PDF on Michael’s Domain

Free digital signing of documents under Linux - an impossibility?

Sun, 01 Dec 2019 00:00:00 +0000

The whole story started when I tried to sign a LibreOffice document. When you belive the internet, document signing is inbuilt into LibreOffice. I still have to find the person that managed to digitally sign a LibreOffice document. This experience shows, that despite Edward Snowden most people do not proactively care about security and privacy. Debian removed scdaemon from the gnupg2 package and as usual, one needs to be a command line ninja to fix this. The scdaemon gives smartcard support (which I do not have, but without the scdaemon the Kleopatra key manager refuses to run). I am using the default Ubuntu 18.04 installation and it was quite an odyssey to get a document signed. In fact, I still do not have a satisfactory way to do this. However one does it, something’s not right. Ubuntu 19.10 has fixed at least the invokation of the key manager from LibreOffice and I can invoke SeaHorse from the document signing dialog, but I still have no clue how to make my gpg keys visible to LibreOffice. Anybody figured this out? Until somebody shows me how to sign with LibreOffice, I use the very good, but proprietary software PDFStudio to import my GPG keys and sign my PDF files.Signing services (DocuSign, HelloSign) So what do you do if you need to sign e.g. a PDF and you have no means or do not want to subscribe to one of the document-signing certificate service like DocuSign ? Even with DocuSign’s budget plan a single digital signing costs $2. DocuSign has a 30-day free trial, but I do not know whether the certificats that you generate during the trial with continue to be valid after the end of the trial. HelloSign ( https://www.hellosign.com , now owned by DropBox ) has also a free tier (allowing to sign 3 documents/month) and when signing, it embeds an invisible signature (which was invalid for some strange reason when I tested it even though HelloSign is in Adobe’s approved trust list).Self-signing, cacert and StartSSLTechnically you can created your own signatures (self-signed certificates), but if such PDFs are viewed with Acrobat Reader, the signature will be flagged as invalid and the fact of self-signing is displayed. There used to be http://www.cacert.org/ , but to my knowledge, all browsers have removed the CAcert certificates and the same is likely true for Acrobat. StartSSL used to give out free certificates, but they do not exist anymore (they were seriously challenged with their own security).PDF Viewer supportInterestingly many PDF Viewers do anyway ignore the signing (e.g. the inbuilt PDF viewer from Firefox does not display anything). Other PDF viewers will display the signature, but NOT indicate, that it is not trusted (e.g. the Chrome Browser’s PDF viewer and Ubuntu’s default PDF viewer Evince). Since you have no idea what viewer your target will use to display your signed PDF, you are anyway in a bad situation (even if you subscribe to a document signing service). LetsencryptTo increase the trust in the signing, one can use a Letsencrypt certificate for signing. This signature certifies that the author of the document controls a specific website (in my case jeltsch.org). That is more than a self-signed certificate (and if the website is trusted, this is arguably also more than buying a subscription from DocuSign), but the re-purposed Letsencrypt certificate is not being trusted by Adobe since obviously the Letsencrypt endeavor was never meant for document signing (“Signer’s identity is unknown because it has not been included in your list oif trusted certificates and none of its parent certificates are trusted certificats”). However, the maximum lifetime of such a certificate is 3 months, after which it becomes invalid. It can still be used, but it will display that it is not valid because it has expired (or is not valid yet).How to misuse the Letsencrypt certificateFirst, you need a web server, that uses Letsencrypt certificates to verify the web site identity. This is out-of-scope for this blog post, but there are several good tutorials (e.g. from the Let’s Encrypt people themselves or from Digital Ocean ). Once you have your Let’s Encrypt certificates, this is the process to “misuse” them for signing documents:Since Letsencrypt requires certificate renewal every three months, there will be lots of fullchain.pem and privkey.pem files in the same directory and they are numbered. You obviously want to use the newest (the only valid) certificate and perhaps you want to renew the Let’s Encrypt certificate immediately before exporting it for document signing:certbot --apache --force-renewal -n -d jeltsch.org or if you want to renew all certificates: certbot --apache --force-renewal If you choose to renew all certificates, certbot will try to issue a single certificate for all domains that exist on your server (this possibility did not exist in the beginning of the Letsencrypt ecosystem, but was introduced later). If your server serves more than one domain, you need to manually specify the domain name, for which you want the certificate.For more details about how to use the certbot script, see https://certbot.eff.org/docs/using.html#certbot-commandsThis is the command, that converts the certs into a PKCS#12 file:openssl pkcs12 -export -out signing_certificat.p12 -in /etc/letsencrypt/archive/website-name/fullchain1.pem -inkey /etc/letsencrypt/archive/website-name/privkey1.pemThe PKCS#12 file stores the certificate and the private key in one encrypted file (with the file extension .p12). Therefore, the command will ask from you a keyphrase, which you absolutely need to remember to be able to use the certificate. Then you can transfer the p12 file to your desktop computer and use it to sign PDF files.Time stamping serversIf your PDF application asks for a time stamping server, you can use one of the free services, e.g. ca.signFiles.com/TSAServer.aspx or http://zeitstempel.dfn.de . However, also these time stamping services are not trusted by Adobe Acrobat.Here the commands to generate a self-signed certificate (it asks for a (temporary) passphrase, just make up something and remember it, you need it in the second step):openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 3650Conversion into a signing certificate (it first asks you for the temporary passphrase from above and then for the final passphrase, which you need to remember in order to use the certificate:openssl pkcs12 -export -out signing_certificat.p12 -in cert.pem -inkey key.pem

