PDF eSign

PDF eSign is an offline-first desktop tool with two deliberately separate modes:

• Visual export places overlays and creates a flattened PDF. It does not provide cryptographic integrity.
• Digital signing creates a certificate-backed PAdES B-B signature through a hash-bound consent ceremony.

The application does not claim legal effect, independent identity proofing, verified time, or current revocation status. Those are separate questions shown explicitly in its verification report.

Phase 0–3 capabilities

• Frozen preparation path with a recorded SHA-256 hash and real PDF signature fields
• PKCS#12 signing through a provider abstraction using pyHanko
• ECDSA P-256 or RSA-3072 self-signed credential generation, labeled “Self-declared identity”
• Explicit, versioned intent-to-sign ceremony bound to the frozen document hash
• Canonical, hash-chained audit events with the pre-signing manifest embedded inside the signed byte range
• Evidence ZIP containing the manifest, complete chain, certificate chain, transaction record, and validation report
• Twelve independent validation axes for app-produced and third-party PDF signatures
• User and organization trust-anchor storage with typed fingerprint confirmation and provenance
• Hash-locked runtime and development dependencies
• Authenticode release workflow and published SHA-256 checksums

Revocation remains “not checked — no revocation data available,” and time remains “unverified — local clock only” until later roadmap phases add dated revocation evidence and trusted timestamps.

Setup

Python 3.11+ is required. Windows is the primary desktop target.

python -m venv .venv
.venv\Scripts\activate
python -m pip install -r requirements.txt
python main.py

Developer setup:

python -m pip install -r requirements-dev.txt
python -m pytest
python -m ruff check .
python -m ruff format --check .
python -m pip_audit -r requirements.txt --disable-pip

requirements.txt and requirements-dev.txt are generated with package hashes from their corresponding .in files. Regenerate them with pip-compile --generate-hashes after deliberately changing a dependency.

Visual export

1. Open a PDF.
2. Place typed, drawn, image, name, date, or text overlays.
3. Choose Export PDF.

The output is flattened and labeled “exported,” never “signed.” PDFs that already contain a cryptographic signature are refused by this path.

Digital signing

1. Open and review a PDF and its visible signature appearance.
2. Choose Digital Sign and select a new output path.
3. Review the frozen SHA-256 hash.
4. Load an existing .p12/.pfx, or create a self-signed credential.
5. Review the subject, issuer, fingerprint, validity period, and honest assurance label.
6. Explicitly affirm intent and create the PAdES B-B signature.

The app writes a sibling .evidence.zip. Passphrases are consumed in memory while the credential is loaded and are not written to session JSON, logs, or evidence files.

Verification

The verification panel never collapses results to one green checkmark. It reports:

1. Document integrity
2. Cryptographic signature validity
3. Certificate validity period
4. Chain trust and named local anchor
5. Revocation status
6. Timestamp validity
7. Audit-manifest validity
8. Post-signing changes
9. Modification permissions
10. Signer identity assurance
11. PAdES profile
12. Long-term validation status

Embedded certificate chains are never silently trusted. Importing a trust anchor requires comparing and typing its full SHA-256 fingerprint, and records who imported it and when. Verify important documents independently with another PAdES-capable reader or Poppler pdfsig.

Build and release integrity

build.bat

Local builds state when they are unsigned and still emit SHA256SUMS.txt. Official release automation requires an Authenticode credential, verifies the executable signature, and publishes release checksums. See release-signing.md.

Privacy and limitations

PDF processing, signing, evidence export, and configured trust validation run locally. The Phase 0–3 workflow does not fetch revocation data or contact a timestamp authority.

This software does not determine legal enforceability or jurisdiction-specific compliance. Users and organizations remain responsible for identity proofing, certificate issuance, trust policy, consent language, record retention, and independent verification appropriate to their use case.

Tech stack

• Python and PySide6
• PyMuPDF for rendering and preparation
• pyHanko, cryptography, and asn1crypto for PAdES/CMS operations

See LICENSE.