17

How do I sign a PDF in Okular? I tried searching for about 20 mins, but I can't find any answers...

I have a .png of my signature, and I basically want to insert it into the document on the dotted line. An electronic timestamp etc would also be nice, but is not required.

I found this article, but it uses GIMP instead of Okular. Also, it doesn't appear to timestamp the document.

The article is a bit old (2010), so I wonder if Okular has a PDF signer yet? This post was also helpful, but does not have the turn-key solution that I am looking for.

2
  • 1
    This is an old question that got no response. It got bumped by the tag edit. I assume it's been overtaken by events, but Okular is just a viewer. AFAIK, it can't edit/modify a document (other than possibly save it in a different format).
    – fixer1234
    Oct 27 '15 at 20:24
  • Take a look at How do I digitally sign a PDF?
    – dma_k
    Sep 21 '17 at 9:49
11

How do I sign a PDF in Okular?

To my knowledge, currently none of Okular's backends support electronic signatures, although that feature has been requested a number of times.

As an alternative, a PDF (or any other file) may be signed using a detached signature with GPG or any of its numerous frontends (such as Kleopatra or Kgpg in KDE).

I have a .png of my signature, and I basically want to insert it into the document on the dotted line

Do not do this.

Anyone having access to your PNG or any document where it is used, such as the PDF you are intending to embed this on, will have a perfect, infinitely reproducible copy of your autograph signature. It offers no security at all and in fact is detrimental to it: upon seeing your scribble on a document, recipients may be tempted to assume that it is authentic and not bother to check for an actual (and legally valid) electronic signature. Acrobat is, or at least used to be, a major offender in this regard—I have seen documents trivially "forged" because of this ill-conceived feature.

4
  • Poppler has recently gained some support for verifying signatures, but not yet for creating them. As for a PNG of the scribble, AFAIK in some countries even a scan of a paper signed document officially counts as a valid form of electronic signature (though lesser than a cryptographic one)...
    – user1686
    May 23 '16 at 11:53
  • Is it even possible to sign and verify a PDF document using Free Software? Let me know if this sounds off, but I would rather insert a PNG of my signature than use a non-FOSS program to sign/verify my signature because a proprietary signature system may not be compatible on all platforms. I'd be very interested to hear more about the progress of signature signing/verification in Poppler, as well as the many FOSS programs that use Poppler.
    – modulitos
    May 28 '16 at 5:44
  • 2
    How is sending a pdf, digitally signed with a .png which I scanned myself, worse w/r/t security than sending a signed hardcopy that can be scanned by anyone? Jun 10 '16 at 12:08
  • 2
    The question does not ask for your personal opinions about security.
    – vaer-k
    May 16 '18 at 19:23
11

Okular (and Poppler) will support digital signatures in PDFs in its official release starting April 2021. Details are found in a post by TU Dresden, who has sponsored the implementation of this feature. Note that this not about inserting a graphics with your scanned signature, but about adding a solid digital certification to the PDF, similar to what is supported by some Adobe products.

As of December 2020, it is already possible to compile the current development version of Okular and the Poppler PDF library locally to obtain the feature. Instructions and a build script are provided with the TU Dresden post.

I have completed the installation using the instructions in the script (watch out for truncated lines in the online-preview!) on KDE Neon 5.20 (based on Ubuntu 20.04 LTS) using Poppler as of Commit 407293bf and Okular as of Commit 110ccd61 (future versions should of course continue to work, so this is just for full reproducibility). I have installed under /usr/local/ and created a start script okular-sign with the variable definitions as in the TU Dresden manual. The new version of Okular identifies as "Version 21.03.70". As typical for KDE, this "local" version of Okular does interfere with the official one from the distribution, which is partly changed to the new version even when starting the old binary (presumably this is due to KDE's system-wide registration of "parts" or some such component). I hope that it will be possible to revert to an official version when signing support is released in my distribution's packages.

After successful installation, I could create a digital signature as advertised in the post:

  • Open a PDF
  • Click 'Digitally sign' in the 'Tools' menu. Alternatively add the "Digitally sign" icon in your preferred tool bar and click it.
  • Draw a rectangle where you want to have the visible hint for the electronic signature.
  • A dialogue will ask for the private key to use, in case there are multiple. Select the one you want to use.
  • Enter the passphrase of your key.