Ḿanuscript reviewing by annotating PDFs

Fri, 28 Jun 2019 00:00:00 +0000

Manuscripts for scientific peer-review are delivered as PDF files. Thus it appears most natural to comment the PDF file itself instead of submitting the comments as a separate text (file). However, many submission systems do not allow to submit comments in form of an annotated PDF file.In addition, there is no easy-to-use free/Open Source PDF editor for Linux (my platform of choice). Yes, there is PDFEdit ( http://pdfedit.cz/en/index.html) , but it requires substantial learning and its last release dates back to 2012. There are free online PDF editors (e.g. https://www.pdfescape.com/) , but sometimes I need a local tool. Although not Open Source and not free, the tool of my choice has been PDF Studio Pro . It has all the features I need (actually much more than I need), it is truly cross-platform (Windows, Mac, Linux), easy to use and very affordable for what it offers ($129 single permanent license). Unfortunately, Quoppa software - the maker of PDF Studio - does not offer academic discounts.PDF Studio ViewerA while ago, the makers of PDF Studio started to offer a free version called PDF Studio Viewer . This free version has gotten more useful over time. Since last year, it also supports PDF annotation, which is very important for my work, mostly when I am peer-reviewing scientific manuscripts. For many academic users, the PDF Studio Viewer might be fully sufficient.Libre Office and InkscapeOf course Libre Office Draw and Inkscape can edit PDFs, but they are not specialized for annotating. If you need to do extensive annotations, the process becomes soon very painful. In addition, Inkscape editing can be destructive (i.e. when you modify text), but I have used it e.g. to fill out forms.Apart from the lack of dedicated annotation and reviewing tools (“markups” like “replace text”, “crossout text”, “delete text”, “insert text” or callouts), Libre Office Draw is actually a quite capable PDF editor, but fails still sometimes to correctly open very complex PDF documents (I have had problems with background images/patterns). Strangely, the only reviewing tool (comments) are not exported by default. You need to check the “Export comments” box when you export your edited PDF file as PDF (the “Save” operation creates an ODG file, which you probably don’t want).PDFsamIf you do not have the need to annotate, then you might get away with the Open Source tool PDFsam . Unlike PDFEdit, PDFsam is available from the Ubuntu repositories. PDFsam also has two non-free versions ( PDFsam Enhanced and PDFsam Visual ). PDFsam Basic (the Open Source version) is just a simple GUI on top of some command line utilities, whereas the PDF Studio Viewer offers a true visual editing experience. I canot talk about the non-free versions of PDFsam as they are not available as free trials. In fact, all of the operations of PDFsam can be achieved via the command line (see here for my blog post about how to perform common PDF editing tasks using mostly the command line tool pdftk ).Reducing file sizePDFsam Basic and PDF Studio Viewer do not offer any functionality to reduce file size. The LibreOffice Draw PDF export dialog let’s you reduce image resolution and JPEG compression, which you can use to reduce file size. But at the Open Source front, the only capable tools to reduce PDF size seem to be command line tools. I use ghostscript for this task, but the command is not easy to remember:gs -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/screen -dNOPAUSE -dQUIET -dBATCH -sOutputFile=output.pdf input.pdfWith PDF Studio Pro, you obviously do not need to remember the different keywords for the different output quality option (screen, ebook, printer, prepress) as you just choose from the drop down menu between the available options. If you are looking for an Open Source graphical wrapper for ghostscript, perhaps try workerPdf . Signing documents and adding signaturesPDF Studio Viewer let’s you sign documents if you have a DocuSign subscription . However, I am mostly concerned about being able to prove myself that I created a certain document (“self-signed signature”) and not that others are able to verify my authorship. For this scenario you are out of luck with PDF Studio Viewer. And apparently, PDFSam does not offer any possibility for signing (neither self-signing nor 3rd party signing). However, Libre Office Draw allows documents signing! I have been looking for an affordable solution (not self-signed, but trusted by other PDF readers) to sign PDF documents, but there seems to be no appropriate solution if you need to sign only rarely. The basic plan by DocuSign ($10/month) appears too expensive when signing only one document per month.Take-home messageIf you want to stay with free or Open Source solutions, you probably need to combine several tools in order to cover all typical PDF editing tasks without pain: PDFsam Basic, LibreOffice Draw, PDF Studio Viewer and ghostscript. But if you edit PDFs often (as I do), buying PDF Studio Pro is clearly the way to go.

