Repository navigation
Digital Signature and Certificate verification - #21247
Merged
Merged
Conversation
Codecov Reportβ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #21247 +/- ##
==========================================
- Coverage 89.80% 89.40% -0.40%
==========================================
Files 261 262 +1
Lines 66346 66758 +412
==========================================
+ Hits 59581 59687 +106
- Misses 6765 7071 +306
Flags with carried forward coverage won't be shown. Click here to find out more. β View full report in Codecov by Harness. π New features to boost your workflow:
|
Contributor
They were consulted and they didn't agree with this approach (the main reason being what you said here), so it's not going to be enabled in Firefox but only in Enterprise Firefox. |
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
calixteman
reviewed
May 13, 2026
bcolsson
requested changes
Jun 15, 2026
Adds a new "Digital signature properties" doorhanger to the pdf.js toolbar that lists every digital signature found in the opened PDF, verifies each one (via NSS in the Firefox build through a new chrome bridge), and shows per-signature status + certificate state. The viewer side parses /Sig dicts in the worker (`PDFDocument.signatures`), strict-validates the /ByteRange offsets before slicing, and ships only signature metadata across the worker boundary. The PKCS#7 blob and signed-data byte spans live in a worker-side map and are fetched lazily one signature at a time via a new `getSignatureData(id)` RPC, immediately before verification runs, so the bytes never sit in main-thread memory for the document's lifetime. The panel is feature-gated by `pdfjs.enableSignatureVerification` (true in MOZCENTRAL/TESTING, off by default in the GENERIC build). External services expose a `createSignatureVerifier()` factory that the Firefox build wires up to `nsIX509CertDB.asyncVerifyPKCS7Object`; GENERIC builds return null and the toolbar button stays hidden. UI summary: - Toolbar button states: loading dots while in flight, then green check, orange `!`, or red `β` based on the worst aggregate signature status. - Doorhanger contains a banner summarising the document state, then one card per signature with status row + certificate row (sub- signatures nested under their outer revision via /ByteRange containment). - Icons are mono SVGs themed via `mask-image` + `background-color` so they pick up light/dark/HCM via `--sig-icon-*` vars; flipped under RTL via `scaleX(var(--dir-factor))`. The HCM mapping reuses the alt-text vocabulary (ButtonFace / ButtonText / ButtonBorder / GrayText / AccentColor / LinkText) so this panel reads the same as the rest of the editor toolbar in high-contrast mode. - All visible strings are localized via Fluent (`pdfjs-digital-signature-properties-*`); status row, banner, and certificate row use explicit lookup tables instead of generated ids so a grep finds them. - Esc + outside-click close the panel through the viewer's existing handlers; the manager exposes `isOpen`, `close()`, and `shouldCloseOnClick(target)` for that. This commit also adds a `test/pdfs/sig_corpus/` directory holding a Python generator that produces a corpus of signed PDFs covering every visible state of the doorhanger (verified / untrusted / expired / invalid / unknown / multi-signature variants). The corpus is intentionally NOT part of the automated test suite β it is a manual-test tool. Generated `.pdf` files are gitignored; only the generator, README, and a `user.js.example` snippet are tracked. The generator shells out to mozilla-central's `security/manager/tools/pycms.py` (resolved via `--mozilla-central <path>` or the `MOZILLA_CENTRAL_SRC` env var) and the embedded test trust anchors (`pdf-sign-ca` / `pdf-sign-ca-expired`), gated by `security.pdf_signature_verification.enable_test_trust_anchors` so the test certificates never validate in shipping Firefox.
This was referenced Jul 4, 2026
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an initial version of the feature off-by-default. A follow-up with a comprehensive treatment of the certificate revocation mechanisms should happen before this can be enabled by default.