Bug 473415

Summary: Cannot see any signature information for a signed PDF
Product: [Applications] okular Reporter: Hugo Osvaldo Barrera <hugo>
Component: PDF backendAssignee: Okular developers <okular-devel>
Status: RESOLVED DOWNSTREAM    
Severity: normal CC: aacid, kde
Priority: NOR    
Version First Reported In: 23.04.3   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:
Attachments: PDF mentioned in the issue description
Screenshot of Okular

Description Hugo Osvaldo Barrera 2023-08-15 13:04:32 UTC
Created attachment 160980 [details]
PDF mentioned in the issue description

SUMMARY

I have received a signed PDF document. This document is signed with a certificate that is signed by a CA operate by the Argentinian government (and is not bundled by default on any distribution or browser).
When I open the PDF on Okular, it merely states "Some of the signatures could not be validated properly". 

The reason that I am opening the file with Okular is to check the signature, but no details are shown anywhere. E.g.: Okular validates the signature for me, but won't display it, nor the certificate associated with it, nor any information related to it. The main issue here is that the "View certificate" button is disabled, but there is no indication why (am I missing an optional dependency?).

The only output that okular is providing is unrelated:

> okular Afirmar_signed.pdf 
kf.windowsystem: Could not find any platform plugin
QWidget::setMinimumSize: (okular_sidebar/Sidebar) Negative sizes (0,-1) are not possible
qt.qpa.wayland: setGrabPopup called with a parent, QtWaylandClient::QWaylandXdgSurface(0x7fdc917f5670) which does not match the current topmost grabbing popup, QtWaylandClient::QWaylandXdgSurface(0x7fdc82abea90) According to the xdg-shell protocol, this is not allowed. The wayland QPA plugin is currently handling it by setting the parent to the topmost grabbing popup. Note, however, that this may cause positioning errors and popups closing unxpectedly because xdg-shell mandate that child popups close before parents

OBSERVED RESULT

No details on the PDF's signature are visible. No details on the certificate that signed it are visible.

EXPECTED RESULT

I should be able to see the PDF and details on its signature.

SOFTWARE/OS VERSIONS
Windows: no
macOS: no
Linux/KDE Plasma: no
KDE Plasma Version: no
KDE Frameworks Version: no
Qt Version: qt5-qtbase-5.15.10

I'm using okular 23.04.3 on Alpine-Edge.

Originally reported at: https://invent.kde.org/graphics/okular/-/issues/82
Comment 1 Hugo Osvaldo Barrera 2023-08-15 13:05:06 UTC
Created attachment 160981 [details]
Screenshot of Okular
Comment 2 Sune Vuorela 2023-08-15 13:13:10 UTC
Can you provide a file showing this?
Comment 3 Hugo Osvaldo Barrera 2023-08-15 13:39:22 UTC
The PDF is already attached to this issue. See https://bugs.kde.org/attachment.cgi?id=160980
Comment 4 Albert Astals Cid 2023-08-15 21:24:21 UTC
Works here. Which poppler version are you using?

Oh wait according to https://build.alpinelinux.org/buildlogs/build-edge-x86_64/main/poppler/poppler-23.07.0-r0.log Alpine doesn't seem to be building the NSS code in poppler. So yeah obviously you don't have signature support. Tell them to fix it.
Comment 5 Hugo Osvaldo Barrera 2023-08-15 23:16:49 UTC
Thanks for narrowing that down for me. I've rebuilt poppler with nss support (and then rebuilt okular) and not it works.

I've sent an MR adding nss-dev as a build dependency: https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/50095