feat: open PDFs in tabs and check their signatures, through a MuPDF helper by FPurchess · Pull Request #123 · FPurchess/blank

FPurchess · 2026-10-12T18:40:20Z

Open PDFs in tabs and check their signatures. Stacked on #122 (feat/signing); 3b (#124) builds on it.

What users get

PDF tabs:
- Open a .pdf like any file. Its pages show read-only, with zoom, Print and the main menu. What doesn't apply to PDFs is greyed out, with the reason.
- Tabs come back after a restart. Blank says when a PDF's file changed or went away, and offers Open again.
Signatures: a status item in the bottom bar: Not signed · Signed / Signed by 2 · Signed, signer unknown · Changed after signing · Signature invalid.
- Clicking it opens the list of signatures. Details… shows the certificate, with Trust this certificate… and its fingerprint to compare.
- "Valid" means your own certificate or one you trusted. For other certificates Blank says it doesn't check certificate authorities.
- SHA-1 signatures are called weak, and revocation isn't checked.
view.signatures has no default key; it can be bound in Settings.

How it works

The PDF helper: a sidecar blank-pdf built from MuPDF 1.28.5 (vendored mupdf-sys; AGPL, compatible with Blank's AGPL-3.0-only), one helper per tab.
- It talks over a versioned protocol on stdin/stdout. Each request has a timeout and an answer limit.
- On Linux and macOS it has a memory limit. It is restarted once after a crash; after that the tab shows its error.
- It sits behind one PdfEngine trait, so another renderer could replace MuPDF.
Shipping:
- The helper ships as bundle.externalBin; on Linux it's installed in /usr/lib/blank.
- MuPDF's sources and the built helper are cached in CI (.github/actions/mupdf). Intel Macs are cross-built on PRs.
- The C libraries inside MuPDF are listed in the third-party notices and checked.
Checking: the signer's own code (verify) checks signatures. It guards against signature-wrapping and incremental-saving attacks, and caps the form walk.
Rules and docs: .claude/rules/pdf.md, docs/guide/pdf.md, and the FAQ, files, install, menu, print and shortcuts pages. CONTRIBUTING explains the helper's build on a fresh machine.
E2E: e2e/specs/pdf.e2e.ts covers opening a PDF, zoom, the signature status and Open again.

First runs on CI

The MuPDF builds on macOS (both architectures) and Windows, and the glibc floor check of the helper, have only run here on Linux. This PR's CI is their first run.

Checked by hand

Linux: open, zoom, print, signatures, restart, a changed or deleted file; a keyboard-only play-through
macOS 12 and Windows: the helper starts, and the app is signed/notarized with it
Snap and AppImage find the helper in /usr/lib/blank
A screen reader; the KDE print portal

… PDF tabs, and say what the signature check found

… notices, and check it

… the focus in a list whose last entry goes

…ewhere

…what they and the client send each other, and take a signature's timestamp only from a token that holds

…in useDeskScroll

… on a busy machine

…g and building them every run

…ch stays whole

…gned again later, unchecked timestamps, weak SHA-1, timestamps required when asked

…tificate, and say plainly what signing does

…o compare, and document the signature check's new fields

…rints, and say why in plain words

…cus, the Sign dialog shows the date and the server, and says how the PDF was signed

… PDF, show a PDF without pages as damaged, and name Save's real key after a Word import

… failed

…eType to itself

…and Cargo configuration its build reads

… Ubuntu no longer has webkit2gtk-driver

… blank-pdf is installed

…cus after Open again in PDF tabs

…nged or went, and offer Open again

…ichever the page and window give

…fter Close tab, and grey out what can't change a PDF, from the keyboard play-through

… instead of drawing it in full

…F that opens while a certificate is trusted, and check a PDF's signatures once per show

…stop another

…into the PDF helper

# Conflicts: # .claude/rules/state.md # CLAUDE.md # scripts/build-notices.ts # src-tauri/Cargo.toml # src/editor/requests.ts # src/importers/docx/signatures.ts

…he test fixtures' line ends into CRLF

This was referenced Oct 12, 2026

feat: sign what you write, with your signature, signature blocks and your own certificate #122

Merged

feat: fill in and sign PDFs you received, with found places, stamps and Next #124

Merged

FPurchess added this pull request to stack #126 October 12, 2026 18:44

FPurchess force-pushed the feat/pdf-tab branch from 8866824 to 5d8eb3b Compare October 12, 2026 18:52

