mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-03 05:10:16 +03:00
Anthony Stirling
f945cc7dc6
The bundled signing test certificates expired at **07:41:10 UTC on 2026-08-26**. They were issued exactly one year earlier, so they went from fine to fatal mid-morning with no warning, and they take down `main` and every open branch, not just one PR. First casualty was the `docker-compose-tests` job on #6802, which started at 07:45: ``` java.security.cert.CertificateExpiredException: NotAfter: Wed Aug 26 07:41:10 UTC 2026 at CreateSignatureBase.checkValidity(CreateSignatureBase.java:159) at CertSignControllerTest.testSignPdfWithPkcs12(CertSignControllerTest.java:205) ``` ``` $ openssl x509 -in app/core/src/test/resources/certs/test-cert.pem -noout -dates notBefore=Aug 26 07:41:10 2025 GMT notAfter =Aug 26 07:41:10 2026 GMT ``` ## What was broken `CertSignControllerTest` (7 tests) and `PdfSigningServiceImplTest` (2) fail outright. `ValidateSignatureControllerMoreTest` and `CertificateValidationServiceMoreTest` read the same fixtures. Auditing the rest of the repo turned up three more time bombs that had not gone off yet: | Fixture | Was | Problem | |---|---|---| | `app/core/.../certs/test-cert.*` + `test-key.*` | expired 2026-08-26 | **already breaking every branch** | | `test-certs/valid-test.p12`, `valid-test.jks` (proprietary + frontend copies) | expire 2027-03-25 | same failure, seven months out | | `test-certs/not-yet-valid-test.p12` | valid **from** 2027-03-25 | becomes valid, so its test silently stops proving anything, on the same day | ## What this does **Regenerates every fixture** with the identical subject DN, alias, password, key size and signature algorithm as before, changing only the validity window. Nothing that any test asserts on has moved. - valid fixtures: `2025-01-01` to `2125-01-01` - `not-yet-valid-test.p12`: `2125-01-01` to `2126-01-01`, so it stays in the future - `expired-test.p12`: pinned to its permanently-past 2024 window **Adds `scripts/generate-test-certs.sh`** as the source of truth, so the next regeneration is one command instead of archaeology. It documents every DN, alias and password, pins the validity windows, and runs on Linux, macOS and Git Bash. **Adds two guard tests** that fail with an actionable message, naming the script, while there is still a year of runway: - `BundledTestCertificateExpiryTest` (app/core) checks all seven formats parse, are in their validity window, and have more than 365 days left - `BundledWorkflowCertificateExpiryTest` (proprietary) does the same for the valid pair, and additionally asserts the expired fixture is still expired and the not-yet-valid one is still in the future That last pair matters: those two fixtures exist to test a validity outcome, and each one silently stops testing anything once the clock passes its window. ## Verification Run locally against the regenerated bytes, on the exact content committed here: ``` ./gradlew :stirling-pdf:test --tests '*CertSignControllerTest*' --tests '*BundledTestCertificateExpiryTest*' \ --tests '*PdfSigningServiceImplTest*' --tests '*ValidateSignatureControllerMoreTest*' \ --tests '*CertificateValidationServiceMoreTest*' BUILD SUCCESSFUL ./gradlew :proprietary:test --tests '*BundledWorkflowCertificateExpiryTest*' --tests '*CertificateValidationIntegrationTest*' \ --tests '*SigningFinalizationServiceMoreTest*' --tests '*ServerCertificateServiceTest*' \ --tests '*CertificateSubmissionValidatorTest*' --tests '*WorkflowSessionServiceTest*' BUILD SUCCESSFUL ``` `spotlessCheck` passes on both modules.
Stirling PDF - The Open-Source PDF Platform
Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
Key Capabilities
- Everywhere you work - Desktop client, browser UI, and self-hosted server with a private API.
- 50+ PDF tools - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
- Automation & workflows - No-code pipelines direct in UI with APIs to process millions of PDFs.
- Enterprise‑grade - SSO, auditing, and flexible on‑prem deployments.
- Developer platform - REST APIs available for nearly all tools to integrate into your existing systems.
- Global UI - Interface available in 40+ languages.
For a full feature list, see the docs: https://docs.stirlingpdf.com
Quick Start
docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
Then open: http://localhost:8080
For full installation options (including desktop and Kubernetes), see our Documentation Guide.
Resources
Support
- Community: Discord
- Bug Reports: GitHub Issues
Contributing
We welcome contributions! Please see CONTRIBUTING.md for guidelines.
This project uses Task as a unified command runner for all build, dev, and test commands. Run task dev to get started running the editor, run task to see the most common commands, or see the Developer Guide for full details.
For adding translations, see the Translation Guide.
License
Stirling PDF is open-core. See LICENSE for details.