Digitally Signed Outputs

Digitally Signed Outputs

[Malcolm Nixon]

[-- Attachment #1.1: Type: text/plain, Size: 911 bytes --]

Greetings all,

I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
workflow - specifically the digital signature would be evidence that the 
document hasn't been tampered with.

While the underlying Miktek PDF generator has a "digsig" package, it looks 
like Pandoc doesn't have any command-line options for triggering the 
signing of the output.

Am I missing something in the documentation (such as some means of 
specifying custom miktek extensions). 

Many thanks,
 - Malcolm

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/5f41500c-54d8-43ca-855b-e2acfd0779dfn%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 1307 bytes --]

Re: Digitally Signed Outputs

[Stephan Meijer]

[-- Attachment #1.1: Type: text/plain, Size: 1189 bytes --]

With digitally signed, do you mean PDF/A?

Pandoc has some info about it on their 
FAQ: https://pandoc.org/faqs.html#how-can-i-produce-pdfa-with-pandoc

Hope I was of any help.

Stephan

On Tuesday, 2 May 2023 at 00:42:57 UTC+2 Malcolm Nixon wrote:

> Greetings all,
>
> I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
> workflow - specifically the digital signature would be evidence that the 
> document hasn't been tampered with.
>
> While the underlying Miktek PDF generator has a "digsig" package, it looks 
> like Pandoc doesn't have any command-line options for triggering the 
> signing of the output.
>
> Am I missing something in the documentation (such as some means of 
> specifying custom miktek extensions). 
>
> Many thanks,
>  - Malcolm
>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/e2e27a0d-7044-4533-b2a6-f42634e84b78n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 1870 bytes --]

Re: Digitally Signed Outputs

[Malcolm Nixon]

[-- Attachment #1.1: Type: text/plain, Size: 1795 bytes --]

Yes, PDF/A (when combined with a digital signature such as PAdES) looks to 
be ideal in creating long-term tamper-resistant artifacts such as release 
notes or test reports in CI pipelines.

I found the PDF/A documentation and tried giving it a shot; however it 
looks like it only works with the ConTeXt engine, and the pandoc docker 
images only come with LaTeX.

I might have to take a diversion and look into docker ;)

Many thanks,

    - Malcolm

On Tuesday, May 9, 2023 at 6:52:19 AM UTC-4 Stephan Meijer wrote:

> With digitally signed, do you mean PDF/A?
>
> Pandoc has some info about it on their FAQ: 
> https://pandoc.org/faqs.html#how-can-i-produce-pdfa-with-pandoc
>
> Hope I was of any help.
>
> Stephan
>
> On Tuesday, 2 May 2023 at 00:42:57 UTC+2 Malcolm Nixon wrote:
>
>> Greetings all,
>>
>> I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
>> workflow - specifically the digital signature would be evidence that the 
>> document hasn't been tampered with.
>>
>> While the underlying Miktek PDF generator has a "digsig" package, it 
>> looks like Pandoc doesn't have any command-line options for triggering the 
>> signing of the output.
>>
>> Am I missing something in the documentation (such as some means of 
>> specifying custom miktek extensions). 
>>
>> Many thanks,
>>  - Malcolm
>>
>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/73c2358c-ef08-411f-94e7-0d55e14b29b7n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 3001 bytes --]

Re: Digitally Signed Outputs

[Stephan Meijer]

[-- Attachment #1.1: Type: text/plain, Size: 2137 bytes --]

Please keep in mind that when people are able to hack into your CI 
pipelines, they can still tamper anyway.

