pdfsig said my edited signed PDF was still valid, so I compare ByteRange with the file size

I appended a line of text to the signed PDF, then ran pdfsig on it, which printed "Signature is Valid". I also used pyHanko on the same file and it called it an illegal modification. Both are correct about different things, which explains why I ended up writing a check that compares a signature's ByteRange with the file size. Our upload service compresses PDFs before storing them, and recently, signed contracts started being sent through it.

Before allowing compression to touch those contracts, I wanted to know if the file carried a signature and if anything changed after signing. The validators check different things. pdfsig verifies the hash over the signed bytes, and if those bytes didn't change, it says valid. pyHanko also checks what comes after the signature. The issue comes when the file size doesn't match the last signed byte.

If they're the same, the signature covers everything. If the ByteRange end is smaller, bytes were added after signing. If it's larger, the file was rewritten and the signature dictionary was copied over with stale numbers. To compare the ByteRange end with the file size, I wrote a function called signature_coverage. It checks if the last signed byte equals the file size, if bytes were appended, or if the file was past the end of the file (EOF).

I ran this check on three incremental files and a rewritten copy. All the incremental files came back as "appended", and the rewritten copy came back as "past EOF". Two outputs return an empty list, meaning the signature used to be there but was deleted. This check helps determine if an uploaded file has a valid signature and if any modifications were made after signing.