Bug 437926

Summary:	Non-ASCII characters in certificate names are not printed on a signed document
Product:	[Applications] okular	Reporter:	Johannes <johannes>
Component:	PDF backend	Assignee:	Okular developers <okular-devel>
Status:	RESOLVED NOT A BUG
Severity:	normal	CC:	aacid, oliver.sander
Priority:	NOR
Version First Reported In:	21.04.1
Target Milestone:	---
Platform:	Other
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:

Description Johannes 2021-05-31 22:04:57 UTC

SUMMARY

Non-ASCII characters in certificate names are removed from the string printed on the document which starts with "Signed by". I think the signing feature text should revert to the friendlyName property instead of just removing those characters from the name property.


STEPS TO REPRODUCE
0. Obtain a certificate with a special (= non-ASCII) character
1. Configure PDF backend to access NSS Certificate DB
2. Digitally sign a pdf


OBSERVED RESULT
Special characters are removed from the rendered text that reads:
Signed by: <name>


EXPECTED RESULT
Either the correct name should be rendered there or the friendlyName specified as part of the certificate.


SOFTWARE/OS VERSIONS
Linux/KDE Plasma:
(available in About System)
KDE Plasma Version: 5.21.5
KDE Frameworks Version: 5.82.0
Qt Version: 5.12.2

ADDITIONAL INFORMATION

Comment 1 Albert Astals Cid 2021-06-01 21:37:36 UTC

This isn't really an Okular issue but a poppler issue.

"Just" a bug that poppler doesn't know how to render some characters. It's not that those characters are unsupported by the PDF specification or anything so there's not much we can do in the Okular side.

Anyhow I have the feeling that the just released poppler 21.06.0 should fix your problem.

Do you have any way to try?

Comment 2 Johannes 2021-06-01 21:39:57 UTC

I cannot easily test it. But what about using friendlyName when defined? So the certificate owner could decide how to render their name only using ASCII letters.

Comment 3 Albert Astals Cid 2021-06-03 21:02:40 UTC

That would give you the hability to say your friendly name is "Albert Astals" and sign.

Yes, i know that is technically fine, since going to the signature details would still give your actual name, but that's a feature i would prefer not offering in Okular, technically correct doens't mean "somewhat confusing" or "intentionally ill formed" sometimes.

Comment 4 Johannes 2021-06-03 22:00:49 UTC

But it's also broken like it is because for a bigger part of the world population, the name will be printed incorrectly, think about François (Franois), Noël (Nol), Mátyás (Mtys), Þuríður (urur), and all names in non-latin scripts, which can perfectly be represented in Unicode and thus appear in certificates. For Ἑλένη, the printed text would only read "Signed by:". That's discriminating people by design. If there's no way to render the characters of the names that can appear in the certificates, an inclusive option would be to just print "digitally signed" or something alike.

Of course I would never set my friendlyName to "Albert Astals" :)

Comment 5 Albert Astals Cid 2021-06-04 21:24:24 UTC

> That's discriminating people by design.

No, that's a bug and needs to be fixed. I take offense in you saying we write discriminatory code by design. I will close this bug now.

Comment 6 Oliver Sander 2021-06-05 06:10:25 UTC

Let me ignore the whole "discrimination" and "offense" business.  Johannes, this is a Poppler bug and needs to be fixed there.  Johannes, can you reproduce the problem using the pdfsig problem (which is part of Poppler)?