6 posts tagged with "normalization"

PDF/A and canonical PDF sound like they should solve the same problem. Both are about making PDFs more reliable. Both matter to compliance teams. Both show up when engineers start asking whether a document will still mean the same thing later.

But they are not the same thing.

PDF/A answers: Will this document remain renderable and self-contained for long-term preservation?

Canonical PDF answers: Will this input produce stable bytes, a stable hash, and a record of what changed?

Adobe is the name most people associate with PDF. Adobe PDF Services is a broad API suite for creating, converting, extracting, combining, and manipulating documents.

PDFCanon is narrower by design. It does not try to be a general PDF toolkit. It solves one infrastructure problem: turn untrusted PDFs into byte-stable, auditable canonical documents.

Glasswall and PDFCanon both handle PDFs in security-sensitive contexts. They answer different questions.

Glasswall is primarily a Content Disarm and Reconstruction platform. Its job is to neutralize risky file content before it reaches a user or system.

PDFCanon is a deterministic PDF normalization API. Its job is to turn untrusted PDFs into byte-stable canonical documents with stable SHA-256 hashes and machine-readable audit reports.

iLoveAPI and PDFCanon turn up in the same developer search, but they solve different problems.

iLoveAPI is a utility toolkit: merge, split, compress, convert, and manipulate documents.

PDFCanon is an integrity layer: normalize untrusted PDFs, remove structural drift, produce a stable SHA-256, and return an audit report.

qpdf is one of the best tools in the PDF ecosystem. It can repair structure, rewrite cross-reference tables, normalize object streams, decrypt files you are allowed to process, linearize documents, and expose a huge amount of the PDF's internal shape.

That makes it tempting to build your own PDF normalization service around it.

Sometimes that is exactly the right call. Other times, the hard part is not running qpdf. The hard part is proving that your output is deterministic, secure, auditable, and stable after the next toolchain upgrade.

I spent a long time figuring out why sha256sum invoice.pdf returns a different hash every time my accounting software re-exports "the same" document.

Turns out this is a fundamental property of the PDF format - and it quietly breaks a number of real-world systems that depend on stable file hashes: deduplication, audit trails, content-addressed storage, integrity verification.