Update jsignpdf-php in LibreSign 3rdparty #8411

Context

LibreSign ships PHP dependencies through the LibreSign/3rdparty submodule.

The jsignpdf/jsignpdf-php package is currently included there, but the locked version is still v3.0.0.

New upstream work adds the JSignPdf 3.2.0 runtime and the typed API required for existing PDF signature fields.

LibreSign should update its vendored jsignpdf-php package only after that upstream work is available in a released package version.

Dependencies

This issue is blocked by:

• Update default JSignPdf runtime to 3.2.0 JSignPdf/jsignpdf-php#63 — updates the default JSignPdf runtime to 3.2.0;
• Add typed API for existing PDF signature fields JSignPdf/jsignpdf-php#62 — adds the typed PHP API for existing PDF signature fields.

Both upstream issues need to be completed and included in a released jsignpdf/jsignpdf-php version before this dependency update can be finished.

Do not start the final dependency bump using an arbitrary development commit only to bypass these blockers.

Goal

Update jsignpdf/jsignpdf-php in LibreSign/3rdparty to a released version that includes the required upstream changes, then update the 3rdparty submodule reference in LibreSign.

This issue is only about updating the vendored dependency.

Do not implement existing signature-field support in LibreSign here.

Current state

LibreSign/3rdparty currently requires:

"jsignpdf/jsignpdf-php": "^3.0.0"

and the current composer.lock resolves:

v3.0.0

The update must use a released version that contains both upstream changes listed in the Dependencies section.

Update LibreSign/3rdparty

Follow the update process documented in:

https://github.com/LibreSign/3rdparty/blob/main/README.md

In the LibreSign/3rdparty repository:

1. update the jsignpdf/jsignpdf-php version constraint if required;
2. run:

composer update jsignpdf/jsignpdf-php

3. remove the generated dependency directories as described in the README:

rm -rf ./composer/*/ ./vendor/*/

4. regenerate the vendored dependencies:

composer install --no-dev

5. clean ignored generated files as documented:

git clean -X -d -f

6. regenerate the autoloader:

composer dump-autoload

7. review the generated changes;
8. run the available checks;
9. open a PR in LibreSign/3rdparty.

Do not manually edit files generated under composer/.

They must be generated by the existing Composer/PHP-Scoper process.

Verify the dependency update

Confirm that:

• composer.lock contains the expected jsignpdf/jsignpdf-php version;
• the selected version contains the changes from Update default JSignPdf runtime to 3.2.0 JSignPdf/jsignpdf-php#63 and Add typed API for existing PDF signature fields JSignPdf/jsignpdf-php#62;
• the scoped package is regenerated under composer/jsignpdf/jsignpdf-php;
• PHP-Scoper completes without errors;
• no unrelated dependencies are updated unless required by Composer;
• generated namespaces continue to use the LibreSign vendor prefix.

If composer update jsignpdf/jsignpdf-php changes unrelated dependencies, review why before including them.

Update the LibreSign submodule

After the LibreSign/3rdparty PR is ready, test it from LibreSign using the process described in the same README.

Create a LibreSign branch such as:

3rdparty/jsignpdf-php

Then point the 3rdparty submodule to the commit from the LibreSign/3rdparty PR:

cd 3rdparty
git checkout <commit-sha>
cd ..
git add 3rdparty
git commit -s

Push the LibreSign branch and open a PR.

After the LibreSign/3rdparty PR is merged, update the submodule again to the merge commit and amend the LibreSign commit:

cd 3rdparty
git checkout <merge-commit-sha>
cd ..
git add 3rdparty
git commit --amend
git push --force-with-lease

Validation in LibreSign

Run the LibreSign CI with the updated 3rdparty submodule.

Existing signing behavior must continue to work.

At minimum, verify that:

• PHP autoloading works with the scoped package;
• existing JSignPdf-based signing tests still pass;
• no namespace or PHP-Scoper regression is introduced;
• existing signing behavior is unchanged.

This issue does not need to add support for existing PDF signature fields to LibreSign.

That integration belongs in a separate issue.

Scope

This issue updates the dependency only.

Do not:

• implement getSignatureFields() usage in LibreSign;
• change the LibreSign field domain;
• add existing-signature-field workflow behavior;
• change signing-engine interfaces;
• modify upstream jsignpdf-php;
• manually edit generated scoped dependency files.

Good first issue

The dependency update process is already documented in LibreSign/3rdparty/README.md.

The upstream implementation work is tracked separately and must be completed first.

After the blockers are resolved, the work here is mainly:

1. update one Composer dependency;
2. regenerate the scoped dependencies;
3. open the LibreSign/3rdparty PR;
4. update the LibreSign submodule pointer;
5. validate the existing CI.

No LibreSign architecture decision is required.

If the dependency update causes unexpected compatibility or PHP-Scoper problems, report them before expanding the scope.

Done when

• Update default JSignPdf runtime to 3.2.0 JSignPdf/jsignpdf-php#63 is completed and included in a released package version.
• Add typed API for existing PDF signature fields JSignPdf/jsignpdf-php#62 is completed and included in a released package version.
• LibreSign/3rdparty uses that released jsignpdf/jsignpdf-php version.
• composer.lock contains the expected version.
• Scoped dependencies are regenerated using the documented process.
• No generated scoped files were manually edited.
• The LibreSign/3rdparty PR is merged.
• LibreSign points its 3rdparty submodule to the merged commit.
• LibreSign CI passes with the updated dependency.
• Existing signing behavior continues to work.
• No existing-signature-field LibreSign behavior is implemented in this issue.