pdfrb 0.8.11 → 0.8.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff9335841bf5176c9489855fe26937637022fb139e2b212e6f5b4aba351aca21
-  data.tar.gz: cbeaed5651257801ed201b45af40b510a28cdf65934b7d18b3347c7372ec5cfa
+  metadata.gz: 20aa9dfc7f1144740e4138b85909b2434e1652fcc88ea6d83445d0e76c40f68b
+  data.tar.gz: 8384f5165e823cc2077b290db27d74c2534b5f53951c4afa6d61a4eec277c340
 SHA512:
-  metadata.gz: 5bd0ad5e3e50563ce7aeb42990fcae8e830fefd8cb10cc5270d6f281b570a620ab5bfa5e8df8c08aaa6fc8252b0e5e395a447e050a853fade8d75dd1fa6f99b1
-  data.tar.gz: c3e35e0a4d2b44e723f171aafcc3a807f399e5b00041e52fb423658654849064047190f35e1d84abba9259f37f4cbfe48b69ab2eff56dfedf577c0f600c977e2
+  metadata.gz: e988fa5b3a1e691b49ebb716311daa0a30d67d1b4c20a1e18e4d32d827f791ffd3931abd7250fcd4732cb4ad53cd92f45b84ac030b380f6d8e32de4edd52f1aa
+  data.tar.gz: 9d280097604c785c8c39aee8defb1fb7979901cec4b965e4b76d8b553d5d620036a7efb2925cd7b473baf72538662aa17c0c1f0217f67d58efd7ba4b3d3185e6

data/CHANGELOG.md

@@ -2,6 +2,160 @@
 
 All notable changes to the pdfrb gem will be documented in this file.
 
+## [0.8.11] — 2026-08-31
+
+### Added
+
+* **Outline reading** — `Document::Outline#each` / `#to_a` walk an
+  existing outline depth-first (preorder), yielding typed
+  `Model::Type::OutlineItem` objects (title, count, destination,
+  bold/italic flags); `#empty?` for outline-less documents.
+  `OutlineItem#title` decodes via the shared TextString seam.
+
+## [0.8.10] — 2026-08-31
+
+### Added
+
+* **Text-string decoding at every semantic accessor** — the shared
+  `Model::Cos::TextString.decode` seam now serves
+  `Annotation#contents`/`#name`, the `FormField` accessors, the
+  `Form` facade (`find`/`field_names`/`get_value`), and
+  `Document::Metadata#read_field`. UTF-16BE+BOM and
+  PDFDocEncoding bytes read back as UTF-8; non-strings pass through.
+
+## [0.8.9] — 2026-08-31
+
+### Fixed
+
+* `Document::Metadata#read_field` relabelled string bytes with
+  `force_encoding("UTF-8")`, which never converts — UTF-16 titles
+  read back as garbage. Info values are text strings (s7.9.2.2) and
+  now decode properly.
+
+## [0.8.8] — 2026-08-31
+
+### Added
+
+* **Read-path decryption** — `ObjectReader#load_oid` decrypts
+  strings and stream payloads with the per-object key (s7.6.1) as
+  objects enter the Model, via a memoized
+  `Document::Encryption#reader_handler` that verifies the configured
+  password and raises `EncryptionError` when it does not verify.
+  Round trips now close at 256/128/40-bit.
+
+### Fixed
+
+* `pad_password` sliced the pad string at the password length
+  instead of its head (Algorithm 3.2), so handler-derived keys
+  diverged from `PasswordVerification`'s.
+* Algorithm 3.5 existed twice with different RC4 round sets
+  (writer 0..18, verifier 19..1; the spec runs 1..19 ascending);
+  one implementation now serves both, and R2 verification compares
+  instead of returning true unconditionally.
+* V4 /Encrypt dicts declared no `CF`/`StmF`/`StrF`, but absent
+  filters default to Identity (s7.6.3.2 Table 21) — conforming
+  readers saw AES ciphertext as cleartext. V4 now declares AESV2.
