Re: Digitally Signed Outputs

[Stephan Meijer <me-nPKYAObcRdo6Blr+0TYHagC/G2K4zDHf@public.gmane.org>]

[-- Attachment #1.1: Type: text/plain, Size: 2347 bytes --]

You might even be able to sign any existing PDF documents using just openssl 
.

On Wednesday, 10 May 2023 at 02:24:05 UTC+2 Stephan Meijer wrote:

> Please keep in mind that when people are able to hack into your CI 
> pipelines, they can still tamper anyway.
>
> Maybe you can sign the PDF after generating it? Maybe take a lookt at 
> https://pypi.org/project/endesive/
>
> On Tuesday, 9 May 2023 at 23:08:19 UTC+2 Malcolm Nixon wrote:
>
>> Yes, PDF/A (when combined with a digital signature such as PAdES) looks 
>> to be ideal in creating long-term tamper-resistant artifacts such as 
>> release notes or test reports in CI pipelines.
>>
>> I found the PDF/A documentation and tried giving it a shot; however it 
>> looks like it only works with the ConTeXt engine, and the pandoc docker 
>> images only come with LaTeX.
>>
>> I might have to take a diversion and look into docker ;)
>>
>> Many thanks,
>>
>>     - Malcolm
>>
>> On Tuesday, May 9, 2023 at 6:52:19 AM UTC-4 Stephan Meijer wrote:
>>
>>> With digitally signed, do you mean PDF/A?
>>>
>>> Pandoc has some info about it on their FAQ: 
>>> https://pandoc.org/faqs.html#how-can-i-produce-pdfa-with-pandoc
>>>
>>> Hope I was of any help.
>>>
>>> Stephan
>>>
>>> On Tuesday, 2 May 2023 at 00:42:57 UTC+2 Malcolm Nixon wrote:
>>>
>>>> Greetings all,
>>>>
>>>> I'm looking to use Pandoc to generate digitally-signed PDFs from a CI 
>>>> workflow - specifically the digital signature would be evidence that the 
>>>> document hasn't been tampered with.
>>>>
>>>> While the underlying Miktek PDF generator has a "digsig" package, it 
>>>> looks like Pandoc doesn't have any command-line options for triggering the 
>>>> signing of the output.
>>>>
>>>> Am I missing something in the documentation (such as some means of 
>>>> specifying custom miktek extensions). 
>>>>
>>>> Many thanks,
>>>>  - Malcolm
>>>>
>>>

-- 
You received this message because you are subscribed to the Google Groups "pandoc-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pandoc-discuss+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To view this discussion on the web visit https://groups.google.com/d/msgid/pandoc-discuss/7fd9f105-5d95-46ae-bf51-37c00c3532b7n%40googlegroups.com.

[-- Attachment #1.2: Type: text/html, Size: 4153 bytes --]