signPDFLM: Digitally sign and verify a PDF report

In sasLM: 'SAS' Linear Model

Digitally sign and verify a PDF report

Description

Apply a cryptographic digital signature to a (report) PDF, as an alternative to the print-sign-scan workflow, and verify it. signPDFLM signs the PDF bytes with the signer's private key (RSA or EC) using SHA-256 and writes a detached signature sidecar ‘<pdf>.sig’ (and, by default, the signer's public key ‘<pdf>.pubkey.pem’). verifyPDFLM confirms, with the signer's public key or certificate, that the PDF is byte-for-byte intact and was signed by that key (tamper-evidence and non-repudiation). These functions require the openssl package.

This is a detached signature (a separate ‘.sig’ file), not a PAdES signature embedded inside the PDF; embedding a visible in-viewer signature requires a dedicated PDF tool (e.g. Adobe Acrobat or ‘⁠pyhanko⁠’). The detached signature is cryptographically equivalent for integrity and non-repudiation.

Usage

signPDFLM(pdf, key, password = NULL, signer = "", role = "",
       sigFile = paste0(pdf, ".sig"), writePubkey = TRUE)

verifyPDFLM(pdf, sigFile = paste0(pdf, ".sig"), pubkey = paste0(pdf, ".pubkey.pem"))

Arguments

pdf	path to the PDF file to sign or verify.
key	the signer's private key: a path to a PEM key file or an openssl key object. Create one once with, e.g., openssl::rsa_keygen() and openssl::write_pem().
password	password for an encrypted private key, or NULL.
signer	name of the signer, recorded in the signature sidecar. Defaults to the login name.
role	optional role recorded in the sidecar, e.g. "Performed by" or "Reviewed by".
sigFile	path of the signature sidecar to write (signPDFLM) or read (verifyPDFLM).
writePubkey	if TRUE, also write the signer's public key next to the PDF for convenience. For non-repudiation, verify against the signer's independently-trusted public key or certificate, not one shipped with the file.
pubkey	the signer's public key or certificate used to verify: a PEM path (public key or X.509 certificate) or an openssl pubkey/cert object.

Value

signPDFLM invisibly returns a list with the sidecar path, the PDF sha256, the signer, and the public-key fingerprint; it writes the ‘.sig’ sidecar as a side effect. verifyPDFLM invisibly returns TRUE only if both the signature is valid and the recorded hash matches, and prints a human-readable result.

Author(s)

Kyun-Seop Bae <[e-mail]>

See Also

IQLM, OQLM, writeMD5LM

Examples

#key <- openssl::rsa_keygen()
#openssl::write_pem(key, "signer_key.pem")
#IQLM("sasLM-IQ-Report.pdf", performedBy = "Kyun-Seop Bae")
#signPDFLM("sasLM-IQ-Report.pdf", "signer_key.pem", signer = "Kyun-Seop Bae")
#verifyPDFLM("sasLM-IQ-Report.pdf")

sasLM documentation built on July 14, 2026, 5:06 p.m.