LibreSign · vitormattos · Sep 5, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/3rdparty b/3rdparty
diff --git a/lib/Handler/SignEngine/Pkcs12Handler.php b/lib/Handler/SignEngine/Pkcs12Handler.php
@@ -18,8 +18,8 @@
 use OCA\Libresign\Service\Crl\CrlService;
 use OCA\Libresign\Service\FolderService;
 use OCA\Libresign\Service\Signature\PdfSignatureValidationService;
-use OCA\Libresign\Vendor\LibreSign\PdfSignatureValidator\Exception\UnsignedPdfException;
-use OCA\Libresign\Vendor\LibreSign\PdfSignatureValidator\Parser\PdfSignatureExtractor;
+use OCA\Libresign\Vendor\LibreSign\PdfSignatureValidator\Model\ExtractedSignature;
+use OCA\Libresign\Vendor\LibreSign\PdfSignatureValidator\Model\TimestampToken;
 use OCA\Libresign\Vendor\phpseclib4\Exception\UnexpectedValueException;
 use OCA\Libresign\Vendor\phpseclib4\File\ASN1;
 use OCP\Files\File;
@@ -47,7 +47,6 @@ public function __construct(
 		private DocMdpHandler $docMdpHandler,
 		private CrlService $crlService,
 		private PdfSignatureValidationService $pdfSignatureValidationService,
-		private PdfSignatureExtractor $pdfSignatureExtractor,
 	) {
 		parent::__construct($l10n, $folderService, $logger);
 	}
@@ -57,38 +56,6 @@ protected function getCertificateEngineFactory(): CertificateEngineFactory {
 		return $this->certificateEngineFactory;
 	}
 
-	/**
-	 * @throws LibresignException When is not a signed file
-	 */
-	private function getSignatures($resource): iterable {
-		rewind($resource);
-		$content = stream_get_contents($resource);
-
-		preg_match_all('/\/Contents\s*<([0-9a-fA-F]+)>/', $content, $contents, PREG_OFFSET_CAPTURE);
-
-		if (empty($contents[1])) {
-			// TRANSLATORS Error while LibreSign reads a PDF for signature validation: the file has no embedded PKCS#12/PDF signature bytes yet.
-			throw new LibresignException($this->l10n->t('Unsigned file.'));
-		}
-
-		$seenHexSignatures = [];
-		foreach ($contents[1] as $match) {
-			$signatureHex = $match[0];
-
-			if (isset($seenHexSignatures[$signatureHex])) {
-				continue;
-			}
-			$seenHexSignatures[$signatureHex] = true;
-
-			$decodedSignature = @hex2bin($signatureHex);
-			if ($decodedSignature === false) {
-				yield null;
-				continue;
-			}
-			yield $decodedSignature;
-		}
-	}
-
 	public function setIsLibreSignFile(): void {
 		$this->isLibreSignFile = true;
 	}
@@ -113,25 +80,25 @@ public function getCertificateChain($resource): array {
 		$certificateEngine->setPolicyUserIdForValidation($this->policyUserIdForValidation);
 
 		try {
-			$nativeMetadata = array_values($this->extractNativeSignatureMetadata($resource));
 			rewind($resource);
-			$nativeValidation = array_values($this->pdfSignatureValidationService->validateFromResource($resource));
-			$index = 0;
+			$validationResults = array_values(
+				$this->pdfSignatureValidationService->validateFromResource($resource)
+			);
 
-			foreach ($this->getSignatures($resource) as $signature) {
-				$metadata = $nativeMetadata[$index] ?? [];
-				$validation = $nativeValidation[$index] ?? [];
-				$index++;
+			if ($validationResults === []) {
+				throw new LibresignException($this->l10n->t('Unsigned file.'));
+			}
 
-				if (!$signature) {
+			foreach ($validationResults as $validation) {
+				$signature = $validation['signature'] ?? null;
+				if (!$signature instanceof ExtractedSignature) {
 					continue;
 				}
 
