[Bug]: indicate modifications after digital signature

Attach (recommended) or Link to PDF file

• signed.pdf: signed PDF document with testing certificate.

• modified-signed.pdf: modified PDF document after signature.

Web browser and its version

Firefox Nigthly 155a

Operating system and its version

Windows 11

PDF.js version

the one that comes with that nightly.

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

1. Digitally sign a document with a testing certificate ( signed.pdf was signed with pdfsig from poppler).[^pdfsig]

   Digital signature is considered valid (as verified).

   

2. Modify the text field with Acrobat Reader and save the results (modifications are saved as incremental updates).

   Digital signature is considered valid, with no further indication that the document has been modified after the signature:

   

[^pdfsig]: pdfsig always signs PDF documents adding an incremental update (this is why modified-signed.pdf contains three %%EOF strings).

What is the expected behavior?

Signature verification should indicate that the document contains unsigned modifications.

This is essential with fill-in forms, since giving no indication that the document has been modified after being digitally signed may be give the misleading information that the modifications have been accepted by the original signer.

What went wrong?

Valid signature with an added incremental update neither renders the signature invalid or

Compare the original signature info (using pdfsig from poppler-26.08.0):

$ pdfcurrentsig signed.pdf 
Digital Signature Info of: signed.pdf
Signature #1:
  - Signature Field Name: x
  - Signer Certificate Common Name: Testing Certificate [RSA 4096])
  - Signer full Distinguished Name: CN=Testing Certificate [RSA 4096])
  - Signing Time: Aug 03 2026 13:37:10
  - Signing Hash Algorithm: SHA-256
  - Signature Type: adbe.pkcs7.detached
  - Signed Ranges: [0 - 5646], [25648 - 25993]
  - Total document signed
  - Signature Validation: Signature is Valid.
  - Certificate Validation: Unknown issue with Certificate or corrupted data.

With the modified document after the signature:

$ pdfcurrentsig modified-signed.pdf
Digital Signature Info of: modified-signed.pdf
Signature #1:
  - Signature Field Name: x
  - Signer Certificate Common Name: Testing Certificate [RSA 4096])
  - Signer full Distinguished Name: CN=Testing Certificate [RSA 4096])
  - Signing Time: Aug 03 2026 13:37:10
  - Signing Hash Algorithm: SHA-256
  - Signature Type: adbe.pkcs7.detached
  - Signed Ranges: [0 - 5646], [25648 - 25993]
  - Not total document signed
  - Signature Validation: Signature is Valid.
  - Certificate Validation: Unknown issue with Certificate or corrupted data.

Link to a viewer

No response

Additional context

If electronic signatures are legally valid in EU/EEA Member States (article 25.2 of Regulation EU/910/2014), it is essential to know whether an electronically signed PDF document has been modified after being signed: signed contents are legally binding, but modifications after signing are ways to forge electronic documents and forgeries aren’t legally binding (when properly detected).

Again, first of all, users should be given hints that signed documents have been modified after being signed.

@beurdouche, congratulations for the implementation and many thanks for your excellent work.

Start by comparing the attached signed.pdf and modified-signed.pdf through PDF.js's digital-signature verification entry point, using the pdfsig output to understand the signed ranges and the added incremental update. Done means the modified document clearly indicates unsigned post-signature changes while the original signed document remains valid.