{
  "id": 15375969,
  "title": "pdfsig said my edited signed PDF was still valid, so I compare ByteRange with the file size",
  "url": "https://urgent.news/2026/10/18/pdfsig-said-my-edited-signed-pdf-was-still-valid-so-i-compare",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-18T08:03:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/iterandum/pdfsig-said-my-edited-signed-pdf-was-still-valid-so-i-compare-byterange-with-the-file-size-p6e"
  },
  "original_language": "en",
  "account": "I appended a line of text to the signed PDF, then ran pdfsig on it, which printed \"Signature is Valid\". I also used pyHanko on the same file and it called it an illegal modification. Both are correct about different things, which explains why I ended up writing a check that compares a signature's ByteRange with the file size. Our upload service compresses PDFs before storing them, and recently, signed contracts started being sent through it. Before allowing compression to touch those contracts, I wanted to know if the file carried a signature and if anything changed after signing. The validators check different things. pdfsig verifies the hash over the signed bytes, and if those bytes didn't change, it says valid. pyHanko also checks what comes after the signature. The issue comes when the file size doesn't match the last signed byte. If they're the same, the signature covers everything. If the ByteRange end is smaller, bytes were added after signing. If it's larger, the file was rewritten and the signature dictionary was copied over with stale numbers. To compare the ByteRange end with the file size, I wrote a function called signature_coverage. It checks if the last signed byte equals the file size, if bytes were appended, or if the file was past the end of the file (EOF). I ran this check on three incremental files and a rewritten copy. All the incremental files came back as \"appended\", and the rewritten copy came back as \"past EOF\". Two outputs return an empty list, meaning the signature used to be there but was deleted. This check helps determine if an uploaded file has a valid signature and if any modifications were made after signing.",
  "summary": "I appended one line of text to the page content of a signed PDF, then ran pdfsig on it. It printed \"Signature is Valid\". pyHanko looked at the same file and called it an illegal modification. Both are right about different things, and that gap is why I ended up writing a small check that compares a signature's ByteRange with the file size. Some context. Our upload service compresses PDFs before…",
  "key_points": [
    "pdfsig confirms signature validity based on hash of signed bytes",
    "pyHanko checks for modifications beyond signature area",
    "signaturecoverage function compares ByteRange end to file size"
  ],
  "editors_take": "Comparing ByteRange values against total file size provides a necessary safeguard for automated services that risk corrupting signed contracts through compression or file rewriting processes.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}