使用Digitoruspdfsign在GO(Golang)中签署pdf文件

使用数字签名对PDF进行签名包括使用公钥加密来生成一对密钥.私钥被用来加密与签名相关的数据，并且只有签名者才能访问它，以及用于解密签名数据以用于验证目的的公钥，如果不是由可信的证书颁发机构发布的，则所述公钥证书必须被添加到证书存储中以使其可信. 在给定的示例中，签名数据存储在一个名为sign.SignData的 struct 中，该 struct 是pdfsign库的一部分，需要一个x509证书和一个实现加密.Signer接口的签名者.

The first step是使用GO标准库中的加密/ECDSA包来生成一对密钥.GenerateKey会将私钥和公钥保存到Private Key变量中.这个返回的PriateKey变量实现了加密的.Signer接口，这是解决您当前面临的问题所必需的.

您可以通过阅读ecdsa.go代码第142行来判断这一点.

• https://github.com/golang/go/blob/master/src/crypto/ecdsa/ecdsa.go个

您当前使用的是gopkcs12.DecodeChain，它返回私钥，但它没有实现加密.Signer接口，因此出现错误.您可能需要实现一个定制的，但这是另一个问题.

概念:

ECDSA代表椭圆曲线数字签名算法.它是一种用于数字签名的公钥加密算法.有关更多信息，请参考GO标准库文档和NIST网站.

• https://pkg.go.dev/crypto/ecdsa@go1.21.4个
• https://csrc.nist.gov/glossary/term/ecdsa个

NIST P-384:P-384是美国国家标准与技术研究所(NIST)推荐的椭圆曲线之一，密钥长度为384位.有关数字签名和更多推荐的椭圆曲线的更多信息，请参考NIST网站.我用P-384作为工作液.

• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
• https://csrc.nist.gov/projects/elliptic-curve-cryptography
• https://csrc.nist.gov/pubs/fips/186-4/fina个

The second step将使用GO标准库中的CRYPTO/X509包来生成一个x509证书和一个带有它的链构建器的证书链.这些是您在问题中请求帮助的特定变量，您可以在错误消息中清楚地看到它们不是预期的类型.只需遵循lib指令并使用x509.Cerficate.Verify()，就像我在工作解决方案中所做的那样，这将为您返回正确的类型[][]*x509证书.

有关更多信息，请参考GO标准库文档.

• https://pkg.go.dev/crypto/x509#Certificate.Verify
• https://golang.google.cn/pkg/crypto/x509/个
• https://pkg.go.dev/crypto/x509#Certificate个

The third step将打开输入pdf文件，并使用GO标准库中的os包创建输出pdf文件.

The fourth step实际上是使用Digitorus/pdfsign库对pdf文件进行签名.

这是我今天编码和测试的有效解决方案，目的是让您重回正轨，进行一些研究并根据您的需求进行修改:

package main

import (
    "crypto"
    "crypto/ecdsa"
    "crypto/elliptic"
    "crypto/rand"
    "crypto/x509"
    "crypto/x509/pkix"
    "fmt"
    "github.com/digitorus/pdf"
    "github.com/digitorus/pdfsign/revocation"
    "github.com/digitorus/pdfsign/sign"
    "log"
    "math/big"
    "os"
    "time"
)

func main() {
    // First step

    privateKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)

    if err != nil {
        panic(err)
    }

    // Second step

    x509RootCertificate := &x509.Certificate{
        SerialNumber: big.NewInt(2023),
        Subject: pkix.Name{
            Organization:  []string{"Your Organization"},
            Country:       []string{"Your Country"},
            Province:      []string{"Your Province"},
            Locality:      []string{"Your Locality"},
            StreetAddress: []string{"Your Street Address"},
            PostalCode:    []string{"Your Postal Code"},
        },
        NotBefore:             time.Now(),
        NotAfter:              time.Now().AddDate(10, 0, 0),
        IsCA:                  true,
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
        KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
        BasicConstraintsValid: true,
    }

    rootCertificateBytes, err := x509.CreateCertificate(rand.Reader, x509RootCertificate, x509RootCertificate, &privateKey.PublicKey, privateKey)

    if err != nil {
        panic(err)
    }

    rootCertificate, err := x509.ParseCertificate(rootCertificateBytes)

    if err != nil {
        panic(err)
    }

    roots := x509.NewCertPool()

    roots.AddCert(rootCertificate)

    certificateChain, err := rootCertificate.Verify(x509.VerifyOptions{
        Roots: roots,
    })

    if err != nil {
        panic(err)
    }

    // Third step

    outputFile, err := os.Create("output.pdf")

    if err != nil {
        panic(err)
    }

    defer func(outputFile *os.File) {
        err = outputFile.Close()

        if err != nil {
            log.Println(err)
        }

        fmt.Println("output file closed")
    }(outputFile)

    inputFile, err := os.Open("input.pdf")

    if err != nil {
        panic(err)
    }

    defer func(inputFile *os.File) {
        err = inputFile.Close()

        if err != nil {
            log.Println(err)
        }

        fmt.Println("input file closed")
    }(inputFile)

    fileInfo, err := inputFile.Stat()

    if err != nil {
        panic(err)
    }

    size := fileInfo.Size()

    pdfReader, err := pdf.NewReader(inputFile, size)

    if err != nil {
        panic(err)
    }

    // Fourth step

    err = sign.Sign(inputFile, outputFile, pdfReader, size, sign.SignData{
        Signature: sign.SignDataSignature{
            Info: sign.SignDataSignatureInfo{
                Name:        "Your name",
                Location:    "Your location",
                Reason:      "Your reason",
                ContactInfo: "Your contact info",
                Date:        time.Now().Local(),
            },
            CertType:   sign.CertificationSignature,
            DocMDPPerm: sign.AllowFillingExistingFormFieldsAndSignaturesPerms,
        },
        Signer:            privateKey,       // crypto.Signer
        Digest算法rithm:   crypto.SHA256,    // hash algorithm for the digest creation
        Certificate:       rootCertificate,  // x509.Certificate
        CertificateChains: certificateChain, // x509.Certificate.Verify()
        TSA: sign.TSA{
            URL:      "",
            Username: "",
            Password: "",
        },

        // The follow options are likely to change in a future release
        //
        // cache revocation data when bulk signing
        RevocationData: revocation.InfoArchival{},
        // custom revocation lookup
        RevocationFunction: sign.DefaultEmbedRevocationStatusFunction,
    })

    if err != nil {
        log.Println(err)
    } else {
        log.Println("pdf signed")
    }
}

结果:

go run main.go

2023/12/01 21:53:37 pdf signed
input file closed
output file closed