+* The cipher is chosen from the resolved CFM (AESV2/V2/Identity),
+  direction-aware (`encrypt_string`/`encrypt_stream` + decrypt
+  twins), instead of `V >= 4` always meaning AES.
+* AES helpers hard-coded aes-128-cbc and truncated 32-byte V5 object
+  keys to 16 bytes; the cipher now follows the key size.
+* Cross-reference streams are never encrypted; the writer now skips
+  them alongside the /Encrypt dictionary.
+
+**Compatibility:** 128-bit files written by 0.8.7 will not decrypt
+under 0.8.8 (they were non-interoperable outside pdfrb); re-encrypt.
+
+## [0.8.7] — 2026-08-30
+
+### Fixed
+
+* **Silent plaintext writes** — the Writer's encrypter construction
+  rescued `StandardError` to `{}`, so any handler failure (wrong
+  password, unsupported filter) wrote encrypted documents as
+  plaintext. Behind that rescue: calls to a nonexistent
+  `verify_user_password` and keyword-args construction where the
+  handler takes a positional trailer hash. A wrong password now
+  raises `EncryptionError`.
+
+### Changed
+
+* `Writer.serializer_for(document)` is the single Serializer factory
+  (compression + encrypter); `Linearization::Writer` shares it
+  instead of a bare serializer that emitted encrypted documents
+  unencrypted.
+* `serialize_indirect` encrypts dictionary strings with the
+  per-object key (s7.6.1), not just stream payloads; the /Encrypt
+  dictionary stays cleartext.
+* Linearized trailers carry /Encrypt and /ID; the hint stream no
+  longer claims a fictitious `/Type /XRef`.
+* Dead autoloads for nonexistent `Revision`/`Revisions` removed;
+  `DigitalSignature.handler_for` resolves handler classes lazily.
+
+## [0.8.6] — 2026-08-30
+
+### Fixed
+
+* **Canvas `concat` with a block emitted `SaveGraphicsState` in its
+  `ensure` instead of `Restore`** — every block-form
+  translate/scale/rotate left an unbalanced `q` on the graphics
+  state stack. The block form now scopes the matrix inside
+  `save_graphics_state`; `with_transparency` reuses the same seam;
+  the draw_image trio folds onto one `invoke_xobject`.
+
+### Added
+
+* `Pdfrb::PdfVersion.compare` / `.at_least?` (extracted from
+  byte-identical private copies in Writer and Conformance::PdfX).
+* `Document#each_indirect_of(klass)` — type-filtered object
+  iteration, Enumerator when blockless; 15 mechanical call sites
+  migrated.
+
+## [0.8.5] — 2026-08-29
+
+### Changed
+
+* Document/Font seams deepened: `Document#resolve` (dereference),
+  `Model::Object#ref`, `Pages#attach_resource`,
+  `Document::Fonts::Subsetting`, shared `Pdfrb::Font::Sfnt` module
+  (sfnt directory parsing/rebuild with real checksums) used by both
+  the TrueType and CFF subsetters.
+
+### Fixed
+
+* TrueType subsetting regression: `rubocop -A` had rewritten
+  `sorted.each do |_tag, data|` on an Array to `each_value`,
+  silently falling back to the full font (773KB instead of 205KB).
+
+## [0.8.4] — 2026-08-29
+
+### Changed
+
+* `Model::Type::NameMap` concern extracted from 17 hand-duplicated
+  resource-map classes (symbol-or-string `[]`, normalizing `add`,
+  `names`, `each_entry`).
+
+## [0.8.3] — 2026-08-28
+
+### Added
+
+* PDF/A generation section in the executable USAGE cookbook
+  (`spec/pdfrb/usage_doc_spec.rb` runs every snippet).
+
+## [0.8.2] — 2026-08-28
+
+### Added
+
+* veraPDF round-trip sweep over the fixture corpus.
