- What is lsnepomuceno/laravel-a1-pdf-sign used for?
- It is a Laravel package for digitally signing PDF documents with A1 (PKCS#12) x509 certificates, built on top of signet-pdf. It gives you a fluent API to sign files straight from a Storage disk, add visual signature stamps, apply PAdES profiles, and attach RFC 3161 timestamps with LTV. It targets ICP-Brasil compliant signatures in Brazilian applications. Everything runs on standard Laravel primitives such as Storage disks and the Gate.
- How do I install laravel-a1-pdf-sign?
- Install it with composer require lsnepomuceno/laravel-a1-pdf-sign and publish the config file using the package's vendor:publish tag. The package requires the openssl PHP extension and follows standard Laravel conventions: a service provider, publishable config, and Storage disks. Check the README and UPGRADE.md for the exact Laravel and PHP version matrix, since that is version specific.
- How do I sign a PDF stored on a Laravel Storage disk?
- You point the package at a disk and a path, so it reads the PDF from that disk instead of requiring an absolute filesystem path. Signing is exposed through a fluent API where you specify the certificate, the signing profile, and optionally a visual stamp, then write the signed output back to a disk. Because it works through the Storage abstraction, the same code path works for local and S3-style disks.
- How do I keep the A1 certificate and private key password out of my code?
- Keep the .pfx/.p12 A1 certificate and its password in environment variables or a secrets manager, never hardcoded in the repository. The package is designed so the private key stays outside the signing process: you hand it a file reference and password rather than manipulating the PKCS#12 bundle yourself. Treat certificate expiry and password rotation as operational concerns that surface as an exception at sign time.
- How can I test PDF signing in Laravel without a real certificate?
- The package is fake-friendly by design, so Process::fake(), Http::fake(), and Storage::fake() cover the external signing process, the timestamp or HTTP calls, and file I/O respectively. That lets you assert a signing job ran and produced the expected output without a real A1 certificate or an RFC 3161 authority in CI. Keep a separate, gated suite with a real certificate for end-to-end validation, including refusal and approval scenarios.
- Which PAdES profiles and timestamp options does laravel-a1-pdf-sign support?
- It supports PAdES signature profiles along with RFC 3161 timestamps and LTV (long-term validation), so signatures remain verifiable over time. That combination is what ICP-Brasil style compliance typically requires. The exact profile identifiers and configuration keys are documented in the package README.
- Can I add a visible signature stamp to the signed PDF?
- Yes, the package supports visual signature stamps on the page in addition to the cryptographic signature. You configure the appearance and placement as part of the fluent signing call. Remember the stamp is cosmetic: actual validation depends on the certificate chain, the PAdES profile, and any timestamp or LTV data.
- How does authorization work when an AI agent triggers a signature?
- Version 3.2.0 moves policy into Laravel's Gate, so you define abilities and your existing policies, role packages, and tenant scoping apply without a parallel authorization model. Be aware of the documented fail-open default: if the ability is not defined the check allows, which is safe for upgrades but risky in a new project, so define the abilities explicitly. An approval flow hook exists, but that control is procedural rather than cryptographic, so decide deliberately whether an unattended agent may sign at all.
- What breaks when upgrading laravel-a1-pdf-sign from 3.1.0 to 3.2.0?
- UPGRADE.md documents the path and no breaking changes are declared, but two behaviour deltas land without an opt-in. A 50 MB max_bytes ceiling applies even to configs published under 3.1.0, which can break workflows signing large scanned contracts, and gate-backed authorization defaults to allow when an ability is undefined. Republish and diff your config and define the gate abilities before deploying, and treat this as a minor version with migration chores rather than a drop-in patch.
- Is lsnepomuceno/laravel-a1-pdf-sign production ready?
- The positive signals are strong: 233 tests, PHPStan at max level, 100% type coverage, a real-certificate end-to-end scenario covering refusals and approvals, and a suite that stays green with the optional laravel/mcp and laravel/ai SDKs removed, so non-AI workloads take no runtime dependency. Open questions flagged in evaluation include audit records for gate decisions and signatures, a deny-by-default strict mode, how certificate expiry is surfaced, and single-maintainer bus factor. Verify the Laravel/PHP matrix and the optional SDK pins in your own CI rather than assuming they match your platform.