npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

node-signpdf

v3.0.0

Published

DEPRECATED. Have a look at @signpdf/signpdf instead.

Downloads

34,246

Readme

node-signpdf is DEPRECATAED

It is being replaced by @signpdf.


Deprecated since Oct 2023 Replaced by @signpdf/signpdf

Simple signing of PDFs in node.

Purpose

The purpose of this package is not as much to be used as a dependendency, although it could. The main purpose is to demonstrate the way signing can be achieved in a piece of readable code as it can take a lot of hours to figure out.

Usage

Deprecated since Oct 2023 Replaced by @signpdf/signpdf

Install with npm i -S node-signpdf node-forge.

In practice we expect that most people will just read through the code we've written in the testing part of this package and figure it out themselves. If that's your case, you should read the [Signing PDF in simple steps] section.

With pdfkit-created document

You have already created a PDF using foliojs/pdfkit and you want to sign that. Before saving (writing to fs, or just converting to Buffer) your file, you need to a add a signature placeholder to it. We have a helper for that. This is demonstrated in the signs input PDF test.

Once you have the placeholder, just [sign the document].

With any PDF document

Yes. This is new since version 1.0. We have a helper that can add a signature placeholder in at least the most basic PDFs without depending on pdfkit. You can see how this is done in the signs a ready pdf test.

Once you have the placeholder, just [sign the document].

Sign the document

import signer from 'node-signpdf';
...
const signedPdf = signer.sign(
  fs.readFileSync(PATH_TO_PDF_FILE),
  fs.readFileSync(PATH_TO_P12_CERTIFICATE),
);

Notes

Deprecated since Oct 2023 Replaced by @signpdf/signpdf

  • The process of signing a document is described in the Digital Signatures in PDF document. As Adobe's files are deprecated, here is the standard as defined by ETSI.
  • This lib:
    • requires the signature placeholder to already be in the document (There are helpers included that can try to add it);
    • requires the Contents descriptor in the Sig be placed after the ByteRange one;
    • takes Buffers of the PDF and a P12 certificate to use when signing;
    • does cover only basic scenarios of signing a PDF. If you have suggestions, ideas or anything, please CONTRIBUTE;
  • Feel free to copy and paste any part of this code. See its defined Purpose.

Signing PDF in simple steps

Generate a PDF

See the unit-testing code. PDFKit is used there for generating the document. This also allows easy addition of the signature placeholder.

Append a signature placeholder

What's needed is a Sig element and a Widget that is also linked in a Form. The form needs to be referenced in the root descriptor of the PDF as well. A (hopefully) readable sample is available in the helpers. Note the Contents descriptor of the Sig where zeros are placed that will later be replaced with the actual signature.

This package provides two helpers for adding the signature placeholder:

  • pdfkitAddPlaceholder
  • plainAddPlaceholder

Note: Signing in detached mode makes the signature length independent of the PDF's content length, but it may still vary between different signing certificates. So every time you sign using the same P12 you will get the same length of the output signature, no matter the length of the signed content. It is safe to find out the actual signature length your certificate produces and use it to properly configure the placeholder length.

PAdES compliant signatures

To produce PAdES compliant signatures, the ETSI Signature Dictionary SubFilter value must be ETSI.CAdES.detached instead of the standard Adobe value.

This can be declared using the subFilter option argument passed to pdfkitAddPlaceholder and plainAddPlaceholder.

import { SUBFILTER_ETSI_CADES_DETACHED, pdfkitAddPlaceholder } from 'node-signpdf';

const pdfToSign = pdfkitAddPlaceholder({
  ...,
  subFilter: SUBFILTER_ETSI_CADES_DETACHED,
});

Generate and apply signature

That's where the Signer kicks in. Given a PDF and a P12 certificate a signature is generated in detached mode and is replaced in the placeholder. This is best demonstrated in the tests.

Dependencies

node-forge is used for working with signatures.

PDFKit is used in the tests for generating a PDF with a signature placeholder.

Credits

node-signpdf is deprecated since Oct 2023 and is being replaced by @signpdf/signpdf