hexapdf 1.9.1 → 1.11.0

data/lib/hexapdf/type/document_security_store.rb

@@ -34,6 +34,7 @@
 # commercial licenses are available at <https://gettalong.at/hexapdf/>.
 #++
 
+require 'openssl'
 require 'hexapdf/dictionary'
 
 module HexaPDF
@@ -54,25 +55,92 @@ module HexaPDF
         define_type :VRI
 
         define_field :Type, type: Symbol, default: type
-        define_field :Cert, type: PDFArray
-        define_field :CRL,  type: PDFArray
-        define_field :OCSP, type: PDFArray
-        define_field :TU,   type: PDFDate
-        define_field :TS,   type: Stream
+        define_field :Cert, type: PDFArray, version: '2.0'
+        define_field :CRL,  type: PDFArray, version: '2.0'
+        define_field :OCSP, type: PDFArray, version: '2.0'
+        define_field :TU,   type: PDFDate, version: '2.0'
+        define_field :TS,   type: Stream, version: '2.0'
 
       end
 
       define_type :DSS
 
       define_field :Type,  type: Symbol, default: type
-      define_field :VRI,   type: Dictionary
-      define_field :Certs, type: PDFArray
-      define_field :OCSPs, type: PDFArray
-      define_field :CRLs,  type: PDFArray
-      define_field :SW, type: Symbol,   default: :A, allowed_values: [:A, :B, :S, :N]
-      define_field :S,  type: Symbol,   default: :P, allowed_values: [:A, :P]
-      define_field :A,  type: PDFArray, default: [0.5, 0.5]
-      define_field :FB, type: Boolean,  default: false, version: '1.5'
+      define_field :VRI,   type: Dictionary, version: '2.0'
+      define_field :Certs, type: PDFArray, version: '2.0'
+      define_field :OCSPs, type: PDFArray, version: '2.0'
+      define_field :CRLs,  type: PDFArray, version: '2.0'
+
+      # Adds validation data for a single signature to the /VRI dictionary and to the various
+      # arrays, and returns the new VRI entry.
+      #
+      # +signature+::
+      #     The signature for which the validation data should be added.
+      #
+      # +certs+::
+      #     Array of DER-encoded certificates.
+      #
+      # +ocsps+::
+      #     Array of DER-encoded OCSP responses.
+      #
+      # +crls+::
+      #     Array of DER-encoded CRLs.
+      def add_vri(signature, certs: [], ocsps: [], crls: [])
+        key = OpenSSL::Digest::SHA1.hexdigest(signature.contents).upcase.to_sym
+        vri = {Type: :VRI}
+        vri[:Cert] = certs.map {|der| add_cert(der) } unless certs.empty?
+        vri[:OCSP] = ocsps.map {|der| add_ocsp(der) } unless ocsps.empty?
+        vri[:CRL]  = crls.map  {|der| add_crl(der)  } unless crls.empty?
+        (self[:VRI] ||= {})[key] = document.add(vri)
+      end
+
+      # Returns the VRI dictionary for the given signature if it exists or else +nil+.
+      def vri_for(signature)
+        self[:VRI] && self[:VRI][OpenSSL::Digest::SHA1.hexdigest(signature.contents).upcase.to_sym]
+      end
+
+      # Adds the DER-encoded certificate to the /Certs array if not already present and returns
+      # the stream object containing it.
+      def add_cert(cert_der)
+        add_data_as_stream_to_field(cert_der, :Certs)
+      end
+
+      # Adds the DER-encoded OCSP response to the /OCSPs array if not already present and returns
+      # the stream object containing it.
+      def add_ocsp(ocsp_der)
+        add_data_as_stream_to_field(ocsp_der, :OCSPs)
+      end
+
+      # Adds the DER-encoded CRL to the /CRLs array if not already present and returns the stream
+      # object containing it.
+      def add_crl(crl_der)
+        add_data_as_stream_to_field(crl_der, :CRLs)
+      end
+
+      # Returns all certificates in the /Certs array as OpenSSL::X509::Certificate objects.
+      def certificates
+        if key?(:Certs)
+          self[:Certs].length.times.map {|i| OpenSSL::X509::Certificate.new(self[:Certs][i].stream) }
+        else
+          []
+        end
+      end
+
+      private
+
+      # Adds the given string +data+ to the +field+ array as stream object and returns the resulting
+      # stream.
+      #
+      # If the field already contains a stream with the same data, this existing stream is returned.
+      def add_data_as_stream_to_field(data, field)
+        self[field] ||= []
+        existing_stream = self[field].find {|stream| stream.stream == data }
+        return existing_stream if existing_stream
+
+        stream = document.add({Filter: :FlateDecode}, stream: data)
+        self[field] << stream
+        stream
+      end
 
