tdf#83877 Add valid/invalid images to signatures

Change-Id: I958c1bad2f32383ebaaeb7d42c761f0d1dfefc35
Reviewed-on: https://gerrit.libreoffice.org/54513
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>

19 files changed, 262 insertions, 80 deletions

diff --git a/cui/source/dialogs/SignSignatureLineDialog.cxx b/cui/source/dialogs/SignSignatureLineDialog.cxx
index 9f793884862e..78cb0bd88b17 100644
--- a/cui/source/dialogs/SignSignatureLineDialog.cxx
+++ b/cui/source/dialogs/SignSignatureLineDialog.cxx
@@ -145,51 +145,49 @@ void SignSignatureLineDialog::Apply()
     }
 
     SfxObjectShell* pShell = SfxObjectShell::Current();
-    pShell->SignSignatureLine(m_aSignatureLineId, m_xSelectedCertifate);
-
-    const bool bSuccess = false; // TODO
+    Reference<XGraphic> xValidGraphic = getSignedGraphic(true);
+    Reference<XGraphic> xInvalidGraphic = getSignedGraphic(false);
+    pShell->SignSignatureLine(m_aSignatureLineId, m_xSelectedCertifate, xValidGraphic,
+                              xInvalidGraphic);
+}
 
-    if (bSuccess)
-    {
-        // Read svg and replace placeholder texts
-        OUString aSvgImage(getSignatureImage());
-        aSvgImage = aSvgImage.replaceAll("[SIGNER_NAME]", getCDataString(m_aSuggestedSignerName));
-        aSvgImage = aSvgImage.replaceAll("[SIGNER_TITLE]", getCDataString(m_aSuggestedSignerTitle));
-
-        aSvgImage = aSvgImage.replaceAll("[SIGNATURE]", getCDataString(m_xEditName->get_text()));
-        OUString aIssuerLine = CuiResId(RID_SVXSTR_SIGNATURELINE_SIGNED_BY)
-                                   .replaceFirst("%1", m_xSelectedCertifate->getIssuerName());
-        aSvgImage = aSvgImage.replaceAll("[SIGNED_BY]", getCDataString(aIssuerLine));
+const css::uno::Reference<css::graphic::XGraphic>
+SignSignatureLineDialog::getSignedGraphic(bool bValid)
+{
+    // Read svg and replace placeholder texts
+    OUString aSvgImage(getSignatureImage());
+    aSvgImage = aSvgImage.replaceAll("[SIGNER_NAME]", getCDataString(m_aSuggestedSignerName));
+    aSvgImage = aSvgImage.replaceAll("[SIGNER_TITLE]", getCDataString(m_aSuggestedSignerTitle));
+
+    aSvgImage = aSvgImage.replaceAll("[SIGNATURE]", getCDataString(m_xEditName->get_text()));
+    OUString aIssuerLine = CuiResId(RID_SVXSTR_SIGNATURELINE_SIGNED_BY)
+                               .replaceFirst("%1", m_xSelectedCertifate->getIssuerName());
+    aSvgImage = aSvgImage.replaceAll("[SIGNED_BY]", getCDataString(aIssuerLine));
+    if (!bValid)
         aSvgImage = aSvgImage.replaceAll("[INVALID_SIGNATURE]", "");
 
