdf_signer.py", line 1221, in sign_pdf
    result = asyncio.run(
  File "C:\Python39\lib\asyncio\runners.py", line 44, in run
    return loop.run_until_complete(main)
  File "C:\Python39\lib\asyncio\base_events.py", line 642, in run_until_complete
    return future.result()
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko\sign\signers\pdf_signer.py", line 1273, in async_sign_pdf
    await signing_session.perform_presign_validation(pdf_out)
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko\sign\signers\pdf_signer.py", line 1443, in perform_presign_validation
    async for ts_path in ts_paths:
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko\sign\timestamps\api.py", line 132, in validation_paths
    yield await validator.async_validate_usage(
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko_certvalidator\__init__.py", line 283, in async_validate_usage
    await self._validate_path()
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko_certvalidator\__init__.py", line 127, in _validate_path
    paths = await self._context.certificate_registry.async_build_paths(
  File "D:\KULIAH\TUGAS AKHIR\Django\ta-TTE\env-tte\lib\site-packages\pyhanko_certvalidator\registry.py", line 431, in async_build_paths
    raise PathBuildingError(pretty_message(
pyhanko_certvalidator.errors.PathBuildingError: Unable to build a validation path for the certificate "Common Name: DigiCert Timestamp 2021; Organization: DigiCert, Inc.; Country: US" - no issuer matching "Common Name: DigiCert Assured ID Root CA, Organizational Unit: www.digicert.com, Organization: DigiCert Inc, Country: US" was found

And my code

from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
from pyhanko.sign import fields, signers ,timestamps
from pyhanko_certvalidator import ValidationContext
from pyhanko.sign.general import load_cert_from_pemder


root_cert = load_cert_from_pemder('signerCA.pem')
vc = ValidationContext(trust_roots=[root_cert])
tst_client = timestamps.HTTPTimeStamper('http://timestamp.digicert.com')
signer = signers.SimpleSigner.load(
    'key.key', 'Cert.pem',
    ca_chain_files=('signerCA.pem',),
    key_passphrase=b'password'
)

with open('testDoc2.pdf', 'rb') as inf:
    w = IncrementalPdfFileWriter(inf)
    fields.append_signature_field(
        w, sig_field_spec=fields.SigFieldSpec(
            'Signature',
        )
    )

    meta = signers.PdfSignatureMetadata(field_name='Signature',validation_context=vc,signer_key_usage=None)
    pdf_signer = signers.PdfSigner(
        meta, signer=signer, timestamper=tst_client
    )
    with open('document-signed2.pdf', 'wb') as outf:
        pdf_signer.sign_pdf(w, output=outf)

I am very confused because when I try the same configuration with CLI its work fine, I am sorry if I have a lot question

Thank you

[MatthiasValvekens]

Hi there,

The error message states that it can't build a path from the TSA's certificate to the DigiCert Root CA. As to why that is: you initialised your validation context with the contents of signerCA.pem as the only trust root. Since you mentioned that this worked when you tried it from the CLI, your problem will probably be resolved if you replace

vc = ValidationContext(trust_roots=[root_cert])

with

vc = ValidationContext(extra_trust_roots=[root_cert])

Using trust_roots will replace the entire trusted certificate store, while extra_trust_roots merely adds a certificate to the trust store without discarding the system trust list.

[mjaddid]

Thank you for the answer the problem is solved

[mjaddid]

I have question again, sorry for using previous discussion. So I have done signing and validating pdf with SDK and its work fine, but when I try sign pdf with multiple signature it still can validate the pdf but only display the last signature. So how to display all signature from the pdf ?

validation code :

from pyhanko.sign.general import load_cert_from_pemder
from pyhanko_certvalidator import ValidationContext
from pyhanko.pdf_utils.reader import PdfFileReader
from pyhanko.sign.validation import validate_pdf_signature

root_cert = load_cert_from_pemder('signerbcCA.pem')
vc = ValidationContext(extra_trust_roots=[root_cert])

with open('document-signed2.pdf', 'rb') as doc:
    r = PdfFileReader(doc)

    length = len(r.embedded_signatures)-1
    sig = r.embedded_signatures[length]
    status = validate_pdf_signature(sig, vc)
    print(status.pretty_print_details())

Thank you

[MatthiasValvekens]

Sorry for the delay in replying, I've been a little busy.

Hmm, it looks like your file might be doing weird things with indirect references. That can be the result of a programming error during signing, or a problem with the input file. That said, it probably makes sense to handle pyHanko's difference analysis logic to cope with this. If possible, could you send the relevant PDF file(s) and your code to pyhanko.samples@mvalvekens.be so that I can dissect them?

In the meantime, passing skip_diff=True to validate_pdf_signature() should do the trick as a temporary workaround (it disables pyHanko's forensic analysis on incremental updates made after signing).

[mjaddid]

Hello Matthias

I've sent an email to pyhanko.samples@mvalvekens.be hope you can help me with my code. in meantime I have already try your suggestion with adding skip_diff=True and it display all the signature, but I still hope can analyze the incremental update.

Thanks

[MatthiasValvekens]

Thanks! I've taken a look, and it looks like your input document has some quirks: several objects in the cross-reference table are marked as freed, but still have existing references lingering in the file. This doesn't violate the letter of the specification (in fact ISO 32000 spells out fallback rules for how to handle cases like this), but it's not exactly good practice either.

I'll create an issue to look into handling this more gracefully.

[MatthiasValvekens]

See #57.

[MatthiasValvekens]

@mjaddid FYI, I dealt with #57 in the scope of the 0.10.0 release, and added a --no-strict-syntax flag to the validate subcommand to (attempt to) gracefully handle syntax issues of this type.