     end
 

data/lib/hexapdf/type/font_type0.rb

@@ -146,7 +146,7 @@ module HexaPDF
           registry = system_info[:Registry]
           ordering = system_info[:Ordering]
           if (encoding.kind_of?(Symbol) && HexaPDF::Font::CMap.predefined?(encoding.to_s) &&
-            encoding != :'Identity-H' && encoding != :'Identity-V') ||
+              encoding != :'Identity-H' && encoding != :'Identity-V') ||
               (registry == "Adobe" && ['GB1', 'CNS1', 'Japan1', 'Korea1'].include?(ordering))
             HexaPDF::Font::CMap.for_name("#{registry}-#{ordering}-UCS2")
           end

data/lib/hexapdf/version.rb

@@ -37,6 +37,6 @@
 module HexaPDF
 
   # The version of HexaPDF.
-  VERSION = '1.9.1'
+  VERSION = '1.11.0'
 
 end

data/test/hexapdf/content/test_canvas.rb

@@ -942,7 +942,7 @@ describe HexaPDF::Content::Canvas do
     it "correctly serializes the form with just the width given" do
       @canvas.image(@form, at: [1, 2], width: 50)
       assert_operators(@page.contents, [[:save_graphics_state],
-                                        [:concatenate_matrix, [0.5, 0, 0, 0.5, -99, -48]],
+                                        [:concatenate_matrix, [0.5, 0, 0, 0.5, -49, -23]],
                                         [:paint_xobject, [:XO1]],
                                         [:restore_graphics_state]])
     end
@@ -950,7 +950,7 @@ describe HexaPDF::Content::Canvas do
     it "correctly serializes the form with just the height given" do
       @canvas.image(@form, at: [1, 2], height: 10)
       assert_operators(@page.contents, [[:save_graphics_state],
-                                        [:concatenate_matrix, [0.2, 0, 0, 0.2, -99, -48]],
+                                        [:concatenate_matrix, [0.2, 0, 0, 0.2, -19, -8]],
                                         [:paint_xobject, [:XO1]],
                                         [:restore_graphics_state]])
     end
@@ -958,7 +958,7 @@ describe HexaPDF::Content::Canvas do
     it "correctly serializes the form with both width and height given" do
       @canvas.image(@form, at: [1, 2], width: 50, height: 10)
       assert_operators(@page.contents, [[:save_graphics_state],
-                                        [:concatenate_matrix, [0.5, 0, 0, 0.2, -99, -48]],
+                                        [:concatenate_matrix, [0.5, 0, 0, 0.2, -49, -8]],
                                         [:paint_xobject, [:XO1]],
                                         [:restore_graphics_state]])
     end

data/test/hexapdf/content/test_smart_text_extractor.rb

@@ -101,6 +101,13 @@ describe HexaPDF::Content::SmartTextExtractor do
                               ['Foot', 50, 10, 66, 20]]))
   end
 