 				$result = $this->processSignature(
 					$resource,
 					$signature,
-					$metadata,
-					$validation
+					$validation,
 				);
 
 				if (empty($result['chain'])) {
@@ -148,35 +115,53 @@ public function getCertificateChain($resource): array {
 		return $certificates;
 	}
 
-	private function processSignature($resource, ?string $signature, array $metadata = [], array $validation = []): array {
-		$result = [];
-
-		if (!$signature) {
-			$result['chain'][0]['signature_validation'] = [
-				'id' => 3,
-				// TRANSLATORS Status label on LibreSign's public/document validation UI when the PDF signature hash does not match the document bytes (tamper or corrupt signature).
-				'label' => $this->l10n->t('Digest mismatch.'),
-			];
-			return $result;
+	private function processSignature(
+		$resource,
+		ExtractedSignature $signature,
+		array $validation = [],
+	): array {
+		$binarySignature = $signature->binarySignature;
+		if ($binarySignature === null || $binarySignature === '') {
+			return $this->enrichLeafWithNativeData(
+				['chain' => [[]]],
+				$signature,
+				$validation,
+			);
 		}
 
+		$result = [];
+
 		try {
-			$decoded = ASN1::decodeBER($signature);
+			$decoded = ASN1::decodeBER($binarySignature);
 		} catch (UnexpectedValueException) {
-			return [];
+			$decoded = null;
+		}
+
+		$result = $this->extractSigningTime($decoded, $result);
+
+		$timestamp = $validation['timestamp'] ?? null;
+		if ($timestamp instanceof TimestampToken) {
+			$result['timestamp'] = $this->mapTimestampToken($timestamp);
 		}
-		$result = $this->extractTimestampData($decoded, $result);
 
-		$chain = $this->extractCertificateChain($signature);
+		$pemCertificates = $validation['certificates'] ?? [];
+		if (!is_array($pemCertificates)) {
+			$pemCertificates = [];
+		}
+
+		$chain = $this->extractCertificateChain($pemCertificates);
 		if (!empty($chain)) {
 			$result['chain'] = $this->orderCertificates($chain);
-			$result = $this->enrichLeafWithNativeData($result, $metadata, $validation);
+			$result = $this->enrichLeafWithNativeData(
+				$result,
+				$signature,
+				$validation,
+			);
 		}
 
 		$result = $this->extractDocMdpData($resource, $result);
 
-		$result = $this->applyLibreSignRootCAFlag($result);
-		return $result;
+		return $this->applyLibreSignRootCAFlag($result);
 	}
 
 	private function applyLibreSignRootCAFlag(array $signer): array {
@@ -209,55 +194,71 @@ private function extractDocMdpData($resource, array $result): array {
 		return array_merge($result, $docMdpData);
 	}
 
-	private function extractTimestampData(?array $decoded, array $result): array {
+	private function extractSigningTime(?array $decoded, array $result): array {
 		if ($decoded === null) {
 			return $result;
 		}
 
 		$tsa = new TSA();
-
-		$timestampData = $tsa->extract($decoded);
-		if (!empty($timestampData['genTime']) || !empty($timestampData['policy']) || !empty($timestampData['serialNumber'])) {
-			$result['timestamp'] = $timestampData;
+		$signingTime = $tsa->getSigninTime($decoded);
+		if ($signingTime instanceof \DateTime) {
+			$result['signingTime'] = $signingTime;
 		}
 
-		if (!isset($result['signingTime']) || !$result['signingTime'] instanceof \DateTime) {
-			$result['signingTime'] = $tsa->getSigninTime($decoded);
-		}
 		return $result;
 	}
 
