Copy from IronPolyglot on 2026-09-03

[mee-ironsoftware]

This PR is auto-generated by iron-software/IronPolyglot.

[ikkyuland]

Status: COMMENT (non-blocking) (bot)

Fix for PDF-2253: cold-session signature verification silently returned false. Root cause was that getVerifiedSignatures relied on the server fetching the PDF bytes from its own document store, which is empty on the first operation of a fresh engine session. The fix streams the document bytes to the server as DataChunks, matching the pattern the other Pdfium* stream methods already use. The imports it needs (ByteString, Iterator, Utils_Util) are all already present, so it compiles. The direction is right; findings below are non-blocking.

Findings not anchored to a changed line

• ⚠️ non-blocking (test hermeticity) — RCTests2026_09.java Test06_PDF2253_DigicertTimestamp_ColdSessionVerifies depends on the live TSA http://timestamp.digicert.com, so it needs outbound network and will be flaky/red in an offline CI agent. The comment also says to run it "IN ISOLATION (its own JVM)" to hit the cold-session path, but nothing enforces that — run in a shared JVM after another document op, it silently stops exercising the regression and becomes a false-green. Consider a category/tag that pins JVM-per-method (surefire forkCount/forkEvery) or documenting the config that guarantees it.
• ℹ️ nit — same test: reloaded (PdfDocument.fromFile) is never closed, unlike pdfPath which is cleaned up in finally. Minor per-iteration resource leak in a 3-attempt loop; close it (or try-with-resources) for symmetry.

[ikkyuland]

⚠️ non-blocking — why false (non-incremental) here? getBytes(doc, isIncremental) is called with false, so the server reserializes the document rather than returning its incremental bytes. For an unmodified, freshly-reloaded document (the path the new test covers) that is fine. But signature ByteRanges are byte-offset-sensitive: if getVerifiedSignatures is ever called on a document with in-memory changes (e.g. signed but not yet saved), a full reserialization can shift offsets and invalidate the very signature being verified. The sibling getBytes(doc, true) incremental form is used elsewhere in this class. Please confirm false is deliberate and that the in-memory-modified case is either impossible here or covered — the added test only exercises the reloaded-unmodified path. (bot)