+
+  it "works in case the majority of text runs have zero height" do
+    assert_equal(["Hello", "World News"].join("\n"*17), layout_runs([['World', 50, 80, 70, 80],
+                                                                     ['News', 75, 80, 100, 80],
+                                                                     ['Hello', 50, 100, 70, 100]]))
+  end
+
   it "ignores outliers when calculating the normal line spacing" do
     assert_equal("Hello\nWorld\n\n\n\nHere",
                  layout_runs([['Hello', 50, 100, 70, 110],

data/test/hexapdf/digital_signature/common.rb

@@ -5,6 +5,9 @@ module HexaPDF
 
     class Certificates
 
+      # Port for the combined OCSP responder / CRL distribution point test server.
+      OCSP_CRL_PORT = 34568
+
       def ca_key
         @ca_key ||= OpenSSL::PKey::RSA.new(2048)
       end
@@ -43,6 +46,106 @@ module HexaPDF
           end
       end
 
+      def signer_certificate_with_ocsp
+        @signer_certificate_with_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with OCSP', serial: 6,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp")
+            cert
+          end
+      end
+
+      def signer_certificate_with_crl
+        @signer_certificate_with_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with CRL', serial: 7,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl")
+            cert
+          end
+      end
+
+      def signer_certificate_with_unsuccessful_ocsp
+        @signer_certificate_with_unsuccessful_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with unsucessful OCSP', serial: 11,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp-unsuccessful")
+            cert
+          end
+      end
+
+      def signer_certificate_with_revoked_ocsp
+        @signer_certificate_with_revoked_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with revoked OCSP', serial: 12,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp-revoked")
+            cert
+          end
+      end
+
+      def signer_certificate_with_http_error_ocsp
+        @signer_certificate_with_http_error_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with HTTP error OCSP', serial: 13,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp-http-error")
+            cert
+          end
+      end
+
+      def signer_certificate_with_bad_ocsp
+        @signer_certificate_with_bad_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with bad OCSP', serial: 8,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT + 1}/ocsp")
+            cert
+          end
+      end
+
+      def signer_certificate_with_revoked_crl
+        @signer_certificate_with_revoked_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with revoked CRL', serial: 14,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl-revoked")
+            cert
+          end
+      end
+
+      def signer_certificate_with_http_error_crl
+        @signer_certificate_with_http_error_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with HTTP error CRL', serial: 15,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl-http-error")
+            cert
+          end
+      end
+
+      def signer_certificate_with_bad_crl
+        @signer_certificate_with_bad_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with bad CRL', serial: 9,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT + 1}/crl")
+            cert
+          end
+      end
+
+
       def dsa_signer_key
         @dsa_signer_key ||= OpenSSL::PKey::DSA.new(2048)
       end
@@ -77,11 +180,36 @@ module HexaPDF
             cert = create_cert(name: '/CN=timestamp', serial: 5,
                                public_key: signer_key, issuer: ca_certificate)
             add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
-                           extended_key_usage: 'timeStamping')
+                           extended_key_usage: 'timeStamping',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl")
+            cert
+          end
+      end
+
+      def ocsp_signing_certificate
+        @ocsp_signing_certificate ||=
+          begin
+            cert = create_cert(name: '/CN=OCSP', serial: 10,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           extended_key_usage: 'OCSPSigning')
             cert
           end
       end
 
+      def crl
+        @crl ||=
+          begin
+            crl = OpenSSL::X509::CRL.new
+            crl.version = 1
+            crl.issuer = ca_certificate.subject
+            crl.last_update = Time.now - 60
+            crl.next_update = Time.now + 86400
+            crl.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+            crl
+          end
+      end
+
       def create_cert(name:, serial:, public_key:, issuer: nil)
         name = OpenSSL::X509::Name.parse(name)
         cert = OpenSSL::X509::Certificate.new
@@ -96,7 +224,7 @@ module HexaPDF
       end
 
       def add_extensions(subject_cert, issuer_cert, signing_key, is_ca: false, key_usage: nil,
-                         extended_key_usage: nil)
+                         extended_key_usage: nil, ocsp_url: nil, crl_url: nil)
         extension_factory = OpenSSL::X509::ExtensionFactory.new
         extension_factory.subject_certificate = subject_cert
         extension_factory.issuer_certificate = issuer_cert
@@ -113,6 +241,16 @@ module HexaPDF
           subject_cert.add_extension(extension_factory.create_extension('extendedKeyUsage',
                                                                         extended_key_usage, true))
         end
+        if ocsp_url
+          subject_cert.add_extension(
+            extension_factory.create_extension('authorityInfoAccess', "OCSP;URI:#{ocsp_url}")
+          )
+        end
+        if crl_url
+          subject_cert.add_extension(
+            extension_factory.create_extension('crlDistributionPoints', "URI:#{crl_url}")
+          )
+        end
         subject_cert.sign(signing_key, OpenSSL::Digest.new('SHA1'))
       end
       private :add_extensions
@@ -148,6 +286,75 @@ module HexaPDF
         Thread.new { @tsa_server.start }
       end
 
