Signing

A simple electronic signature: a drawn signature, the name of the signer and the time, bound to the content and stored in a PDF whose hash is audited.

The signature field

• Works with a pen (with pressure), a finger or a mouse; on tablets the page does not scroll or select text while drawing.
• Clear empties the field.
• The drawing is sent as PNG when the form is submitted.

What the server checks

1. Confirmation: if the template has a confirmation text, the checkbox must be checked.
2. Name: 1 to 150 characters.
3. Signature: a PNG data URL of at most 300 KB, 50×20 to 2400×1200 pixels, with enough drawn pixels – an empty field is rejected. The PNG is decoded and encoded again: no metadata or other content survives.
4. Binding: see below.
5. Status: the document must still be a draft. The row is locked while signing, so two devices cannot sign the same draft.

A failed check is shown on the signing page; the document stays a draft.

Binding

The signing page sends the SHA-256 of the content it shows. The server signs only if it matches the hash of the draft rendered now. If the content changed in between – different data, a changed view – the signature is rejected (“The document has changed”).

The PDF

The PDF is rendered from the snapshot with:

• the signature image,
• the name of the signer and the time,
• the content hash in a verification line.

It is stored as a file of the owner record (FileStore, field __documents) named after the title and the date. Its own SHA-256 is stored with the document.

In the same transaction

• the document gets the status signed, the signer, the time, the PDF and its hash, the device (user agent) and the employee who handed over,
• the retention starts if it counts from the signature,
• signed() of the template runs,
• document.signed is audited with content hash, PDF hash, file and device.

If any step fails, nothing is stored.

Verifying a PDF

The SHA-256 of a PDF must match the pdf_hash of its document and the document.signed entry of the audit log. A changed PDF no longer matches.

Legal note

This is a simple electronic signature in the sense of eIDAS. Whether it is enough for a document is a decision of the organisation (e.g. data protection officer and works council). An electronic seal (a certificate of the organisation in the PDF) can be added to the renderer later without changing templates.