-	private function extractCertificateChain(string $signature): array {
-		$pkcs7PemSignature = $this->der2pem($signature);
-		$pemCertificates = [];
-
-		if (!openssl_pkcs7_read($pkcs7PemSignature, $pemCertificates)) {
-			return [];
-		}
+	private function mapTimestampToken(TimestampToken $timestamp): array {
+		$result = [
+			'genTime' => $timestamp->generatedAt,
+			'policy' => $timestamp->policyOid,
+			'serialNumber' => $timestamp->serialNumber,
+			'cnHints' => $timestamp->certificateSubject,
+			'tsaName' => $timestamp->certificateSubject['commonName'] ?? null,
+		];
+
+		return array_filter(
+			$result,
+			static fn (mixed $value): bool => $value !== null
+				&& $value !== ''
+				&& $value !== [],
+		);
+	}
 
+	/**
+	 * @param list<string> $pemCertificates
+	 */
+	private function extractCertificateChain(array $pemCertificates): array {
 		$chain = [];
 		$isLibreSignRootCA = false;
 		$certificateEngine = $this->getCertificateEngine();
 
 		foreach ($pemCertificates as $index => $pemCertificate) {
+			if (!is_string($pemCertificate) || $pemCertificate === '') {
+				continue;
+			}
+
 			$parsed = $certificateEngine->parseCertificate($pemCertificate);
-			if ($parsed) {
-				$parsed['signature_validation'] = [
-					'id' => 1,
-					// TRANSLATORS Status label on LibreSign signature validation when the cryptographic PDF signature checks out successfully.
-					'label' => $this->l10n->t('Signature is valid.'),
-				];
-				if (!$isLibreSignRootCA) {
-					$isLibreSignRootCA = $this->isLibreSignRootCA($pemCertificate, $parsed);
-				}
-				$parsed['isLibreSignRootCA'] = $isLibreSignRootCA;
-				$chain[$index] = $parsed;
+			if (!$parsed) {
+				continue;
+			}
+
+			if (!$isLibreSignRootCA) {
+				$isLibreSignRootCA = $this->isLibreSignRootCA(
+					$pemCertificate,
+					$parsed,
+				);
 			}
+
+			$parsed['isLibreSignRootCA'] = $isLibreSignRootCA;
+			$chain[$index] = $parsed;
 		}
+
 		if ($isLibreSignRootCA || $this->isLibreSignFile) {
 			foreach ($chain as &$cert) {
 				$cert['isLibreSignRootCA'] = true;
 			}
+			unset($cert);
 		}
 
 		return $chain;
@@ -310,38 +311,57 @@ private function getRootCertificatePem(): string {
 			return $this->rootCertificatePem;
 		}
 		$configPath = $this->appConfig->getValueString(Application::APP_ID, 'config_path');
+		$caPemPath = $configPath . DIRECTORY_SEPARATOR . 'ca.pem';
+
 		if (empty($configPath)
 			|| !is_dir($configPath)
-			|| !is_readable($configPath . DIRECTORY_SEPARATOR . 'ca.pem')
+			|| !is_readable($caPemPath)
 		) {
 			return '';
 		}
-		$rootCertificatePem = file_get_contents($configPath . DIRECTORY_SEPARATOR . 'ca.pem');
+
+		$rootCertificatePem = file_get_contents($caPemPath);
 		if ($rootCertificatePem === false) {
 			return '';
 		}
 		$this->rootCertificatePem = $rootCertificatePem;
 		return $this->rootCertificatePem;
 	}
 
-	private function enrichLeafWithNativeData(array $result, array $metadata, array $validation): array {
+	private function enrichLeafWithNativeData(
+		array $result,
+		ExtractedSignature $signature,
+		array $validation,
+	): array {
 		if (empty($result['chain'])) {
 			return $result;
 		}
 
 		$leaf = &$result['chain'][0];
+		$metadata = $signature->metadata;
 
