pdf-lite 1.0.1-alpha.2 → 1.0.1-alpha.3

package/dist/signing/document-security-store.js

@@ -0,0 +1,156 @@
+import { PdfArray } from '../core/objects/pdf-array';
+import { PdfDictionary } from '../core/objects/pdf-dictionary';
+import { PdfIndirectObject } from '../core/objects/pdf-indirect-object';
+import { PdfStream } from '../core/objects/pdf-stream';
+/**
+ * Indirect object containing a certificate stream.
+ */
+export class PdfCertObject extends PdfIndirectObject {
+}
+/**
+ * Indirect object containing a CRL stream.
+ */
+export class PdfCrlObject extends PdfIndirectObject {
+}
+/**
+ * Indirect object containing an OCSP response stream.
+ */
+export class PdfOcspObject extends PdfIndirectObject {
+}
+/**
+ * Dictionary for the Document Security Store (DSS).
+ * Contains arrays of certificates, CRLs, OCSPs, and VRI entries.
+ */
+export class PdfDocumentSecurityStoreDictionary extends PdfDictionary {
+}
+/**
+ * Document Security Store (DSS) object for PAdES LTV signatures.
+ * Stores validation data (certificates, CRLs, OCSPs) for long-term validation.
+ *
+ * @example
+ * ```typescript
+ * const dss = new PdfDocumentSecurityStoreObject(document)
+ * await dss.addCert(certificateBytes)
+ * await dss.addCrl(crlBytes)
+ * await dss.addOcsp(ocspBytes)
+ * ```
+ */
+export class PdfDocumentSecurityStoreObject extends PdfIndirectObject {
+    /** Reference to the parent document. */
+    document;
+    /**
+     * Creates a new DSS object.
+     *
+     * @param document - The parent PDF document.
+     * @param content - Optional pre-existing DSS dictionary.
+     */
+    constructor(document, content) {
+        super(content ?? new PdfDocumentSecurityStoreDictionary());
+        this.document = document;
+    }
+    /**
+     * Adds an OCSP response to the DSS, avoiding duplicates.
+     *
+     * @param ocsp - The DER-encoded OCSP response.
+     * @returns The created or existing OCSP object.
+     */
+    async addOcsp(ocsp) {
+        const newOcsp = new PdfStream(ocsp);
+        let ocspArray = this.content.get('OCSPs');
+        const currentOcsps = (await Promise.all((ocspArray?.items ?? []).map(async (ref) => {
+            const obj = await this.document.readObject(ref);
+            return obj;
+        })));
+        for (const existingOcsp of currentOcsps) {
+            if (existingOcsp.content.equals(newOcsp)) {
+                return existingOcsp;
+            }
+        }
+        const ocspObject = new PdfOcspObject(newOcsp);
+        this.document.add(ocspObject);
+        if (!ocspArray) {
+            ocspArray = new PdfArray([]);
+            this.content.set('OCSPs', ocspArray);
+        }
+        ocspArray.items.push(ocspObject.reference);
+        return ocspObject;
+    }
+    /**
+     * Adds a CRL to the DSS, avoiding duplicates.
+     *
+     * @param crl - The DER-encoded CRL.
+     * @returns The created or existing CRL object.
+     */
+    async addCrl(crl) {
+        let crlArray = this.content.get('CRLs');
+        const currentCrls = (await Promise.all((crlArray?.items ?? []).map(async (ref) => {
+            const obj = await this.document.readObject(ref);
+            return obj;
+        })));
+        for (const existingCrl of currentCrls) {
+            if (existingCrl.content.equals(new PdfStream(crl))) {
+                return existingCrl;
+            }
+        }
+        const crlObject = new PdfCrlObject(new PdfStream(crl));
+        this.document.add(crlObject);
+        if (!crlArray) {
+            crlArray = new PdfArray([]);
+            this.content.set('CRLs', crlArray);
+        }
+        crlArray.items.push(crlObject.reference);
+        return crlObject;
+    }
+    /**
+     * Adds a certificate to the DSS, avoiding duplicates.
+     *
+     * @param cert - The DER-encoded certificate.
+     * @returns The created or existing certificate object.
+     */
+    async addCert(cert) {
+        let certArray = this.content.get('Certs');
+        const currentCerts = (await Promise.all((certArray?.items ?? []).map(async (ref) => {
+            const obj = await this.document.readObject(ref);
+            return obj;
+        })));
+        for (const existingCert of currentCerts) {
+            if (existingCert.content.equals(new PdfStream(cert))) {
+                return existingCert;
+            }
+        }
+        const certObject = new PdfCertObject(new PdfStream(cert));
+        this.document.add(certObject);
+        if (!certArray) {
+            certArray = new PdfArray([]);
+            this.content.set('Certs', certArray);
+        }
+        certArray.items.push(certObject.reference);
+        return certObject;
+    }
+    /**
+     * Adds revocation information (CRLs and OCSPs) to the DSS.
+     *
+     * @param revocationInfo - The revocation information to add.
+     */
+    async addRevocationInfo(revocationInfo) {
+        for (const ocsp of revocationInfo.ocsps ?? []) {
+            await this.addOcsp(ocsp);
+        }
+        for (const crl of revocationInfo.crls ?? []) {
+            await this.addCrl(crl);
+        }
+    }
+    /**
+     * Checks if the DSS is empty (contains no certificates, CRLs, or OCSPs).
+     *
+     * @returns True if the DSS has no stored data.
+     */
+    isEmpty() {
+        const certs = this.content.get('Certs');
+        const crls = this.content.get('CRLs');
+        const ocsps = this.content.get('OCSPs');
+        return ((!certs || certs.items.length === 0) &&
+            (!crls || crls.items.length === 0) &&
+            (!ocsps || ocsps.items.length === 0));
+    }
+}

