sign: write the catalog /Perms /DocMDP entry for certification signatures

[vanbroup]

Summary

A CertificationSignature writes the DocMDP transform into the signature dictionary's /Reference, but the document catalog never gained the matching /Perms entry. ISO 32000-1 §12.8.2.2 requires both: /P states the permission level, /Perms /DocMDP is what makes a conforming reader apply it. Without it the output is read as an ordinary approval signature — the file verifies, verify.checkDocMDP still reports it as certified from /Reference, but Acrobat shows no "Certified by" banner and does not enforce the restriction.

Supersedes #165 and #166, which are independent submissions of the same fix (credit to @uinoushi and @akkaraponph for the diagnosis). Both miss the same case: the catalog copy loop already reproduces an existing /Perms, so #165 emits the key twice (invalid dictionary) and #166 refuses any document that already has one, including a never-certified Reader-enabled (/UR3) document.

Changes

createCatalog writes /Perms << /DocMDP N 0 R >> for a certification signature, referencing the signature object addSignatureObject assigns before addCatalog runs. An existing /Perms is rewritten with its entries (/UR3 etc.) preserved and /DocMDP merged in. Direct values inside an indirect /Perms carry that object's pointer, so the writer passes it to serializeCatalogEntry instead of the catalog's; without that they were written as references back to the superseded /Perms object.

validateSignData now rejects a certification signature up front (before the retry loop and PreSignCallback) when the document is already certified (/Perms /DocMDP present, checked by key so a dangling reference still counts), when /Perms cannot be read as a dictionary, or when the document already has a signed field — the spec's "shall be the first signed field". Writing /Perms /DocMDP for a later signature would produce a file readers flag as invalid, which is worse than the approval-style output main produced for that case. The errors name ApprovalSignature as the alternative; the README notes the constraint next to the CLI's CertificationSignature default. The field walk follows /Kids and inherited /FT like the verify package does, with a visited set and depth bound.

serializeCatalogEntry escapes literal strings and #-encodes names on output. The reader decodes both, so a copied value containing a delimiter could end its own token and continue as catalog structure; with /Perms now the dictionary that defines the certification, a crafted entry could close it early and swallow the /DocMDP reference. This gap pre-dates the PR for every root-level entry (a root /Lang (\)) reaches the same branch on main), so the fix applies there too. Output for ordinary values is byte-identical.

Tests

TestCreateCatalog golden catalogs gain the entry with the object number pinned. sign/pdfcatalog_docmdp_test.go covers: only a certification signature writes /Perms; inline and indirect /Perms keep their entries (the indirect case fails on the old pointer logic); the escaping round-trip (fails without the fix — the /DocMDP pointer is lost); rejection of already-certified, unreadable-/Perms, already-signed, nested-signed and inherited-/FT documents, including a /Kids cycle; an unsigned signature field does not block; an end-to-end sign whose /Perms /DocMDP resolves through the reader to the /Type /Sig object with the right transform and /P.

go build, go vet and go test ./... are green. golangci-lint was not run locally (the installed 2.5.0 refuses the Go 1.27 target); the new code mirrors the file's existing buffer-write patterns.

Not in this PR

• UsageRightsSignature has the identical omission (/TransformMethod /UR3 with no catalog /Perms /UR3). Same shape, one line; left out to keep this focused.
• verify.checkDocMDP trusts /Reference alone and never checks the catalog points back at the signature, so pdfsign reports a pre-fix file as certified where no reader would.
• fetchExistingSignatures, verify and extract walk the field tree without a cycle guard (pre-existing).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fey5UYDEY84too4QCQ28oM

---

Generated by Claude Code

[akkaraponph]

@vanbroup

I have tested #169 against both a self-signed mock certificate and an AATL-trusted certificate (INET CA).

Black Box Testing result via Acrobat

White Box Testing using

1. Unpack streams and normalize indirect objects

qpdf --qdf --object-streams=disable mock-signing-document-signed.pdf unpacked.pdf

2. Search for the Perms dictionary and its sub-entries

grep -E "(/Perms|/DocMDP|/UR3)" unpacked.pdf

By compare to the version github.com/digitorus/pdfsign v0.9.0 (highlighted in the red box on the screenshot) with the locally checked-out branch agent/wizardly-shannon-mtm0lq." (green box highlighted)

[vanbroup]

Thanks @akkaraponph, the "Certified by" ribbon and "No changes are allowed" shows Acrobat now recognises the certification, and the qpdf comparison against v0.9.0 pins it to the /Perms entry.