+
+## [0.8.1] — 2026-08-27
+
+### Added
+
+* veraPDF cross-check integration (local `rake verapdf` + macOS CI
+  job) with PDF/A conformance fixes: trailer /ID, explicit page
+  /Resources, parseable XMP.
+
 ## [0.8.0] — 2026-08-27
 
 ### Added

data/docs/USAGE.md

@@ -153,18 +153,42 @@ File.binwrite("linearized.pdf", io.string)
 ```ruby
 doc = Pdfrb::Document.new
 doc.pages.add
+doc.metadata[:Title] = "Confidential"
 doc.encrypt!(user_password: "secret", owner_password: "owner", bits: 128)
 doc.write("encrypted.pdf")
 
-# Opening an encrypted document:
+# Opening an encrypted document — strings and streams decrypt on
+# read; a wrong password raises Pdfrb::EncryptionError:
 doc = Pdfrb.open("encrypted.pdf",
                  config: { "encryption.password" => "secret" })
+doc.metadata[:Title] # => "Confidential"
 
 # Removing encryption from a parsed document:
 doc.decrypt!
 doc.write("decrypted.pdf")
 ```
 
+## Bookmarks (Outlines)
+
+```ruby
+doc = Pdfrb::Document.new
+page = doc.pages.add
+font = doc.fonts.add("Helvetica")
+page.canvas.text("Intro", at: [72, 720], font: font, size: 12)
+
+chapter = doc.outline.add("Chapter 1", dest: :xyz)
+chapter.add_child(Pdfrb::Document::OutlineEntry.new(title: "1.1", dest: :xyz))
+doc.outline.add("Chapter 2", dest: :xyz)
+doc.outline.build!
+doc.write("bookmarked.pdf")
+
+# Reading an outline back (depth-first, parents before children):
+doc = Pdfrb.open("bookmarked.pdf")
+doc.outline.each do |item|
+  puts item.title   # "Chapter 1", "1.1", "Chapter 2"
+end
+```
+
 ## Merging PDFs
 
 ```ruby

data/lib/pdfrb/digital_signature/verification.rb

@@ -68,33 +68,60 @@ module Pdfrb
         hex_start = sig_info[:contents_hex_start]
         hex_end = sig_info[:contents_hex_end]
         contents_hex = pdf_bytes[hex_start...hex_end]
-        contents_hex = contents_hex.sub(/0+$/, "")
-
-        begin
-          der = [contents_hex].pack("H*")
-          pkcs7 = OpenSSL::PKCS7.new(der)
-
-          store = OpenSSL::X509::Store.new
-          trusted_certs.each { |c| store.add_cert(c) }
-
-          valid = pkcs7.verify(nil, store, signed_data,
-                               OpenSSL::PKCS7::DETACHED |
-                               OpenSSL::PKCS7::BINARY)
-
-          VerificationResult.new(
-            signer: pkcs7.signers.first&.issuer&.to_s,
-            valid?: valid,
-            byte_range_ok?: true,
-            cert_chain: pkcs7.certificates || [],
-            trusted?: !trusted_certs.empty? && valid,
-            error: valid ? nil : "signature verification failed",
-          )
-        rescue OpenSSL::PKCS7::PKCS7Error, ArgumentError => e
-          VerificationResult.new(valid?: false,
-                                 byte_range_ok?: true,
-                                 cert_chain: [],
-                                 error: e.message)
+
+        # The /Contents placeholder is zero-padded to its reserved
+        # size; DER is self-delimiting, so der_prefix reads the
+        # declared length instead of guessing where the signature
+        # ends (blindly trimming trailing zeros also eats legitimate
+        # 0x00 final bytes and can split a hex byte).