package/dist/signing/index.d.ts

@@ -0,0 +1,3 @@
+export * from './signatures';
+export * from './document-security-store';
+export * from './types';

package/dist/signing/index.js

@@ -0,0 +1,3 @@
+export * from './signatures';
+export * from './document-security-store';
+export * from './types';

package/dist/signing/signatures/adbe-pkcs7-detached.d.ts

@@ -0,0 +1,57 @@
+import { RevocationInfo, TimeStampAuthority } from '../types';
+import { AsymmetricEncryptionAlgorithmParams } from 'pki-lite/core/index';
+import { PdfSignatureObject, PdfSignatureSignOptions } from './base';
+import { ByteArray } from '../../types';
+/**
+ * PKCS#7 detached signature object (adbe.pkcs7.detached).
+ * Creates CMS SignedData with the document hash as external data.
+ *
+ * @example
+ * ```typescript
+ * const signature = new PdfAdbePkcs7DetachedSignatureObject({
+ *     privateKey: keyBytes,
+ *     certificate: certBytes,
+ *     reason: 'Document approval',
+ *     timeStampAuthority: true
+ * })
+ * ```
+ */
+export declare class PdfAdbePkcs7DetachedSignatureObject extends PdfSignatureObject {
+    /** Private key for signing. */
+    privateKey: ByteArray;
+    /** Signer certificate. */
+    certificate: ByteArray;
+    /** Additional certificates for chain building. */
+    additionalCertificates: ByteArray[];
+    /** Issuer certificate for OCSP requests. */
+    issuerCertificate?: ByteArray;
+    /** Signing date. */
+    date?: Date;
+    /** Signature algorithm parameters. */
+    algorithm?: AsymmetricEncryptionAlgorithmParams;
+    /** Revocation information or 'fetch' to retrieve automatically. */
+    revocationInfo?: RevocationInfo | 'fetch';
+    /** Timestamp authority configuration. */
+    timeStampAuthority?: TimeStampAuthority;
+    /**
+     * Creates a new PKCS#7 detached signature object.
+     *
+     * @param options - Signature configuration options.
+     */
+    constructor(options: PdfSignatureSignOptions & {
+        privateKey: ByteArray;
+        certificate: ByteArray;
+        issuerCertificate?: ByteArray;
+        additionalCertificates?: ByteArray[];
+        algorithm?: AsymmetricEncryptionAlgorithmParams;
+        revocationInfo?: RevocationInfo | 'fetch';
+        timeStampAuthority?: TimeStampAuthority | true;
+    });
+    /**
+     * Signs the document bytes using PKCS#7 detached format.
+     *
+     * @param options - Signing options with bytes and revocation embedding flag.
+     * @returns The CMS SignedData and revocation information.
+     */
+    sign: PdfSignatureObject['sign'];
+}