FPurchess added 25 commits October 13, 2026 08:47

chore: build the PDF helper from MuPDF 1.28.5 and ship it next to Blank

a654fe3

feat: open PDFs in tabs and check their signatures

0ac0be2

docs: describe PDF tabs, checking signatures and the PDF helper

47f3f99

fix: keep the focus, the session version and the bitmaps right around…

a5425b0

… PDF tabs, and say what the signature check found

fix: list the code inside MuPDF's sources under other licences in the…

a998efe

… notices, and check it

ci: cross-build the PDF helper for Intel Macs on pull requests

6a789b4

fix: write certificates and copy their fingerprints one way, and keep…

72b467b

… the focus in a list whose last entry goes

fix: drop render and signature results of a PDF opened again from els…

f8a5030

…ewhere

fix: start and switch while a restored PDF tab still opens

39fe623

fix: keep PDF helpers alive past the thread that started them, bound …

4a6269e

…what they and the client send each other, and take a signature's timestamp only from a token that holds

refactor: share the scrolling of the page view and a PDF tab's pages …

2d7986a

…in useDeskScroll

fix: give a cancelled render in the PDF client's tests room to answer…

beaa273

… on a busy machine

feat: zoom the pages of PDF tabs with the window's zoom

4139be1

feat: print a PDF tab's file itself through the system's print dialog

88f4923

feat: say in the main menu why what isn't for PDFs is off in a PDF tab

c337fd2

chore: install the PDF helper in /usr/lib/blank on Linux

15eadd8

ci: cache MuPDF's sources and the built PDF helper instead of fetchin…

e93f2f4

…g and building them every run

fix: put signature lines from Word's table cells after the table, whi…

a08af45

…ch stays whole

fix: check PDF signatures safely and honestly: a capped form walk, si…

34d698d

…gned again later, unchecked timestamps, weak SHA-1, timestamps required when asked

fix: sign only the tab and block chosen, name the signer by their cer…

a59ca55

…tificate, and say plainly what signing does

fix: show the fingerprint to trust in monospace with all its groups t…

10d4b67

…o compare, and document the signature check's new fields

fix: keep PDF tabs working when their file changes, opens slowly or p…

ba29814

…rints, and say why in plain words

fix: focus and feedback of signing: the signature dialog takes the fo…

705d27b

…cus, the Sign dialog shows the date and the server, and says how the PDF was signed

fix: say Creating your certificate while it is made, like its button

22652d0

fix: let Tab move the focus in PDF tabs, grey out what can't change a…

799822c

… PDF, show a PDF without pages as damaged, and name Save's real key after a Word import

FPurchess added 14 commits October 13, 2026 08:47

fix: offer signing without a timestamp only when the timestamp server…

a0bd7a8

… failed

fix: load fontconfig at run time, so the PDF helper keeps MuPDF's Fre…

42d8483

…eType to itself

fix: stamp the PDF helper by its own crates and the compilers, flags …

7d7166b

…and Cargo configuration its build reads

ci: install WebKitWebDriver as webkitgtk-webdriver where the runner's…

5b4c731

… Ubuntu no longer has webkit2gtk-driver

docs: set up the PDF helper's build on a fresh machine, and say where…

8a22b49

… blank-pdf is installed

docs: note Tab, the greyed-out inserts, PDFs without pages and the fo…

e8c6ce6

…cus after Open again in PDF tabs

fix: say when a PDF's signatures weren't checked because its file cha…

78c9d19

…nged or went, and offer Open again

test: check that a signature relying on SHA-1 is called weak

db61d26

test: check that a key zooms a PDF tab's pages from Fit to a step, wh…

7f963b7

…ichever the page and window give

fix: keep the focus in signing's dialogs and popovers, on PDF pages a…

e7e6d25

…fter Close tab, and grey out what can't change a PDF, from the keyboard play-through

fix: drop a page render cancelled while it waited for the PDF helper,…

12e6f0d

… instead of drawing it in full

fix: bring a markdown tab back to its spot after a PDF tab, keep a PD…

50f9c5c

…F that opens while a certificate is trusted, and check a PDF's signatures once per show

fix: number page renders once per run, so a late cancel of one can't …

0a76635

…stop another

test: check a page its own DSS lists by the coverage it gets

a8978aa

FPurchess force-pushed the feat/pdf-tab branch from 5d8eb3b to a8978aa Compare October 13, 2026 06:58

FPurchess added 4 commits October 13, 2026 09:16

fix: link the Windows library MuPDF 1.28 draws its random bytes from …

4e596ba

…into the PDF helper

merge: take signing on the block standards of #119

a96a236

# Conflicts: # .claude/rules/state.md # CLAUDE.md # scripts/build-notices.ts # src-tauri/Cargo.toml # src/editor/requests.ts # src/importers/docx/signatures.ts

merge: take signing on #119 and Tauri 2.12

e977e6c

fix: keep PDFs byte for byte in a checkout on Windows, which turned t…

fc9bd66

…he test fixtures' line ends into CRLF

FPurchess merged commit e887601 into main Oct 13, 2026
9 checks passed

FPurchess deleted the feat/pdf-tab branch October 13, 2026 21:15

Navigation Menu

Repository navigation

feat: open PDFs in tabs and check their signatures, through a MuPDF helper - #123

feat: open PDFs in tabs and check their signatures, through a MuPDF helper#123
FPurchess merged 43 commits into
feat/signingfrom
feat/pdf-tab

FPurchess commented Oct 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

FPurchess commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What users get

How it works

First runs on CI

Checked by hand

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

FPurchess commented Oct 12, 2026 •

edited

Loading