+        verify_pkcs7(der_prefix([contents_hex].pack("H*")),
+                     signed_data, trusted_certs)
+      end
+
+      def verify_pkcs7(der, signed_data, trusted_certs)
+        pkcs7 = OpenSSL::PKCS7.new(der)
+
+        store = OpenSSL::X509::Store.new
+        trusted_certs.each { |c| store.add_cert(c) }
+
+        valid = pkcs7.verify(nil, store, signed_data,
+                             OpenSSL::PKCS7::DETACHED |
+                             OpenSSL::PKCS7::BINARY)
+
+        VerificationResult.new(
+          signer: pkcs7.signers.first&.issuer&.to_s,
+          valid?: valid,
+          byte_range_ok?: true,
+          cert_chain: pkcs7.certificates || [],
+          trusted?: !trusted_certs.empty? && valid,
+          error: valid ? nil : "signature verification failed",
+        )
+      rescue OpenSSL::PKCS7::PKCS7Error, ArgumentError => e
+        VerificationResult.new(valid?: false,
+                               byte_range_ok?: true,
+                               cert_chain: [],
+                               error: e.message)
+      end
+
+      # The DER structure starting at +bytes+ (a SEQUENCE), exactly
+      # as long as its own declared length - any placeholder padding
+      # after it is dropped. Non-SEQUENCE input passes through.
+      def der_prefix(bytes)
+        return bytes if bytes.bytesize < 2 || bytes.getbyte(0) != 0x30
+
+        length = bytes.getbyte(1)
+        offset = 2
+        if length.anybits?(0x80)
+          count = length & 0x7F
+          return bytes if count.zero? || bytes.bytesize < 2 + count
+
+          length = 0
+          count.times do |i|
+            length = (length << 8) | bytes.getbyte(2 + i)
+          end
+          offset = 2 + count
         end
+        bytes.byteslice(0, offset + length)
       end
     end
   end

data/lib/pdfrb/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pdfrb
-  VERSION = "0.8.11"
+  VERSION = "0.8.12"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pdfrb
 version: !ruby/object:Gem::Version
-  version: 0.8.11
+  version: 0.8.12
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-31 00:00:00.000000000 Z
+date: 2026-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: benchmark
@@ -1276,7 +1276,6 @@ files:
 - lib/pdfrb/source/recovery.rb
 - lib/pdfrb/source/token.rb
 - lib/pdfrb/source/tokenizer.rb
-- lib/pdfrb/source/tokenizer.rb.bak
 - lib/pdfrb/source/trailer_reader.rb
 - lib/pdfrb/source/xref_stream_reader.rb
 - lib/pdfrb/source/xref_table_reader.rb

data/lib/pdfrb/source/tokenizer.rb.bak

@@ -1,320 +0,0 @@
-# frozen_string_literal: true
-
-require "set"
-
-module Pdfrb
-  module Source
-    # Byte-level PDF lexer (s7.2). State machine that emits Token
-    # values via +next_token+ / +peek+. Pull-based so the Parser can
-    # stream through arbitrarily large PDFs without materialising the
-    # whole token stream.
-    #
-    # States:
-    #   :top       — between tokens; dispatch by first byte.
-    #   :string    — inside (...) with depth tracking and \ escapes.
-    #   :hexstring — inside <...> (after distinguishing << as dict open).
-    #   :comment   — inside %... until EOL.
-    #
-    # The keyword set per s7.2: obj/endobj/stream/endstream/xref/
-    # startxref/trailer/true/false/null. The Tokenizer emits them with
-    # type :keyword and value equal to the keyword string; the Parser
-    # dispatches on the value.
-    class Tokenizer
-      WHITESPACE_BYTES = PdfConstants::WHITESPACE.bytes.to_set.freeze
-      DELIMITER_BYTES  = PdfConstants::DELIMITERS.bytes.to_set.freeze
-
-      # Public so the Parser can recognise the same set when scanning
-      # post-stream whitespace.
-      public_constant :WHITESPACE_BYTES
-      public_constant :DELIMITER_BYTES
-
-      attr_reader :pos, :io
-
-      def initialize(io)
-        @io = io
-        @pos = 0
-        @pushback = []
-        @lookahead = []
-      end
-
-      def next_token
-        return @pushback.pop unless @pushback.empty?