package/dist/signing/signatures/adbe-pkcs7-detached.js

@@ -0,0 +1,117 @@
+import { SignedData } from 'pki-lite/pkcs7/SignedData';
+import { Certificate } from 'pki-lite/x509/Certificate';
+import { SignerInfo } from 'pki-lite/pkcs7/SignerInfo';
+import { Attribute } from 'pki-lite/x509/Attribute';
+import { RevocationInfoArchival } from 'pki-lite/adobe/RevocationInfoArchival';
+import { CertificateList } from 'pki-lite/x509/CertificateList';
+import { OCSPResponse } from 'pki-lite/ocsp/OCSPResponse';
+import { PrivateKeyInfo } from 'pki-lite/keys/PrivateKeyInfo';
+import { OtherRevInfo } from 'pki-lite/adobe/OtherRevInfo';
+import { fetchRevocationInfo } from '../utils';
+import { PdfSignatureObject } from './base';
+/**
+ * PKCS#7 detached signature object (adbe.pkcs7.detached).
+ * Creates CMS SignedData with the document hash as external data.
+ *
+ * @example
+ * ```typescript
+ * const signature = new PdfAdbePkcs7DetachedSignatureObject({
+ *     privateKey: keyBytes,
+ *     certificate: certBytes,
+ *     reason: 'Document approval',
+ *     timeStampAuthority: true
+ * })
+ * ```
+ */
+export class PdfAdbePkcs7DetachedSignatureObject extends PdfSignatureObject {
+    /** Private key for signing. */
+    privateKey;
+    /** Signer certificate. */
+    certificate;
+    /** Additional certificates for chain building. */
+    additionalCertificates;
+    /** Issuer certificate for OCSP requests. */
+    issuerCertificate;
+    /** Signing date. */
+    date;
+    /** Signature algorithm parameters. */
+    algorithm;
+    /** Revocation information or 'fetch' to retrieve automatically. */
+    revocationInfo;
+    /** Timestamp authority configuration. */
+    timeStampAuthority;
+    /**
+     * Creates a new PKCS#7 detached signature object.
+     *
+     * @param options - Signature configuration options.
+     */
+    constructor(options) {
+        super({
+            ...options,
+            subfilter: 'adbe.pkcs7.detached',
+        });
+        this.privateKey = options.privateKey;
+        this.certificate = options.certificate;
+        this.issuerCertificate = options.issuerCertificate;
+        this.additionalCertificates = options.additionalCertificates || [];
+        this.date = options.date;
+        this.algorithm = options.algorithm;
+        this.revocationInfo = options.revocationInfo;
+        this.timeStampAuthority =
+            options.timeStampAuthority === true
+                ? {
+                    url: 'http://timestamp.digicert.com',
+                }
+                : options.timeStampAuthority;
+    }
+    /**
+     * Signs the document bytes using PKCS#7 detached format.
+     *
+     * @param options - Signing options with bytes and revocation embedding flag.
+     * @returns The CMS SignedData and revocation information.
+     */
+    sign = async (options) => {
+        const { bytes } = options;
+        const certificate = Certificate.fromDer(this.certificate);
+        const additionalCertificates = this.additionalCertificates.map(Certificate.fromDer);
+        const signedAttributes = new SignerInfo.SignedAttributes();
+        const unsignedAttributes = new SignerInfo.UnsignedAttributes();
+        signedAttributes.push(Attribute.signingTime(this.date ?? new Date()));
+        const revocationInfo = this.revocationInfo === 'fetch'
+            ? await fetchRevocationInfo({
+                certificates: [
+                    this.certificate,
+                    ...(this.additionalCertificates ?? []),
+                ],
+                issuerCertificate: this.issuerCertificate,
+            })
+            : this.revocationInfo;
+        if (options.embedRevocationInfo && revocationInfo) {
+            signedAttributes.push(Attribute.adobeRevocationInfoArchival(new RevocationInfoArchival({
+                crls: revocationInfo.crls?.map((x) => CertificateList.fromDer(x)),
+                ocsps: revocationInfo.ocsps?.map((x) => OCSPResponse.fromDer(x)),
+                otherRevInfo: revocationInfo.otherRevInfo?.map((x) => new OtherRevInfo({
+                    type: x.type,
+                    value: x.value,
+                })),
+            })));
+        }
+        const signedData = await SignedData.builder()
+            .addCertificate(...additionalCertificates)
+            .setData(bytes)
+            .setDetached(true)
+            .addSigner({
+            certificate,
+            privateKeyInfo: PrivateKeyInfo.fromDer(this.privateKey),
+            encryptionAlgorithm: this.algorithm,
+            signedAttrs: signedAttributes,
+            unsignedAttrs: unsignedAttributes,
+            tsa: this.timeStampAuthority,
+        })
+            .build();
+        return {
+            signedBytes: signedData.toCms().toDer(),
+            revocationInfo,
+        };
+    };
+}

