feat: integrate pdf-signature-validator for native validation by vitormattos · Pull Request #7596 · LibreSign/libresign

vitormattos · 2026-04-23T23:59:01Z

Objective:

Remove necessity of Java when validate signatures of a document.

Copilot

Pull request overview

Integrates the libresign/pdf-signature-validator Composer package into LibreSign to perform native (pure-PHP) PDF signature validation, and wires its metadata/validation outputs into LibreSign’s existing certificate-chain payload.

Changes:

Add PdfSignatureValidationService to run native validation and translate package results/reasons into LibreSign’s expected format.
Update Pkcs12Handler to enrich signature/certificate chain data using native extractor/validator outputs (replacing the previous pdfsig-based Poppler path).
Update install checks and unit tests to reflect the new validation flow and dependencies.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/php/Unit/Service/Signature/PdfSignatureValidationServiceTest.php	New unit tests for mapping native validator results into LibreSign payload shape.
tests/php/Unit/Service/IdentifyMethod/PasswordTest.php	Updates test construction for `Pkcs12Handler` after constructor dependency changes.
tests/php/Unit/Handler/SignEngine/Pkcs12HandlerTest.php	Adds tests for extractor metadata parsing and native validation integration in `getCertificateChain()`.
lib/Service/Signature/PdfSignatureValidationService.php	New service wrapping `PdfSignatureValidator` and translating results/reasons with l10n.
lib/Service/Install/ConfigureCheckService.php	Removes the `pdfsig` setup check, keeping `pdfinfo` as Poppler fallback check.
lib/Handler/SignEngine/Pkcs12Handler.php	Injects native extractor/validation service and uses them to enrich chain leaf data.
lib/Controller/FileController.php	Refactors preview mime-fallback redirects and adds broader error handling/logging.
composer.json	Adds `libresign/pdf-signature-validator` dependency.
composer.lock	Locks the new package and updates dependency hash.

vitormattos · 2026-06-18T20:32:29Z

/backport to stable35

vitormattos · 2026-06-18T20:32:34Z

/backport to stable34

vitormattos · 2026-06-18T20:32:38Z

/backport to stable33

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

The service's validateFromResource() already returns properly formatted arrays with id, label, isValid, and reason. The localize* methods were unnecessarily converting numbers back to enums and then back to numbers. Now Pkcs12Handler uses the validation results directly without the circular conversion, eliminating code duplication and improving clarity. Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

- FileController::fetchPreview: add inline type assertions for RedirectResponse to specify exact status code (303) when returning null-checked values - PdfSignatureValidationService: update docblocks for validateFromResource, validateFromString, and mapValidationResults to include the 'raw' field - Pkcs12Handler::extractNativeSignatureMetadata: change return type from list<array> to array<int, array{...}> to match actual implementation All Psalm errors resolved, unit tests still passing. Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Update constructor arguments to match the new signature which includes PdfSignatureValidationService and PdfSignatureExtractor, and removes the no-longer-used TempManager. Also use real instance of PdfSignatureExtractor instead of mock since the class is final and cannot be mocked. Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

phpseclib is already vendored and scoped in the 3rdparty submodule under OCA\Libresign\Vendor\phpseclib3. Declaring it as a direct composer dependency caused roave/security-advisories to block the insecure 3.0.52 version locked in composer.lock. Remove phpseclib/phpseclib, paragonie/constant_time_encoding and paragonie/random_compat from composer.json require and composer.lock. Use "provide" to satisfy the transitive dependency declared by libresign/pdf-signature-validator without installing the package. Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

The libresign/pdf-signature-validator package is moved from libresign's own composer dependencies into the 3rdparty scoped vendor directory so that php-scoper can prefix both its classes and its phpseclib3 references with OCA\Libresign\Vendor\. - Remove libresign/pdf-signature-validator from composer.json + lock - Remove phpseclib/phpseclib 'provide' declaration (no longer needed) - Update all use statements: LibreSign\PdfSignatureValidator\... => OCA\Libresign\Vendor\LibreSign\PdfSignatureValidator\... - Update 3rdparty submodule ref to include the scoped package Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

vitormattos · 2026-07-07T14:43:34Z

/backport to stable34

vitormattos · 2026-07-07T14:43:43Z

/backport to stable32

vitormattos · 2026-07-07T14:43:52Z

/backport to stable33

backportbot-libresign · 2026-07-07T14:49:21Z

The backport to stable35 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable35
git pull origin stable35

# Create the new backport branch
git checkout -b backport/7596/stable35

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 602c2215 58718e80 4e6236f2 a37d8e32 12139471 8723bcee 3dafc5ba 4751b240 6f3970f1 adaadf72 01295284 0dff4296 f45ff2b4 18a10a98 bebc11e0 8a078afb 8f8195d7 739ec4a2 7ea10ee5 6ba971e9 361675d6 aaa6617c 04ba7304 e9b887ab ad89ce51 f31f34fc 39192a05 adcb25dc 3574b2b6 8c9f9439

