[RELEASE] iText 9.5.0

Author: iText-CI

barcodes/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.itextpdf</groupId>
     <artifactId>root</artifactId>
-    <version>9.4.0</version>
+    <version>9.5.0</version>
   </parent>
 
   <artifactId>barcodes</artifactId>

bouncy-castle-adapter/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.itextpdf</groupId>
     <artifactId>root</artifactId>
-    <version>9.4.0</version>
+    <version>9.5.0</version>
   </parent>
 
   <artifactId>bouncy-castle-adapter</artifactId>

bouncy-castle-adapter/src/main/java/com/itextpdf/bouncycastle/BouncyCastleFactory.java

@@ -345,6 +345,7 @@ This file is part of the iText (R) project.
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.bouncycastle.pqc.jcajce.provider.BouncyCastlePQCProvider;
 import org.bouncycastle.tsp.TSPException;
 import org.bouncycastle.tsp.TimeStampRequest;
 import org.bouncycastle.tsp.TimeStampRequestGenerator;
@@ -357,16 +358,19 @@ This file is part of the iText (R) project.
 public class BouncyCastleFactory implements IBouncyCastleFactory {
 
     private static final Provider PROVIDER = new BouncyCastleProvider();
+    private static final Provider PQC_PROVIDER = new BouncyCastlePQCProvider();
     private static final BouncyCastleTestConstantsFactory BOUNCY_CASTLE_TEST_CONSTANTS =
             new BouncyCastleTestConstantsFactory();
 
     private final SecurityProviderProxy securityProviderProxy;
+    private final SecurityProviderProxy pqcSecurityProviderProxy;
 
     /**
      * Creates {@link IBouncyCastleFactory} for usual bouncy-castle module.
      */
     public BouncyCastleFactory() {
         this.securityProviderProxy = new SecurityProviderProxy(PROVIDER);
+        this.pqcSecurityProviderProxy = new SecurityProviderProxy(PQC_PROVIDER);
     }
 
     /**
@@ -930,6 +934,14 @@ public String getProviderName() {
         return this.securityProviderProxy.getProviderName();
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public Provider getPqcProvider() {
+        return this.pqcSecurityProviderProxy.getProvider();
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -1555,6 +1567,18 @@ public IJcaContentSignerBuilder createJcaContentSignerBuilder(String algorithm)
         return new JcaContentSignerBuilderBC(new JcaContentSignerBuilder(algorithm));
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public IJcaContentSignerBuilder createJcaContentSignerBuilder(String signatureAlgorithm, String digestOid) {
+        if (digestOid == null) {
+            return createJcaContentSignerBuilder(signatureAlgorithm);
+        }
+        return new JcaContentSignerBuilderBC(new JcaContentSignerBuilder(signatureAlgorithm,
+                new AlgorithmIdentifier(new ASN1ObjectIdentifier(digestOid))));
+    }
+
     /**
      * {@inheritDoc}
      */

bouncy-castle-adapter/src/main/java/com/itextpdf/bouncycastle/cert/ocsp/BasicOCSPRespBC.java

@@ -24,10 +24,12 @@ This file is part of the iText (R) project.
 
 import com.itextpdf.bouncycastle.asn1.ASN1EncodableBC;
 import com.itextpdf.bouncycastle.asn1.ASN1ObjectIdentifierBC;
+import com.itextpdf.bouncycastle.asn1.x509.AlgorithmIdentifierBC;
 import com.itextpdf.bouncycastle.cert.X509CertificateHolderBC;
 import com.itextpdf.bouncycastle.operator.ContentVerifierProviderBC;
 import com.itextpdf.commons.bouncycastle.asn1.IASN1Encodable;
 import com.itextpdf.commons.bouncycastle.asn1.IASN1ObjectIdentifier;
+import com.itextpdf.commons.bouncycastle.asn1.x509.IAlgorithmIdentifier;
 import com.itextpdf.commons.bouncycastle.cert.IX509CertificateHolder;
 import com.itextpdf.commons.bouncycastle.cert.ocsp.IBasicOCSPResp;
 import com.itextpdf.commons.bouncycastle.cert.ocsp.IRespID;
@@ -174,4 +176,12 @@ public int hashCode() {
     public String toString() {
         return basicOCSPResp.toString();
     }
+
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public IAlgorithmIdentifier getSignatureAlgorithmID() {
+        return new AlgorithmIdentifierBC(basicOCSPResp.getSignatureAlgorithmID());
+    }
 }

bouncy-castle-connector/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.itextpdf</groupId>
     <artifactId>root</artifactId>
-    <version>9.4.0</version>
+    <version>9.5.0</version>
   </parent>
 
