From 66bf6af7baa9ba08b38cd2f2b2ad481ab22d37dc Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Sun, 30 Aug 2026 10:56:34 +0300
Subject: [PATCH] adjust verify pdf signature

---
 lib/verify_pdf_signature.rb | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/lib/verify_pdf_signature.rb b/lib/verify_pdf_signature.rb
index 3543c1c2..ec588e5e 100644
--- a/lib/verify_pdf_signature.rb
+++ b/lib/verify_pdf_signature.rb
@@ -16,7 +16,8 @@ module VerifyPdfSignature
       next [] if signatures.blank?
 
       verified_signatures = signatures.select { |e| verified_signature?(e, io, trusted_certs) }
-      last_signature = verified_signatures.max_by(&:signed_end)
+      trusted_signatures = verified_signatures.select { |e| trusted_signature?(e, trusted_certs) }
+      last_signature = (trusted_signatures.presence || verified_signatures).max_by(&:signed_end)
       has_unsigned_changes = last_signature && unsigned_changes?(document, io, last_signature.signed_end)
 
       signatures.map do |signature|
@@ -72,15 +73,25 @@ module VerifyPdfSignature
   end
 
   def certificate_message(pkcs7, trusted_certs)
-    public_key = signer_certificate(pkcs7)&.public_key&.to_der
-
-    if trusted_certs.any? { |e| e.public_key.to_der == public_key }
+    if trusted_certificate?(pkcs7, trusted_certs)
       MessageStruct.new(text: I18n.t('signed_with_trusted_certificate'), status: :success)
     else
       MessageStruct.new(text: I18n.t('signed_with_external_certificate'), status: :error)
     end
   end
 
+  def trusted_signature?(signature, trusted_certs)
+    trusted_certificate?(OpenSSL::PKCS7.new(signature.contents), trusted_certs)
+  rescue OpenSSL::PKCS7::PKCS7Error
+    false
+  end
+
+  def trusted_certificate?(pkcs7, trusted_certs)
+    public_key = signer_certificate(pkcs7)&.public_key&.to_der
+
+    trusted_certs.any? { |e| e.public_key.to_der == public_key }
+  end
+
   def verify_contents(pkcs7, signed_data, trusted_certs)
     return false if digest_algorithms(pkcs7).blank?