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/7596/stable35

Error: Failed to clone repository: Failed to create working tree: Preparing worktree (new branch 'backport/7596/stable35')
fatal: not a valid object name: 'origin/stable35'

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

github-project-automation Bot added this to Roadmap Apr 23, 2026

github-project-automation Bot moved this to 0. Needs triage in Roadmap Apr 23, 2026

vitormattos requested a review from Copilot April 24, 2026 01:20

Copilot started reviewing on behalf of vitormattos April 24, 2026 01:21 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

vitormattos mentioned this pull request Apr 24, 2026

[BUG] NSS_Init failed: security library: bad database #7595

Closed

vitormattos force-pushed the feat/integrate-pdf-signature-validator branch 2 times, most recently from 4db8ad1 to 4595c3e Compare April 24, 2026 15:51

vitormattos force-pushed the feat/integrate-pdf-signature-validator branch from 4595c3e to 6015855 Compare May 5, 2026 22:47

vitormattos marked this pull request as draft May 7, 2026 02:21

vitormattos force-pushed the feat/integrate-pdf-signature-validator branch 2 times, most recently from 7341797 to ac44e0c Compare June 18, 2026 19:52

vitormattos self-assigned this Jun 18, 2026

vitormattos added this to the Next Major (35) milestone Jun 18, 2026

backportbot-libresign Bot added the backport-request label Jun 18, 2026

vitormattos marked this pull request as ready for review June 18, 2026 20:33

vitormattos requested a review from YvesCesar June 18, 2026 20:33

vitormattos force-pushed the feat/integrate-pdf-signature-validator branch from ac44e0c to ca66efc Compare June 30, 2026 21:26

YvesCesar reviewed Jul 3, 2026

View reviewed changes

Comment thread lib/Handler/SignEngine/Pkcs12Handler.php Outdated

vitormattos added 8 commits July 7, 2026 10:22

feat: integrate pdf-signature-validator for native validation

602c221

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

refactor: translate signature validation messages via l10n

58718e8

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

refactor: avoid translating dynamic reason strings

4e6236f

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

feat: add translatable dictionary for validation reasons

a37d8e3

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

docs: add translator guidance for validation reasons

1213947

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

docs: place translator comments above each l10n call

8723bce

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

docs: place translator comments above each l10n call

3dafc5b

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

refactor: remove redundant docs from CA getters

4751b24

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

vitormattos added 13 commits July 7, 2026 10:22

refactor: centralize validation localization mapping

0dff429

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: remove invalid UNKNOWN_FAILURE enum state

f45ff2b

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: cs

bebc11e

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: cs

739ec4a

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: preserve legacy signature validation on native digest mismatch

7ea10ee

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: address native validator review feedback

6ba971e

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: cs

361675d

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix(cs): fix use statement ordering per php-cs-fixer

e9b887a

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

vitormattos force-pushed the feat/integrate-pdf-signature-validator branch from ca66efc to e9b887a Compare July 7, 2026 13:25

vitormattos added 6 commits July 7, 2026 10:43

fix: propagate unexpected native validation exceptions

ad89ce5

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: always reset policy context on metadata failures

f31f34f

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

test: cover native validation exception flow

39192a0

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

test: cover metadata extraction failure propagation

adcb25d

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: cs

3574b2b

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

fix: unit tests

8c9f943

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

vitormattos merged commit b781c04 into main Jul 7, 2026
75 checks passed

vitormattos deleted the feat/integrate-pdf-signature-validator branch July 7, 2026 14:48

github-project-automation Bot moved this from 0. Needs triage to 4. to release in Roadmap Jul 7, 2026

This was referenced Jul 7, 2026

[stable33] feat: integrate pdf-signature-validator for native validation #7872

Merged

[stable32] feat: integrate pdf-signature-validator for native validation #7873

Merged

[stable34] feat: integrate pdf-signature-validator for native validation #7874

Merged

Navigation Menu

Uh oh!

Uh oh!

feat: integrate pdf-signature-validator for native validation - #7596

feat: integrate pdf-signature-validator for native validation#7596
vitormattos merged 30 commits into
mainfrom
feat/integrate-pdf-signature-validator

vitormattos commented Apr 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vitormattos commented Jun 18, 2026

Uh oh!

vitormattos commented Jun 18, 2026

Uh oh!

vitormattos commented Jun 18, 2026

Uh oh!

Uh oh!

vitormattos commented Jul 7, 2026

Uh oh!

vitormattos commented Jul 7, 2026

Uh oh!

vitormattos commented Jul 7, 2026

Uh oh!

Uh oh!

backportbot-libresign Bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

vitormattos commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vitormattos commented Jun 18, 2026

Uh oh!

vitormattos commented Jun 18, 2026

Uh oh!

vitormattos commented Jun 18, 2026

Uh oh!

Uh oh!

vitormattos commented Jul 7, 2026

Uh oh!

vitormattos commented Jul 7, 2026

Uh oh!

vitormattos commented Jul 7, 2026

Uh oh!

Uh oh!

backportbot-libresign Bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vitormattos commented Apr 23, 2026 •

edited

Loading