+      def start_ocsp_crl_server
+        return if defined?(@ocsp_crl_server)
+        require 'webrick'
+        @ocsp_crl_server = WEBrick::HTTPServer.new(Port: OCSP_CRL_PORT, BindAddress: '127.0.0.1',
+                                                   Logger: WEBrick::Log.new(StringIO.new), AccessLog: [])
+        @ocsp_crl_server.mount_proc('/ocsp') do |request, response|
+          ocsp_req = OpenSSL::OCSP::Request.new(request.body)
+          basic_resp = OpenSSL::OCSP::BasicResponse.new
+          ocsp_req.certid.each do |certid|
+            basic_resp.add_status(certid, OpenSSL::OCSP::V_CERTSTATUS_GOOD,
+                                  OpenSSL::OCSP::REVOKED_STATUS_UNSPECIFIED,
+                                  nil, Time.now - 60, Time.now + 86400, nil)
+          end
+          basic_resp.sign(CERTIFICATES.ocsp_signing_certificate, CERTIFICATES.signer_key,
+                          [CERTIFICATES.ca_certificate])
+          response.body = OpenSSL::OCSP::Response.create(
+            OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, basic_resp
+          ).to_der
+          response['Content-Type'] = 'application/ocsp-response'
+        end
+
+        @ocsp_crl_server.mount_proc('/ocsp-unsuccessful') do |request, response|
+          basic_resp = OpenSSL::OCSP::BasicResponse.new
+          basic_resp.sign(CERTIFICATES.ocsp_signing_certificate, CERTIFICATES.signer_key,
+                          [CERTIFICATES.ca_certificate])
+          response.body = OpenSSL::OCSP::Response.create(
+            OpenSSL::OCSP::RESPONSE_STATUS_INTERNALERROR, basic_resp
+          ).to_der
+          response['Content-Type'] = 'application/ocsp-response'
+        end
+
+        @ocsp_crl_server.mount_proc('/ocsp-revoked') do |request, response|
+          ocsp_req = OpenSSL::OCSP::Request.new(request.body)
+          basic_resp = OpenSSL::OCSP::BasicResponse.new
+          ocsp_req.certid.each do |certid|
+            basic_resp.add_status(certid, OpenSSL::OCSP::V_CERTSTATUS_REVOKED,
+                                  OpenSSL::OCSP::REVOKED_STATUS_UNSPECIFIED,
+                                  Time.now - 100, Time.now - 60, Time.now + 86400, nil)
+          end
+          basic_resp.sign(CERTIFICATES.ocsp_signing_certificate, CERTIFICATES.signer_key,
+                          [CERTIFICATES.ca_certificate])
+          response.body = OpenSSL::OCSP::Response.create(
+            OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, basic_resp
+          ).to_der
+          response['Content-Type'] = 'application/ocsp-response'
+        end
+
+        @ocsp_crl_server.mount_proc('/crl') do |_request, response|
+          response.body = CERTIFICATES.crl.to_der
+          response['Content-Type'] = 'application/pkix-crl'
+        end
+
+        @ocsp_crl_server.mount_proc('/crl-revoked') do |_request, response|
+          crl = OpenSSL::X509::CRL.new
+          crl.version = 1
+          crl.issuer = ca_certificate.subject
+          crl.last_update = Time.now - 60
+          crl.next_update = Time.now + 86400
+          revoked = OpenSSL::X509::Revoked.new
+          revoked.serial = signer_certificate_with_revoked_crl.serial
+          revoked.time = Time.now - 100
+          crl.add_revoked(revoked)
+          crl.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+          response.body = crl.to_der
+          response['Content-Type'] = 'application/pkix-crl'
+        end
+        Thread.new { @ocsp_crl_server.start }
+      end
+
     end
 