package/dist/signing/signatures/adbe-pkcs7-sha1.d.ts

@@ -0,0 +1,55 @@
+import { RevocationInfo, TimeStampAuthority } from '../types';
+import { AsymmetricEncryptionAlgorithmParams } from 'pki-lite/core/index';
+import { PdfSignatureObject, PdfSignatureSignOptions } from './base';
+import { ByteArray } from '../../types';
+/**
+ * PKCS#7 SHA-1 signature object (adbe.pkcs7.sha1).
+ * Creates CMS SignedData with SHA-1 hash embedded as signed content.
+ *
+ * @example
+ * ```typescript
+ * const signature = new PdfAdbePkcs7Sha1SignatureObject({
+ *     privateKey: keyBytes,
+ *     certificate: certBytes
+ * })
+ * ```
+ */
+export declare class PdfAdbePkcs7Sha1SignatureObject extends PdfSignatureObject {
+    /** Fixed algorithm for SHA-1 signatures. */
+    static readonly ALGORITHM: AsymmetricEncryptionAlgorithmParams;
+    /** Private key for signing. */
+    privateKey: ByteArray;
+    /** Signer certificate. */
+    certificate: ByteArray;
+    /** Additional certificates for chain building. */
+    additionalCertificates: ByteArray[];
+    /** Issuer certificate for OCSP requests. */
+    issuerCertificate?: ByteArray;
+    /** Signing date. */
+    date?: Date;
+    /** Revocation information or 'fetch' to retrieve automatically. */
+    revocationInfo?: RevocationInfo | 'fetch';
+    /** Timestamp authority configuration. */
+    timeStampAuthority?: TimeStampAuthority;
+    /**
+     * Creates a new PKCS#7 SHA-1 signature object.
+     *
+     * @param options - Signature configuration options.
+     */
+    constructor(options: PdfSignatureSignOptions & {
+        privateKey: ByteArray;
+        certificate: ByteArray;
+        issuerCertificate?: ByteArray;
+        additionalCertificates?: ByteArray[];
+        algorithm?: AsymmetricEncryptionAlgorithmParams;
+        revocationInfo?: RevocationInfo | 'fetch';
+        timeStampAuthority?: TimeStampAuthority | true;
+    });
+    /**
+     * Signs the document bytes using PKCS#7 SHA-1 format.
+     *
+     * @param options - Signing options with bytes and revocation embedding flag.
+     * @returns The CMS SignedData and revocation information.
+     */
+    sign: PdfSignatureObject['sign'];
+}