Maybe you can sign the PDF after generating it? Maybe take a lookt 
at https://pypi.org/project/endesive/

On Tuesday, 9 May 2023 at 23:08:19 UTC+2 Malcolm Nixon wrote:

> Yes, PDF/A (when combined with a digital signature such as PAdES) looks to 
> be ideal in creating long-term tamper-resistant artifacts such as release 
> notes or test reports in CI pipelines.
>
> I found the PDF/A documentation and tried giving it a shot; however it 
> looks like it only works with the ConTeXt engine, and the pandoc docker 
> images only come with LaTeX.
>
> I might have to take a diversion and look into docker ;)
>
> Many thanks,
>
>     - Malcolm
>
> On Tuesday, May 9, 2023 at 6:52:19 AM UTC-4 Stephan Meijer wrote:
>
>> With digitally signed, do you mean PDF/A?
>>
>> Pandoc has some info about it on their FAQ: 
>> https://pandoc.org/faqs.html#how-can-i-produce-pdfa-with-pandoc
>>
>> Hope I was of any help.
>>
>> Stephan
>>
>> On Tuesday, 2 May 2023 at 00:42:57 UTC+2 Malcolm Nixon wrote:
>>
>>> Greetings all,
>>>
>>> I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
>>> workflow - specifically the digital signature would be evidence that the 
>>> document hasn't been tampered with.
>>>
>>> While the underlying Miktek PDF generator has a "digsig" package, it 
>>> looks like Pandoc doesn't have any command-line options for triggering the 
>>> signing of the output.
>>>
>>> Am I missing something in the documentation (such as some means of 
>>> specifying custom miktek extensions). 
>>>
>>> Many thanks,
>>>  - Malcolm
>>>
>>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/4fffb9ee-436c-4356-88d1-6c918d3b44e8n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 3509 bytes --]

Re: Digitally Signed Outputs

[Stephan Meijer]

[-- Attachment #1.1: Type: text/plain, Size: 2347 bytes --]

You might even be able to sign any existing PDF documents using just openssl 
.

On Wednesday, 10 May 2023 at 02:24:05 UTC+2 Stephan Meijer wrote:

> Please keep in mind that when people are able to hack into your CI 
> pipelines, they can still tamper anyway.
>
> Maybe you can sign the PDF after generating it? Maybe take a lookt at 
> https://pypi.org/project/endesive/
>
> On Tuesday, 9 May 2023 at 23:08:19 UTC+2 Malcolm Nixon wrote:
>
>> Yes, PDF/A (when combined with a digital signature such as PAdES) looks 
>> to be ideal in creating long-term tamper-resistant artifacts such as 
>> release notes or test reports in CI pipelines.
>>
>> I found the PDF/A documentation and tried giving it a shot; however it 
>> looks like it only works with the ConTeXt engine, and the pandoc docker 
>> images only come with LaTeX.
>>
>> I might have to take a diversion and look into docker ;)
>>
>> Many thanks,
>>
>>     - Malcolm
>>
>> On Tuesday, May 9, 2023 at 6:52:19 AM UTC-4 Stephan Meijer wrote:
>>
>>> With digitally signed, do you mean PDF/A?
>>>
>>> Pandoc has some info about it on their FAQ: 
>>> https://pandoc.org/faqs.html#how-can-i-produce-pdfa-with-pandoc
>>>
>>> Hope I was of any help.
>>>
>>> Stephan
>>>
>>> On Tuesday, 2 May 2023 at 00:42:57 UTC+2 Malcolm Nixon wrote:
>>>
>>>> Greetings all,
>>>>
>>>> I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
>>>> workflow - specifically the digital signature would be evidence that the 
>>>> document hasn't been tampered with.
>>>>
>>>> While the underlying Miktek PDF generator has a "digsig" package, it 
>>>> looks like Pandoc doesn't have any command-line options for triggering the 
>>>> signing of the output.
>>>>
>>>> Am I missing something in the documentation (such as some means of 
>>>> specifying custom miktek extensions). 
>>>>
>>>> Many thanks,
>>>>  - Malcolm
>>>>
>>>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/7fd9f105-5d95-46ae-bf51-37c00c3532b7n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 4153 bytes --]

Re: Digitally Signed Outputs

[Stephan Meijer]

