hexapdf 1.10.0 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c85f671cd9d2e469b7f0e8c1ea2f9beec6a09247881c2404b8c9789ba65cd03
-  data.tar.gz: e6d53dd3da7a366f5b724448d31bc7edacae9acb65f6f4fe95e6e3c5caf27564
+  metadata.gz: da17a2a9dd8459e6f4624f59621c84f1b0be73f4d23347bffcdd6c534b58680e
+  data.tar.gz: ecdcfedc4f89722f799d04fda467acbed24bf256a1fa626623fce1d6399d6d98
 SHA512:
-  metadata.gz: 2572d491909fa5f4574705de076a2889d7a0869f6cb3358787394b02ed00ec7e0763617515f9f2ecb50718f6b584189f88e0dad0ab612f0472b8551402331628
-  data.tar.gz: cfe5c5efeaa319b781c566a3d1b0034bf1876ddc8100fecdb96257f68064779476f579e266e796b5a5740177b899319c1fde9e4f21b355d14054e5f157cb3e30
+  metadata.gz: 5a39a7635005c7ef8be1dc0a1efc21b1aca00fba3bedb80886e5d909d9fc0ebfed0f967fff6f10f96ed6b05a883fee0337fea3802bfcde3a93a644e512d0ee3b
+  data.tar.gz: 4e9ccdbe854d0e5fb00e7042d61c758da93c5b354982b48a20f4a6cec3a07d209dac5711d1eb9b3b6274d8662acac8851124a838bed5795cc6e40c924f4bba26

data/CHANGELOG.md

@@ -1,3 +1,33 @@
+## 1.11.0 - 2026-09-22
+
+### Added
+
+* [HexaPDF::DigitalSignature::Signatures#add_ltv_information] for adding
+  long term validation information to signed documents
+* [HexaPDF::Type::DocumentSecurityStore] convenience methods for accessing
+  entries
+
+### Changed
+
+* [HexaPDF::Type::AcroForm::ChoiceField#list_box_top_index] to always return a
+  valid index
+* [HexaPDF::Task::ImportPages] to allow resizing the pages to a target media box
+
+### Fixed
+
+* [HexaPDF::Content::Canvas#xobject] to correctly position the bottom-left
+  corner of Form XObjects in case of scaling
+* Reading password from standard input for the hexapdf CLI
+* Use Adobe (not PDF spec) order for link annotation's /QuadPoints value to
+  ensure compatibility with most major PDF viewers/software
+* [HexaPDF::Type::AcroForm::AppearanceGenerator] to work for files where one or
+  more values are not in the set of available list box options
+* [HexaPDF::Type::AcroForm::Field#embedded_widget?] to only return if the
+  /Subtype entry is actually /Widget
+* [HexaPDF::Task::ImportPages] to take optional content groups in Form XObjects
+  into account
+
+
 ## 1.10.0 - 2026-08-21
 
 ### Added

data/lib/hexapdf/cli/command.rb

@@ -410,8 +410,7 @@ module HexaPDF
       def read_from_console(prompt, noecho: false)
         IO.console.write("#{prompt}: ")
         if noecho
-          IO.console.noecho {|io| io.gets.chomp }
-          puts
+          IO.console.noecho {|io| io.gets.chomp }.tap { puts }
         else
           IO.console.gets.chomp
         end

data/lib/hexapdf/content/canvas.rb

@@ -1763,8 +1763,8 @@ module HexaPDF
         if obj[:Subtype] != :Image
           width /= obj.box.width.to_f
           height /= obj.box.height.to_f
-          left -= obj.box.left
-          bottom -= obj.box.bottom
+          left -= obj.box.left * width
+          bottom -= obj.box.bottom * height
         end
 
         if left == 0 && bottom == 0 && width == 1 && height == 1

data/lib/hexapdf/digital_signature/signatures.rb

@@ -34,8 +34,10 @@
 # commercial licenses are available at <https://gettalong.at/hexapdf/>.
 #++
 
+require 'net/http'
 require 'openssl'
 require 'stringio'
+require 'uri'
 require 'hexapdf/digital_signature'
 require 'hexapdf/error'
 
@@ -175,6 +177,41 @@ module HexaPDF
         io.close if io && io != file_or_io
       end
 
