R Observatory: Metrics for pdfsigner version 0.3.0

Balamuta, James Joseph

doi:10.5281/zenodo.21843040

pdfsigner

0.3.0Package record

Digitally Sign and Verify PDF Documents

0packages depend

764downloads / year

–test coverage

13/13flavors OK

Overview

About

Maintained by Andre LeiteCRAN page ↗GitHub ↗Issues ↗

Digitally sign PDF documents with a 'PKCS#12' keystore and verify their signatures. Signing produces a detached 'PKCS#7' / 'CMS' signature ('adbe.pkcs7.detached') over the document and is applied as an incremental update, so existing signatures remain valid. The cryptography and PDF manipulation are performed by a bundled, pure-'Rust' backend (the 'pdf_signer' crate); no Java runtime, 'OpenSSL', or external command-line tools are required. Visible signature appearances with custom text are supported.

Changes in 0.3.0

Synced the pure-Rust backend to pdf_signer engine v0.3.2, which closes a multi-agent security review. Verification now judges the **whole document**: verify_pdf_signature() returns the attributes document_intact, all_valid and all_trusted; a PDF whose content was changed by an unsigned incremental update after signing is no longer reported as valid overall (each signature still reports valid over its own byte range). Document timestamps get their own chain_trusted; timestamp authorities must carry the RFC 3161 id-kp-timeStamping purpose before their time is trusted; revocation dated at or before the signing time is honoured even from later CRL/OCSP evidence; certificate extensions are processed per RFC 5280 §6.1.3.
New per-signature fields is_timestamp and trusted_time.
Signing: reason, name, location and contact_info with non-ASCII text (e.g. "Aprovação") are now written as UTF-16 text strings and render correctly in every viewer; the previous trailer's /Info (Title, Author) is preserved; a second B-LT/B-LTA signature merges into the existing /DSS; the claimed signing time is written to /M by default. Encrypted PDFs (even with an empty user password) and documents certified with DocMDP P=1 are refused with a clear error instead of producing a corrupted file.

Show all changes in 0.3.0Hide the rest of the changes in 0.3.0

Build: the vendored Rust dependency set now resolves for **rustc 1.81** (September 2024), in line with CRAN's two-year toolchain policy. pdf_signer declares rust-version = 1.81 and depends on p12-keystore 0.1.5 (0.2.x is edition 2024 / rustc 1.85+, and 0.2.1 needs rustc 1.88 — the cause of the 0.2.5 installation failure on CRAN's check machine); time is 0.3.44, ureq 3.2.1, getrandom 0.3.1 (its later WebAssembly-only dependencies are 2024 edition, and cargo 1.81 refuses to parse any vendored 2024-edition manifest even for targets it never builds). The lockfile is resolved with cargo's MSRV-aware resolver (CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS=fallback) before vendoring, and the built tarball is installed offline with rustc 1.81.0 as part of the release checks.

From NEWS.md in the release

Install

R (CRAN)pak (dev)Ubuntu (r2u)Fedora (COPR)

install.packages("pdfsigner", repos = "https://cloud.r-project.org/")

Installs the current CRAN release. Prebuilt binaries on Windows and macOS.

if (!requireNamespace("pak", quietly = TRUE))
  install.packages("pak", repos = "https://cloud.r-project.org/")
pak::pak("StrategicProjects/pdfsigner")

Development version from StrategicProjects/pdfsigner. Installs pak first if it is not already available.

Release

# enable cranapt (r2u) if it is not already set up, then install
grep -rqs r2u.stat.illinois.edu /etc/apt/sources.list /etc/apt/sources.list.d/ \
  || curl -fsSL https://raw.githubusercontent.com/eddelbuettel/r2u/master/inst/scripts/add_cranapt_noble.sh | sudo bash
sudo apt install -y r-cran-pdfsigner

Fast Ubuntu binaries via r2u (no compilation). The cranapt setup runs once and is skipped when it is already enabled. We list this channel from recorded r2u download activity rather than from a live index of the repository, so treat it as last known rather than guaranteed.

bspm (used by r2u) also needs make: sudo apt install make

# enable the iucar/cran COPR if it is not already present, then install
ls /etc/yum.repos.d/*iucar*cran*.repo >/dev/null 2>&1 \
  || sudo dnf copr enable -y iucar/cran
sudo dnf install -y R-CRAN-pdfsigner

RPMs from the iucar/cran COPR, rebuilt from CRAN.

For install.packages() integration in R, also: sudo dnf install R-CoprManager

Health

CRAN checks

13OK

CRAN check page ↗

Slowest check: 12.0 min · r-release-windows-x86_64

Status changes

OK13 OKNow
OK7 OK2026-06-22

Advisories

none known

How this is measured·How advisories are found

Documentation

In release 0.3.0

READMEYes · 359 wordsVignettesNoNEWSYes · 100% structured · mentions 0.3.0Citation fileNo

Help pages: 3 (1 internal)includes a package overview page
Examples that run: 0%2 never run
Exported functions with examples: 100%
Documented parameters: 85%
Return-value docs: 100%
Help pages citing references: 0%

How these are measured

Downloads

764

CRAN downloads in the past year

Rank #25,158 · ~2/day · ~64/mo

Releases R versions

Daily download trend is not available in this view yet.