[-- Attachment #1.1: Type: text/plain, Size: 2529 bytes --]

Also see https://github.com/opensignature/pdfsign

On Wednesday, 10 May 2023 at 02:30:14 UTC+2 Stephan Meijer wrote:

> You might even be able to sign any existing PDF documents using just 
> openssl .
>
> On Wednesday, 10 May 2023 at 02:24:05 UTC+2 Stephan Meijer wrote:
>
>> Please keep in mind that when people are able to hack into your CI 
>> pipelines, they can still tamper anyway.
>>
>> Maybe you can sign the PDF after generating it? Maybe take a lookt at 
>> https://pypi.org/project/endesive/
>>
>> On Tuesday, 9 May 2023 at 23:08:19 UTC+2 Malcolm Nixon wrote:
>>
>>> Yes, PDF/A (when combined with a digital signature such as PAdES) looks 
>>> to be ideal in creating long-term tamper-resistant artifacts such as 
>>> release notes or test reports in CI pipelines.
>>>
>>> I found the PDF/A documentation and tried giving it a shot; however it 
>>> looks like it only works with the ConTeXt engine, and the pandoc docker 
>>> images only come with LaTeX.
>>>
>>> I might have to take a diversion and look into docker ;)
>>>
>>> Many thanks,
>>>
>>>     - Malcolm
>>>
>>> On Tuesday, May 9, 2023 at 6:52:19 AM UTC-4 Stephan Meijer wrote:
>>>
>>>> With digitally signed, do you mean PDF/A?
>>>>
>>>> Pandoc has some info about it on their FAQ: 
>>>> https://pandoc.org/faqs.html#how-can-i-produce-pdfa-with-pandoc
>>>>
>>>> Hope I was of any help.
>>>>
>>>> Stephan
>>>>
>>>> On Tuesday, 2 May 2023 at 00:42:57 UTC+2 Malcolm Nixon wrote:
>>>>
>>>>> Greetings all,
>>>>>
>>>>> I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
>>>>> workflow - specifically the digital signature would be evidence that the 
>>>>> document hasn't been tampered with.
>>>>>
>>>>> While the underlying Miktek PDF generator has a "digsig" package, it 
>>>>> looks like Pandoc doesn't have any command-line options for triggering the 
>>>>> signing of the output.
>>>>>
>>>>> Am I missing something in the documentation (such as some means of 
>>>>> specifying custom miktek extensions). 
>>>>>
>>>>> Many thanks,
>>>>>  - Malcolm
>>>>>
>>>>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/18a7dc61-1f07-4d4d-90c1-02a6c4588c91n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 4480 bytes --]

Re: Digitally Signed Outputs

[Albert Krewinkel]

Malcolm Nixon <malcolm.nixon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:

> I found the PDF/A documentation and tried giving it a shot; however
> it looks like it only works with the ConTeXt engine, and the pandoc
> docker images only come with LaTeX.
>
> I might have to take a diversion and look into docker ;)

Run this:

    printf 'FROM pandoc/latex\nRUN tlmgr install context' | \
      docker build -t pandoc/context -

Now you have a pandoc/context Docker image.


-- 
Albert Krewinkel
GPG: 8eed e3e2 e8c5 6f18 81fe  e836 388d c0b2 1f63 1124

Re: Digitally Signed Outputs

[Leonard Rosenthol]

[-- Attachment #1: Type: text/plain, Size: 1802 bytes --]

 After you resolve how to setup the pipeline - the next (bigger?) issue is
where will you get a digital certificate from?  How/where will you store it
so your CI can find it?  And how will you safely/securely provide the
passphrase for the key to the signing process?