-        OUString aDate;
-        if (m_bShowSignDate)
-        {
-            const SvtSysLocale aSysLocale;
-            const LocaleDataWrapper& rLocaleData = aSysLocale.GetLocaleData();
-            Date aDateTime(Date::SYSTEM);
-            aDate = rLocaleData.getDate(aDateTime);
-        }
-        aSvgImage = aSvgImage.replaceAll("[DATE]", aDate);
-
-        // Insert/Update graphic
-        SvMemoryStream aSvgStream(4096, 4096);
-        aSvgStream.WriteOString(OUStringToOString(aSvgImage, RTL_TEXTENCODING_UTF8));
-        Reference<XInputStream> xInputStream(new utl::OSeekableInputStreamWrapper(aSvgStream));
-        Reference<XComponentContext> xContext(comphelper::getProcessComponentContext());
-        Reference<XGraphicProvider> xProvider = css::graphic::GraphicProvider::create(xContext);
-
-        Sequence<PropertyValue> aMediaProperties(1);
-        aMediaProperties[0].Name = "InputStream";
-        aMediaProperties[0].Value <<= xInputStream;
-        Reference<XGraphic> xGraphic(xProvider->queryGraphic(aMediaProperties));
-
-        m_xShapeProperties->setPropertyValue("Graphic", Any(xGraphic));
-    }
-    else
+    OUString aDate;
+    if (m_bShowSignDate && bValid)
     {
-        // TODO: Show error dialog
+        const SvtSysLocale aSysLocale;
+        const LocaleDataWrapper& rLocaleData = aSysLocale.GetLocaleData();
+        Date aDateTime(Date::SYSTEM);
+        aDate = rLocaleData.getDate(aDateTime);
     }
+    aSvgImage = aSvgImage.replaceAll("[DATE]", aDate);
+
+    // Create graphic
+    SvMemoryStream aSvgStream(4096, 4096);
+    aSvgStream.WriteOString(OUStringToOString(aSvgImage, RTL_TEXTENCODING_UTF8));
+    Reference<XInputStream> xInputStream(new utl::OSeekableInputStreamWrapper(aSvgStream));
+    Reference<XComponentContext> xContext(comphelper::getProcessComponentContext());
+    Reference<XGraphicProvider> xProvider = css::graphic::GraphicProvider::create(xContext);
+
+    Sequence<PropertyValue> aMediaProperties(1);
+    aMediaProperties[0].Name = "InputStream";
+    aMediaProperties[0].Value <<= xInputStream;
+    Reference<XGraphic> xGraphic = xProvider->queryGraphic(aMediaProperties);
+    return xGraphic;
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab cinoptions=b1,g0,N-s cinkeys+=0=break: */
diff --git a/cui/source/inc/SignSignatureLineDialog.hxx b/cui/source/inc/SignSignatureLineDialog.hxx
index 72f9c1a40882..a78124bc2679 100644
--- a/cui/source/inc/SignSignatureLineDialog.hxx
+++ b/cui/source/inc/SignSignatureLineDialog.hxx
@@ -12,6 +12,7 @@
 #include "SignatureLineDialogBase.hxx"
 
 #include <com/sun/star/beans/XPropertySet.hpp>
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/security/XCertificate.hpp>
 #include <com/sun/star/uno/Reference.hxx>
 
@@ -37,6 +38,7 @@ private:
     bool m_bShowSignDate;
 
     void ValidateFields();
+    const css::uno::Reference<css::graphic::XGraphic> getSignedGraphic(bool bValid);
     virtual void Apply() override;
 
     DECL_LINK(chooseCertificate, weld::Button&, void);
diff --git a/include/sfx2/docfile.hxx b/include/sfx2/docfile.hxx
index 6bf4d740e079..5ef0426c36c1 100644
--- a/include/sfx2/docfile.hxx
+++ b/include/sfx2/docfile.hxx
@@ -27,6 +27,7 @@
 #include <sfx2/signaturestate.hxx>
 #include <svl/lockfilecommon.hxx>
 #include <sal/types.h>
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/util/RevisionTag.hpp>
 #include <com/sun/star/util/DateTime.hpp>
 #include <com/sun/star/io/XOutputStream.hpp>
@@ -264,9 +265,14 @@ public:
                              const css::uno::Reference< css::ucb::XCommandEnvironment >& xComEnv );
 
     SAL_DLLPRIVATE bool
-    SignContents_Impl(const css::uno::Reference<css::security::XCertificate> xCert,
-                      const OUString& aSignatureLineId,
-                      bool bSignScriptingContent, bool bHasValidDocumentSignature);
+    SignContents_Impl(bool bSignScriptingContent, bool bHasValidDocumentSignature,
+                      const OUString& aSignatureLineId = OUString(),
+                      const css::uno::Reference<css::security::XCertificate> xCert
+                      = css::uno::Reference<css::security::XCertificate>(),
+                      const css::uno::Reference<css::graphic::XGraphic> xValidGraphic
+                      = css::uno::Reference<css::graphic::XGraphic>(),
+                      const css::uno::Reference<css::graphic::XGraphic> xInvalidGraphic
+                      = css::uno::Reference<css::graphic::XGraphic>());
 