-
-        fill_lookahead(1) if @lookahead.empty?
-        @lookahead.shift
-      end
-
-      def peek(offset = 0)
-        fill_lookahead(offset + 1)
-        @lookahead[offset]
-      end
-
-      def pushback(token)
-        @pushback << token
-        self
-      end
-
-      private
-
-      def fill_lookahead(n)
-        while @lookahead.length < n
-          tok = lex_one
-          break if tok.nil?
-
-          @lookahead << tok
-        end
-      end
-
-      def lex_one
-        skip_whitespace_and_comments
-        return nil if eos?
-
-        start_pos = @pos
-        b = peek_byte
-        case b
-        when 40  then read_string(start_pos)
-        when 60
-          peek_byte(1) == 60 ? read_two_byte_token(:dict_open, "<<", start_pos) : read_hex_string(start_pos)
-        when 62
-          peek_byte(1) == 62 ? read_two_byte_token(:dict_close, ">>", start_pos) : raise(lex_error("lone '>' at #{start_pos}"))
-        when 91  then advance_byte && emit(:array_open, "[", start_pos)
-        when 93  then advance_byte && emit(:array_close, "]", start_pos)
-        when 47  then read_name(start_pos)
-        when 43, 45, 46, *digit_bytes then read_number_or_keyword(start_pos)
-        else read_keyword(start_pos)
-        end
-      end
-
-      def digit_bytes
-        (48..57).to_a
-      end
-      private :digit_bytes
-
-      def eos?
-        @io.eof?
-      end
-
-      def peek_byte(offset = 0)
-        cur = @io.pos
-        if offset.zero?
-          b = @io.getbyte
-          @io.seek(cur, IO::SEEK_SET) if b
-          return b
-        end
-
-        @io.seek(cur + offset, IO::SEEK_SET)
-        b = @io.getbyte
-        @io.seek(cur, IO::SEEK_SET)
-        b
-      end
-
-      def advance_byte
-        @pos += 1
-        @io.getbyte
-      end
-
-      # Append an Integer byte to +buf+ without re-encoding through
-      # UTF-8 (which is the default for `+""` in a UTF-8 source file).
-      def append_byte(buf, b)
-        buf << b.chr(Encoding::BINARY)
-      end
-
-      def skip_whitespace_and_comments
-        loop do
-          break if eos?
-
-          b = peek_byte
-          if WHITESPACE_BYTES.include?(b)
-            advance_byte
-          elsif b == 37 # %
-            skip_comment
-          else
-            break
-          end
-        end
-      end
-
-      def skip_comment
-        until eos? || peek_byte == 10 # \n
-          advance_byte
-        end
-        advance_byte if !eos? && peek_byte == 10
-        nil
-      end
-
-      def read_two_byte_token(type, literal, start_pos)
-        advance_byte
-        advance_byte
-        emit(type, literal, start_pos)
-      end
-
-      def read_string(start_pos)
-        advance_byte # consume (
-        depth = 1
-        bytes = +""
-        until eos?
-          b = advance_byte
-          case b
-          when 92 # backslash
-            esc = read_string_escape
-            bytes << esc if esc >= 0
-          when 40 # (
-            depth += 1
-            bytes << 40
-          when 41 # )
-            depth -= 1
-            break if depth.zero?
-
-            bytes << 41
-          else
-            bytes << b
-          end
-        end
-        raise lex_error("unterminated string at #{start_pos}") if depth.positive?
-
-        emit(:string, bytes.force_encoding(Encoding::BINARY), start_pos)
-      end
-
-      def read_string_escape
-        b = advance_byte
-        case b
-        when 110 then 10    # \n
-        when 114 then 13    # \r
-        when 116 then 9     # \t
-        when 98  then 8     # \b
-        when 102 then 12    # \f
-        when 40  then 40    # \(
-        when 41  then 41    # \)
-        when 92  then 92    # \\
-        when 48..55 then read_octal_escape(b)
-        when 10, 13
-          # Line continuation — eat CRLF/LF/CR; emit no byte.