+      # Adds long-term validation information to the document.
+      #
+      # For each certificate OCSP is tried as it is smaller. If OCSP is not available, the CRL is
+      # used. If a problem is encountered, an error is thrown.
+      def add_ltv_information
+        dss = @document.catalog.dss
+
+        each do |signature|
+          certificates = signature.signature_handler.certificate_chain.dup
+          if (tsa_token = signature.signature_handler.embedded_tsa_signature)
+            certificates.concat(tsa_token.certificates)
+          end
+          cert_from_subject = certificates.each_with_object({}) {|c, h| h[c.subject] = c }
+
+          certs = []
+          ocsps = []
+          crls  = []
+          certificates.each do |cert|
+            certs << cert.to_der
+            next if cert.issuer == cert.subject  # skip self-signed root CA
+
+            issuer = cert_from_subject[cert.issuer]
+            if issuer && (ocsp_der = fetch_ocsp_response(cert, issuer))
+              ocsps << ocsp_der
+            elsif (crl_der = fetch_crl(cert))
+              crls << crl_der
+            else
+              raise HexaPDF::Error, "No OCSP and CRL response could be fetched for #{cert.subject}"
+            end
+          end
+
+          dss.add_vri(signature, certs: certs, ocsps: ocsps, crls: crls)
+        end
+      end
+
       # :call-seq:
       #   signatures.each {|signature| block }   -> signatures
       #   signatures.each                        -> Enumerator
@@ -205,6 +242,74 @@ module HexaPDF
         "Signature#{index}"
       end
 
+      # Fetches an OCSP response for +cert+ issued by +issuer+. Returns the DER-encoded response, or
+      # +nil+ if no URL is found or the request fails.
+      def fetch_ocsp_response(cert, issuer)
+        url = cert.ocsp_uris&.first
+        return nil unless url
+
+        certificate_id = OpenSSL::OCSP::CertificateId.new(cert, issuer)
+        req = OpenSSL::OCSP::Request.new
+        req.add_certid(certificate_id)
+        req.add_nonce
+
+        url = URI(url)
+        http_request = Net::HTTP::Post.new(url, 'Content-Type' => 'application/ocsp-request')
+        http_request.body = req.to_der
+        http_response = Net::HTTP.start(url.hostname, url.port, use_ssl: (url.scheme == 'https')) do |http|
+          http.request(http_request)
+        end
+
+        if http_response.kind_of?(Net::HTTPOK)
+          ocsp_der = http_response.body
+          response = OpenSSL::OCSP::Response.new(ocsp_der)
+          basic_response = response.basic
+          if response.status != OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL ||
+             req.check_nonce(basic_response) == 0
+            return nil
+          end
+          single_response = basic_response.find_response(certificate_id)
+          return nil unless single_response && single_response.check_validity
+          if single_response.cert_status != OpenSSL::OCSP::V_CERTSTATUS_GOOD
+            raise HexaPDF::Error, "OCSP response indicates that the certificate is not valid"
+          end
+          ocsp_der
+        else
+          nil
+        end
+      rescue HexaPDF::Error
+        raise
+      rescue
+        nil
+      end
+
+      # Fetches a CRL for +cert+. Returns the DER-encoded CRL, or +nil+ if no URL is found or the
+      # request fails.
+      def fetch_crl(cert)
+        url = cert.crl_uris&.first
+        return nil unless url
+
+        http_response = Net::HTTP.get_response(URI(url))
+        if http_response.kind_of?(Net::HTTPOK)
+          crl_der = http_response.body
+          cert_serial = cert.serial
+          crl = OpenSSL::X509::CRL.new(crl_der)
+          if crl_der.include?(OpenSSL::ASN1::Integer.new(cert_serial).to_der)
+            crl = OpenSSL::X509::CRL.new(crl_der)
+            if crl.revoked.find {|r| r.serial == cert_serial }
+              raise HexaPDF::Error, "CRL response indicates that the certificate is revoked"
+            end
+          end
+          crl_der
+        else
+          nil
+        end
+      rescue HexaPDF::Error
+        raise
+      rescue
+        nil
+      end
+
     end
 
   end

data/lib/hexapdf/digital_signature/signing/signed_data_creator.rb

@@ -53,8 +53,6 @@ module HexaPDF
       # As the created CMS object is only meant to be used in the context of PDF signing, it also
       # restricts certain things, like allowing only a single signer.
       #
-      # Additionally, only RSA signatures are currently supported!
-      #
       # See: PDF2.0 s12.8.3.3, PDF2.0 s12.8.3.4, RFC5652, ETSI TS 102 778 Parts 1-4
       class SignedDataCreator
 