     // the following two methods must be used and make sense only during saving currently
     // TODO/LATER: in future the signature state should be controlled by the medium not by the document
diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
index 0acc4f69a45d..1fa653b93437 100644
--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
@@ -29,6 +29,7 @@
 #include <com/sun/star/script/XLibraryContainer.hpp>
 #include <com/sun/star/embed/XStorage.hpp>
 #include <com/sun/star/beans/PropertyValue.hpp>
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/security/DocumentSignatureInformation.hpp>
 #include <com/sun/star/security/XDocumentDigitalSignatures.hpp>
 #include <com/sun/star/task/XInteractionHandler.hpp>
@@ -361,7 +362,9 @@ public:
     SignatureState              GetDocumentSignatureState();
     void                        SignDocumentContent();
     void SignSignatureLine(const OUString& aSignatureLineId,
-                           const css::uno::Reference<css::security::XCertificate> xCert);
+                           const css::uno::Reference<css::security::XCertificate> xCert,
+                           const css::uno::Reference<css::graphic::XGraphic> xValidGraphic,
+                           const css::uno::Reference<css::graphic::XGraphic> xInvalidGraphic);
     SignatureState              GetScriptingSignatureState();
     void                        SignScriptingContent();
     DECL_LINK(SignDocumentHandler, Button*, void);
diff --git a/include/svx/xoutbmp.hxx b/include/svx/xoutbmp.hxx
index f75d2e1bf52f..ba33ed989746 100644
--- a/include/svx/xoutbmp.hxx
+++ b/include/svx/xoutbmp.hxx
@@ -62,7 +62,7 @@ public:
                                       const OUString& rFilterName, const XOutFlags nFlags,
                                       const Size* pMtfSize_100TH_MM = nullptr,
                                       const css::uno::Sequence< css::beans::PropertyValue >* pFilterData = nullptr);
-    static bool         GraphicToBase64(const Graphic& rGraphic, OUString& rOUString);
+    static bool         GraphicToBase64(const Graphic& rGraphic, OUString& rOUString, bool bAddPrefix=true);
 
     static ErrCode      ExportGraphic( const Graphic& rGraphic, const INetURLObject& rURL,
                                        GraphicFilter& rFilter, const sal_uInt16 nFormat,
diff --git a/offapi/com/sun/star/security/XDocumentDigitalSignatures.idl b/offapi/com/sun/star/security/XDocumentDigitalSignatures.idl
index c31af5e176fd..b1c3020229e0 100644
--- a/offapi/com/sun/star/security/XDocumentDigitalSignatures.idl
+++ b/offapi/com/sun/star/security/XDocumentDigitalSignatures.idl
@@ -47,16 +47,21 @@ interface XDocumentDigitalSignatures : com::sun::star::uno::XInterface
                                  [in] ::com::sun::star::io::XStream xSignStream);
 
     /** Signs the content of the document including text and pictures
-        using the given XCertificate
+        using the given XCertificate.
+
+        Also adds the given Signature Line Id and the signed and unsigned graphics to
+        the signature.
 
        Macros will not be signed.
 
        @since LibreOffice 6.1
      */
-    boolean signDocumentContentWithCertificate( [in] ::com::sun::star::embed::XStorage xStorage,
-                                                [in] ::com::sun::star::io::XStream xSignStream,
-                                                [in] ::com::sun::star::security::XCertificate xCertificate,
-                                                [in] string signatureLineId);
+    boolean signSignatureLine( [in] ::com::sun::star::embed::XStorage xStorage,
+                               [in] ::com::sun::star::io::XStream xSignStream,
+                               [in] string signatureLineId,
+                               [in] ::com::sun::star::security::XCertificate xCertificate,
+                               [in] ::com::sun::star::graphic::XGraphic xValidGraphic,
+                               [in] ::com::sun::star::graphic::XGraphic xInvalidGraphic);
 
     /** checks for digital signatures and their status.
 
diff --git a/sfx2/source/doc/docfile.cxx b/sfx2/source/doc/docfile.cxx
index 093dfbe8557b..c56be8e20329 100644
--- a/sfx2/source/doc/docfile.cxx
+++ b/sfx2/source/doc/docfile.cxx
@@ -43,6 +43,7 @@
 #include <com/sun/star/embed/ElementModes.hpp>
 #include <com/sun/star/embed/UseBackupException.hpp>
 #include <com/sun/star/embed/XOptimizedStorage.hpp>
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/ucb/InteractiveIOException.hpp>
 #include <com/sun/star/ucb/UnsupportedDataSinkException.hpp>
 #include <com/sun/star/ucb/CommandFailedException.hpp>
@@ -133,6 +134,7 @@
 #include <memory>
 
 using namespace ::com::sun::star;
+using namespace ::com::sun::star::graphic;
 using namespace ::com::sun::star::uno;
 using namespace ::com::sun::star::ucb;
 using namespace ::com::sun::star::beans;
@@ -3661,9 +3663,12 @@ void SfxMedium::CreateTempFileNoCopy()
     CloseStorage();
 }
 
-bool SfxMedium::SignContents_Impl(const Reference<XCertificate> xCert, const OUString& aSignatureLineId,
-                                  bool bSignScriptingContent,
-                                  bool bHasValidDocumentSignature)
+bool SfxMedium::SignContents_Impl(bool bSignScriptingContent,
+                                  bool bHasValidDocumentSignature,
+                                  const OUString& aSignatureLineId,
+                                  const Reference<XCertificate> xCert,
+                                  const Reference<XGraphic> xValidGraphic,
+                                  const Reference<XGraphic> xInvalidGraphic)
 {
     bool bChanges = false;
 
@@ -3753,8 +3758,8 @@ bool SfxMedium::SignContents_Impl(const Reference<XCertificate> xCert, const OUS
 
                 bool bSuccess = false;
                 if (xCert.is())
-                    bSuccess = xSigner->signDocumentContentWithCertificate(
-                        GetZipStorageToSign_Impl(), xStream, xCert, aSignatureLineId);
+                    bSuccess = xSigner->signSignatureLine(
+                        GetZipStorageToSign_Impl(), xStream, aSignatureLineId, xCert, xValidGraphic, xInvalidGraphic);
                 else
                     bSuccess = xSigner->signDocumentContent(GetZipStorageToSign_Impl(),
                                                             xStream);
@@ -3779,8 +3784,8 @@ bool SfxMedium::SignContents_Impl(const Reference<XCertificate> xCert, const OUS
                 bool bSuccess = false;
                 if (xCert.is())
                 {
-                    bSuccess = xSigner->signDocumentContentWithCertificate(
-                        GetZipStorageToSign_Impl(/*bReadOnly=*/false), xStream, xCert, aSignatureLineId);
+                    bSuccess = xSigner->signSignatureLine(
+                        GetZipStorageToSign_Impl(/*bReadOnly=*/false), xStream, aSignatureLineId, xCert, xValidGraphic, xInvalidGraphic);
                 }
                 else
                 {
diff --git a/sfx2/source/doc/objserv.cxx b/sfx2/source/doc/objserv.cxx
index 294ff9473faf..8a259909c534 100644
--- a/sfx2/source/doc/objserv.cxx
+++ b/sfx2/source/doc/objserv.cxx
@@ -115,6 +115,7 @@ using namespace ::com::sun::star::beans;
 using namespace ::com::sun::star::document;
 using namespace ::com::sun::star::security;
 using namespace ::com::sun::star::task;
+using namespace ::com::sun::star::graphic;
 
 #define ShellClass_SfxObjectShell
 #include <sfxslots.hxx>
@@ -1556,14 +1557,15 @@ void SfxObjectShell::SignDocumentContent()
     if (CheckIsReadonly(false))
         return;
 
-    bool bSignSuccess = GetMedium()->SignContents_Impl(
-        Reference<XCertificate>(), "", false, HasValidSignatures());
+    bool bSignSuccess = GetMedium()->SignContents_Impl(false, HasValidSignatures());
 
     AfterSigning(bSignSuccess, false);
 }
 
 void SfxObjectShell::SignSignatureLine(const OUString& aSignatureLineId,
-                                       const Reference<XCertificate> xCert)
+                                       const Reference<XCertificate> xCert,
+                                       const Reference<XGraphic> xValidGraphic,
+                                       const Reference<XGraphic> xInvalidGraphic)
 {
     if (!PrepareForSigning())
         return;
@@ -1572,7 +1574,7 @@ void SfxObjectShell::SignSignatureLine(const OUString& aSignatureLineId,
         return;
 
     bool bSignSuccess = GetMedium()->SignContents_Impl(
-        xCert, aSignatureLineId, false, HasValidSignatures());
+        false, HasValidSignatures(), aSignatureLineId, xCert, xValidGraphic, xInvalidGraphic);
 
     AfterSigning(bSignSuccess, false);
 }
@@ -1590,8 +1592,7 @@ void SfxObjectShell::SignScriptingContent()
     if (CheckIsReadonly(true))
         return;
 
-    bool bSignSuccess = GetMedium()->SignContents_Impl(
-        Reference<XCertificate>(), OUString(), true, HasValidSignatures());
+    bool bSignSuccess = GetMedium()->SignContents_Impl(true, HasValidSignatures());
 
     AfterSigning(bSignSuccess, true);
 }
diff --git a/svx/source/xoutdev/_xoutbmp.cxx b/svx/source/xoutdev/_xoutbmp.cxx
index 3fc0110ed9e7..4b943e817767 100644
--- a/svx/source/xoutdev/_xoutbmp.cxx
+++ b/svx/source/xoutdev/_xoutbmp.cxx
@@ -357,7 +357,7 @@ ErrCode XOutBitmap::WriteGraphic( const Graphic& rGraphic, OUString& rFileName,
     }
 }
 
