A timestamp counted as trusted time whenever its signer's certificate
chained to a trusted certificate, whatever the certificate was issued
for. Any key from a trusted CA could then vouch for an arbitrary time.
Trusted time, for a document timestamp and for a signature's embedded
one, now also needs a certificate whose extended key usage includes
timeStamping, whose key usage allows signing, and which has no critical
extension PdfCraft doesn't process (RFC 3161 §2.3). The test timestamp
authority gets such a certificate.
Chain building accepted an intermediate CA without looking at its critical
extensions, which were checked only on the signer's certificate. A
subordinate CA limited by critical name constraints could vouch for a
signer outside its namespace, because PdfCraft does not enforce those
constraints. A CA certificate (other than a self-signed root, whose
limits are the trust store's business) with a critical extension
PdfCraft doesn't process is refused as an issuer, and the reason is
reported.
Revision checks compared objects only. A later revision that pointed the
trailer at another catalog already present in the signed file changed no
object, so the signature stayed valid while the reader showed a different
document. A /Root that differs from the signed revision's is now a
disallowed change to the document structure.
An OCSP response's signer counted as the issuer itself whenever its
certificate carried the issuer's subject name. A response naming its
responder by key hash could embed a certificate for any key with the
issuer's name copied in, skip the delegation checks, and mark a valid
certificate revoked. Whether the responder is the issuer now follows from
how it was selected (the issuer's own name or key hash); every embedded
certificate must be signed by the issuer and carry the OCSP-signing
purpose.
The example passed a constant seed to set_encryption. AES-256 derives the
file key from the seed alone, so anyone could rebuild the key and read a
file it protected without either password. The seed now comes from the
operating system's randomness through RandomState, as in the engine.
The qpdf oracle test wrote into temp_dir()/pdfcraft-enc-<pid>, reusing the
directory if it existed and following any symlink inside it, so another
local account could prepare it and have the test overwrite a file of the
developer's. The directory now has an unpredictable name, is created by
the test (mode 0700 on Unix) and the files are created new.
A stream that named its own crypt filter (/Filter /Crypt with
/DecodeParms /Name) kept that name when the document was given new
password protection. The new /Encrypt defines only /StdCF, so the
inherited name resolved to /Identity and the stream was written in
clear into a file the user asked to protect. When saving with protection
applied by set_encryption, a selector the new handler does not define is
removed with its parameters and the stream follows the new policy.
Saving with the original handler keeps the source's selectors.
Saving with encryption left a dictionary's /Contents in clear whenever it
had a string /Contents and an array /ByteRange, whatever else it was. A
source file could add a /ByteRange to an ordinary annotation and its
comment text was then written unencrypted. A dictionary with a /Subtype or
a /Type other than Sig or DocTimeStamp is never a signature dictionary, so
its /Contents is encrypted like any other string.
The tab caches the audit per document and edit generation. Pin both
halves: frames with the file unchanged keep the same rows, and an edit
made while the tab is open (a new bookmark) shows up on the next frame.
With the cache keyed on the document alone, the test fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Extract pages only took the selected pages. Its dialog now has a Pages
field for ranges such as "1-5, 8, 11-13", read like Combine files' and
Print's ranges, in the order typed and each page once. Left empty (as
the dialog opens), it takes the selection as before, shown as the hint.
A range it can't use says why and turns Extract off; Extract and delete
removes the typed pages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflict in parity/acrobat-features.toml: main moved the integration
tests into tests/it/, so the evidence paths take main's side and this
branch's two dialog_chrome tests are added on the new paths; the notes
keep this branch's wording. The custom-properties entry is now partial
through the tools, but the dialog still has no Custom tab, so the
"No Custom tab" note stays true.
Also fixes a break the merge could not show as a conflict: the cursor
test's form.pdf fixture is ../data/form.pdf from tests/it/.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ratio_text is derived from the scale fields (one function, sync_ratio_text):
on page seeding and after a hand edit of drawing points, real distance, unit
or page unit it shows the matching 1:N, or is emptied when the fields are not
a plain m/mm drawing scale. The "Common scales" highlight follows it.
- format_ratio no longer rounds (1:1.234, 1:0.001), so the field shows exactly
the ratio that applies.