   <artifactId>bouncy-castle-connector</artifactId>

bouncy-castle-connector/src/main/java/com/itextpdf/bouncycastleconnector/BouncyCastleDefaultFactory.java

@@ -455,6 +455,11 @@ public String getProviderName() {
         throw new UnsupportedOperationException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
     }
 
+    @Override
+    public Provider getPqcProvider() {
+        throw new UnsupportedOperationException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
+    }
+
     @Override
     public IJceKeyTransEnvelopedRecipient createJceKeyTransEnvelopedRecipient(PrivateKey privateKey) {
         throw new UnsupportedOperationException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
@@ -812,6 +817,11 @@ public IJcaContentSignerBuilder createJcaContentSignerBuilder(String algorithm)
         throw new UnsupportedOperationException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
     }
 
+    @Override
+    public IJcaContentSignerBuilder createJcaContentSignerBuilder(String signatureAlgorithm, String digestOid) {
+        throw new UnsupportedOperationException(BouncyCastleLogMessageConstant.BOUNCY_CASTLE_DEPENDENCY_MUST_PRESENT);
+    }
+
     @Override
     public IJcaSignerInfoGeneratorBuilder createJcaSignerInfoGeneratorBuilder(
             IDigestCalculatorProvider digestCalcProviderProvider) {

bouncy-castle-fips-adapter/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.itextpdf</groupId>
     <artifactId>root</artifactId>
-    <version>9.4.0</version>
+    <version>9.5.0</version>
   </parent>
 
   <artifactId>bouncy-castle-fips-adapter</artifactId>

bouncy-castle-fips-adapter/src/main/java/com/itextpdf/bouncycastlefips/BouncyCastleFipsFactory.java

@@ -935,6 +935,15 @@ public String getProviderName() {
         return securityProviderProxy.getProviderName();
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public Provider getPqcProvider() {
+        throw new UnsupportedOperationException("Post-Quantum-Cryptography algorithms are not supported " +
+                "by BouncyCastle-FIPS yet.");
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -1560,6 +1569,14 @@ public IJcaContentSignerBuilder createJcaContentSignerBuilder(String algorithm)
         return new JcaContentSignerBuilderBCFips(new JcaContentSignerBuilder(algorithm));
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public IJcaContentSignerBuilder createJcaContentSignerBuilder(String signatureAlgorithm, String digestOid) {
+        return createJcaContentSignerBuilder(signatureAlgorithm);
+    }
+
     /**
      * {@inheritDoc}
      */

bouncy-castle-fips-adapter/src/main/java/com/itextpdf/bouncycastlefips/cert/ocsp/BasicOCSPRespBCFips.java

@@ -24,10 +24,12 @@ This file is part of the iText (R) project.
 
 import com.itextpdf.bouncycastlefips.asn1.ASN1EncodableBCFips;
 import com.itextpdf.bouncycastlefips.asn1.ASN1ObjectIdentifierBCFips;
+import com.itextpdf.bouncycastlefips.asn1.x509.AlgorithmIdentifierBCFips;
 import com.itextpdf.bouncycastlefips.cert.X509CertificateHolderBCFips;
 import com.itextpdf.bouncycastlefips.operator.ContentVerifierProviderBCFips;
 import com.itextpdf.commons.bouncycastle.asn1.IASN1Encodable;
 import com.itextpdf.commons.bouncycastle.asn1.IASN1ObjectIdentifier;
+import com.itextpdf.commons.bouncycastle.asn1.x509.IAlgorithmIdentifier;
 import com.itextpdf.commons.bouncycastle.cert.IX509CertificateHolder;
 import com.itextpdf.commons.bouncycastle.cert.ocsp.IBasicOCSPResp;
 import com.itextpdf.commons.bouncycastle.cert.ocsp.IRespID;
@@ -142,6 +144,14 @@ public IRespID getResponderId() {
         return new RespIDBCFips(basicOCSPResp.getResponderId());
     }
 
