pdfreader | An experimental PDF reader for go

Your code mutilates the pdf from the database and throws away everything except static page content of the last page. That in particular discards the signature.

If you actually merely want to allow users to download any pdf files from database, you can simply directly respond the PDF bytes you get by base64 decoding the string from the database.

That should be something like this:

Indeed, in my original answer I used the wrong showTextAligned overload which drew on the last page, not the first. As I tested with a single-page document that didn't show.

In general you have to replace

Is this a bug?

No. It's matching your code and a feature of the PdfCanvas(PdfPage page) constructor.

Each PDF content stream contains a sequence of instructions that change the current graphics state and/or draw something. If the original creator of the respective content stream did not take care to clean up the graphics state, instructions you add to it or to a following content stream of the same page are subject to those graphics state changes.

In your case the original page content stream apparently at the end has a graphics state with the current transformation matrix set to a reflection. Depending on how you add your new content, your additions also are subject to that reflection transformation:

The problem was that EmptyContainer.sign method just gives out PDF bytes and not the authenticated attributes. The authenticated attributes are actually which needs to be signed. Thanks mkl for pointing in the right direction.

I modified EmptyContainer.sign method to create a PdfPKCS7 object and call PdfPKCS7.getAuthenticatedAttributeBytes with PDF hash as one of the arguments.

After signing the bytes returned by getAuthenticatedAttributeBytes() method and creating CMS container of the signed bytes and the original hash, I was able to successfully sign the PDF.

Here is the code if someone needs it. It is cluttered all over but you will get the essence.

In your architecture you have a ByteArrayOutputStream parameter in which you retrieve the pdf to LTV-enable and in which you also in the end return the LTV-enabled result pdf.

In such an architecture have to clear the ByteArrayOutputStream between retrieving the original content from it and adding the new content to it.

In your case, therefore, you have to clear it between

When calculating the hash of the to-be-signed attributes, you use the then current time as value of the signing time attribute:

The visual appearance of a button in PDF can be fully customized, with text, graphics and images. So, the image data could be stored in a slightly different way in different PDF documents. But generally speaking, the form field's widget annotation will have an appearance stream, which will have the image data as an XObject in its Resources dictionary.

Creating a PDF with a button with image for testing:

You can add the Javascript snippet as a document level OpenAction, to be executed when the document is opened:

Unrelated to the issue of getting null, but doc.getXmpMetadata() returns a byte array. So you will not be able to print its content with