Flutter Guides Verify digital signatures

Read and Verify Digital Signatures

Use CPDFDocument to list signatures and verify their status. In these examples, document is an opened signed PDF.

import 'package:compdfkit_flutter/compdfkit.dart';

Read Signature Information

final signatures = await document.getDigitalSignatures();
for (final signature in signatures) {
  print(signature.fieldName);
  print(signature.pageIndex);
  print(signature.permissions);
  for (final signer in signature.signers) {
    for (final certificate in signer.certificates) {
      print(certificate.subject);
      print(certificate.issuer);
    }
  }
}

Results include the signature index, field name, page index, bounds, signer, signing date, reason, location, and permissions. An unsigned document returns an empty list.

Verify a Signature

if (signatures.isNotEmpty) {
  final signature = signatures.first;
  final result = await document.verifyDigitalSignature(
    signature.signatureIndex,
  );
  print('Signature valid: ${result.signatureValid}');
  print('Document unmodified: ${result.documentUnmodified}');
  print('Certificate trusted: ${result.certificateTrusted}');
  print('Certificate expired: ${result.certificateExpired}');
}

Pass signature.signatureIndex, not the signature's position in the returned list. Verification uses the saved signed file. If there are pending changes, explicitly save or discard them before checking the target file.

Result	Meaning
signatureValid	Signature verification result
documentUnmodified	Whether document integrity has been preserved since signing
certificateTrusted	Whether the signing certificate is trusted
certificateExpired	Whether the signing certificate has expired
timestampSource	Source of the time information
embeddedTimestampValid	Embedded timestamp verification result; may be null
timestampTrusted	Timestamp authority trust result; may be null
ltvEnabled	Document-level long-term validation material status

Display signature validity, certificate trust, and document modification status separately. Do not treat any one field as proof that all checks passed. See Timestamps and Long-Term Validation.

Android does not currently expose public details of post-signing modifications. Do not rely on modifications to enumerate every change; check the verification result for document integrity.