+    /**
+     * {@inheritDoc}
+     */
+    @Override
+    public IAlgorithmIdentifier getSignatureAlgorithmID() {
+        return new AlgorithmIdentifierBCFips(basicOCSPResp.getSignatureAlgorithmID());
+    }
+
     /**
      * Indicates whether some other object is "equal to" this one. Compares wrapped objects.
      */

brotli-compressor/README.md

@@ -0,0 +1,134 @@
+# Brotli Compression Strategy for iText
+
+## Overview
+
+This module provides a Brotli compression implementation for PDF streams in iText. Brotli is a modern compression
+algorithm that typically provides better compression ratios than traditional Flate/Deflate compression, especially for
+text-heavy content.
+
+## Important Notice
+
+**EXPERIMENTAL FEATURE**: Brotli compression for PDF streams is currently experimental and is not part of the official
+PDF specification. PDF documents compressed using Brotli may not be compatible with other PDF processors or readers. Use
+this feature with caution and only when you control both the generation and consumption of the PDF documents.
+
+## Features
+
+- Implementation of iText's `IStreamCompressionStrategy` interface
+- Automatic compression level mapping from iText's 0-9 scale to Brotli's 0-11 scale
+- Better compression ratios compared to Flate compression for most text content
+- Seamless integration with iText's PDF generation workflow
+
+## Requirements
+
+- iText 9.5.0 or later
+
+## Installation
+
+`brotli-compressor` is experimental so the artifacts are only available on iText's artifactory.
+
+Add the following dependency and config to your Maven project:
+
+```xml
+<repositories>
+  <repository>
+    <id>itext-releases</id>
+    <name>iText Repository - releases</name>
+    <url>https://repo.itextsupport.com/releases</url>
+  </repository>
+</repositories>
+
+<dependency>
+  <groupId>com.itextpdf</groupId>
+  <artifactId>brotli-compressor</artifactId>
+  <version>{itext.version.bigger.then.9.5.0}</version>
+</dependency>
+```
+
+
+
+## Usage
+
+To use Brotli compression for PDF streams, register the `BrotliStreamCompressionStrategy` with your PDF document:
+
+```java
+import com.itextpdf.BrotliStreamCompressionStrategy;
+import com.itextpdf.kernel.pdf.DocumentProperties;
+import com.itextpdf.kernel.pdf.IStreamCompressionStrategy;
+import com.itextpdf.kernel.pdf.PdfDocument;
+import com.itextpdf.kernel.pdf.PdfWriter;
+
+// Create a PDF document with Brotli compression
+DocumentProperties properties = new DocumentProperties();
+properties.registerDependency(IStreamCompressionStrategy .class, new BrotliStreamCompressionStrategy());
+        PdfDocument pdfDoc = new PdfDocument(new PdfWriter(outputStream), properties);
+
+// Continue with normal PDF generation
+// All streams will be compressed using Brotli
+```
+
+## Compression Levels
+
+The Brotli compression strategy automatically maps iText compression levels to Brotli levels:
+
+- iText levels: 0 (no compression) to 9 (best compression)
+- Brotli levels: 0 to 11
+- Mapping formula: `brotliLevel = round(iTextLevel * (11.0 / 9.0))`
+- Default level: 6 (used when the input level is out of range)
+
+You can set the compression level on the PDF writer:
+
+```java
+
+DocumentProperties properties = new DocumentProperties();
+properties.registerDependency(IStreamCompressionStrategy .class, new BrotliStreamCompressionStrategy());
+
+PdfWriter writer = new PdfWriter(outputStream);
+writer.setCompressionLevel(9); // Maximum compression
+
+PdfDocument pdfDoc = new PdfDocument(writer, properties);
+
+```
+
+## Decompression
+
+Supported out of the box in the iText kernel module
+
+The filter supports:
+
+- Standard Brotli decompression
+- Optional Brotli dictionary streams (specified via decode parameters)
+- Memory limits awareness through iText's MemoryLimitsAwareHandler
+
+## Compatibility Warning
+
+PDF documents using Brotli compression (`/BrotliDecode` filter) are currently not compliant with the official PDF
+specification (ISO 32000). These documents may:
+
+- Fail to open in standard PDF readers (Adobe Acrobat, Preview, etc.)
+- Not render correctly in web browsers
+- Be rejected by PDF validation tools
+- Not be processable by third-party PDF libraries
+
+This compression method should only be used in controlled environments where:
+
+- You generate and consume the PDF documents within your own system
+- You have verified compatibility with your specific PDF processing pipeline
+- You can handle potential incompatibilities with external tools
+
+## Brotli (brotli4j) Support in GraalVM Native Image
+
+This project uses **brotli4j**, which relies on a native Brotli library. When building a **GraalVM native image**, the
+native library is **not included automatically** and must be configured explicitly.
+
+### Native Image Configuration
+
+Add the following options to your `native-image` buildargs:
+
+```bash
+#add all the runtimes you are deploying to, iText test env does these so we have added these as a example
+-H:IncludeResources=lib/windows-x86_64/brotli.dll 
+-H:IncludeResources=lib/linux-aarch64/libbrotli.so
+
+--initialize-at-run-time=com.aayushatharva.brotli4j.Brotli4jLoader
+```