All functions raise atick.AtickError on failure.
Sign `pdf` (bytes) with a PFX/P12. Returns the signed PDF (bytes).
Sign with a PKCS#11 token / smart-card / HSM. Same options as `sign_pfx` (no PFX/encryption args).
Sign with a certificate from the Windows store. `thumbprint=None` opens the certificate picker.
Return `[(serial_hex, common_name), …]` for the certificates on a token.
Add an empty signature field + appearance + container; returns `(prepared_pdf, ctx)` where
`ctx["data"]` are the bytes to sign and `ctx["digest"]` their hash.
The multi-placement form (one signature, several pages). Returns `(prepared_pdf, ctx)`.
Embed a detached CMS/PKCS#7 into a prepared PDF. Returns the signed PDF.
Embed a raw RSA signature + signer certificate (e.g. an eSign `rawrsa` reply).
A detached CMS over `data` signed with a PFX. `revocation=True` adds the RevocationInfoArchival
attribute (a `pkcs7Pdf`-style reply). Returns the CMS (bytes).
A raw RSA signature over hash(`data`) with a PFX. Returns `(signature, signer_certificate_der)`.
Add ONE empty signature field with an appearance. Returns the PDF.
Add SEVERAL empty fields at once (a template). Returns the PDF.
Attach a container to an existing field by name; returns `(prepared_pdf, ctx)`.
Add the DSS (validation material) for the given certificates / revocation.
Append a document timestamp (RFC-3161) over the whole PDF (PAdES-B-LTA).
Set the `/Info` metadata on an unsigned PDF.
Decrypt a password-protected PDF; returns the plaintext PDF.
Enable/disable the in-memory revocation cache (default on). Disabling also clears it.
Forget all cached revocation.
The verified-signature appearance. `image="cn"` draws the CN on the left; `body=` is a custom-text-
only appearance (`\n` = line, `*x*` = bold); `green_tick=True` is the "?" mark, `always_check=True`
the embedded green tick.
Certification levels: `NONE` (0), `NO_CHANGES` (1), `FORM_FILLING` (2), `FORM_FILLING_ANNOTATIONS` (3).
Raised for every failure (bad password, malformed PDF, network error, …).