aleleba/pdfcraft
1
0
Fork 0
mirror of https://github.com/storytold/pdfcraft.git synced 2026-11-02 06:28:49 -06:00
Code Issues Packages Projects Releases Wiki Activity

M9: the signer's certificate must allow document signing (key usage, EKU, critical extensions) (#749)

Browse Source 
* Parity: merge the duplicate form.field-list evidence and notes

#649 and #650 each added `evidence` and `notes` to the same entry, so the
TOML has duplicate keys and `cargo xtask parity` fails on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M9: the signer's certificate must allow document signing (key usage, EKU, critical extensions)

A trusted signer whose certificate may not sign documents was reported
Valid. Validation now checks the signer certificate (RFC 5280 §4.2.1.3,
§4.2.1.12, §4.2): a keyUsage needs digitalSignature or nonRepudiation, an
extended key usage needs a document-signing purpose (any, emailProtection,
codeSigning, RFC 9336 documentSigning, Adobe Authentic Documents, Microsoft
document signing), and no critical extension may be one PdfCraft doesn't
process. Otherwise the verdict is Unknown and the details say why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M9: a critical qcStatements extension doesn't make a qualified certificate unusable

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
This commit is contained in:
Márk Bartalos
2026-10-10 08:14:55 -04:00
committed by GitHub
co-authored by Claude Opus 5.5 Brandon Thomas
parent e4e39f4bef
commit 7a33d4bf25
6 changed files with 126 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
parity/acrobat-features.toml
+2 -2
View File
@@ -6086,8 +6086,8 @@ milestone = "M9"
status = "shipped"
commands = ["sign.validate"]
tools = ["sign_list"]
evidence = ["crates/sign/tests/pdf.rs::signing_then_validating_with_and_without_trust", "crates/automation/tests/automation.rs::digital_ids_signing_and_validation_through_tools"]
notes = ""
evidence = ["crates/sign/tests/pdf.rs::signing_then_validating_with_and_without_trust", "crates/automation/tests/automation.rs::digital_ids_signing_and_validation_through_tools", "crates/sign/tests/chain.rs::a_trusted_signer_whose_certificate_may_not_sign_is_not_valid"]
notes = "The signer's key usage, extended key usage and critical extensions are checked; name constraints are not"
[[feature]]
id = "sign.signatures-panel"