Ubuntu is slowly getting unusable

Mon, 01 Sep 2014 00:00:00 +0000

The default Document Viewer in Ubuntu 14.04 is Evince. Recently it started to have problems with many PDF files that are opened by other PDF viewers (Okular, Acroread) without problems. Actually Evince opens them, but the window remains invisible. I tried to change the PDF viewer, but Ubuntu has apparently removed all means to do so in version 14.04 short of going into the command line and editing configuration files by hand: what a progress! In previous versions of the File Manager, it was possible to right-click a file and after selecting “Open with” > “Other Application” to choose “Set as default”. Now the only way to do so is to edit ~/.local/share/applications/mimeapps.list, replacing [Default Applications]application/pdf=evince.desktop with[Default Applications]application/pdf=kde4-okularApplication_pdf.desktop; I guess it is time to switch back to OpenSuSE…

Poster printing without an A0 printer

Thu, 15 May 2014 00:00:00 +0000

I failed to prepare my poster for the GRC conference on Molecular Mechanisms in Lymphatic Function & Disease in time. The A0 printer from UNIGRAFIA is not available on weekends. Hence the best I could do is to print it out on A3 and stitch it together. A definite advantage is that I do not have to run around with these ridiculously large poster tubes, that identify you as a Science nerd from half a mile distance.Unfortunately, the only application that can decently split a DIN A0 PDF into separate pages on the fly while printing is the full version of Acrobat. I tried out other options: pdfposter did a fairly good job, but it did not manage with the background: pdfposter -mA3 -pA0 input.pdf output.pdf Pdfposter also doesn’t create overlaps. A solution, that always should work is to convert the PDF into an image (convert -density 150 input.pdf output.png) and then use PosteRazor to create individual PDF files from that image. However, conversion of a A0 pdf into a high res image can last hours. Use a .png file! PosteRazor refused to work on a 60 MB TIF file. The background gradient conversion results in visible colour steps. In order to avoid that, you would have to define the background gradient as an image rather than a vector element. Otherwise PosteRazor worked well; unlike in pdfposter you can define overlaps for the assembly.I have been using Inkscape to prepare my poster and usually I export it from there as a PDF file. This did not work this time because the program consistently crashed during the export. Hence I tried to save it as an encapsulated postscript file and to distil it into a PDF. When exporting from Inkscape (actually it is “Save as”), I selected the following options:Postscript level 3Rasterize filter effects: yesResolution for rasterisation: something between 150 to 300Export area is page: yesAfter distilling it, I printed it from Acrobat Pro with the following options: Page setup: DIN A3, portrait orientationPage scaling: Tile large pagesAt a tile scale of 95% and an overlap of 10mm I got 9 pages (3x3), which is still OK for assembly.

