[BentoPDF](https://github.com/alam00000/bentopdf) for [bau-pm](https://src.bundespruefstelle.ch/magdev/bau-pm): about 120 PDF tools (edit, annotate, sign, fill forms, organise, merge, split, compress, convert, OCR) that run entirely in the browser, packaged so that a page of it talks to its own origin and to **nobody else**, plus the glue that hands a PDF from bau-pm into a tool and the result back.
This repository is public on purpose. BentoPDF is AGPL-3.0, and this is a modified version served over a network, so its source is offered to every user: each page of the running image links here, to the tag it was built from.
## What is in the image
- **BentoPDF built from source at a pinned commit** (`BENTOPDF_REF` and `BENTOPDF_COMMIT` in the `Dockerfile`; the build fails if the tag points elsewhere), with BentoPDF's own air-gapped build options: Simple Mode, German as the default language, every module path pointing at this image (`/wasm/...`), the CORS proxy switched off.
- **Every module BentoPDF would otherwise load from a CDN**, served from `/wasm/`: PyMuPDF and Ghostscript from BentoPDF's own repository at that commit, CoherentPDF, Tesseract with `deu`, `fra`, `ita` and `eng`, the OCR text-layer font and the PDF editor's Latin, Arabic and Hebrew fallback fonts from npm. `scripts/vendor.sh` packs each one and refuses the build when the registry's integrity differs from `vendor.lock`. The editor's CJK fonts (30 to 42 MB each) are left out; a document that needs them asks this server and gets a 404, never a third party.
- **A Content-Security-Policy without a single host**: BentoPDF's generated header file with every `http(s):` source taken out, `img-src` included (`scripts/finish.sh`, which fails the build if any host survives).
- **Two tools disabled** in `config/config.json`, because they cannot work without a third party: `digital-sign-pdf` (X.509 signing fetches certificate chains through a CORS proxy) and `timestamp-pdf` (an RFC 3161 timestamp needs an external timestamp authority).
- **The glue**, `glue/handoff.js`, added to every HTML page by `scripts/finish.sh`: the source link, the hand-in of a file from bau-pm, the hand-back of a result, the signing tool's flatten switch locked on, and no signature kept on the device. See the file's header for how each works.
- **No saved signatures, no image signatures.** PDF.js's signature dialog would save up to five signatures in the browser's `localStorage`, with *Unterschrift speichern* ticked by default, for this origin rather than for a bau-pm user: on a shared tablet the next person found the last one's signature one click away, a logout in bau-pm included (issue #1). The glue deletes the store on every page, refuses its writes, holds the box unticked and hides it, and hides the dialog's *Bild* tab, so a scanned signature never enters the tool. Signing means typing or drawing it, each time.
Nothing of BentoPDF's code is edited: its documented build arguments, its runtime `config.json`, its generated header file with fewer hosts, and our files beside its own.
## How bau-pm uses it
bau-pm runs the image as its `pdf-tools` service on an origin of its own (`PDF_TOOLS_ADDRESS`, e.g. `pdf.example.ch`), behind its Caddy, which asks Redmine before serving any page, so only logged-in users get in. The design, the login gate and the hand-off protocol are bau-pm's (`PLAN.md` §2.50 there); this image only needs to be reachable on port 8080. It is static nginx: about 3 MB of memory, and it writes nothing but its temp directories, so it runs with a read-only root and three tmpfs mounts owned by uid 101 (see bau-pm's `compose.yaml`).
## The gate
`test/zero-hosts.mjs` drives every tool page linked from the German overview in a phone-sized Chromium: it gives each a probe file its input accepts, presses its main button, and fails on any request to another origin and on any CSP violation (a blocked request is a tool that tried to call out). It also fails when the CSP names a host, and when an id in `config.json` does not name a real page or its page still offers the tool. CI runs it on every push (`.gitea/workflows/ci.yml`), and the release workflow runs it again on the image it is about to push.
It has teeth: fed the stock upstream image it fails with 115 findings (PyMuPDF, Pyodide and CoherentPDF from jsdelivr), and fed a misspelled disabled id it fails with "no page".
`test/signatures.mjs` is the second gate, run in the same step: on a browser that already holds a saved signature (a real entry, `test/fixtures/saved-signature.json`) the signing tool offers none and the store ends up empty; in its dialog the save box and the image tab are hidden; a typed signature, once placed, is not stored; and a fresh page, the next person, is offered nothing. Fed v0.1.0 it fails with 9 findings.
1. Set `BENTOPDF_REF` and `BENTOPDF_COMMIT` in the `Dockerfile` to the new tag and its commit.
2. Compare the module versions BentoPDF expects (`package-lock.json` for Tesseract, `.env.production` and `src/js/utils/wasm-provider.ts` for PyMuPDF, Ghostscript and CoherentPDF, `src/js/config/editor-fonts.ts` for the editor's fonts, `src/js/config/font-mappings.ts` for the OCR font) with `vendor.lock` and `scripts/vendor.sh`, and update both together: a new version needs its integrity from the registry (`npm view <pkg>@<version> dist.integrity`).
3. Read the diff of `scripts/generate-security-headers.mjs`, `nginx.conf` and `scripts/prepare-airgap.sh` upstream: a new directive, a new CDN or a new module layout is where a bump can break the zero-host promise.
4. Build, run the gate, and check the two disabled tools are still the only ones that need a third party.
5. Note the bump in `CHANGELOG.md`, release, and pin the new tag in bau-pm (`PDF_TOOLS_VERSION`).
## Known upstream issues (BentoPDF v2.8.8)
Measured on 2026-10-10 against the stock image as much as against this one, so they are upstream behaviour, not this packaging:
- **A signature drawn in the signing tool cannot be saved.** With real touch input, pdf.js's serialisation fails (`Cannot read properties of null (reading 'serialize')`): with *Flatten PDF* on the export fails visibly, with it off pdf.js silently saves the unsigned original. A typed signature saves.
- **Flattening drops a signature on some PDFs.** BentoPDF's `flattenAnnotations` removes any annotation without an appearance stream, and on a PDF rendered by rbpdf/TCPDF (bau_pm_preflight's Vorausmass sheet) the typed signature comes back without one. On a PDF pdf-lib has re-saved once, it is kept. With flatten off, the signature stays as an annotation.
bau_pm_preflight's tablet sign-off (its PRE-43) waits on these; see its `PLAN.md` §3.22.
## Licence
AGPL-3.0, as BentoPDF (`LICENSE`). The vendored modules keep their own licences; see `THIRD-PARTY.md`.