One is prompted to save the signed PDF under a new file name after that.

3

Okular is limited by it's backend poppler. Within the last few months poppler has slowly been adding support for the nss backend. https://bugs.freedesktop.org/show_bug.cgi?id=16770

However, until this functionality is exposed in it's API (also being worked on) and until that API is utilized in Okular, it won't be able to sign/verify signed PDFs.

The cli tool pdfisg that comes with recent version of poppler can read signatures and determine if the signature is valid and if the cert issuer is trusted.

For signing, there is a FOSS java app called PortableSigner that can sign PDF documents. http://portablesigner.sourceforge.net/

Recent versions of LibreOffice also feature document signing.

1
  • You are right, it works with LibreOffice Draw.
    – jadelord
    Mar 31 '17 at 17:59
1

So, it's been about 1.5 years since I asked this question, and I still haven't found an optimal solution for this issue. The main shortcoming is finding a FOSS program to cryptographically sign and verify a PDF document.

I think the accepted answer details the situation best, as well as why Okular falls short.

So, I just wanted to share my current solution, which inserts a png of my image using GIMP. Basically, I am following the steps outlined in the article from my question. But I also use a GIMP plug-in to handle multi-page PDF, outline here: http://www.zyxware.com/articles/4438/how-to-export-multiple-layers-from-gimp-into-a-pdf-file And here is the plug-in: https://www.dropbox.com/s/jzdkgv2f0jrbw6i/export-layers-to-pdf.py?dl=0

I know that solution is not cryptographically correct, but it works for me! But if someone can outline a FOSS solution that can cryptographically sign a PDF document, I will gladly accept that answer!

1
  • Try xournal; it handles the scenario of embedding a PNG/SVG signature in a more straightforward way than GIMP in my experience.
    – user30747
    Dec 15 '18 at 17:37
1

There are no FOSS PDF readers that can sign an Adobe PDF. The reason for this is that signable PDFs created with Adobe tools use Adobe proprietary extensions of the PDF format. PDF is an open format but in this case Adobe have created their own extensions which are owned, patented and licensed by them in order to prevent others from being able to do this.

The only way that a PDF can be signed using FOSS software is to wrap the PDF inside of an open digital signature file format.

You could also investigate remote signing services, where your PDF will be presented to you as HTML which you can then sign. You can sign weakly with an adopted picture of something that resembles your hand written signature - which is a very bad idea as noted by other answers and comments. You can sign more strongly with a cryptographic key - usually with the proviso that the remote signing service hold your key. I do not know if any remote signing services allow you to hold the key, for example, on a 2-factor token device or encrypted on your own hard disk.

1

LibreOffice developer blog post about signing existing PDF files in LO 5.3 or newer: http://vmiklos.hu/blog/pdf-sign.html

1
  • 1
    Welcome to Super User. External links can break or be unavailable, in which case your answer would not be useful. Please include the essential information within your answer and use the link for attribution and further reading. Thanks.
    – fixer1234
    Jan 15 '17 at 8:57
1

IMHO pdfsig is a good choice to check signatures of PDF. If you are willing to use ruby ​​look at the origami gem, here you will find an example to embed a signature in a PDF with your self-signed certificate.

0

There is a foss pdf signing product. It's called autofirma. Also see Manajoro's documentation.

Since I read something about patents in a previous comment (@user2800708), in Europe there is the eIDAS (electronic IDentification, Authentication, and Trust Services) which defines implementation standards and technologies for electronic signatures, digital certificates and other crypto primitives. The Connecting Europe Facility (CEF) provides an opensource software library called Digital Signature Services(DSS).

In my system (ubuntu 20.04) I followed the directions here for my smart card. Since my smart card demands proprietary drivers, I suppose for other cards the procedure is similar. If you generated your digital signature without the help of a smart card, you will not need any extra driver, and you just follow the procedure without installing any driver.

To check digital signatures you can use the latest version of masterpdf5 or the last version of Okular.

-1

You can use online tools like

Adobe Or SmallPdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.