Digitally signing PDF documents in Linux: with hardware token & Okular

We are living in 2022. And it is now possible to digitally sign a PDF document using libre software. This is a love letter to libre software projects, and also a manual.

For a long time, one of the challenges in using libre software in ‘enterprise’ environments or working with Government documents is that one will eventually be forced to use a proprietary software that isn’t even available for a libre platform like GNU/Linux. A notorious use-case is digitally signing PDF documents.

Recently, Poppler (the free software library for rendering PDF; used by Evince and Okular) and Okular in particular has gained a lot of improvements in displaying digital signature and actually signing a PDF document digitally (see this, this, this, this, this and this). When the main developer Albert asked for feedback on what important functionality would the community like to see incorporated as part this effort; I had asked if it would be possible to use hardware tokens for digital signature. Turns out, poppler uses nss (Network Security Services, a Mozilla project) for managing the certificates, and if the token is enrolled in NSS database, Okular should be able to just use it.

This blog post written a couple of years ago about using hardware token in GNU/Linux is still actively referred by many users. Trying to make the hardware token work with Okular gave me some more insights. With all the other prerequisites (token driver installation etc.) in place, follow these steps to get everything working nicely.

Howto

  1. There are 2 options to manage NSSDB: (i) manually by setting up $HOME/.pki/nssdb, or (ii) use the one automatically created by Firefox if you already use it. Assuming the latter, the nssdb would be located in the default profile directory $HOME/.mozilla/firefox/<random.dirname>/ (check for existence of the file pkcs11.txt in that directory to be sure).
  2. Open Okular and go to SettingsConfigure backendPDF and choose/set the correct certificate database path, if not already set by default.
Fig. 1: Okular PDF certificate database configuration.
  1. Start the smart card service (usually auto-started, you won’t have to do this): either pcsc_wd.service (for WatchData keys) or pcscd.service.
  2. Plug in the hardware token.
  3. Open a PDF in Okular. Add digitial signature using menu ToolsDigitally Sign
  4. This should prompt for the hardware token password.
Fig. 2: Digital token password prompt when adding digital sign in the PDF document.
  1. Click & drag a square area where you need to place the signature and choose the certificate. Note that, since Poppler 22.03, it is also possible to insert signature in a designated field.
Fig. 3: Add digital signature by drawing a rectangle.
  1. Signature will be placed on a new PDF file (with suffix -signed) and it will open automatically.
Fig. 4: Digitally signed document.
  1. You can also see the details of the hardware token in PDF backend settings.
Fig. 5: Signature present in hardware token visible on the PDF backend settings.

Thanks to the free software projects & developers who made this possible.

Okular 20.08 — redesigned annotation tools

Last year I wrote about some enhancements made to Okular’s annotation tool and in one of those, Simone Gaiarin commented that he was working on redesigning the Annotation toolbar altogether. I was quite interested and was also thinking of ‘modernizing’ the tool — only, I had no idea how much work it would be.

The existing annotation tool works, but it had some quirks and had many advanced options which were documented pretty well in the Handbook but not obvious to an unscrupulous user. For instance, if the user would like to highlight some part of the text, she selects (single-clicks) the highlighter tool, applies it to a block of text. When another part of text is to be highlighted, you’d expect the highlighter tool to apply directly; but it didn’t ‘stick’ — tool was unselected after highlighting the first block of text. There is an easy way to make the annotation tool ‘stick’ — instead of single-click to select the tool, simply double-click, and it persists. Another instance is the ‘Strikeout’ annotation which is not displayed by default, but can be added to the tools list.

Simone, with lots of inputs, testing and reviews from David Hurka, Nate Graham and Albert Astals Cid et al., has pulled off a magnificent rewrite of Okular’s annotation toolbar. To get an idea of the amount of work went into this, see this phabricator task and this invent code review. The result of many months of hardwork is a truly modern, easy to explore-and-use annotation support. I am not aware of any other libre PDF reader with such good annotation features.

Annotation toolbar in Okular 20.08.

Starting from the left, default tools are: Highlight (brush icon), Underline (straight line) and Squiggle (wobbly line), Strike out, Insert text (Typewriter), Inline note, Popup note, Freehand drawing and Shapes (arrows, lines, rectangles etc.). The line thickness, colour, opacity and font of the tools can be customized easily from the drawer. Oh, and the selected annotation tool ‘sticks’ by default (see the ‘pin’ icon at the right end of toolbar).

When upgrading to okular-20.08 from a previous version, it will preserve the customized annotation tools created by the user and make those available under ‘Quick annotations’, and these can be quickly applied using Alt+n (Alt-1, Alt-2 etc.) short cuts. It did reset my custom shortcuts keys for navigation (I use Vim keys gg to go to the first page and G to go to the last page), which can be manually added back.

Custom tools (Quick annotations) can be applied with short cuts.

Here is the new toolbar in action.

Complex text shaping fixed in Konsole 20.08

Konsole was one of the few terminal emulators with proper complex text shaping support. Unfortunately, complex text (including Malayalam) shaping was broken around KDE Applications release 18.08 (see upstream bug 401094 for details).

Broken Malayalam text shaping in Konsole 20.04

Mariusz Glebocki fixed the code in January this year which I tested to work correctly. There’s a minor issue of glyphs with deep vertical components being cut-off (notice rendering of “സ്കൂ”), but otherwise the shaping and rendering is good. The patches are also merged upstream and will be part of the KDE Applications Bundle 20.08.

Proper Malayalam text shaping in Konsole 20.04 with shaping fixes.

If you don’t want to wait that long, I have made a 20.04 release with the fixes on top available for Fedora 31 & 32 in this COPR.