[okular] [Bug 496490] New: Okular "corrupts" (QES-)signed documents

[MichaelOF]

https://bugs.kde.org/show_bug.cgi?id=496490

            Bug ID: 496490
           Summary: Okular "corrupts" (QES-)signed documents
    Classification: Applications
           Product: okular
           Version: 23.08.5
          Platform: openSUSE
                OS: Linux
            Status: REPORTED
          Severity: normal
          Priority: NOR
         Component: PDF backend
          Assignee: okular-devel at kde.org
          Reporter: michaelof at rocketmail.com
  Target Milestone: ---

(Correctly) QES-signed pdf files are shown as "changed after signature" when
opened in Okular. 
FYI: Adobe Acrobat Reader (rolling release, Win11) shows same files as
"signature valid/correct"
Seems to be specific for some pdf of unknown (technical) source

STEPS TO REPRODUCE
1. Took (source) pdf from https://hapkido-muyedo.de/Anmeldung.shtml, concretely
https://hapkido-muyedo.de/pdf/Aufnahmeantrag00.pdf
2. Filled, and signed with my "ID Austria" (Austrian eID) QES, via app
"PDF-Over" (https://github.com/a-sit/PDF-Over)
3. Opened signed doc in Okular 

OBSERVED RESULT
4. Okular says in header "doc is digitally signed, changes since last signing"
-> Which is WRONG
5. Tested also with pdf https://hapkido-muyedo.de/pdf/Satzung00.pdf, which is a
static pdf, no form data. Okluar also says "doc is digitally signed, changes
since last signing"
6. Tested also with a pdf from totally different source: cups-pdf print of an
email, signed, opened in Okular: Signature fine, no issue

Means IMHO, that buggy behaviour of Okular is related to these specific pdfs.,
Will try to find out with the creator what might be special, and add here
later, if meaningful.

EXPECTED RESULT
QES-signed pdf files MUST NOT be changed by Okular WITHOUT user interaction, in
any cases. 

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: OpenSUSE Leap 15.6, all current patches 
KDE Plasma Version: 5.27.11
KDE Frameworks Version: 5.115.0
Qt Version: 5.15.12

ADDITIONAL INFORMATION

It's a "speciality" that pdf files with form data could be changed after
signature anyway. But all pdf readers I'm aware are allowing this, but they
100% correctly shows the file as "changed" if changed, and "fine" if unchanged
or changes reverted. 

Discussed all of the above with the maintainer of PDF-Over here:
https://github.com/a-sit/PDF-Over/issues/128
He suspects a potential incorrect handling of "validation/auto-fill" rule by
Okular here:
https://github.com/a-sit/PDF-Over/issues/128#issuecomment-2485192603

Last Remark: If helpful, I of course could provide signed example pdfs if
needed/helpful. But as I'm using an "anonymous" login for all my publicly
visible internet activities, for good reasons, just attaching would NOT be an
appropriate way, as the QES of course identifies me. So maybe there are other
ways to share with you?

-- 
You are receiving this mail because:
You are the assignee for the bug.