package/dist/signing/signatures/adbe-pkcs7-sha1.js

@@ -0,0 +1,121 @@
+import { SignedData } from 'pki-lite/pkcs7/SignedData';
+import { Certificate } from 'pki-lite/x509/Certificate';
+import { SignerInfo } from 'pki-lite/pkcs7/SignerInfo';
+import { Attribute } from 'pki-lite/x509/Attribute';
+import { RevocationInfoArchival } from 'pki-lite/adobe/RevocationInfoArchival';
+import { CertificateList } from 'pki-lite/x509/CertificateList';
+import { OCSPResponse } from 'pki-lite/ocsp/OCSPResponse';
+import { PrivateKeyInfo } from 'pki-lite/keys/PrivateKeyInfo';
+import { OtherRevInfo } from 'pki-lite/adobe/OtherRevInfo';
+import { fetchRevocationInfo } from '../utils';
+import { PdfSignatureObject } from './base';
+import { DigestAlgorithmIdentifier } from 'pki-lite/algorithms/AlgorithmIdentifier';
+/**
+ * PKCS#7 SHA-1 signature object (adbe.pkcs7.sha1).
+ * Creates CMS SignedData with SHA-1 hash embedded as signed content.
+ *
+ * @example
+ * ```typescript
+ * const signature = new PdfAdbePkcs7Sha1SignatureObject({
+ *     privateKey: keyBytes,
+ *     certificate: certBytes
+ * })
+ * ```
+ */
+export class PdfAdbePkcs7Sha1SignatureObject extends PdfSignatureObject {
+    /** Fixed algorithm for SHA-1 signatures. */
+    static ALGORITHM = {
+        type: 'RSASSA_PKCS1_v1_5',
+        params: {
+            hash: 'SHA-1',
+        },
+    };
+    /** Private key for signing. */
+    privateKey;
+    /** Signer certificate. */
+    certificate;
+    /** Additional certificates for chain building. */
+    additionalCertificates;
+    /** Issuer certificate for OCSP requests. */
+    issuerCertificate;
+    /** Signing date. */
+    date;
+    /** Revocation information or 'fetch' to retrieve automatically. */
+    revocationInfo;
+    /** Timestamp authority configuration. */
+    timeStampAuthority;
+    /**
+     * Creates a new PKCS#7 SHA-1 signature object.
+     *
+     * @param options - Signature configuration options.
+     */
+    constructor(options) {
+        super({
+            ...options,
+            subfilter: 'adbe.pkcs7.sha1',
+        });
+        this.privateKey = options.privateKey;
+        this.certificate = options.certificate;
+        this.issuerCertificate = options.issuerCertificate;
+        this.additionalCertificates = options.additionalCertificates || [];
+        this.date = options.date;
+        this.revocationInfo = options.revocationInfo;
+        this.timeStampAuthority =
+            options.timeStampAuthority === true
+                ? {
+                    url: 'http://timestamp.digicert.com',
+                }
+                : options.timeStampAuthority;
+    }
+    /**
+     * Signs the document bytes using PKCS#7 SHA-1 format.
+     *
+     * @param options - Signing options with bytes and revocation embedding flag.
+     * @returns The CMS SignedData and revocation information.
+     */
+    sign = async (options) => {
+        const { bytes } = options;
+        const certificate = Certificate.fromDer(this.certificate);
+        const additionalCertificates = this.additionalCertificates.map(Certificate.fromDer);
+        const signedAttributes = new SignerInfo.SignedAttributes();
+        const unsignedAttributes = new SignerInfo.UnsignedAttributes();
+        signedAttributes.push(Attribute.signingTime(this.date ?? new Date()));
+        const revocationInfo = this.revocationInfo === 'fetch'
+            ? await fetchRevocationInfo({
+                certificates: [
+                    this.certificate,
+                    ...(this.additionalCertificates ?? []),
+                ],
+                issuerCertificate: this.issuerCertificate,
+            })
+            : this.revocationInfo;
+        if (options.embedRevocationInfo && revocationInfo) {
+            signedAttributes.push(Attribute.adobeRevocationInfoArchival(new RevocationInfoArchival({
+                crls: revocationInfo.crls?.map((x) => CertificateList.fromDer(x)),
+                ocsps: revocationInfo.ocsps?.map((x) => OCSPResponse.fromDer(x)),
+                otherRevInfo: revocationInfo.otherRevInfo?.map((x) => new OtherRevInfo({
+                    type: x.type,
+                    value: x.value,
+                })),
+            })));
+        }
+        const digest = await DigestAlgorithmIdentifier.digestAlgorithm('SHA-1').digest(bytes);
+        const signedData = await SignedData.builder()
+            .addCertificate(...additionalCertificates)
+            .setData(digest)
+            .setDetached(false)
+            .addSigner({
+            certificate,
+            privateKeyInfo: PrivateKeyInfo.fromDer(this.privateKey),
+            encryptionAlgorithm: PdfAdbePkcs7Sha1SignatureObject.ALGORITHM,
+            signedAttrs: signedAttributes,
+            unsignedAttrs: unsignedAttributes,
+            tsa: this.timeStampAuthority,
+        })
+            .build();
+        return {
+            signedBytes: signedData.toCms().toDer(),
+            revocationInfo,
+        };
+    };
+}

