I compressed a signed PDF with five tools. Every signature broke or vanished
A lot of e-contract pipelines sign first and compress later. The signed file often carries scans or photos, so shrinking it right before archiving feels natural. I wanted to see what that order actually does, so I built a test file, ran it through five compression or rewrite tools, and checked every output with two validators. Short version: every tool rewrote the whole file, and every signature…
Many e-contract workflows sign documents first and compress them afterward. The signed file often contains scans or images, so it makes sense to shrink it before archiving. The reporter built a test file, ran it through five compression tools, and checked the outputs using two validators. The results showed that every tool restructured the whole file, and every signature either failed or disappeared.
The test file was a one-page agreement with an 1800×1200 synthetic photo, signed by pyHanko using adbe.pkcs7.detached and a self-made test root CA. It compressed to 931,980 bytes. Both poppler s pdfsig 26.08.0 and pyHanko 0.33.0 validated the signature, trusting only the test root CA. The signature covered two byte ranges: 923,749 bytes starting at offset 0 and 705 bytes starting at offset 931,275, totaling 931,980 bytes.
The signature was based on byte changes, not the appearance of the page. Reordering objects or recompressing a single stream caused the hash to fail, even if the page layout remained unchanged. After running the test file through qpdf, pdfsig reported an illegal ByteRange array. Ghostscript's ebook output lost the signature entirely.
ImgIng's output still claimed a range ending at byte 931,980 in a 64,903-byte file. Ghostscript and iLovePDF removed the signature field altogether. The reporter recommends compressing signed PDFs before signing and avoids re-signing if revisions are made.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
