add tests for digital signatures

mbkma · mbkma · commit 7669c822aefe · 2026-04-02T20:30:17.000+02:00
diff --git a/.github/workflows/archlinux.sh b/.github/workflows/archlinux.sh
@@ -28,6 +28,7 @@ requires+=(
 	make
 	mate-common
 	mate-desktop
+	poppler
 	poppler-glib
 	texlive-bin
 	webkit2gtk
diff --git a/.github/workflows/debian.sh b/.github/workflows/debian.sh
@@ -29,6 +29,7 @@ requires+=(
 	libkpathsea-dev
 	libmate-desktop-dev
 	libpoppler-glib-dev
+	poppler-utils
 	libsecret-1-dev
 	libsm-dev
 	libspectre-dev
diff --git a/.github/workflows/fedora.sh b/.github/workflows/fedora.sh
@@ -36,6 +36,7 @@ requires+=(
 	mate-common
 	mate-desktop-devel
 	poppler-glib-devel
+	poppler-utils
 	redhat-rpm-config
 	texlive-lib-devel
 	webkit2gtk4.1-devel
diff --git a/.github/workflows/ubuntu.sh b/.github/workflows/ubuntu.sh
@@ -30,6 +30,7 @@ requires+=(
 	libkpathsea-dev
 	libmate-desktop-dev
 	libpoppler-glib-dev
+	poppler-utils
 	libsecret-1-dev
 	libsm-dev
 	libspectre-dev
diff --git a/test/Makefile.am b/test/Makefile.am
@@ -4,7 +4,8 @@ dist_check_SCRIPTS = \
 	test2.py \
 	test3.py \
 	test4.py \
-	test5.py
+	test5.py \
+	testDigitalSignatures.py
 
 TESTS = $(dist_check_SCRIPTS)
 
@@ -13,7 +14,12 @@ EXTRA_DIST = \
 	test-links.pdf \
 	test-mime.bin \
 	test-page-labels.pdf \
+	test-signature-unsigned.pdf \
+	test-signature-valid.pdf \
+	test-signature-invalid.pdf \
 	test6.py \
-	test7.py
+	test7.py \
+	testDigitalSignatures.py \
+	generate-signature-fixtures.sh
 
 -include $(top_srcdir)/git.mk
diff --git a/test/generate-signature-fixtures.sh b/test/generate-signature-fixtures.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+set -eu
+
+# Regenerate signed PDF fixtures used by testDigitalSignatures.py.
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+WORK_DIR="$SCRIPT_DIR/.siggen"
+NSS_DIR="$WORK_DIR/nssdb"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$NSS_DIR"
+
+certutil -N -d "sql:$NSS_DIR" --empty-password
+
+openssl req -x509 -newkey rsa:2048 -keyout "$WORK_DIR/key.pem" -out "$WORK_DIR/cert.pem" \
+    -days 365 -nodes -subj "/CN=Atril Test Signer/O=MATE/C=US"
+
+openssl pkcs12 -export -out "$WORK_DIR/signer.p12" -inkey "$WORK_DIR/key.pem" \
+    -in "$WORK_DIR/cert.pem" -name "Atril Test Signer" -passout pass:test123
+
+pk12util -i "$WORK_DIR/signer.p12" -d "sql:$NSS_DIR" -W test123 -K ""
+certutil -M -n "Atril Test Signer" -t "u,u,u" -d "sql:$NSS_DIR"
+
+cp "$SCRIPT_DIR/test-links.pdf" "$SCRIPT_DIR/test-signature-unsigned.pdf"
+
+pdfsig -add-signature \
+    -nssdir "$NSS_DIR" \
+    -nss-pwd "" \
+    -new-signature-field-name Sig1 \
+    -sign Sig1 \
+    -nick "Atril Test Signer" \
+    -kpw test123 \
+    "$SCRIPT_DIR/test-signature-unsigned.pdf" \
+    "$SCRIPT_DIR/test-signature-valid.pdf"
+
+cp "$SCRIPT_DIR/test-signature-valid.pdf" "$SCRIPT_DIR/test-signature-invalid.pdf"
+
+TEST_DIR="$SCRIPT_DIR" python3 - <<'PY'
+import os
+from pathlib import Path
+p = Path(os.environ["TEST_DIR"]) / "test-signature-invalid.pdf"
+b = bytearray(p.read_bytes())
+for i in range(len(b) // 3, len(b)):
+    if b[i] not in (0, 10, 13, 32):
+        b[i] ^= 0x01
+        break
+p.write_bytes(b)
+PY
+
+echo "Generated:"
+echo "  test-signature-unsigned.pdf"
+echo "  test-signature-valid.pdf"
+echo "  test-signature-invalid.pdf"
diff --git a/test/meson.build b/test/meson.build
@@ -7,7 +7,8 @@ test_cases = [
     'testBookmarksMenu.py',
     'testEncryptedFile.py',
     'testFileReloading.py',
-    'testWrongFileExtension.py'
+    'testWrongFileExtension.py',
+    'testDigitalSignatures.py'
 ]
 
