Add cades verification for pdfa documents

DEVSIX-7745

Author: Dmitry Radchuk

kernel/src/main/java/com/itextpdf/kernel/pdf/IsoKey.java

@@ -38,5 +38,6 @@ public enum IsoKey {
     FONT_GLYPHS,
     XREF_TABLE,
     SIGNATURE,
+    SIGNATURE_TYPE,
     CRYPTO
 }

kernel/src/main/java/com/itextpdf/kernel/utils/PdfMergerProperties.java

@@ -115,7 +115,8 @@ public PdfMergerProperties setMergeOutlines(boolean mergeOutlines) {
     }
 
     /**
-     * merge documents ECMA scripts
+     * merge documents ECMA scripts,
+     * if AA or OpenAction or Names dictionaries contained in both documents than nothing will be merged
      *
      * @param mergeNames true to merge, false otherwise
      *

pdfa/src/main/java/com/itextpdf/pdfa/PdfADocument.java

@@ -211,6 +211,9 @@ public void checkIsoConformance(Object obj, IsoKey key, PdfResources resources,
             case SIGNATURE:
                 checker.checkSignature((PdfDictionary) obj);
                 break;
+            case SIGNATURE_TYPE:
+                checker.checkSignatureType(((Boolean) obj).booleanValue());
+                break;
             case CRYPTO:
                 checker.checkCrypto((PdfObject) obj);
                 break;

pdfa/src/main/java/com/itextpdf/pdfa/checker/PdfA1Checker.java

@@ -320,6 +320,14 @@ public void checkCrypto(PdfObject crypto) {
         }
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public void checkSignatureType(boolean isCAdES) {
+        //nothing to do
+    }
+
     @Override
     protected void checkPageTransparency(PdfDictionary pageDict, PdfDictionary pageResources) {
         // This check is irrelevant for the PdfA1 checker, so the body of the method is empty

pdfa/src/main/java/com/itextpdf/pdfa/checker/PdfA4Checker.java

@@ -293,6 +293,16 @@ public void checkCanvasStack(char stackOperation) {
 
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public void checkSignatureType(boolean isCAdES) {
+        if (!isCAdES) {
+            throw new PdfAConformanceException(PdfaExceptionMessageConstant.SIGNATURE_SHALL_CONFORM_TO_ONE_OF_THE_PADES_PROFILE);
+        }
+    }
+
     //There is no limit for String length in pdf-a/4
     /**
      * {@inheritDoc}

pdfa/src/main/java/com/itextpdf/pdfa/checker/PdfAChecker.java

@@ -273,6 +273,18 @@ public void checkSignature(PdfDictionary signatureDict) {
         checkedObjects.add(signatureDict);
     }
 
+    /**
+     * This method checks compliance of the signature type
+     *
+     * @param isCAdES true is CAdES sig type is used, false otherwise.
+     *
+     * @deprecated Will become an abstract in the next major release.
+     */
+    @Deprecated
+    public void checkSignatureType(boolean isCAdES) {
+
+    }
+
     /**
      * This method checks compliance with the graphics state architectural
      * limitation, explained by {@link PdfAChecker#maxGsStackDepth}.

pdfa/src/main/java/com/itextpdf/pdfa/exceptions/PdfaExceptionMessageConstant.java

@@ -180,5 +180,8 @@ public final class PdfaExceptionMessageConstant {
     public static final String XMP_METADATA_HISTORY_ENTRY_SHALL_CONTAIN_KEY = "XMP metadata history entry shall"
             + " contain key {0}";
 
+    public static final String SIGNATURE_SHALL_CONFORM_TO_ONE_OF_THE_PADES_PROFILE =
+            "Signature shall conform to one of the PAdES profiles from either ISO 32000-2 or ISO 14533-3.";
+
     private PdfaExceptionMessageConstant(){}
 }

pdfa/src/test/java/com/itextpdf/pdfa/PdfADocumentTest.java

@@ -0,0 +1,42 @@
+package com.itextpdf.pdfa;
+
+import com.itextpdf.kernel.pdf.IsoKey;
+import com.itextpdf.kernel.pdf.PdfAConformanceLevel;
+import com.itextpdf.kernel.pdf.PdfOutputIntent;
+import com.itextpdf.kernel.pdf.PdfVersion;
+import com.itextpdf.kernel.pdf.PdfWriter;
+import com.itextpdf.kernel.pdf.WriterProperties;
+import com.itextpdf.pdfa.exceptions.PdfAConformanceException;
+import com.itextpdf.pdfa.exceptions.PdfaExceptionMessageConstant;
+import com.itextpdf.test.ExtendedITextTest;
+import com.itextpdf.test.annotations.type.UnitTest;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+
+import java.io.ByteArrayOutputStream;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+
+@Category(UnitTest.class)
+public class PdfADocumentTest extends ExtendedITextTest {
+    public static final String SOURCE_FOLDER = "./src/test/resources/com/itextpdf/pdfa/";
+
+    @Test
+    public void checkCadesSignatureTypeIsoConformance() throws FileNotFoundException {
+        PdfWriter writer = new PdfWriter(new ByteArrayOutputStream(), new WriterProperties().setPdfVersion(PdfVersion.PDF_2_0));
+        InputStream is = new FileInputStream(SOURCE_FOLDER + "sRGB Color Space Profile.icm");
+        PdfADocument document = new PdfADocument(writer, PdfAConformanceLevel.PDF_A_4, new PdfOutputIntent("Custom", "", "http://www.color.org", "sRGB IEC61966-2.1", is));
+        document.checkIsoConformance(true, IsoKey.SIGNATURE_TYPE, null, null);
+    }
+
+    @Test
+    public void checkCMSSignatureTypeIsoConformance() throws FileNotFoundException {
+        PdfWriter writer = new PdfWriter(new ByteArrayOutputStream(), new WriterProperties().setPdfVersion(PdfVersion.PDF_2_0));
+        InputStream is = new FileInputStream(SOURCE_FOLDER + "sRGB Color Space Profile.icm");
+        PdfADocument document = new PdfADocument(writer, PdfAConformanceLevel.PDF_A_4, new PdfOutputIntent("Custom", "", "http://www.color.org", "sRGB IEC61966-2.1", is));
+        Exception e = Assert.assertThrows(PdfAConformanceException.class, () -> document.checkIsoConformance(false, IsoKey.SIGNATURE_TYPE, null, null));
+        Assert.assertEquals(PdfaExceptionMessageConstant.SIGNATURE_SHALL_CONFORM_TO_ONE_OF_THE_PADES_PROFILE, e.getMessage());
+    }
+}

pdfa/src/test/java/com/itextpdf/pdfa/checker/PdfA1CheckerTest.java

@@ -103,6 +103,12 @@ public void checkSignatureTest() {
         Assert.assertTrue(pdfA1Checker.objectIsChecked(dict));
     }
 
+    @Test
+    public void checkSignatureTypeTest() {
+        pdfA1Checker.checkSignatureType(true);
+        //nothing to check, only for coverage
+    }
+
     @Test
     public void checkLZWDecodeInInlineImage() {
         PdfStream stream = new PdfStream();

sign/src/main/java/com/itextpdf/signatures/PdfSigner.java

@@ -556,6 +556,8 @@ public void signDetached(IExternalDigest externalDigest, IExternalSignature exte
             }
         }
 
+        document.checkIsoConformance(sigtype == CryptoStandard.CADES, IsoKey.SIGNATURE_TYPE);
+
         Collection<byte[]> crlBytes = null;
         int i = 0;
         while (crlBytes == null && i < chain.length) {