recon_gen.common.pdf.signing

PDF digital-signing helper backed by pyHanko (U.7.b).

Single entry point: sign_pdf_in_place(pdf_path, signing_config). Rewrites the PDF with an incremental update carrying a CMS signature over the entire byte range. Subsequent signers can add their own signatures on top via Adobe / pyHanko / any compliant tool — the generator is deliberately silent on how many signatures are required.

pyHanko is an optional runtime dep (only needed when an integrator sets signing: in config.yaml); imports happen inside the function so the audit CLI loads cleanly without it.

Functions

sign_pdf_in_place(pdf_path, signing)

Apply a CMS digital signature to pdf_path (incremental update).
recon_gen.common.pdf.signing.sign_pdf_in_place(pdf_path, signing)[source]

Apply a CMS digital signature to pdf_path (incremental update).

Loads the PEM RSA private key + PEM cert, opens the PDF for incremental writing, signs it via pyHanko, and replaces the file bytes with the signed result. Field name is fixed (QSGSystemSignature) so the system signature is identifiable by tools that inspect signature widgets — but that’s a system concern, not a “signer 1 of N” claim; the document doesn’t advertise how many signatures are expected.

Raises FileNotFoundError if key or cert file is missing, ValueError if the passphrase env var is named but unset.

Return type:

None

Parameters: