v4.3.4: release notes

Redirect stderr->stdout to hopefully make GS output easier to work with
overall, since the previous code didn’t seem to account for mixed used
properly.

.gitignore

@@ -1,7 +1,7 @@
 # Development environment
 *.pyc
 *.sublime-*
-venv-*/
+venv*/
 pyvenv.cfg
 tasks.py
 

MANIFEST.in

@@ -14,6 +14,7 @@ include .dockerignore
 # tests
 include pytest.ini
 recursive-include tests *.jpg
+recursive-include tests *.png
 recursive-include tests *.pdf
 recursive-include tests *.py
 recursive-include tests *.rst

RELEASE_NOTES.rst

@@ -3,6 +3,25 @@ RELEASE NOTES
 
 OCRmyPDF uses `semantic versioning <http://semver.org/>`_.
 
+v4.3.4:
+=======
+
+-  Fixed "decimal.InvalidOperation: quantize result has too many digits" for high DPI images
+
+
+v4.3.3:
+=======
+
+-  Fixed PDF/A creation with Ghostscript 9.20 properly
+-  Fixed an exception on inline stencil masks with a missing optional parameter
+
+
+v4.3.2:
+=======
+
+-  Fixed a PDF/A creation issue with Ghostscript 9.20 (note: this fix did not actually work)
+
+
 v4.3.1:
 =======
 
@@ -276,7 +295,7 @@ Changes
 -------
 
 -  Default output format is now PDF/A-2b instead of PDF/A-1b
--  Python 3.5 and OS X El Capitan are now supported platforms - no changes were
+-  Python 3.5 and macOS El Capitan are now supported platforms - no changes were
    needed to implement support
 -  Improved some error messages related to missing input files
 -  Fixed issue #20 - uppercase .PDF extension not accepted

docs/index.rst

@@ -20,6 +20,7 @@ Contents:
    installation
    languages
    cookbook
+   security
    errors
 
 

docs/security.rst

@@ -0,0 +1,44 @@
+PDF Security Issues
+===================
+
+	OCRmyPDF should only be used on PDFs you trust. It is not designed to protect you against malware. 
+
+Recognizing that many users have an interest in handling PDFs and applying OCR to PDFs they did not generate themselves, this article discusses the security implications of PDFs and how users can protect themselves.
+
+The disclaimer applies: this software has no warranties of any kind.
+
+PDFs may contain malware
+------------------------
+
+PDF is a rich, complex file format. The official PDF 1.7 specification, ISO 32000:2008, is hundreds of packages long and references several annexes each of which are similar in length. PDFs can contain video, audio, JavaScript and other programming, and forms. In some cases, they can open internet connections to pre-selected URLs. All of these possible attack vectors.
+
+In short, PDFs `may contain viruses <https://security.stackexchange.com/questions/64052/can-a-pdf-file-contain-a-virus>`_.
+
+This `article <https://theinvisiblethings.blogspot.ca/2013/02/converting-untrusted-pdfs-into-trusted.html>`_ describes a method which allows potentially hostile PDFs to be viewed and rasterized safely in a disposable virtual machine. A trusted PDF created in this manner is converted to images and loses all information making it searchable. OCRmyPDF could be used restore searchability.
+
+How OCRmyPDF processes PDFs
+---------------------------
+
+OCRmyPDF must open and interpret your PDF in order to insert an OCR layer. First, it runs all PDFs through `qpdf <https://github.com/qpdf/qpdf>`_, a program that repairs PDFs with syntax errors. This is done because, in the author's experience, a significant number of PDFs in the wild especially those created by scanners are not well-formed files. qpdf makes it more likely that OCRmyPDF will succeed, but offers no security guarantees. qpdf is also used to split the PDF into single page PDFs.
+
+After qpdf, OCRmyPDF examines each page using `PyPDF2 <https://github.com/mstamy2/PyPDF2>`_. This library also has no warranties or guarantees.
+
+Finally, OCRmyPDF rasterizes each page of the PDF using `Ghostscript <http://ghostscript.com/>`_ in ``-dSAFER`` mode. 
+
+Depending on the options specified, OCRmyPDF may graft the OCR layer into the existing PDF or it may essentially reconstruct ("re-fry") a visually identical PDF that may be quite different at the binary level. That said, OCRmyPDF is not a tool designed for sanitizing PDFs.
+
+Using OCRmyPDF online
+---------------------
+
+OCRmyPDF is not designed to be deployed "as a service", in a setting where a user/attacker could upload a file for OCR processing online. It is not designed to be secure in this case.
+
+Abbyy Cloud OCR is a viable commercial alternative with a web services API. The author also provides professional services that include OCR and building databases around PDFs, and is happy to provide consultation.
+
+Password protection, digital signatures and certification
+---------------------------------------------------------
+
+OCRmyPDF cannot remove password protection from a PDF. ``qpdf``, one of its dependencies, has this capability. After OCR is applied, password protection is not permitted on PDF/A documents but the file can be converted to regular PDF.
+
+Many programs exist which are capable of inserting an image of someone's signature. On its own, this offers no security guarantees. It is trivial to remove the signature image and apply it to other files. This practice offers no real security.
+
+Important documents can be digitally signed and certified to attest to their authorship. OCRmyPDF cannot do this. Open source tools such as pdfbox (Java) have this capability as does Adobe Acrobat. 