   end

data/test/hexapdf/digital_signature/test_cms_handler.rb

@@ -125,7 +125,9 @@ describe HexaPDF::DigitalSignature::CMSHandler do
       fac.serial_number = 1
       fac.allowed_digests = ["sha256", "sha512"]
       res = fac.create_timestamp(CERTIFICATES.signer_key, CERTIFICATES.timestamp_certificate, req)
-      @dict.contents = res.token.to_der
+      der_form = res.token.to_der
+      # Convert DER to BER with indefinite length encoding as variation
+      @dict.contents = der_form[0] << "\x80".b << der_form[4..-1] << "\x00\x00".b << "\x00\x00\x00\x00".b
       @dict.signature_type = 'ETSI.RFC3161'
       @handler = HexaPDF::DigitalSignature::CMSHandler.new(@dict)
 
@@ -151,7 +153,7 @@ describe HexaPDF::DigitalSignature::CMSHandler do
         key: CERTIFICATES.signer_key, timestamp_handler: tsh,
         certificates: [CERTIFICATES.ca_certificate]
       )
-      @dict.contents = cms.to_der
+      @dict.contents = cms.to_der << "\x00\x00\x00\x00"
       @dict.signed_data = @data
       @handler = HexaPDF::DigitalSignature::CMSHandler.new(@dict)
     end

data/test/hexapdf/digital_signature/test_pkcs1_handler.rb

@@ -28,6 +28,10 @@ describe HexaPDF::DigitalSignature::PKCS1Handler do
     assert_equal(CERTIFICATES.signer_certificate, @handler.signer_certificate)
   end
 
+  it "returns nil for the embedded timestamp signature" do
+    assert_nil(@handler.embedded_tsa_signature)
+  end
+
   describe "verify" do
     before do
       @store = OpenSSL::X509::Store.new

data/test/hexapdf/digital_signature/test_signatures.rb

@@ -161,4 +161,135 @@ describe HexaPDF::DigitalSignature::Signatures do
       assert(signed_doc.signatures.first.verify)
     end
   end
+
+  describe "add_ltv_information" do
+    before do
+      CERTIFICATES.start_ocsp_crl_server
+      @doc = HexaPDF::Document.new(io: StringIO.new(MINIMAL_PDF))
+      @io = StringIO.new(''.b)
+    end
+
+    # Signs @doc and returns a new HexaPDF::Document instance for the signed document.
+    def sign_with(certificate, key: CERTIFICATES.signer_key, certificate_chain: [CERTIFICATES.ca_certificate])
+      io = StringIO.new(''.b)
+      @doc.sign(io, certificate: certificate, key: key, certificate_chain: certificate_chain)
+      HexaPDF::Document.new(io: io)
+    end
+
+    it "adds all certificates to the DSS" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      assert_equal([CERTIFICATES.signer_certificate_with_ocsp, CERTIFICATES.ca_certificate],
+                   dss.certificates)
+    end
+
+    it "fails if one of the certificates has no OCSP or CRL URL" do
+      doc = sign_with(CERTIFICATES.signer_certificate)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "adds a VRI entry for all non-root certificates" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      assert_equal(1, dss[:VRI].value.length)
+      assert(dss.vri_for(doc.signatures.first))
+    end
+
+    it "embeds OCSP validation data for a certificate that has an AIA OCSP URL" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      vri = dss.vri_for(doc.signatures.first)
+      assert_equal(dss[:OCSPs].value, vri[:OCSP].value)
+      assert_equal(dss[:Certs].value, vri[:Cert].value)
+      assert_nil(dss[:CRLs])
+      assert_nil(vri[:CRL])
+    end
+
+    it "handles a connection failure to the OCSP server" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_bad_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "handles unsuccessful OCSP validation" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_unsuccessful_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "handles successful OCSP validation but with a non-good certificate status" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_revoked_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/OCSP response.*not valid/, e.message)
+    end
+
+    it "handles non-OK HTTP response codes when fetching the OCSP response" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_http_error_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "doesn't use the OCSP information if the issuer certificate is not embedded" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp, certificate_chain: [])
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "embeds CRL validation data when no OCSP URL is present in the certificate" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_crl)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      vri = dss.vri_for(doc.signatures.first)
+      assert_equal(dss[:CRLs].value, vri[:CRL].value)
+      assert_equal(dss[:Certs].value, vri[:Cert].value)
+      assert_nil(dss[:OCSPs])
+      assert_nil(vri[:OCSP])
+    end
+
+    it "handles a connection failure to the CRL server" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_bad_crl)
+      # CRL URL available but bad endpoint
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "handles a certificate that is revoked via CRL" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_revoked_crl)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/CRL.*certificate is revoked/, e.message)
+    end
+
+    it "handles non-OK HTTP response codes when fetching the CRL response" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_http_error_crl)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "embeds validation data for an embedded timestamp signature" do
+      CERTIFICATES.start_tsa_server
+      ts_handler = @doc.signatures.signing_handler(name: :timestamp, signature_size: 20_000,
+                                                   tsa_url: "http://127.0.0.1:34567")
+      io = StringIO.new(''.b)
+      @doc.sign(io, certificate: CERTIFICATES.signer_certificate_with_ocsp,
+                key: CERTIFICATES.signer_key, certificate_chain: [CERTIFICATES.ca_certificate],
+                timestamp_handler: ts_handler)
+      doc = HexaPDF::Document.new(io: io)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      vri = dss.vri_for(doc.signatures.first)
+      assert_equal(3, vri[:Cert].value.size)
+    end
+
+    it "creates VRI entries for all signatures" do
+      @doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc = sign_with(CERTIFICATES.signer_certificate_with_crl)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      assert_equal(2, dss[:VRI].value.size)
+    end
+  end
 end

