使用Go包pdfsign添加多数字签名后，Adobe Acrobat中前序签名失效问题

我最近在用Go语言的github.com/digitorus/pdfsign包给PDF添加多重数字签名时遇到了个棘手的问题：在Adobe Acrobat里查看文档时，添加后续签名后，第一个签名会失效。

具体现象如下：

• 第一个签名添加完成后，验证完全正常
• 添加上第二个及后续签名后，第一个签名会被标记为“无效”
• 有意思的是，单独检查每个签名时，它们各自都能验证通过

只有最后一个签名在当前文档中显示验证正确：

签名面板中仅最后一个签名状态为有效

如果用Acrobat的“查看已签名版本”功能查看第一个签名对应的历史版本，这个签名也能正常验证：

在“查看已签名版本”界面中，第一个签名验证通过

我用Adobe Acrobat Preflight工具检查原始文档和已签名文档的PDF语法，没有检测到任何问题：

Preflight工具未发现PDF语法错误

我之前看过一个类似的问题，那边的原因是分段xref表，但我这里不存在这个情况——即使重新生成完整的xref表，问题依然存在。

我现在怀疑问题出在增量更新的处理上

下面是追加到PDF文档中的增量更新内容：

10 0 obj
<< /Type /Annot /Subtype /Widget /Rect [0 0 0 0] /P 5 0 R /F 132 /FT /Sig /T (Signature10) /Ff 0 /V 12 0 R >>
endobj
11 0 obj
<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [7 0 R 10 0 R] /NeedAppearances false /SigFlags 3 /Perms << /UR 12 0 R >> >> >>
endobj
12 0 obj
<< /Type /Sig /Filter /Adobe.PPKLite /SubFilter /adbe.pkcs7.detached /ByteRange [0 5000 7870 414]                   /Contents<308204e306092a864886f70d010702a08204d4308204d0020101310d300b0609608648016503040203300b06092a864886f70d010701a08202903082028c308201f5a003020102021411ea8e89c304b42bad08db8136af460103580f5d300d06092a864886f70d01010b05003057310b3009060355040613024e4c3113301106035504080c0a536f6d652d537461746531123010060355040a0c0944696769746f727573311f301d06035504030c165061756c2076616e2042726f7577657273686176656e3020170d3234313131333039353131315a180f32313234313032303039353131315a3057310b3009060355040613024e4c3113301106035504080c0a536f6d652d537461746531123010060355040a0c0944696769746f727573311f301d06035504030c165061756c2076616e2042726f7577657273686176656e30819f300d06092a864886f70d010101050003818d00308189028181009abbeb66251967f9d298528cb105e0e6c9584d08e3ee7b9e9dccedeca18f56e180f2734eaa21a4b5ffb27a9e61dabf3b8cfbd58d55e32558ce4cac7d1cc85a144087287295ef6890865c387d76bc881d440de1aec0ffa94e9456973bab43f60cc6f7a634955c18c7d3138d97e4182a87a0ef91d7514c079ea900c10fafb954fb0203010001a3533051301d0603551d0e0416041444e2ce2d9b4cb44c2249d05d60d19d0e7dc48f7d301f0603551d2304183016801444e2ce2d9b4cb44c2249d05d60d19d0e7dc48f7d300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038181003819e0f84cc3db103a785fd6e5687e3ed844d4ca49d50bde8d9043c823a2a65585508989017dfd65f4e8fd875fcf6c51e09c3884e1749122f10cae161ad0acee6441d1ddb8603270a498f428de7eba1de25a4e68ad8ef91527a7b1f2d937b60856e50ded0fb6bfcec58d6b25d30dc23dca6307a120239407b0d9b5ddb9102db43182021930820215020101306f3057310b3009060355040613024e4c3113301106035504080c0a536f6d652d537461746531123010060355040a0c0944696769746f727573311f301d06035504030c165061756c2076616e2042726f7577657273686176656e021411ea8e89c304b42bad08db8136af460103580f5d300b0609608648016503040203a0820100300f06092a864886f72f01010831023000301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3234313131333131313531305a304f06092a864886f70d01090431420440b35bead7e94a1ac181444e83d78d858feaaad7dee19e84c5b72a5ae5cb69b67fd686fc90d8e2f237200bf4aaa33e0218f669ea924a506dec438d8845896932cf3064060b2a864886f70d010910022f315530533051304f300b0609608648016503040203044048e7b14c70a3beb47b5b8af714af447e03db88f72eba5307afa4c6862537d40fae77371b9a31baeda1a5dcfbe1d7a6a85aa98f64f26a47fdac1de06c06d8eed1300b06092a864886f70d01010d04818074135f1a3f5d6120baa154ccb01f4331df19f9b29cc444ab586091774caa267075642d28f8e8275167fa516d87cc091eecd16dcb7d22992898d774bc8a27cc17c4bef224c1dc60178aeab1f4601b4cb308b0042685d7e0744fd9bde17a3ba0052e519a2a79d3e456d4aca10554b165a910da3b62ef94939b1a6ed72c3d01658200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000>> /TransformMethod /FieldMDP /TransformParams << /Type /TransformParams /Fields [<< /Type /SigFieldLock /Action /All >>] /V /1.2 >> /Name (Jane 2 Doe) /Location (Anywhere) /Reason (Approval Signature 2) /ContactInfo (None) /M (D:20241113121510+01'00') >>
endobj
xref
10 3
0000004592 00000 n 
0000004718 00000 n 
0000004866 00000 n 
trailer
<<
    /Root 11 0 R
    /Prev 4441
    /Size 13
>>
startxref
8131
%%EOF

相关文件：

• 源文件：small.pdf
• 已签名文件：SignPDFWithTwoApproval_2_556137430.pdf

备注：内容来源于stack exchange，提问作者vanbroup