Locking document after approval signatures

[tlilja]

Hi

If I want to create PDF document with multiple approval signatures, and want to lock the document to prevent changes after signing. I attached a piece of code to this article that creates one approval signature with seed_value_dict set to lock the document and document modification policy to NO_CHANGES and while Acroread tells me that something is wrong with the signatures, the actual signature is not shown properly:

I.e. the first signature stamp is shown with that blueish box

Also, is it possible to make the signature fields immovable and set up them so that the user cannot delete them with a PDF reader?

I attached a sample code and PDF demonstrating the problem.

locking.zip

[MatthiasValvekens]

Hi @tlilja,

Thanks for the self-contained sample. As to your problems with Acrobat rendering:

• First off, locking for approval signatures is very poorly specified, so some degree of wonkiness and lack of interoperability is to be expected...
• You probably don't want to mess with seed values for this use case; FieldMDP should suffice. These are also underspecified & underused, and I unfortunately don't have the time or resources to get to the bottom of all the potential interop issues there. :/
  I'm not saying that those would affect locking, but better not to touch it unless you really need to :).
• You seem to be setting up the first signature field to lock all others. It's to be expected that you'd run into validation issues when signing that one first, then. Have you tried reversing the order?
• Signature validity theoretically wouldn't affect rendering, but Acrobat has been known to do some peculiar things when it runs into validation issues.

To your second question: if you're purely asking about viewer UX, then yes, that's possible: that's a matter of setting bit 8 in the annotation flags. Now, as a matter of fact, pyHanko already does that by default for all signature fields it creates, so it should be taken care of already :). If not, maybe something else is up.

That said, you have to take into account the fact that those flags aren't always cryptographically enforceable. Given a sufficiently savvy user, signatures and signature fields can always be removed in the reverse order in which they were applied.