- The smallest accepted ratio is 1:0.001, keeping the real distance within the
minimum of its field; set_ratio refuses out-of-range ratios too.
- "Scale", "Common scales", "Enter a scale such as 1:50." and a hint that
applying a scale switches units to m / mm are in every i18n catalog, with a
completeness test.
Co-Authored-By: Claude <noreply@anthropic.com>
The click-cycle test assumed a fresh install starts Light; it starts on
System now, so the cycle is System, Light, Dark.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The theme preference defaults to System: dark on a dark desktop, light
where the desktop says nothing. Saved settings and --theme still win.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The ArtCraft community card on Home gets a close button. Closing it hides
the card until the next launch; the choice is deliberately not remembered,
and the same links stay in the top bar's Discord button and the Help menu.
A UI regression covers closing and the fresh-launch default.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With no document open the expanded view covers Home itself, so the control
option `home` changed no tab and the view stayed up (CodeRabbit's remaining
merge-risk note on 8a8bb92d). The option now puts the view away itself.
`going_home_with_no_document_puts_the_expanded_all_tools_away` was seen to
fail with the fix reverted.
Also doc comments on the view's `show` and `tile` and the sidebar's
`all_tools`, for CodeRabbit's docstring-coverage check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Build each crate's integration tests as one binary
Every tests/*.rs file is its own executable that links the whole crate
graph. Move each crate's test files into tests/it/ as modules of one
tests/it/main.rs, for apps/pdfcraft, apps/pdfcraft-cli, automation, cos,
crypt, engine, render, sign and ui-egui. ui-egui's ui_group binary and
the support modules move into tests/it/ too. Crates with a single test
file keep it. The test executables go from 150 to 52, and every crate
runs the same number of tests as before.
ui-egui perf keeps its own binary (own process): its frame-time budgets
would charge each measurement for the other tests running beside it.
What the move needs:
- include_str!/include_bytes! and #[path] paths gain one "../".
- ui-egui: one GPU lock in tests/it/main.rs replaces the five per-file
ones (content, document_links, editing, fill_sign, view), so one
process creates one wgpu device at a time. The drop-line test in ui.rs
and the screenshot blocks behind PDFCRAFT_*_SHOT(S) and
CRAFT_UI_DOCKING_DIR, which render without holding it, take it too.
- pdfcraft winit_wayland_scroll: the vendored winit source it compiles
names crate::event, so that shim lives in main.rs.
- parity evidence names the new paths.
* Name the one-binary test paths in docs and comments
- READMEs, docs, ATTRIBUTION and source comments name tests/it/<file>.rs.
- The oracle README's example filters with --test it encryption::qpdf_agrees.
- pdfcraft's GPU lock comment points at the UI tests' shared lock in
crates/ui-egui/tests/it/main.rs.
The expanded view kept covering the workspace after a control client chose a
tool (`tool=organize`) or went Home (`home`), so the chosen panel or the Home
view never showed. The same held for a document tab click, Open Recent on an
open file, and the Combine files tab.
select_tool now clears the view, so every way of choosing a tool does. The
view also remembers which tab was in front when it opened, and another tab
coming forward puts it away, whichever path brought it there.
Each new test was seen to fail with the fix reverted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review follow-ups for the expanded All tools view:
- Opening a document left the view on, either over the new document (All
tools as the default workspace) or waiting to reappear on the next switch
back (Read as the default, or a mode override). Activating a document now
puts it away, and the reset lives in enter_mode, which every workspace
change goes through.
- The sidebar's expand button and `--tools full` assigned the mode directly.
From Read the right panel saved on entry was not restored, and from Edit the
Edit text tool stayed active. Both now go through switch_mode, as the mode
bar does, so the sidebar shows the All tools list again on collapse.
Each new test was seen to fail with the fix reverted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two cases still drew a value cut off without saying so. A single-line
value at a fixed font size taller than the box (12 pt text in an 8 pt
field) was checked only for width, so it fit sideways and was cut at the
top and bottom. In a multiline field, a character wider than the box
becomes a line of its own, which fits vertically but is cut at the sides.
The single-line and comb branch now compares the line's ascent to
descent against the clip box (a new `Overflow::High`), and the multiline
branch reports the widest wrapped line that is still wider than the box.