ocrmypdf/__main__.py

@@ -418,6 +418,7 @@ class WrappedLogger:
             self.logger.critical(*args, **kwargs)
 
 _log = WrappedLogger(_logger, _logger_mutex)
+_log.debug('ocrmypdf ' + VERSION)
 
 
 def re_symlink(input_file, soft_link_name, log=_log):
@@ -1282,7 +1283,7 @@ def merge_pages_ghostscript(
 
     pdf_pages = sorted(input_files, key=input_file_order)
     log.debug("Final pages: " + "\n".join(pdf_pages))
-    ghostscript.generate_pdfa(pdf_pages, output_file, options.jobs or 1)
+    ghostscript.generate_pdfa(pdf_pages, output_file, log, options.jobs or 1)
 
 
 @posttask(partial(done_task, 'merge_pages_qpdf'))

ocrmypdf/ghostscript.py

@@ -2,7 +2,7 @@
 # © 2015 James R. Barlow: github.com/jbarlow83
 
 from tempfile import NamedTemporaryFile
-from subprocess import Popen, PIPE, check_call
+from subprocess import Popen, PIPE, STDOUT, check_call
 from shutil import copy
 from . import get_program
 from .pdfa import SRGB_ICC_PROFILE
@@ -25,16 +25,13 @@ def rasterize_pdf(input_file, output_file, xres, yres, raster_device, log,
             input_file
         ]
 
-        p = Popen(args_gs, close_fds=True, stdout=PIPE, stderr=PIPE,
+        p = Popen(args_gs, close_fds=True, stdout=PIPE, stderr=STDOUT,
                   universal_newlines=True)
-        stdout, stderr = p.communicate()
-        if stdout:
-            if 'error' in stdout:
-                log.error(stdout)  # Ghostscript puts errors in stdout
-            else:
-                log.debug(stdout)
-        if stderr:
-            log.error(stderr)
+        stdout, _ = p.communicate()
+        if 'error' in stdout:
+            log.error(stdout)  # Ghostscript puts errors in stdout
+        else:
+            log.debug(stdout)
 
         if p.returncode == 0:
             copy(tmp.name, output_file)
@@ -42,7 +39,7 @@ def rasterize_pdf(input_file, output_file, xres, yres, raster_device, log,
             log.error('Ghostscript rendering failed')
 
