Update from 0.7 to 0.12.1 and now returns error on signing pdfs

[vtgdias]

I get the following error: pyhanko.sign.general.SigningError: Attempting to sign document with hybrid cross-reference sections while hybrid xrefs are disabled.

My sign request:
signers.PdfSigner(signers.PdfSignatureMetadata(field_name='Sig1'),signer=cms_signer, timestamper=tst_client,stamp_style=stamp_style).sign_pdf(original_file,output=file_out,appearance_text_params={'signer':cms_signer.subject_name,'ts':tst_client})

Any ideas where the error could be?

My parameters:

cms_signer = PKCS11Signer(cms_session,signing_cert=certlabel,bulk_fetch=False,key_id=keyid)
tst_client = timestamps.HTTPTimeStamper('XXXXXXXX',https=False,auth=None,timeout=2) (XXXX excluded for privacy)
stamp_style = stamp.TextStampStyle(
stamp_text='XXXXXXXX',
timestamp_format='%d-%m-%Y %H:%M:%S %Z',
background=images.PdfImage(XXXXX)
) (XXXX excluded for privacy)

and

sign_pdf(original_file,output=file_out,appearance_text_params={'signer':cms_signer.subject_name,'ts':tst_client})

original_file = IncrementalPdfFileWriter(pdf_file)

[MatthiasValvekens]

Hi @vtgdias,

This is explained in the release notes for 0.12.0.

For some further background: the file you're trying to sign is a hybrid reference file. Those were introduced as a transitional compatibility measure between PDF 1.4 and PDF 1.5 (which was a godawful idea in hindsight) and they're relatively rare these days, but some tools still routinely generate such files (looking at you, MS Word).

Prior to 0.12.0, pyHanko would actually not process these files correctly and would sometimes even accidentally corrupt them. That bug has been fixed, but there's more to it than that. The problem with hybrid files is that by design there's no single unambiguous way to parse them, which makes them inherently less secure than non-hybrid PDFs. That's a problem when dealing with document signatures, and also the reason why pyHanko 0.12.0 makes hybrid files an "opt-in" feature: you have to disable strict parsing mode to be able to use them. In your case, that concretely means that you have to pass strict=False to IncrementalPdfFileWriter.

Hope that helps :)

[vtgdias]

Tks for rapid response Matthias, setting the strict parameter to false worked out just fine!!