An empty value draws nothing, so it is never reported, however small the
box.
Fixes#4018
Review of #3670: with the depth limit at 50, depth was the only bound on the
form walk. A form that draws the next level twice, or a cycle of two forms,
costs 2^depth interpretations — at 12 that was 4096, at 50 it is a hang on a
file anyone can send.
The pass now also counts the forms it enters, and the budget is Edit text's own
`MAX_FORM_VISITS`, referenced rather than copied. Running out is treated as a
form that cannot be read, which is what the depth limit already did: removed in
Apply, the page left alone in Verify.
Measured with the new test:
depth 50, fan-out and a 50-deep cycle, with the budget 5.9 s
depth 22, fan-out, budget removed still running after
5 minutes
A `const` assertion ties this pass's depth limit to Edit text's, so the build
fails rather than a redaction quietly removing what a reader still shows (the
review's third point). Checked by setting the limit back to 12:
error[E0080]: evaluation panicked: assertion failed:
MAX_DEPTH >= pdfcraft_edit::text::MAX_FORM_DEPTH
Tests: a page whose forms each draw the next twice, and the same with the last
form drawing the first again — both must finish and still redact the page.
On top of #3011's page unit, the Drawing scale block gets a "1:N" field (1:50,
1/100, 50, 1:2,5 are read; zero, negative, huge and malformed values are
refused with a message) and a combo of common architect scales (1:1 to
1:1000). Either one fills the existing fields (1 mm of paper = N mm, shown in
metres) and applies the scale to the page without a second click, only when
the document allows annotation. Apply scale is unchanged.
Each font-family in assets/demo/showcase.html named only a specific font with
no generic fallback. Add an appropriate generic (serif/sans-serif/monospace/
cursive/math) so text still renders if the specific face is unavailable.
With a fixed font size, a text field's appearance cuts a long value at
the edge of its box, but form_fill only answered "filled": n. A person
sees the cut; an agent filling forms through the CLI or MCP did not.
The text appearance builder now notes when the text it lays out does
not fit: one line wider than the box, or wrapped lines below it.
forms::appearance::value_overflow asks that for a field's widget,
Document::field_overflow for a field by name, and form_fill adds a
warning for each filled field that is cut off. The value is still saved
whole and drawn as before; auto-sized fields shrink to fit and are not
reported.
The automation tests' inline PDF builder moves to a shared pdf_of.
Fixes#4018
Conflicts:
- crates/ui-egui/src/panels.rs: main made `panel_header` pub(crate) with
`back: Option<&str>` (the Calculation order page uses it too); this branch
needs its leading button to be Expand on All tools. It now takes
`lead: Option<(&str, &str)>`, the button's icon and tooltip, and the three
callers pass theirs (calc_order_ui.rs included).
- i18n catalogues: both sides appended entries at the same place; kept both.
- ATTRIBUTION.toml: catalogue hashes recomputed.
Main added eleven catalogues since this branch was cut (ca, ckb, fi, hi, id,
ko, lo, nb, ro, sq, th), and their coverage tests require every UI literal, so
the eight All tools view strings are translated in them too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
page_extract (and Split, which extracts each part) wrote the copied
pages without any outline, even when every page was extracted, though
the tool says bookmarks come along.
extract_pages now reads the source's bookmarks with the destinations
mapped to the copies, as Combine already does, and writes them as the
new document's outline. A bookmark whose page was left out goes, unless
a bookmark under it stays. A source without bookmarks still gets no
outline.
Fixes#4020
Resolved by the keeper:
- ATTRIBUTION.toml: upstream's copy, hashes recomputed
- crates/organize/src/tests.rs: additions from both sides, upstream's first
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Windows CI has a default printer, so the button still read Print in the
frame where the test cleared the printer; the other print tests already
run a frame first.
aiongg
alehelandClaude Opus 5.5
Lombardi2003andClaude Opus 5.5
Osvaldo DuranandClaude Sonnet 5.5
Adrien AlbertiandClaude
mtlcl410andClaude Fable 5.1
Max AbramowitzandClaude Opus 5.5
Eric Kaden
aiongg
Ridzzz0Alam
jonathanwxh-cell
Hamza
Dylan M. Taylor
BFlat