40230 days

40290 days

7641 year

Compare downloads with other packages →

Also on85 r2u

How downloads are counted

Repository

strategicprojects/pdfsigner ↗Organization: StrategicProjects

3Stars

0Forks

0Open issues

0Open PRs

1Releases

38Commits

1Commit identities

License file reads as GPL-3.0 · 38 commits · Last activity 2026-09-30 · +50% stars, 30d

Responsiveness

How these are sampled

PRs merged (all time): 100%
Median days to close, 50 most recently updated closed issues: not measured
Median days to close, 50 most recently updated closed PRs: 0

Stars over time

2026-04-06 · 22026-09-30 · 3

How these are measured

PracticesBeta

7 development-tooling and community-health practices detected across 4 families in the upstream repository

Checks run against github.com/strategicprojects/pdfsigner on 2026-10-21.

Continuous integration (1)

GitHub Actions

Docs source (3)

pkgdown

GitHub Pages site last deployed 2026-09-30 · The repository has a site deploy workflow

CRAN release process (2)

cran-comments.mdCRAN-SUBMISSION

Lint, format, editor (1)

RStudio project

How this is detected·Detection ruleset v4 (2026-10-20)

AI coding toolsBeta

This repository shows signs of AI coding tools.

Claude Codefirst seen 2026-06-14
Named in .Rbuildignore: .claude, CLAUDE.md
Named in .gitignore: CLAUDE.md
Commits: at least 33 crediting it in the message

From outside contributors

Claude Code
Pull requests: 2 from outside contributors, first on 2026-06-16

Models named in its commits

Claude Opus 4.823 commits · Jun to Jul 2026
Claude Fable 5.14 commits · Sep 2026
Claude Opus 5.54 commits · Sep 2026
Claude Sonnet 52 commits · Jul 2026

Counts are commits, not lines of code. Commits by a tool's accounts count once across all of its accounts. Commits crediting it are the largest count among its credit lines, a minimum.How this is detected·Detection ruleset v4 (updated 2026-09-27)

Dependencies

Declared dependencies

1 external dependency (excludes base and recommended)

Installing pdfsigner adds no packages beyond those that come with R.

Depends (1)

R >= 4.2

Imports (0)

none

LinkingTo (0)

none

Suggests (1)

testthat

Enhances (0)

none

Dependency license breakdown →

Reverse dependencies

0direct

0indirect

Nothing depends on this yet.

How these are counted

Code & Tests

People & History

People (4)

Andre Leite

Author, Maintainer since 0.2.2 (2026)

Diogo Bezerra

Author

Hugo Vasconcelos

Author

Authors of the vendored Rust crates

Contributor, Copyright holder

see inst/AUTHORS for the bundled crates and their licences

Releases (4)

Pick two releases to compare their code metrics.

unarchivedReturned to CRAN
2026-09-25
0.3.0Latest
record
2026-09-25 · current release · diff ↗
archivedRemoved from CRAN
2026-07-15
issues were not corrected in time
0.2.5
record
2026-06-26 · diff ↗
0.2.4
record
2026-06-26 · diff ↗
0.2.2
record
2026-06-21
R
R 4.6.0 released · 2026-04-24

Package metadata

First published: 2026-06-21
Total releases: 4 / 1 yrs
License: GPL-3 OSI
Copyright: The pdfsigner package and its bundled 'pdf_signer' Rust backend are released under GPL-3. The build vendors the source of third-party Rust crates (src/rust/vendor.tar.xz) that remain under the copyright of their respective authors and are licensed under permissive terms (MIT, Apache-2.0, BSD, ISC, Zlib, Unicode-3.0, 0BSD, Unlicense or CDLA-Permissive-2.0); see the inst/AUTHORS file for the full list.
Minimum R: ≥ 4.2
Download size: 18 MB

Cite

Cite this package

Run in R for the authors' preferred citation:

citation("pdfsigner")

Format

Leite, A., Authors of the vendored Rust crates, Bezerra, D., & Vasconcelos, H. (2026). pdfsigner: Digitally Sign and Verify PDF Documents (Version 0.3.0) [Computer software]. https://doi.org/10.32614/CRAN.package.pdfsigner

This package has no citation file, so citation() returns this entry built from DESCRIPTION.

Cite the R Observatory

For a number measured here: a download total, a coverage figure, an archival date.

Format

APA

Balamuta, J. J. (2026). R Observatory: Metrics for pdfsigner version 0.3.0 [Data set]. HJJB, LLC. Data release v2026-10-23. https://doi.org/10.5281/zenodo.21843040

From data release v2026-10-23, which the citation names so these numbers can be found later. More on citing and the projects behind them.

Report a problem with this page →