 foreach case : test_cases
diff --git a/test/test-signature-invalid.pdf b/test/test-signature-invalid.pdf
diff --git a/test/test-signature-unsigned.pdf b/test/test-signature-unsigned.pdf
diff --git a/test/test-signature-valid.pdf b/test/test-signature-valid.pdf
diff --git a/test/testDigitalSignatures.py b/test/testDigitalSignatures.py
@@ -0,0 +1,53 @@
+#!/usr/bin/python3
+
+# Validate digital-signature fixtures used by Atril tests.
+
+import os
+import subprocess
+import sys
+
+
+def run_pdfsig(pdf_path):
+    cmd = ["pdfsig", "-nocert", pdf_path]
+    result = subprocess.run(cmd, capture_output=True, text=True, check=False)
+    return result.returncode, (result.stdout + result.stderr)
+
+
+def assert_contains(output, expected):
+    if expected not in output:
+        raise AssertionError(f"Expected '{expected}' in output:\n{output}")
+
+
+def main():
+    test_dir = os.path.dirname(os.path.abspath(__file__))
+
+    unsigned_pdf = os.path.join(test_dir, "test-signature-unsigned.pdf")
+    valid_pdf = os.path.join(test_dir, "test-signature-valid.pdf")
+    invalid_pdf = os.path.join(test_dir, "test-signature-invalid.pdf")
+
+    for fixture in (unsigned_pdf, valid_pdf, invalid_pdf):
+        if not os.path.exists(fixture):
+            raise FileNotFoundError(f"Missing fixture: {fixture}")
+
+    unsigned_rc, unsigned_out = run_pdfsig(unsigned_pdf)
+    valid_rc, valid_out = run_pdfsig(valid_pdf)
+    invalid_rc, invalid_out = run_pdfsig(invalid_pdf)
+
+    if unsigned_rc not in (0, 2):
+        raise RuntimeError(f"pdfsig failed for unsigned fixture (rc={unsigned_rc}):\n{unsigned_out}")
+    if valid_rc != 0:
+        raise RuntimeError(f"pdfsig failed for valid fixture (rc={valid_rc}):\n{valid_out}")
+    if invalid_rc != 0:
+        raise RuntimeError(f"pdfsig failed for invalid fixture (rc={invalid_rc}):\n{invalid_out}")
+
+    assert_contains(unsigned_out, "does not contain any signatures")
+    assert_contains(valid_out, "Signature Validation: Signature is Valid.")
+    assert_contains(invalid_out, "Signature Validation: Digest Mismatch.")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as exc:
+        print(exc)
+        sys.exit(1)

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,8 @@ test_cases = [`
`7`	`7`	`'testBookmarksMenu.py',`
`8`	`8`	`'testEncryptedFile.py',`
`9`	`9`	`'testFileReloading.py',`
`10`		`- 'testWrongFileExtension.py'`
	`10`	`+ 'testWrongFileExtension.py',`
	`11`	`+ 'testDigitalSignatures.py'`
`11`	`12`	`]`
`12`	`13`
`13`	`14`	`foreach case : test_cases`