Leonard

On May 10, 2023 at 6:21:58 AM, Albert Krewinkel <albert+pandoc-9EawChwDxG8hFhg+JK9F0w@public.gmane.org>
wrote:

>
> Malcolm Nixon <malcolm.nixon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:
>
> I found the PDF/A documentation and tried giving it a shot; however
>
> it looks like it only works with the ConTeXt engine, and the pandoc
>
> docker images only come with LaTeX.
>
>
> I might have to take a diversion and look into docker ;)
>
>
> Run this:
>
>    printf 'FROM pandoc/latex\nRUN tlmgr install context' | \
>      docker build -t pandoc/context -
>
> Now you have a pandoc/context Docker image.
>
>
> --
> Albert Krewinkel
> GPG: 8eed e3e2 e8c5 6f18 81fe  e836 388d c0b2 1f63 1124
>
> --
> You received this message because you are subscribed to the Google Groups
> "pandoc-discuss" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/pandoc-discuss/871qjoscsn.fsf%40zeitkraut.de
> .
>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/CALu%3Dv3KtnixWASLZrp6pp8oCZoqkP_5L3xBOXMa2RavW8-wMwA%40mail.gmail.com.

[-- Attachment #2: Type: text/html, Size: 3065 bytes --]

Re: Digitally Signed Outputs

[Malcolm Nixon]

[-- Attachment #1.1: Type: text/plain, Size: 3520 bytes --]

All the big players in the CI space have methods for providing secrets to 
the CI pipeline scripts:
 - https://docs.github.com/en/actions/security-guides/encrypted-secrets
 - https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-secret-variables
 - https://docs.gitlab.com/charts/installation/secrets.html

Two approaches that seem common is to store the passphrase in the secrets 
manager, but check in the certificate file to the repository; or 
alternatively also store the certificate as a base64-encoded string in the 
secrets manager and have the script export it temporarily to file before 
use. 

Admittedly it would be more secure if CI tools came with signing 
capabilities built in - rather than having to inject secrets as arguments 
into a CI pipeline script which could be inadvertently/maliciously modified 
by a PR to try and leak the secrets (script injection attacks). The CI 
tools try to redact secrets from logs, but no system is perfect. Security 
hardening of pipelines is an entire research topic ;)

I'm mostly interested in creating tamper-resistant records (attestations) 
describing what was performed in the creation of an artifact and can be 
copied around with the artifacts. The digital-signature is only for 
tamper-resistance and wouldn't be used to signify suitability for 
distribution. If there's a lengthy gap between the creation of the record 
and its signing, then it opens a window for tampering before signature. 
That's one of the benefits of emitting the record pre-signed.

On Wednesday, May 10, 2023 at 2:45:11 PM UTC-4 Leonard Rosenthol wrote:

> After you resolve how to setup the pipeline - the next (bigger?) issue is 
> where will you get a digital certificate from?  How/where will you store it 
> so your CI can find it?  And how will you safely/securely provide the 
> passphrase for the key to the signing process?
>
> Leonard
>
> On May 10, 2023 at 6:21:58 AM, Albert Krewinkel <albert...-9EawChwDxG8hFhg+JK9F0w@public.gmane.org> 
> wrote:
>
>>
>> Malcolm Nixon <malcol...-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:
>>
>> I found the PDF/A documentation and tried giving it a shot; however
>>
>> it looks like it only works with the ConTeXt engine, and the pandoc
>>
>> docker images only come with LaTeX.
>>
>>
>> I might have to take a diversion and look into docker ;)
>>
>>
>> Run this:
>>
>>    printf 'FROM pandoc/latex\nRUN tlmgr install context' | \
>>      docker build -t pandoc/context -
>>
>> Now you have a pandoc/context Docker image.
>>
>>
>> -- 
>> Albert Krewinkel
>> GPG: 8eed e3e2 e8c5 6f18 81fe  e836 388d c0b2 1f63 1124
>>
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "pandoc-discuss" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to pandoc-discus...-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/pandoc-discuss/871qjoscsn.fsf%40zeitkraut.de
>> .
>>
>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/4c8954d3-5676-4ff4-b68d-23b1e7c4901dn%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 5320 bytes --]