package/dist/signing/signatures/adbe-x509-rsa-sha1.d.ts

@@ -0,0 +1,49 @@
+import { AsymmetricEncryptionAlgorithmParams } from 'pki-lite/core/index';
+import { PdfSignatureObject, PdfSignatureSignOptions } from './base';
+import { ByteArray } from '../../types';
+import { RevocationInfo } from '../types';
+/**
+ * X.509 RSA-SHA1 signature object (adbe.x509.rsa_sha1).
+ * Creates a raw RSA-SHA1 signature with certificates in the Cert entry.
+ *
+ * @example
+ * ```typescript
+ * const signature = new PdfAdbePkcsX509RsaSha1SignatureObject({
+ *     privateKey: keyBytes,
+ *     certificate: certBytes
+ * })
+ * ```
+ */
+export declare class PdfAdbePkcsX509RsaSha1SignatureObject extends PdfSignatureObject {
+    /** Fixed algorithm for RSA-SHA1 signatures. */
+    static readonly ALGORITHM: AsymmetricEncryptionAlgorithmParams;
+    /** Private key for signing. */
+    privateKey: ByteArray;
+    /** Signer certificate. */
+    certificate: ByteArray;
+    /** Additional certificates for chain building. */
+    additionalCertificates?: ByteArray[];
+    /** Issuer certificate for OCSP requests. */
+    issuerCertificate?: ByteArray;
+    /** Revocation information or 'fetch' to retrieve automatically. */
+    revocationInfo?: RevocationInfo | 'fetch';
+    /**
+     * Creates a new X.509 RSA-SHA1 signature object.
+     *
+     * @param options - Signature configuration options.
+     */
+    constructor(options: PdfSignatureSignOptions & {
+        privateKey: ByteArray;
+        certificate: ByteArray;
+        additionalCertificates?: ByteArray[];
+        issuerCertificate?: ByteArray;
+        revocationInfo?: RevocationInfo | 'fetch';
+    });
+    /**
+     * Signs the document bytes using RSA-SHA1 format.
+     *
+     * @param options - Signing options with bytes.
+     * @returns The signature bytes and revocation information.
+     */
+    sign: PdfSignatureObject['sign'];
+}

package/dist/signing/signatures/adbe-x509-rsa-sha1.js

@@ -0,0 +1,81 @@
+import { PrivateKeyInfo } from 'pki-lite/keys/PrivateKeyInfo';
+import { PdfSignatureObject } from './base';
+import { OctetString } from 'pki-lite/asn1/OctetString';
+import { AlgorithmIdentifier } from 'pki-lite/algorithms/AlgorithmIdentifier';
+import { fetchRevocationInfo } from '../utils';
+/**
+ * X.509 RSA-SHA1 signature object (adbe.x509.rsa_sha1).
+ * Creates a raw RSA-SHA1 signature with certificates in the Cert entry.
+ *
+ * @example
+ * ```typescript
+ * const signature = new PdfAdbePkcsX509RsaSha1SignatureObject({
+ *     privateKey: keyBytes,
+ *     certificate: certBytes
+ * })
+ * ```
+ */
+export class PdfAdbePkcsX509RsaSha1SignatureObject extends PdfSignatureObject {
+    /** Fixed algorithm for RSA-SHA1 signatures. */
+    static ALGORITHM = {
+        type: 'RSASSA_PKCS1_v1_5',
+        params: {
+            hash: 'SHA-1',
+        },
+    };
+    /** Private key for signing. */
+    privateKey;
+    /** Signer certificate. */
+    certificate;
+    /** Additional certificates for chain building. */
+    additionalCertificates;
+    /** Issuer certificate for OCSP requests. */
+    issuerCertificate;
+    /** Revocation information or 'fetch' to retrieve automatically. */
+    revocationInfo;
+    /**
+     * Creates a new X.509 RSA-SHA1 signature object.
+     *
+     * @param options - Signature configuration options.
+     */
+    constructor(options) {
+        super({
+            ...options,
+            subfilter: 'adbe.x509.rsa_sha1',
+            certs: [
+                options.certificate,
+                ...(options.additionalCertificates ?? []),
+            ],
+        });
+        this.privateKey = options.privateKey;
+        this.revocationInfo = options.revocationInfo;
+        this.certificate = options.certificate;
+        this.issuerCertificate = options.issuerCertificate;
+        this.additionalCertificates = options.additionalCertificates;
+    }
+    /**
+     * Signs the document bytes using RSA-SHA1 format.
+     *
+     * @param options - Signing options with bytes.
+     * @returns The signature bytes and revocation information.
+     */
+    sign = async (options) => {
+        const { bytes } = options;
+        const revocationInfo = this.revocationInfo === 'fetch'
+            ? await fetchRevocationInfo({
+                certificates: [
+                    this.certificate,
+                    ...(this.additionalCertificates ?? []),
+                ],
+                issuerCertificate: this.issuerCertificate,
+            })
+            : this.revocationInfo;
+        const privateKeyInfo = PrivateKeyInfo.fromDer(this.privateKey);
+        const signatureAlgorithm = AlgorithmIdentifier.signatureAlgorithm(PdfAdbePkcsX509RsaSha1SignatureObject.ALGORITHM);
+        const signatureBytes = await signatureAlgorithm.sign(bytes, privateKeyInfo);
+        return {
+            signedBytes: new OctetString({ bytes: signatureBytes }).toDer(),
+            revocationInfo,
+        };
+    };
+}