 
-def generate_pdfa(pdf_pages, output_file, threads=1):
+def generate_pdfa(pdf_pages, output_file, log, threads=1):
     with NamedTemporaryFile(delete=True) as gs_pdf:
         args_gs = [
             get_program("gs"),
@@ -56,9 +53,30 @@ def generate_pdfa(pdf_pages, output_file, threads=1):
             "-sProcessColorModel=DeviceRGB",
             "-dJPEGQ=95",
             "-dPDFA=2",
-            "-sPDFACompatibilityPolicy=2",
+            "-dPDFACompatibilityPolicy=1",
             "-sOutputFile=" + gs_pdf.name,
         ]
         args_gs.extend(pdf_pages)
-        check_call(args_gs)
-        copy(gs_pdf.name, output_file)
+        p = Popen(args_gs, close_fds=True, stdout=PIPE, stderr=STDOUT,
+                  universal_newlines=True)
+        stdout, _ = p.communicate()
+
+        if 'error' in stdout:
+            log.error(stdout)
+        elif 'overprint mode not set' in stdout:
+            # Unless someone is going to print PDF/A documents on a
+            # magical sRGB printer I can't see the removal of overprinting
+            # being a problem....
+            log.debug(
+                "Ghostscript had to remove PDF 'overprinting' from the "
+                "input file to complete PDF/A conversion. "
+                )
+        else:
+            log.debug(stdout)
+
+        if p.returncode == 0:
+            # Ghostscript does not change return code when it fails to create
+            # PDF/A - check PDF/A status elsewhere
+            copy(gs_pdf.name, output_file)
+        else:
+            log.error('Ghostscript PDF/A failed')

ocrmypdf/pageinfo.py

@@ -2,7 +2,7 @@
 # © 2015 James R. Barlow: github.com/jbarlow83
 
 from subprocess import Popen, PIPE
-from decimal import Decimal, getcontext
+from decimal import Decimal
 from math import hypot
 import re
 import sys
@@ -232,7 +232,10 @@ def _find_page_inline_images(page, pageinfo, contentsinfo):
             image['bpc'] = inline.settings['/BPC']
         else:
             image['bpc'] = 8
-        image['color'] = FRIENDLY_COLORSPACE.get(inline.settings['/CS'], '-')
+        if '/CS' in inline.settings:
+            image['color'] = FRIENDLY_COLORSPACE.get(inline.settings['/CS'], '-')
+        else:
+            image['color'] = '-'
         image['comp'] = FRIENDLY_COMP.get(image['color'], '?')
         if '/F' in inline.settings:
             filter_ = inline.settings['/F']
@@ -327,9 +330,9 @@ def _find_page_regular_images(page, pageinfo, contentsinfo):
             image['dpi_h'] = max(dpi_h, image.get('dpi_h', 0))
 
         DPI_PREC = Decimal('1.000')
+        dpi = Decimal(image['dpi_w'] * image['dpi_h']).sqrt()
         image['dpi_w'] = Decimal(image['dpi_w']).quantize(DPI_PREC)
         image['dpi_h'] = Decimal(image['dpi_h']).quantize(DPI_PREC)
-        dpi = Decimal(image['dpi_w'] * image['dpi_h']).sqrt()
         image['dpi'] = dpi.quantize(DPI_PREC)
         yield image
 
@@ -404,7 +407,6 @@ def _pdf_get_pageinfo(infile, pageno: int):
 
 def pdf_get_all_pageinfo(infile):
     pdf = pypdf.PdfFileReader(infile)
-    getcontext().prec = 6
     return [_pdf_get_pageinfo(infile, n) for n in range(pdf.numPages)]
 
 

ocrmypdf/pdfa.py

@@ -140,21 +140,20 @@ def file_claims_pdfa(filename):
                 'conformance': 'No XMP metadata'}
 
     pdfa_dict = {attr.localName: attr.value for attr in pdfa_nodes}
-    pdfa_dict['pass'] = False
-    pdfa_dict['output'] = 'pdf'
-    if pdfa_dict:
-        part_conformance = pdfa_dict['part'] + pdfa_dict['conformance']
-        valid_part_conforms = {'1A', '1B', '2A', '2B', '2U', '3A', '3B', '3U'}
+    if not pdfa_dict:
+        return {'pass': False, 'output': 'pdf',
+                'conformance': 'No XMP metadata'}
 
-        conformance = 'PDF/A-{}'.format(
-            part_conformance)
+    part_conformance = pdfa_dict['part'] + pdfa_dict['conformance']
+    valid_part_conforms = {'1A', '1B', '2A', '2B', '2U', '3A', '3B', '3U'}
 
-        if part_conformance in valid_part_conforms:
-            pdfa_dict['pass'] = True
-            pdfa_dict['output'] = 'pdfa'
-        pdfa_dict['conformance'] = conformance
-    else:
-        pdfa_dict['conformance'] = 'PDF'
+    conformance = 'PDF/A-{}'.format(
+        part_conformance)
+
+    if part_conformance in valid_part_conforms:
+        pdfa_dict['pass'] = True
+        pdfa_dict['output'] = 'pdfa'
+    pdfa_dict['conformance'] = conformance
 
     return pdfa_dict
 

setup.py

@@ -191,7 +191,7 @@ setup(
     url='https://github.com/jbarlow83/OCRmyPDF',
     author='James R. Barlow',
     author_email='jim@purplerock.ca',
-    license='Public Domain',
+    license='MIT',
     packages=['ocrmypdf'],
     keywords=['PDF', 'OCR', 'optical character recognition', 'PDF/A', 'scanning'],
     classifiers=[

tests/resources/README.rst

@@ -31,6 +31,9 @@ In some cases they were converted from one image format to another without other
     *   - LinnSequencer.jpg, linn.pdf, linn.txt
         - `Wikimedia: LinnSequencer`_
         - Creative Commons BY-SA 3.0
+    *   - typewriter.png, 2400dpi.pdf
+        - `Wikimedia: Triumph typewrtier text Linzensoep`_
+        * Creative Commons BY-SA 2.5
 
 
 Files generated for this project
@@ -104,4 +107,6 @@ These test resources are assemblies from other previously mentioned files, relea
 
 .. _`Wikimedia: JPEG2000 Lichtenstein`: https://en.wikipedia.org/wiki/JPEG_2000#/media/File:Jpeg2000_2-level_wavelet_transform-lichtenstein.png
 
-.. _`Linux (Wikipedia Article)`: https://de.wikipedia.org/wiki/Linux 
+.. _`Linux (Wikipedia Article)`: https://de.wikipedia.org/wiki/Linux 
+
+.. _`Wikimedia: Triumph typewrtier text Linzensoep`: https://commons.wikimedia.org/wiki/File:Triumph.typewriter_text_Linzensoep.gif

tests/spoof/gs_feature_elision.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+import sys
+import os
+from subprocess import check_call
+
+"""Replicate one type of Ghostscript feature elision warning during
+PDF/A creation."""
+
+
+def real_ghostscript(argv):
+    gs_args = ['gs'] + argv[1:]
+    os.execvp("gs", gs_args)
+    return  # Not reachable
+
+
+elision_warning = """GPL Ghostscript 9.20: Setting Overprint Mode to 1
+not permitted in PDF/A-2, overprint mode not set"""
+
+
+def main():
+    if '--version' in sys.argv:
+        print('9.20')
+        print('SPOOFED: ' + os.path.basename(__filename__))
+        sys.exit(0)
+
+    gs_args = ['gs'] + sys.argv[1:]
+    check_call(gs_args)
+
+    if '-sDEVICE=pdfwrite' in sys.argv[1:]:
+        print(elision_warning)
+
+    sys.exit(0)
+
+if __name__ == '__main__':
+    main()

tests/spoof/gs_pdfa_failure.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+import sys
+import os
+
+"""Replicate Ghostscript PDF/A conversion failure by suppressing some
+arguments"""
+
+
+def real_ghostscript(argv):
+    gs_args = ['gs'] + argv[1:]
+    os.execvp("gs", gs_args)
+    return  # Not reachable
+
+
+def main():
+    if '--version' in sys.argv:
+        print('9.20')
+        print('SPOOFED: ' + os.path.basename(__filename__))
+        sys.exit(0)
+
+    # Unless some argument is calling for PDFA generation, forward to
+    # real ghostscript
+    if not any(arg.startswith('-dPDFA') for arg in sys.argv):
+        real_ghostscript(sys.argv)
+        return
+
+    # Remove the two arguments that tell ghostscript to create a PDF/A
+    # Does not remove the Postscript definition file - not necessary
+    # to cause PDF/A creation failure
+    argv = []
+    for arg in sys.argv:
+        if arg.startswith('-dPDFA'):
+            continue
+        elif arg.startswith('-dPDFACompatibilityPolicy'):
+            continue
+        argv.append(arg)
+
+    real_ghostscript(argv)
+
+
+if __name__ == '__main__':
+    main()

