GetSignatureModificationVerdict

Digital signatures

Description

Says whether the updates appended after a signature were ones the document's certification level allows.

Syntax

Delphi

Function TPDFlib.GetSignatureModificationVerdict(Const InputFile, Password, FieldName: WideString): Integer;

Parameters

InputFile	The signed document.
Password	The password to open it, or an empty string.
FieldName	The signature field to judge.

Return values

1	Nothing was appended after the signature.
2	Only changes the certification level permits were appended.
3	Something the level does not permit was appended.
4	The answer could not be determined.
5	The signature does not end on a revision boundary, so bytes sit inside the range it claims to cover.
0	The file or the field could not be read.

Remarks

ISO 32000-1 §12.8.2.2 gives a certifying signature a permission level: 1 permits no later change at all, 2 additionally permits filling form fields and signing, 3 additionally permits annotations. Validation material and document time stamps are permitted at every level, so promoting a signature to long-term validation never reads as tampering.

A result of 4 is not approval. It is returned when a certification's own structure could not be verified, when a field lock is present and which fields the later updates touched cannot be traced, when a later revision holds something that could not be read, and when the file carries bytes past the signed range that form no recognisable revision. In each of those cases something material is unknown, and treating it as permitted would be the wrong way to be wrong.

GetSignatureModificationDetail names the revision and the kind of change behind the answer, and GetSignatureEffectiveMDPLevel reports the level applied.

Example

case PDF.GetSignatureModificationVerdict('signed.pdf', '', 'Signature1') of
  1, 2: ShowMessage('the signature still covers the document');
  3:    ShowMessage('not allowed: '+ PDF.GetSignatureModificationDetail);
else
  ShowMessage('undetermined: '+ PDF.GetSignatureModificationDetail);
end;