data/lib/hexapdf/document.rb

@@ -693,8 +693,8 @@ module HexaPDF
     # If not changed, the default signing handler is DigitalSignature::Signing::DefaultHandler.
     #
     # *Note*: Once signing is done the document cannot be changed anymore since it was written
-    # during the signing process. If a document needs to be signed multiple times, it needs to be
-    # loaded again afterwards.
+    # during the signing process. If a document needs to be signed multiple times or if LTV
+    # information needs to be added, it needs to be loaded again afterwards.
     def sign(file_or_io, handler: :default, signature: nil, write_options: {}, **handler_options)
       handler = signatures.signing_handler(name: handler, **handler_options)
       signatures.add(file_or_io, handler, signature: signature, write_options: write_options)

data/lib/hexapdf/layout/style.rb

@@ -541,8 +541,8 @@ module HexaPDF
 
           page = canvas.context
           matrix = canvas.graphics_state.ctm
-          quad_points = [*matrix.evaluate(0, 0), *matrix.evaluate(box.width, 0),
-                         *matrix.evaluate(box.width, box.height), *matrix.evaluate(0, box.height)]
+          quad_points = [*matrix.evaluate(0, box.height), *matrix.evaluate(box.width, box.height),
+                         *matrix.evaluate(0, 0), *matrix.evaluate(box.width, 0)]
           x_minmax = quad_points.values_at(0, 2, 4, 6).minmax
           y_minmax = quad_points.values_at(1, 3, 5, 7).minmax
           border_color = case @border_color

data/lib/hexapdf/layout/text_shaper.rb

@@ -43,62 +43,6 @@ HARFBUZZ_AVAILABLE = begin
                      rescue LoadError
                      end
 
-if HARFBUZZ_AVAILABLE
-  class HarfBuzz::Buffer #:nodoc:
-
-    GLYPH_INFO_SIZE = HarfBuzz::C::HbGlyphInfoT.size
-    GLYPH_INFO_CODEPOINT_OFFSET = HarfBuzz::C::HbGlyphInfoT.offset_of(:codepoint)
-    GLYPH_INFO_CLUSTER_OFFSET = HarfBuzz::C::HbGlyphInfoT.offset_of(:cluster)
-    GLYPH_POS_SIZE  = HarfBuzz::C::HbGlyphPositionT.size
-    GLYPH_POS_XADVANCE_OFFSET = HarfBuzz::C::HbGlyphPositionT.offset_of(:x_advance)
-    GLYPH_POS_YADVANCE_OFFSET = HarfBuzz::C::HbGlyphPositionT.offset_of(:y_advance)
-    GLYPH_POS_XOFFSET_OFFSET = HarfBuzz::C::HbGlyphPositionT.offset_of(:x_offset)
-    GLYPH_POS_YOFFSET_OFFSET = HarfBuzz::C::HbGlyphPositionT.offset_of(:y_offset)
-
-    # Iterates efficiently over the shaping result without creating intermediary objects.
-    def each_result
-      return enum_for(__method__) unless block_given?
-
-      length_ptr = FFI::MemoryPointer.new(:uint)
-      infos_ptr = HarfBuzz::C.hb_buffer_get_glyph_infos(@ptr, length_ptr)
-      length_ptr = FFI::MemoryPointer.new(:uint)
-      positions_ptr = HarfBuzz::C.hb_buffer_get_glyph_positions(@ptr, length_ptr)
-      length = length_ptr.read_uint
-
-      return if infos_ptr.null? || positions_ptr.null? || length.zero?
-
-      last_info_cluster_offset = (length - 1) * GLYPH_INFO_SIZE + GLYPH_INFO_CLUSTER_OFFSET
-      i = 0
-      while i < length
-        info_offset = i * GLYPH_INFO_SIZE
-        pos_offset  = i * GLYPH_POS_SIZE
-
-        glyph_id = infos_ptr.get_uint32(info_offset + GLYPH_INFO_CODEPOINT_OFFSET)
-        cluster  = infos_ptr.get_uint32(info_offset + GLYPH_INFO_CLUSTER_OFFSET)
-
-        next_cluster = nil
-        tmp_offset = info_offset + GLYPH_INFO_CLUSTER_OFFSET + GLYPH_INFO_SIZE
-        while tmp_offset <= last_info_cluster_offset &&
-              (next_cluster = infos_ptr.get_uint32(tmp_offset)) == cluster
-          tmp_offset += GLYPH_INFO_SIZE
-          next_cluster = nil
-        end
-
-        x_advance = positions_ptr.get_int32(pos_offset + GLYPH_POS_XADVANCE_OFFSET)
-        y_advance = positions_ptr.get_int32(pos_offset + GLYPH_POS_YADVANCE_OFFSET)
-        x_offset = positions_ptr.get_int32(pos_offset + GLYPH_POS_XOFFSET_OFFSET)
-        y_offset = positions_ptr.get_int32(pos_offset + GLYPH_POS_YOFFSET_OFFSET)
-
-        yield(glyph_id, cluster, next_cluster, x_advance, y_advance, x_offset, y_offset)
-
-        i += 1
-      end
-
-      self
-    end
-  end
-end
-
 module HexaPDF
   module Layout
 