Some useful PDF editing (and search) commands

Thu, 28 Jul 2011 00:00:00 +0000

Insert pages with interleave: pdftk A=input_odd_pages.pdf B=input_even_pages.pdf shuffle A B output collated.pdf(from the pdftk package)
Split an A2-sized PDF into two A3 pages for printing (no overlap): pdfposter -m A3 -p A2 Periodic-Table_A2.pdf Periodic-Table_2xA3.pdf
Split an arbitrary-sized PDF into A3 pages for printing at 100% size (= 1), no overlap: pdfposter -m A3 -s1 Poster.pdf Poster_split_to_A3.pdf
Reverse page order: pdftk input.pdf cat end-1 output reversed.pdf(from the pdftk package)
Reduce PDF filesize: gs -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/screen -dNOPAUSE -dQUIET -dBATCH -sOutputFile=output.pdf input.pdf Allowed PDFSETTINGS are /screen, /ebook, /printer, /prepress, /default. (from the ghostscript package)
Convert a color PDF into grayscale: gs -sOutputFile=output.pdf -sDEVICE=pdfwrite -sColorConversionStrategy=Gray -dProcessColorModel=/DeviceGray -dAutoRotatePages=/None -dCompatibilityLevel=1.4 -dNOPAUSE -dBATCH input.pdf (from the ghostscript package)
Export bitmap images: pdfimages -j original.pdf extracted (from the xpdf package)
Convert into a bitmap image: convert original.pdf converted.png (from the imagemagick package)
Split into individual 1-page PDF files: pdftk original.pdf burst (from the pdftk package)
Merge two or more PDF files: pdftk original1.pdf original2.pdf cat output merged.pdf (from the pdftk package)
Delete page 13 from a PDF file: pdftk original.pdf cat 1-12 14-end output page13deleted.pdf (from the pdftk package>
Rotate page 5 of the PDF file 90 degrees counterclockwise: pdftk Figures_LRES.pdf cat 1-4 5L 6-end output Figures_LRES2.pdf (from the pdftk package>
Assemble a new PDF where each 4 pages from the source files are merged into one landscape page: pdfjam *.pdf –landscape –nup 2x2 For portrait orientation use the “–no-landscape” option (from the pdfjam package).
Underlay a PDF with another (background) PDF: pdftk foreground.pdf background background.pdf output overlay.pdf (from the pdftk package).
GUI PDF editors: I tried out PDFEdit , but it is too difficult for me. The Master PDF Editor" is not free, but it seems to be much more usable without extensive initialization of the user.
**Encrypt a PDF with both a owner password (to change the file) and a user password (to open the file): **pdftk input.pdf output encrypted.pdf owner_pw PROMPT user_pw PROMPT (from the pdftk package).
**If you need to do a text search through many PDF files in the current directory and all of its subdirectories, you can use pdfgrep : **pdfgrep -r searchterm * (from the pdfgrep package).
**Convert & merge all jpg files in the current directory into one PDF file:**convert *.jpg pictures.pdfIn the recent Ubuntu editions, this batch operation is not allowed due to security risks and you can disable this policy by renaming the configuration file:/etc/ImageMagick-6$ sudo mv policy.xml policy.xmlout

ps2pdf versus pstill and password protection of pdf documents

Wed, 23 May 2007 00:00:00 +0000

While reading about ps2pdf (which is just a commandline front-end to ghostscript), I realized that despite its simple appearance, ps2pdf has almost all capabilities of Acrobat 5. ps2pdf14 outputs Acrobat 5-compatible files. According to the documentation strong password protection should be possible, however, I never managed with that.In theory the following commands should work:-sOwnerPassword= and -sUserPassword=In order to set the key length to 128 you have to useps2pdf14 -dEncryptionR=3 -dKeylength=128Another thing that I don’t know how to handle easily with ps2pdf is the cropping of documents.For the password protection, a very good alternative seems to be PStill ( http://www.pstill.com/ ). The command:pstill -Muserpassword=testpassword testfile.psdoes the trick.

Removing PDF password protection

Thu, 05 Apr 2007 00:00:00 +0000

I recently bought a pdf book. It was password-protected (40bit security). Unfortunately some of the PDF viewers on Linux cannot open password-protected pdf files. So I decided that I can remove the password protection for private use.A quick lock at the web showed two very easy methods of password removal: