Package: pyHanko
The lack of open-source CLI tooling to handle digitally signing and stamping PDF files was bothering me, so I went ahead and rolled my own.Note:The working title of this project (and former name of the repository on GitHub) waspdf-stamp, which might still linger in some references.Note:This project is currently in beta, and not yet production-ready.DocumentationThedocumentation for pyHanko is hosted on ReadTheDocsand includes information on CLI usage, library usage, and API reference documentation derived from
inline docstrings.InstallingPyHanko is hosted onPyPI,
and can be installed usingpip:pipinstall'pyHanko[pkcs11,image-support,opentype,xmp]'Depending on your shell, you might have to leave off the quotes:pipinstallpyHanko[pkcs11,image-support,opentype,xmp]Thispipinvocation includes the optional dependencies required for PKCS#11, image handling and
OpenType/TrueType support.PyHanko requires Python 3.8 or later.ContributingDo you have a question about pyHanko?Post it on the discussion forum!This project welcomes community contributions. If there's a feature you'd like
to have implemented, a bug you want to report, or if you're keen on
contributing in some other way: that's great! However, please make sure to
review thecontribution guidelinesbefore making your
contribution. When in doubt,ask for help on the discussion board.Please do not ask for support on the issue tracker.The issue tracker is for bug
reports and actionable feature requests. Questions related to pyHanko usage
and development should be asked in thediscussion foruminstead.FeaturesThe code in this repository functions both as a library and as a command-line tool.
It's nowhere near complete, but here is a short overview of the features.
Note that not all of these are necessarily exposed through the CLI.StampingSimple text-based stampsQR stampsFont can be monospaced, or embedded from a TTF/OTF font (requires[opentype]optional deps)Document preparationAdd empty signature fields to existing PDFsAdd seed values to signature fields, with or without constraintsManage document metadataSigningOption to use async signing APISignatures can be invisible, or with an appearance based on the stamping toolsLTV-enabled signatures are supportedPAdES baseline profiles B-B, B-T, B-LT and B-LTA are all supported.Adobe-style revocation info embedding is also supported.RFC 3161 timestamp server supportSupport for multiple signatures (all modifications are executed using incremental updates to
preserve cryptographic integrity)Supports RSA, DSA, ECDSA and EdDSARSA padding modes: PKCS#1 v1.5 and RSASSA-PSSDSAECDSA curves: anything supported by thecryptographylibrary,
seehere.EdDSA: both Ed25519 and Ed448 are supported (in "pure" mode only, as per RFC 8419)Built-in support for PDF extensions defined in ISO/TS 32001 and ISO/TS 32002.PKCS#11 supportAvailable both from the library and through the CLIExtra convenience wrapper for Belgian eID cards"Interrupted signing" mode for ease of integration with remote and/or interactive signing
processes.Signature validationCryptographic integrity checkAuthentication through X.509 chain of trust validationLTV validation/sanity check (ad hoc)Difference analysis on files with multiple signatures and/or incremental
updates made after signing (experimental)Signature seed value constraint validationAdES validation (incubating)EncryptionAll encryption methods in PDF 2.0 are supported.In addition, we support a number of extra file encryption
modes of operation for the public-key security handler that are not
explicitly called out in the standard.RSAES-OAEP (does not appear to be widely supported in PDF tooling)ephemeral-static ECDH with X9.63 key derivation (supported by Acrobat)CLI & configurationYAML-based configuration (optional for most features)CLI based onclickAvailable aspyhanko(when installed) orpython -m pyhankowhen running from
the source directoryBuilt-in help: runpyhanko --helpto get startedSome TODOs and known limitationsSee theknown issuespage in the documentation.AcknowledgementThis repository includes code fromPyPDF2(with both minor and major modifications); the original license has been includedhere.LicenseMIT License, seeLICENSE.