@@ -188,7 +132,7 @@ module HexaPDF
         items = text_fragment.items.clear
         last_cluster = nil
         last_y_offset = 0
-        buffer.each_result do |glyph_id, cluster, next_cluster, x_advance, y_advance, x_offset, y_offset|
+        buffer.each_glyph_with_clusters do |glyph_id, cluster, next_cluster, x_advance, y_advance, x_offset, y_offset|
           advance = (x_advance - x_offset) * font.scaling_factor
 
           # 1. Determine the source characters for each glyph via their cluster numbers. If two or

data/lib/hexapdf/task/import_pages.rb

@@ -51,6 +51,9 @@ module HexaPDF
     # Note that the /Order, /AS and /Locked fields of the default optional content configuration
     # dictionary are not preserved.
     #
+    # The imported page can optionally be resized to a given page size. Note, however, that this
+    # will make all interactive elements (e.g. annotation widgets and form fields) static.
+    #
     # Example:
     #
     #   doc.task(:import_pages, source: source_doc, pages: [1..-2])
@@ -87,7 +90,20 @@ module HexaPDF
       #
       #     +:merge+:: Merge AcroForm fields using the MergeAcroForm task.
       #     +:ignore+:: Ignore AcroForm fields.
-      def self.call(doc, source:, pages: :all, append: true, ocgs: :preserve, acro_form: :merge)
+      #
+      # +:resize_to+::
+      #     Resizes the pages to the given page size (either a pre-defined name or an array
+      #     specifying the media box), potentially deforming it. This is done by converting the page
+      #     to a Form XObject and then painting it.
+      #
+      #     Note 1: By specifying this argument, the argument +acro_form+ is handled as if it were
+      #     :ignore.
+      #
+      #     Note 2: Annotations without an appearance stream are ignored. If that is something that
+      #     needs to be considered, +page.flatten_annotations+ should be called beforehand for each
+      #     source page and the results handled.
+      def self.call(doc, source:, pages: :all, append: true, ocgs: :preserve, acro_form: :merge,
+                    resize_to: nil)
         # Retrieve all specified source pages
         pages = if pages == :all
                   source.pages.each.to_a
@@ -106,6 +122,7 @@ module HexaPDF
         # Import the source pages and optionally append them to the target page tree
         pages = pages.map do |page|
           imported_page = doc.import(page)
+          imported_page = resize_page(doc, imported_page, resize_to) if resize_to
           doc.pages << imported_page if append
           imported_page
         end
@@ -128,17 +145,19 @@ module HexaPDF
             ocgs.merge(obj[:OCGs].to_ary)
           end
         end
+        process_page_or_form = lambda do |page_or_form|
+          page_or_form.resources[:Properties]&.each do |name, obj|
+            process_ocg_or_ocmd.call(obj) if obj
+          end
+          page_or_form.resources[:XObject]&.each do |name, obj|
+            process_ocg_or_ocmd.call(obj[:OC]) if obj.key?(:OC)
+            process_page_or_form.call(obj) if obj[:Subtype] == :Form
+          end
+        end
         seen_resources = {}
         pages.each do |page|
           unless seen_resources[page.resources] # handle case when pages share the resources dict
-            page.resources[:Properties]&.each do |name, obj|
-              next unless obj
-              process_ocg_or_ocmd.call(obj)
-            end
-
-            page.resources[:XObject]&.each do |name, obj|
-              process_ocg_or_ocmd.call(obj[:OC]) if obj.key?(:OC)
-            end
+            process_page_or_form.call(page)
           end
 
           page.each_annotation do |annot|
@@ -178,6 +197,19 @@ module HexaPDF
           (target_config[:RBGroups] ||= []) << result
         end
       end
+      private_class_method :preserve_ocgs
+
+      # Resizes the +page+ to the given +media_box+ exactly, potentially deforming it.
+      def self.resize_page(doc, page, media_box)
+        page.flatten_annotations
+        form = page.to_form_xobject
+        doc.delete(page)
+        page = doc.pages.create(media_box: media_box)
+        media_box = page.box(:media) # needed because before media_box could be e.g. :A4
+        page.canvas.xobject(form, at: [0, 0], width: media_box.width, height: media_box.height)
+        page
+      end
+      private_class_method :resize_page
 
