Bug 504853

Summary: Endless loop asking for a certificate password when signing a document
Product: [Applications] okular Reporter: bugs.kde.org.ripening956
Component: PDF backendAssignee: Okular developers <okular-devel>
Status: CONFIRMED ---    
Severity: normal CC: kde, kde, richard.palo
Priority: NOR    
Version First Reported In: 25.04.1   
Target Milestone: ---   
Platform: Manjaro   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description bugs.kde.org.ripening956 2025-05-27 10:41:09 UTC 
SUMMARY
The signing dialog that is accessible from "Tools>Digitally Sign..." repeatedly asks for a certificate password even though the certificate doesn't have any, and the user enters nothing.

STEPS TO REPRODUCE
1. Open a PDF
2. Select "Tools>Digitally Sign..."
3. Click "OK"

OBSERVED RESULT
The application goes into an endless loop asking for a certificate password

EXPECTED RESULT
Since no certificate is selected, either disable the "OK" button or select the first certificate at dialog init.

SOFTWARE/OS VERSIONS
Okular: 25.04.1
KDE Frameworks: 6.14.0
Qt: Using 6.9.0 and built against 6.9.0
Manjaro Linux (Xcb)
Build ABI: x86_64-little_endian-lp64
Kernel: linux 6.12.28-1-MANJARO


ADDITIONAL INFORMATION
The bug is not present if one selects a certificate from the list, in my case the certificate I have in the NSS database.
This is the location of the loop: https://github.com/KDE/okular/blob/b1d97424246e43a230a2875458eab28231028abc/part/signaturepartutils.cpp#L223
Comment 1 bugs.kde.org.ripening956 2025-05-27 10:42:33 UTC 
Similar to #486680 but in a newer version of Okular that should have presumably fixed it
Comment 2 Sune Vuorela 2025-05-27 12:19:24 UTC 
Are you saying it is a exact replica of the other bug you mentioned? That if you select first, then it works as expected?
Comment 3 bugs.kde.org.ripening956 2025-05-27 12:25:50 UTC 
(In reply to Sune Vuorela from comment #2)
> Are you saying it is a exact replica of the other bug you mentioned? That if
> you select first, then it works as expected?

I would not say so.
The steps to reproduce and observations do match.
The setup varies: The other bug is about okular deployed with Flatpak, in my setup it's through Archlinux pacman.
Comment 4 bugs.kde.org.ripening956 2025-05-27 12:26:45 UTC 
(In reply to Sune Vuorela from comment #2)
> That if you select first, then it works as expected?
This is correct
Comment 5 Sune Vuorela 2025-05-27 18:30:18 UTC 
If I can give you a couple of pointers, would you be willing to give it a go in trying to fix it ?

I'm 95% certain that the selection that is supposed to happen here:
https://invent.kde.org/graphics/okular/-/blob/master/part/signaturepartutils.cpp?ref_type=heads#L81

somehow leads to reading it back here:
https://invent.kde.org/graphics/okular/-/blob/master/part/signaturepartutils.cpp?ref_type=heads#L207 fails
Comment 6 bugs.kde.org.ripening956 2025-05-28 05:56:53 UTC 
(In reply to Sune Vuorela from comment #5)
> If I can give you a couple of pointers, would you be willing to give it a go
> in trying to fix it ?

sure, let's try
Comment 7 Jasper-Ben 2025-05-28 14:25:34 UTC 
Quick drive-by comment: The last working version is 24.12.3. 25.04.0 shows the same erroneous behaviour.
Comment 8 Richard PALO 2025-08-20 13:58:37 UTC 
I suffered this too, and by chance came to a post somewhere mentioning to check $ cat ~/.pki/nssdb/pkcs11.txt 
there, I got rid of the *onepin* entry and magically this started acting normal again.
(naturally, this presumes you're using nss)