Write the embedded file CheckSum as a hex string of the raw MD5 bytes

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ### Unreleased
 
+- Fix the `/CheckSum` of an embedded file being written as a 32-character literal string of hex digits, instead of the 16 raw bytes of the MD5 digest the PDF specification requires, which validators such as veraPDF and pdfcpu reject. It is now written as a hex string of those bytes. Fixes #1531
 - Fix `doc.table()` parsing a font passed as binary data (e.g. registered with `registerFont(name, uint8Array)`) again for every cell, when it restores the font after measuring and drawing the cell, which made tables with such fonts slower. A font loaded from the same `Uint8Array` is now reused without parsing it again
 - Add `lineBreak: 'whitespace'` to `doc.text()`, which breaks a line only at whitespace, a soft hyphen or a zero-width space. The Unicode line breaking rules the wrapper follows also allow a break after a hyphen or a slash, so `design-system` or `https://github.com/foliojs/pdfkit` could be cut at a line end, and a text extractor that joins the lines, such as a résumé parser, reads two words
 - Add an `objectStreams` option, which packs the objects that are not streams into compressed object streams and writes a cross-reference stream instead of the xref table, making documents with many such objects, e.g. tagged ones, much smaller. It requires a `pdfVersion` of `1.5` or higher, and cannot be used with encryption or PDF/A-1. Fixes #1810

lib/mixins/attachments.js

@@ -1,5 +1,5 @@
 import fs from '#fs';
-import { md5Hex } from '../crypto/md5';
+import { md5Hash } from '../crypto/md5';
 import { escapeName } from '../object.js';
 import { fromBase64 } from '../binary';
 
@@ -67,8 +67,7 @@ export default {
     }
 
     // add checksum and size information
-    const checksum = md5Hex(new Uint8Array(data));
-    refBody.Params.CheckSum = new String(checksum);
+    refBody.Params.CheckSum = md5Hash(new Uint8Array(data));
     refBody.Params.Size = data.byteLength;
 
     // save some space when embedding the same file again
@@ -113,11 +112,15 @@ export default {
   },
 };
 
+function bytesEqual(a, b) {
+  return a.length === b.length && a.every((byte, i) => byte === b[i]);
+}
+
 /** check two embedded file metadata objects for equality */
 function isEqual(a, b) {
   return (
     a.Subtype === b.Subtype &&
-    a.Params.CheckSum.toString() === b.Params.CheckSum.toString() &&
+    bytesEqual(a.Params.CheckSum, b.Params.CheckSum) &&
     a.Params.Size === b.Params.Size &&
     isSameDate(a.Params.CreationDate, b.Params.CreationDate) &&
     isSameDate(a.Params.ModDate, b.Params.ModDate)

tests/unit/attachments.spec.js

@@ -39,7 +39,7 @@ describe('file', () => {
 /Params <<
 /CreationDate (D:20180201000000Z)
 /ModDate (D:20180201000000Z)
-/CheckSum (${md5})
+/CheckSum <${md5}>
 /Size 12
 >>
 /Subtype /text#2Fplain
@@ -97,7 +97,7 @@ describe('file', () => {
 /Params <<
 /CreationDate (D:20180201000000Z)
 /ModDate (D:20180201000000Z)
-/CheckSum (${md5})
+/CheckSum <${md5}>
 /Size 12
 >>
 /Length 20
@@ -155,7 +155,7 @@ describe('file', () => {
 /Params <<
 /CreationDate (D:20180201000000Z)
 /ModDate (D:20180201000000Z)
-/CheckSum (${md5})
+/CheckSum <${md5}>
 /Size 12
 >>
 /Length 20