[Bug]: edited PDF document still contains signature information

Attach (recommended) or Link to PDF file

BOE-A-2026-16756.pdf

Web browser and its version

Firefox 153.0

Operating system and its version

Fedora 43

PDF.js version

PDF.js: 6.0.346 [e75a7cfd6]

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

1. Open BOE-A-2026-16756.pdf.

2. Export the first page only, such as in:

   

3. Digital signature information is still present in the output document (first_page-broken-signature.pdf):

   $ pdfcurrentsig first_page-broken-signature.pdf 
   Digital Signature Info of: first_page-broken-signature.pdf
   Internal Error (0): Input couldn't be parsed as a CMS signature
   Syntax Error (0): Illegal values in ByteRange array
   Signature #1:
     - Signature Field Name: Signature1
     - Signer Certificate Common Name: 
     - Signer full Distinguished Name: 
     - Signing Time: Jul 31 2026 19:15:48
     - Signing Hash Algorithm: unknown
     - Signature Type: adbe.pkcs7.sha1
     - Signed Ranges: [0 - 982], [30020 - 227572]
     - Not total document signed
     - Signature Validation: Signature has not yet been verified.
   

What is the expected behavior?

The source document (BOE-A-2026-16756.pdf) is digitally signed:

$ pdfcurrentsig BOE-A-2026-16756.pdf 
Digital Signature Info of: BOE-A-2026-16756.pdf
Internal Error (0): Input couldn't be parsed as a CMS signature
Signature #1:
  - Signature Field Name: Signature1
  - Signer Certificate Common Name: 
  - Signer full Distinguished Name: 
  - Signing Time: Jul 31 2026 19:15:48
  - Signing Hash Algorithm: unknown
  - Signature Type: adbe.pkcs7.sha1
  - Signed Ranges: [0 - 982], [30020 - 227572]
  - Total document signed
  - Signature Validation: Unknown Validation Failure.

The signature validation error is caused by using the deprecated SHA1 algorithm, that Fedora 43 doesn’t accept for security reasons.

What went wrong?

Both /FT /Sig and /Type /Sig objects should be removed from the edited output.

Just for reference, these are the ones from an uncompressed version of first_page-broken-signature.pdf read:

28 0 obj
<<
  /P 4 0 R
  /Subtype /Widget
  /StructParent 1
  /T (Signature1)
  /V 29 0 R
  /F 132
  /Type /Annot
  /FT /Sig
  /DR <<
  >>
  /Rect [ 0 0 0 0 ]
  /AP <<
    /N 30 0 R
  >>
>>
endobj

29 0 obj
<<
  /Contents <[...]>
  /Filter /Adobe.PPKMS
  /Type /Sig
  /ByteRange [ 0 982 30020 197552 ]
  /SubFilter /adbe.pkcs7.sha1
  /Reason ()
  /Location ()
  /ContactInfo ()
  /M (D:20260731191548+02'00')
>>
endobj

Link to a viewer

No response

Additional context

There seem to be no option to export pages from https://www.svenskforfattningssamling.se/sites/default/files/sfs/2026-07/SFS2026-1523.pdf.

Being its first signature:

$ pdfcurrentsig SFS2026-1523.pdf 
Digital Signature Info of: SFS2026-1523.pdf
Signature #1:
  - Signature Field Name: Signature1
  - Signer Certificate Common Name: Utgivare av SFS
  - Signer full Distinguished Name: E=sfs@regeringskansliet.se,CN=Utgivare av SFS,O=Regeringskansliet,serialNumber=AATL20230905313184,L=Stockholm,ST=Stockholm,C=SE
  - Signing Time: Jul 23 2026 13:43:16
  - Signing Hash Algorithm: SHA-256
  - Signature Type: ETSI.CAdES.detached
  - Signed Ranges: [0 - 166], [82088 - 313371]
  - Not total document signed
  - Signature Validation: Signature is Valid.
  - Certificate Validation: Unknown issue with Certificate or corrupted data.

I wonder whether /ETSI.CAdES.detached is preventing the editing of this signed PDF document.

Many thanks for your help.

Reproduce the export using BOE-A-2026-16756.pdf and compare the result with first_page-broken-signature.pdf, including the shown signature objects. Start by tracing PDF.js's page-export path and inspect how /FT /Sig and /Type /Sig are preserved. Done means the exported pages no longer contain the signature information while the page content remains intact.