-          advance_byte if b == 13 && peek_byte == 10
-          -1
-        else b
-        end
-      end
-
-      def read_octal_escape(first)
-        digits = [first]
-        2.times do
-          break if eos?
-
-          b = peek_byte
-          break unless (48..55).cover?(b)
-
-          digits << advance_byte
-        end
-        digits.map(&:chr).join.to_i(8) & 0xFF
-      end
-
-      def read_hex_string(start_pos)
-        advance_byte # consume <
-        bytes = +""
-        hi = nil
-        until eos?
-          b = advance_byte
-          break if b == 62 # >
-
-          next if WHITESPACE_BYTES.include?(b)
-
-          nibble = hex_value(b)
-          raise lex_error("bad hex digit #{b.chr.inspect} at #{@pos}") unless nibble
-
-          if hi.nil?
-            hi = nibble
-          else
-            bytes << (hi * 16 + nibble)
-            hi = nil
-          end
-        end
-        bytes << (hi * 16 + 0) if hi # odd nibble padded with 0
-        emit(:hex_string, bytes.force_encoding(Encoding::BINARY), start_pos)
-      end
-
-      def hex_value(b)
-        return (b - 48) if (48..57).cover?(b)
-        return (b - 55) if (65..70).cover?(b)
-        return (b - 87) if (97..102).cover?(b)
-
-        nil
-      end
-
-      def read_name(start_pos)
-        advance_byte # consume /
-        bytes = +""
-        until eos?
-          b = peek_byte
-          break if WHITESPACE_BYTES.include?(b) || DELIMITER_BYTES.include?(b)
-
-          advance_byte
-          if b == 35 # # — expect two hex digits
-            hi = peek_byte
-            lo = peek_byte(1)
-            if hi && lo && (n1 = hex_value(hi)) && (n2 = hex_value(lo))
-              advance_byte; advance_byte
-              bytes << (n1 * 16 + n2)
-            else
-              bytes << 35
-            end
-          else
-            bytes << b
-          end
-        end
-        emit(:name, bytes.force_encoding(Encoding::BINARY), start_pos)
-      end
-
-      def read_number_or_keyword(start_pos)
-        bytes = +""
-        bytes << advance_byte # first char
-        until eos?
-          b = peek_byte
-          break if WHITESPACE_BYTES.include?(b) || DELIMITER_BYTES.include?(b)
-
-          advance_byte
-          bytes << b
-        end
-        emit_number_or_keyword(bytes, start_pos)
-      end
-
-      def read_keyword(start_pos)
-        bytes = +""
-        until eos?
-          b = peek_byte
-          break if WHITESPACE_BYTES.include?(b) || DELIMITER_BYTES.include?(b)
-
-          advance_byte
-          bytes << b
-        end
-        emit_keyword(bytes, start_pos)
-      end
-
-      def emit_number_or_keyword(bytes, start_pos)
-        if bytes.match?(/\A[-+]?\d+\z/)
-          emit(:integer, bytes.to_i, start_pos)
-        elsif bytes.match?(/\A[-+]?(\d*\.\d+|\d+\.?\d*)(?:[eE][-+]?\d+)?\z/) && (bytes.include?(".") || bytes =~ /[eE]/)
-          emit(:real, bytes.to_f, start_pos)
-        else
-          emit_keyword(bytes, start_pos)
-        end
-      end
-
-      def emit_keyword(bytes, start_pos)
-        case bytes
-        when "true"  then emit(:true, true, start_pos)
-        when "false" then emit(:false, false, start_pos)
-        when "null"  then emit(:null, nil, start_pos)
-        else emit(:keyword, bytes, start_pos)
-        end
-      end
-
-      def emit(type, value, position)
-        Token.new(type: type, value: value, position: position)
-      end
-
-      def lex_error(message)
-        Pdfrb::LexError.new(message, source_position: @pos)
-      end
-    end
-  end
-end