-		foreach (['field', 'range', 'signature_type', 'signing_hash_algorithm', 'covers_entire_document'] as $key) {
-			if (array_key_exists($key, $metadata)) {
-				$leaf[$key] = $metadata[$key];
-			}
+		$leaf['field'] = $metadata->field;
+		$leaf['range'] = $metadata->range;
+		$leaf['signature_type'] = $metadata->signatureType;
+		$leaf['signing_hash_algorithm'] = $signature->hashAlgorithm;
+		$leaf['covers_entire_document'] = $metadata->coversEntireDocument;
+
+		if ($metadata->documentModificationState !== null) {
+			$leaf['document_modification_state']
+				= $metadata->documentModificationState->value;
 		}
 
-		if (isset($validation['signatureValidation']) && is_array($validation['signatureValidation'])) {
+		if (
+			isset($validation['signatureValidation'])
+			&& is_array($validation['signatureValidation'])
+		) {
 			$leaf['signature_validation'] = $validation['signatureValidation'];
 		}
 
-		if (isset($validation['certificateValidation']) && is_array($validation['certificateValidation'])) {
+		if (
+			isset($validation['certificateValidation'])
+			&& is_array($validation['certificateValidation'])
+		) {
 			$leaf['certificate_validation'] = $validation['certificateValidation'];
 		}
 
@@ -356,46 +376,6 @@ private function enrichLeafWithNativeData(array $result, array $metadata, array
 		return $result;
 	}
 
-	/**
-	 * @param resource $resource
-	 * @return array<int, array{field: ?string, range: ?array{offset1: int, offset2: int, length1: int, length2: int}, signature_type: ?string, covers_entire_document: bool}>
-	 */
-	private function extractNativeSignatureMetadata($resource): array {
-		rewind($resource);
-		$content = stream_get_contents($resource);
-		if (!is_string($content) || $content === '') {
-			return [];
-		}
-
-		try {
-			$signatures = $this->extractNativeSignaturesFromContent($content);
-		} catch (UnsignedPdfException) {
-			return [];
-		}
-		$metadata = [];
-
-		foreach ($signatures as $index => $signature) {
-			$metadata[$index] = [
-				'field' => $signature->metadata->field,
-				'range' => $signature->metadata->range,
-				'signature_type' => $signature->metadata->signatureType,
-				'covers_entire_document' => $signature->metadata->coversEntireDocument,
-			];
-		}
-
-		return $metadata;
-	}
-
-	protected function extractNativeSignaturesFromContent(string $content): array {
-		return $this->pdfSignatureExtractor->extractFromString($content);
-	}
-
-	private function der2pem($derData) {
-		$pem = chunk_split(base64_encode((string)$derData), 64, "\n");
-		$pem = "-----BEGIN CERTIFICATE-----\n" . $pem . "-----END CERTIFICATE-----\n";
-		return $pem;
-	}
-
 	private function getHandler(): SignEngineHandler {
 		$sign_engine = $this->appConfig->getValueString(Application::APP_ID, 'signature_engine', 'JSignPdf');
 		$property = lcfirst($sign_engine) . 'Handler';

diff --git a/lib/ResponseDefinitions.php b/lib/ResponseDefinitions.php
@@ -223,6 +223,7 @@
  *     sign_request_uuid?: string,
  *     hash_algorithm?: string,
  *     covers_entire_document?: bool,
+ *     document_modification_state?: 'unchanged'|'unsigned_content'|'trailing_data'|'invalid_byte_range'|'invalid_eof_boundary',
  *     me: bool,
  *     signingOrder?: non-negative-int,
  *     visibleElements: LibresignVisibleElement[],
+1 −1		composer.json
+7 −7		composer.lock
+7 −7		composer/composer/installed.json
+3 −0		composer/libresign/pdf-signature-validator/src/Model/ValidationReason.php
+15 −3		composer/libresign/pdf-signature-validator/src/Parser/PdfDocumentModificationAnalyzer.php
+34 −7		composer/libresign/pdf-signature-validator/src/Parser/PdfSignatureValidator.php
+96 −0		composer/libresign/pdf-signature-validator/tests/Unit/Parser/PdfSignatureStructureValidationTest.php