Download the PHP package jeidison/signer-php without Composer

On this page you can find all versions of the php package jeidison/signer-php. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of jeidison/signer-php

Informations about the package signer-php

Signer PHP (PDF Module)

PHP library to digitally sign PDFs using A1 certificates (.pfx/.p12) with a simple, developer-friendly API.

What problem it solves

If you need backend PDF signing with cryptographic validity, this library provides a direct flow to:

Main features

Requirements

Installation

Install with Composer:

Usage

1) Basic signature

By default, the library applies a fallback visible appearance with a styled built-in stamp (internal image + default position) for simpler usage.

If you already have PKCS#12 in memory, use content instead of a file path:

2) Signature with metadata

3) Visible signature with background image

The image is placed in the n0 layer and scaled with contain logic (aspect ratio preserved, centred inside the bbox).

A base64-encoded string is also accepted:

3.1) Visible signature with signer's drawn image

To show the signer's drawn PNG on a specific area of the bbox (e.g. left half), use signatureImagePath and signatureImageFrame. This places the image as an external XObject in the n2 layer, independently from the n0 background.

3.2) Visible signature with custom content stream (n2 layer)

To embed arbitrary PDF text or graphics operators in the n2 layer — for example, the signer's name, date and reason — pass a SignatureAppearanceXObjectDto with the stream and its resource dictionary.

4) Disable default appearance (invisible signature)

5) Multiple signatures in the same PDF

Use the signed output as input for the next signature:

6) Signature with RFC3161 timestamp

To enable timestamping with default configuration, call withTimestamp(). In this case, the library uses a public default TSA (https://freetsa.org/tsr).

If you want a custom TSA only for this signing flow, use withTimestamp(new TimestampOptionsDto(...)). The hashAlgorithm field accepts HashAlgorithm (recommended) or a compatible string (sha256, sha384, sha512, sha224, sha1).

6.1) Override the default TSA for this flow

6.2) Disable default timestamping

6.3) Real TSA test and token generation (RFC3161)

For SaaS/API flows, you can run a real TSA routine (not only endpoint ping) using the timestamp facade:

6.3) Enable PAdES Baseline-B profile

6.4) Enable PAdES Baseline-T profile

In PAdES-T mode, timestamp must be active (for example, withTimestamp(...)).

6.5) Enable PAdES Baseline-LT profile

In PAdES-LT mode, besides timestamping, the library applies DSS enrichment with certificates extracted from CMS/RFC3161 signatures.

6.6) Enable PAdES Baseline-LTA profile

In PAdES-LTA mode, after LT enrichment, the library adds one extra archival Document Timestamp on the final document revision.

6.7) Define document certification (DocMDP)

Available levels:

Default behavior:

6.8) Brazil policy mode (br-iti)

This preset applies PAdES-LTA + DocMDP=2 + explicit policy timestamp.

To switch quickly to another TSA:

SERPRO support (homologation):

SERPRO helper example:

7) Protect PDF (block copy/print/modify)

8) Recommended flow: protect and sign in the same builder

Use this flow to avoid ordering mistakes and ensure the signature is applied on the already protected PDF.

9) Validate digital signatures in a PDF

9.1) Validation with trust chain (trust store)

9.2) Validation with Brazil policy mode (br-iti)

withBrazilPolicy(...) trust store precedence:

If trustStorePath is null, br-iti mode builds an ICP-Brasil trust anchors bundle automatically in local cache:

In br-iti mode, validation also verifies ICP-Brasil PAdES policy list (LPA):

You can override these URLs:

9.3) How to interpret trustValid and policyValid

Signature inspection via CLI

Besides signing, the project provides bin/signer-inspect for technical diagnostics of signed PDFs.

Basic usage

JSON output

Main inspection fields:

This inspection helps explain warnings reported by external validators (for example CRL/OCSP connectivity issues).

Environment diagnostics via CLI

Use bin/signer-doctor to quickly validate runtime dependencies (PHP version, required extensions, OpenSSL binary and openssl ts, qpdf, and temporary directory access).

Recommended flow (Brazil/ITI)

  1. Sign with --policy=br-iti using bin/signer-sign.
  2. Validate programmatically with Signer::validation()->withBrazilPolicy(...).
  3. Inspect final PDF with bin/signer-inspect --json.
  4. If revocation warnings appear, check revocation_risk_summary and endpoint availability for OCSP/CRL URLs.

Running with Docker Compose

This project already includes docker-compose.yml and Dockerfile for the app service.

1) Create external network (first time only)

2) Start the service

3) Install dependencies

4) Run tests

5) Stop environment

Sign using command line (CLI)

The project provides bin/signer-sign, bin/signer-inspect, and bin/signer-doctor.

Basic usage

Example with PAdES Baseline-B and explicit timestamp

Example with DocMDP certification

Example with Brazil policy in CLI

Example with PAdES Baseline-LT

Example with PAdES Baseline-LTA

Options help

Exceptions you should handle

Operational requirements

Implementation notes

Running tests

Code quality

All versions of signer-php with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
ext-openssl Version *
ext-curl Version *
ext-zlib Version *
ext-fileinfo Version *
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package jeidison/signer-php contains the following files

Loading the files please wait ...