data/test/hexapdf/encryption/test_security_handler.rb

@@ -302,6 +302,18 @@ describe HexaPDF::Encryption::SecurityHandler do
       assert_equal('string', obj.stream)
     end
 
+    it "handles decryption of should-be stream objects without actual streams" do
+      doc = HexaPDF::Document.new
+      obj = doc.add({}) # Create XObject as Dictionary and not as Stream
+      obj[:Type] = :XObject
+      obj[:Subtype] = :Form
+      doc.catalog[:Test] = obj
+      doc.encrypt
+      doc = HexaPDF::Document.new(io: StringIO.new(doc.write_to_string))
+      assert_kind_of(HexaPDF::Stream, doc.catalog[:Test])
+      assert_equal('', doc.catalog[:Test].raw_stream)
+    end
+
     it "doesn't decrypt a document's Encrypt dictionaries" do
       @document = HexaPDF::Document.new
       @document.trailer[:Encrypt] = @document.add({Key: "Something"})

data/test/hexapdf/layout/test_style.rb

@@ -616,7 +616,7 @@ describe HexaPDF::Layout::Style::LinkLayer do
       annot = call_link(dest: true)
       assert_equal(:Link, annot[:Subtype])
       assert_equal([10, 10, 25, 20], annot[:Rect].value)
-      assert_equal([10, 10, 25, 10, 25, 20, 10, 20], annot[:QuadPoints].value)
+      assert_equal([10, 20, 25, 20, 10, 10, 25, 10], annot[:QuadPoints].value)
     end
 
     it "removes the border by default" do
@@ -852,8 +852,10 @@ describe HexaPDF::Layout::Style do
   end
 
   it "has several dynamically generated properties with default values that take blocks" do
+    refute(@style.text_segmentation_algorithm?)
     assert_equal(HexaPDF::Layout::TextLayouter::SimpleTextSegmentation,
                  @style.text_segmentation_algorithm)
+    refute(@style.text_line_wrapping_algorithm?)
     assert_equal(HexaPDF::Layout::TextLayouter::SimpleLineWrapping,
                  @style.text_line_wrapping_algorithm)