tests/test_main.py

@@ -60,6 +60,7 @@ def check_ocrmypdf(input_basename, output_basename, *args, env=None):
     output_file = _outfile(output_basename)
 
     p, out, err = run_ocrmypdf(input_basename, output_basename, *args, env=env)
+    print(err)  # ensure py.test collects the output, use -s to view
     if p.returncode != 0:
         print('stdout\n======')
         print(out)
@@ -90,41 +91,56 @@ def run_ocrmypdf(input_basename, output_basename, *args, env=None):
     return p, out, err
 
 
-def spoof(replace_program, with_spoof):
+def spoof(**kwargs):
     """Modify environment variables to override subprocess executables
 
+    spoof(program1='replacement', ...)
+
     Before running any executable, ocrmypdf checks the environment variable
     OCRMYPDF_PROGRAMNAME to override default program name/location, e.g.
     OCRMYPDF_GS redirects from the system path Ghostscript ("gs") to elsewhere.
+
     """
     env = os.environ.copy()
-    spoofer = os.path.join(SPOOF_PATH, with_spoof)
-    if not os.access(spoofer, os.X_OK):
-        os.chmod(spoofer, 0o755)
-    env['OCRMYPDF_' + replace_program.upper()] = spoofer
+
+    for replace_program, with_spoof in kwargs.items():
+        spoofer = os.path.join(SPOOF_PATH, with_spoof)
+        if not os.access(spoofer, os.X_OK):
+            os.chmod(spoofer, 0o755)
+        env['OCRMYPDF_' + replace_program.upper()] = spoofer
     return env
 
 
 @pytest.fixture
 def spoof_tesseract_noop():
-    return spoof('tesseract', 'tesseract_noop.py')
+    return spoof(tesseract='tesseract_noop.py')
 
 
 @pytest.fixture
 def spoof_tesseract_cache():
     if running_in_docker():
         return os.environ.copy()
-    return spoof('tesseract', "tesseract_cache.py")
+    return spoof(tesseract="tesseract_cache.py")
 
 
 @pytest.fixture
 def spoof_tesseract_crash():
-    return spoof('tesseract', 'tesseract_crash.py')
+    return spoof(tesseract='tesseract_crash.py')
 
 
 @pytest.fixture
 def spoof_tesseract_big_image_error():
-    return spoof('tesseract', 'tesseract_big_image_error.py')
+    return spoof(tesseract='tesseract_big_image_error.py')
+
+
+@pytest.fixture
+def spoof_no_tess_no_pdfa():
+    return spoof(tesseract='tesseract_noop.py', gs='gs_pdfa_failure.py')
+
+
+@pytest.fixture
+def spoof_no_tess_pdfa_warning():
+    return spoof(tesseract='tesseract_noop.py', gs='gs_feature_elision.py')
 
 
 def test_quick(spoof_tesseract_cache):
@@ -722,3 +738,20 @@ def test_rotated_skew_timeout():
         in_pageinfo['height_pixels'] == out_pageinfo['width_pixels'], \
         "Expected page rotation to be baked in"
 
+
+def test_ghostscript_pdfa_failure(spoof_no_tess_no_pdfa):
+    p, out, err = run_ocrmypdf(
+        'ccitt.pdf', 'test_pdfa_failure.pdf',
+        env=spoof_no_tess_no_pdfa)
+    assert p.returncode == 4, "Expected return code 4 when PDF/A fails"
+
+
+def test_ghostscript_feature_elision(spoof_no_tess_pdfa_warning):
+    check_ocrmypdf('ccitt.pdf', 'test_feature_elision.pdf',
+                   env=spoof_no_tess_pdfa_warning)
+
+
+def test_very_high_dpi(spoof_tesseract_cache):
+    "Checks for a Decimal quantize error with high DPI, etc"
+    check_ocrmypdf('2400dpi.pdf', 'test_2400dpi.pdf',
+                   env=spoof_tesseract_cache)