     end
 

data/lib/hexapdf/type/acro_form/appearance_generator.rb

@@ -505,7 +505,7 @@ module HexaPDF
           top_index = @field.list_box_top_index
           items = @document.layout.text_fragments(option_items[top_index..-1].join("\n"), style: style)
           # Should use /I but if it differs from /V, we need to use /V; so just use /V...
-          indices = [@field.field_value].flatten.compact.map {|val| option_items.index(val) }
+          indices = [@field.field_value].flatten.compact.filter_map {|val| option_items.index(val) }
 
           layouter = Layout::TextLayouter.new(style)
           layouter.style.text_align(@field.text_alignment).line_spacing(:proportional, 1.25)

data/lib/hexapdf/type/acro_form/choice_field.rb

@@ -199,7 +199,9 @@ module HexaPDF
 
         # Returns the index of the first visible option item of a list box.
         def list_box_top_index
-          self[:TI]
+          prepare_option_items
+          ti = self[:TI]
+          ti.kind_of?(Integer) && self[:Opt] && ti.between?(0, self[:Opt].length - 1) ? ti : 0
         end
 
         # Makes the option item referred to via the given +index+ the first visible option item of a

data/lib/hexapdf/type/acro_form/field.rb

@@ -260,7 +260,7 @@ module HexaPDF
 
         # Returns +true+ if the field contains an embedded widget.
         def embedded_widget?
-          key?(:Subtype)
+          self[:Subtype] == :Widget
         end
 
         # :call-seq:

data/lib/hexapdf/type/document_security_store.rb

@@ -94,6 +94,11 @@ module HexaPDF
         (self[:VRI] ||= {})[key] = document.add(vri)
       end
 
+      # Returns the VRI dictionary for the given signature if it exists or else +nil+.
+      def vri_for(signature)
+        self[:VRI] && self[:VRI][OpenSSL::Digest::SHA1.hexdigest(signature.contents).upcase.to_sym]
+      end
+
       # Adds the DER-encoded certificate to the /Certs array if not already present and returns
       # the stream object containing it.
       def add_cert(cert_der)
@@ -112,6 +117,15 @@ module HexaPDF
         add_data_as_stream_to_field(crl_der, :CRLs)
       end
 
+      # Returns all certificates in the /Certs array as OpenSSL::X509::Certificate objects.
+      def certificates
+        if key?(:Certs)
+          self[:Certs].length.times.map {|i| OpenSSL::X509::Certificate.new(self[:Certs][i].stream) }
+        else
+          []
+        end
+      end
+
       private
 
       # Adds the given string +data+ to the +field+ array as stream object and returns the resulting

data/lib/hexapdf/version.rb

@@ -37,6 +37,6 @@
 module HexaPDF
 
   # The version of HexaPDF.
-  VERSION = '1.10.0'
+  VERSION = '1.11.0'
 
 end

data/test/hexapdf/content/test_canvas.rb

@@ -942,7 +942,7 @@ describe HexaPDF::Content::Canvas do
     it "correctly serializes the form with just the width given" do
       @canvas.image(@form, at: [1, 2], width: 50)
       assert_operators(@page.contents, [[:save_graphics_state],
-                                        [:concatenate_matrix, [0.5, 0, 0, 0.5, -99, -48]],
+                                        [:concatenate_matrix, [0.5, 0, 0, 0.5, -49, -23]],
                                         [:paint_xobject, [:XO1]],
                                         [:restore_graphics_state]])
     end
@@ -950,7 +950,7 @@ describe HexaPDF::Content::Canvas do
     it "correctly serializes the form with just the height given" do
       @canvas.image(@form, at: [1, 2], height: 10)
       assert_operators(@page.contents, [[:save_graphics_state],
-                                        [:concatenate_matrix, [0.2, 0, 0, 0.2, -99, -48]],
+                                        [:concatenate_matrix, [0.2, 0, 0, 0.2, -19, -8]],
                                         [:paint_xobject, [:XO1]],
                                         [:restore_graphics_state]])
     end
@@ -958,7 +958,7 @@ describe HexaPDF::Content::Canvas do
     it "correctly serializes the form with both width and height given" do
       @canvas.image(@form, at: [1, 2], width: 50, height: 10)
       assert_operators(@page.contents, [[:save_graphics_state],
-                                        [:concatenate_matrix, [0.5, 0, 0, 0.2, -99, -48]],
+                                        [:concatenate_matrix, [0.5, 0, 0, 0.2, -49, -8]],
                                         [:paint_xobject, [:XO1]],
                                         [:restore_graphics_state]])
     end