fix black sign rectangle, add WITHOUT_OCSP_REVOCATION_CHECK if the check returns a generic errorsign

2 files changed, 55 insertions, 10 deletions

diff --git a/backend/pdf/ev-poppler.cc b/backend/pdf/ev-poppler.cc
index b7c388c4..72394b93 100644
--- a/backend/pdf/ev-poppler.cc
+++ b/backend/pdf/ev-poppler.cc
@@ -3426,13 +3426,42 @@ pdf_document_signatures_get_signature_state (EvDocumentSignatures *document,
 		                                                           NULL,
 		                                                           &error);
 		if (!signature_info) {
+			if (error)
+				g_warning ("Signature validation failed: %s", error->message);
 			all_valid = FALSE;
 			continue;
 		}
 
-		signature_status = poppler_signature_info_get_signature_status (signature_info);
 		certificate_status = poppler_signature_info_get_certificate_status (signature_info);
 
+		/* POPPLER_CERTIFICATE_GENERIC_ERROR here means the online OCSP
+		 * revocation check itself could not complete (no network, or no
+		 * OCSP responder configured on the certificate) -- an actual
+		 * revocation is reported as POPPLER_CERTIFICATE_REVOKED regardless
+		 * of this retry, so this never masks a real revocation. Retry
+		 * without OCSP so an otherwise-trusted chain whose revocation
+		 * status merely couldn't be checked isn't reported as broken. */
+		if (certificate_status == POPPLER_CERTIFICATE_GENERIC_ERROR) {
+			g_autoptr(GError) retry_error = NULL;
+			PopplerSignatureInfo *retry_info;
+
+			retry_info = poppler_form_field_signature_validate_sync (field,
+			                                                       (PopplerSignatureValidationFlags)
+			                                                       (POPPLER_SIGNATURE_VALIDATION_FLAG_VALIDATE_CERTIFICATE |
+			                                                        POPPLER_SIGNATURE_VALIDATION_FLAG_WITHOUT_OCSP_REVOCATION_CHECK),
+			                                                       NULL,
+			                                                       &retry_error);
+			if (retry_info) {
+				poppler_signature_info_free (signature_info);
+				signature_info = retry_info;
+				certificate_status = poppler_signature_info_get_certificate_status (signature_info);
+			} else if (retry_error) {
+				g_warning ("Signature validation retry (without OCSP) failed: %s", retry_error->message);
+			}
+		}
+
+		signature_status = poppler_signature_info_get_signature_status (signature_info);
+
 		switch (signature_status) {
 		case POPPLER_SIGNATURE_VALID:
 			break;
@@ -3528,9 +3557,9 @@ pdf_document_signatures_sign (EvDocumentSignatures *document,
 	poppler_signing_data_set_signature_text_left (signing_data, data->signature_left);
 
 	color = poppler_color_new ();
-	color->red = data->font_color.red * 255;
-	color->green = data->font_color.green * 255;
-	color->blue = data->font_color.blue * 255;
+	color->red = data->font_color.red * 65535;
+	color->green = data->font_color.green * 65535;
+	color->blue = data->font_color.blue * 65535;
 	poppler_signing_data_set_font_color (signing_data, color);
 	g_clear_pointer (&color, poppler_color_free);
 
@@ -3539,16 +3568,16 @@ pdf_document_signatures_sign (EvDocumentSignatures *document,
 	poppler_signing_data_set_border_width (signing_data, data->border_width);
 
 	color = poppler_color_new ();
-	color->red = data->border_color.red * 255;
-	color->green = data->border_color.green * 255;
-	color->blue = data->border_color.blue * 255;
+	color->red = data->border_color.red * 65535;
+	color->green = data->border_color.green * 65535;
+	color->blue = data->border_color.blue * 65535;
 	poppler_signing_data_set_border_color (signing_data, color);
 	g_clear_pointer (&color, poppler_color_free);
 
 	color = poppler_color_new ();
-	color->red = data->background_color.red * 255;
-	color->green = data->background_color.green * 255;
-	color->blue = data->background_color.blue * 255;
+	color->red = data->background_color.red * 65535;
+	color->green = data->background_color.green * 65535;
+	color->blue = data->background_color.blue * 65535;
 	poppler_signing_data_set_background_color (signing_data, color);
 	g_clear_pointer (&color, poppler_color_free);
 
diff --git a/configure.ac b/configure.ac
index 3ff04caa..87ca738a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -434,6 +434,21 @@ fi
 AM_CONDITIONAL(ENABLE_PDF, test x$enable_pdf = xyes)
 dnl ================== end of pdf checks ============================================
 
+dnl ================== pdf digital signing checks ===================================
+dnl The PDF backend always calls poppler-glib's signing/validation API
+dnl (poppler_document_sign and friends) when PDF support is enabled, so this
+dnl is informational only: it reports whether the poppler-glib found above
+dnl actually declares that API, it does not disable the PDF backend.
+enable_pdf_signing=no
+if test "x$enable_pdf" = "xyes"; then
+    save_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS $POPPLER_CFLAGS"
+    AC_CHECK_DECLS([poppler_document_sign], [enable_pdf_signing=yes], [enable_pdf_signing=no],
+                   [#include <poppler.h>])
+    CFLAGS="$save_CFLAGS"
+fi
+dnl ================== end of pdf digital signing checks =============================
+
 dnl libspectre (used by ps and dvi backends)
 SPECTRE_REQUIRED=0.2.0
 PKG_CHECK_MODULES(SPECTRE, libspectre >= $SPECTRE_REQUIRED,have_spectre=yes,have_spectre=no)
@@ -792,6 +807,7 @@ Configure summary:
     Tests...............:    $enable_tests
 
     PDF Backend.........:    $enable_pdf
+    PDF Digital Signing.:    $enable_pdf_signing
     Synctex enabled.....:    $enable_synctex
     PostScript Backend..:    $enable_ps
     TIFF Backend........:    $enable_tiff