-bool XOutBitmap::GraphicToBase64(const Graphic& rGraphic, OUString& rOUString)
+bool XOutBitmap::GraphicToBase64(const Graphic& rGraphic, OUString& rOUString, bool bAddPrefix)
 {
     SvMemoryStream aOStm;
     OUString aMimeType;
@@ -393,7 +393,11 @@ bool XOutBitmap::GraphicToBase64(const Graphic& rGraphic, OUString& rOUString)
     css::uno::Sequence<sal_Int8> aOStmSeq( static_cast<sal_Int8 const *>(aOStm.GetData()),aOStm.Tell() );
     OUStringBuffer aStrBuffer;
     ::comphelper::Base64::encode(aStrBuffer,aOStmSeq);
-    rOUString = aMimeType + ";base64," + aStrBuffer.makeStringAndClear();
+    rOUString = aStrBuffer.makeStringAndClear();
+
+    if (bAddPrefix)
+        rOUString = aMimeType + ";base64," + rOUString;
+
     return true;
 }
 
diff --git a/xmlsecurity/inc/documentsignaturemanager.hxx b/xmlsecurity/inc/documentsignaturemanager.hxx
index 542a9af6a8a9..f88820f03803 100644
--- a/xmlsecurity/inc/documentsignaturemanager.hxx
+++ b/xmlsecurity/inc/documentsignaturemanager.hxx
@@ -28,6 +28,7 @@
 #include "xmlsignaturehelper.hxx"
 #include <com/sun/star/uno/XComponentContext.hpp>
 #include <com/sun/star/embed/XStorage.hpp>
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include "documentsignaturehelper.hxx"
 #include <com/sun/star/beans/PropertyValue.hpp>
 
@@ -66,7 +67,11 @@ public:
     bool add(const css::uno::Reference<css::security::XCertificate>& xCert,
              const css::uno::Reference<css::xml::crypto::XXMLSecurityContext>& xSecurityContext,
              const OUString& rDescription, sal_Int32& nSecurityId, bool bAdESCompliant,
-             const OUString& rSignatureLineId = OUString());
+             const OUString& rSignatureLineId = OUString(),
+             const css::uno::Reference<css::graphic::XGraphic> xValidGraphic
+             = css::uno::Reference<css::graphic::XGraphic>(),
+             const css::uno::Reference<css::graphic::XGraphic> xInvalidGraphic
+             = css::uno::Reference<css::graphic::XGraphic>());
     /// Remove signature at nPosition.
     void remove(sal_uInt16 nPosition);
     /// Read signatures from either a temp stream or the real storage.
diff --git a/xmlsecurity/inc/xmlsignaturehelper.hxx b/xmlsecurity/inc/xmlsignaturehelper.hxx
index f4de3b01b56e..c41179d4805c 100644
--- a/xmlsecurity/inc/xmlsignaturehelper.hxx
+++ b/xmlsecurity/inc/xmlsignaturehelper.hxx
@@ -30,6 +30,7 @@
 #include "xmlsecuritydllapi.h"
 #include "xmlsignaturehelper.hxx"
 
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/uno/XComponentContext.hpp>
 #include <com/sun/star/xml/sax/XWriter.hpp>
 #include <com/sun/star/xml/crypto/XSEInitializer.hpp>
@@ -130,6 +131,11 @@ public:
     void        SetDateTime( sal_Int32 nSecurityId, const Date& rDate, const tools::Time& rTime );
     void SetDescription(sal_Int32 nSecurityId, const OUString& rDescription);
     void SetSignatureLineId(sal_Int32 nSecurityId, const OUString& rSignatureLineId);
+    void
+    SetSignatureLineValidGraphic(sal_Int32 nSecurityId,
+                                 const css::uno::Reference<css::graphic::XGraphic>& xValidGraphic);
+    void SetSignatureLineInvalidGraphic(
+        sal_Int32 nSecurityId, const css::uno::Reference<css::graphic::XGraphic>& xInvalidGraphic);
 
     void        AddForSigning( sal_Int32 securityId, const OUString& uri, bool bBinary, bool bXAdESCompliantIfODF );
     void        CreateAndWriteSignature( const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler, bool bXAdESCompliantIfODF );
diff --git a/xmlsecurity/inc/xsecctl.hxx b/xmlsecurity/inc/xsecctl.hxx
index 750bb5b63348..2620bc6cbea9 100644
--- a/xmlsecurity/inc/xsecctl.hxx
+++ b/xmlsecurity/inc/xsecctl.hxx
@@ -27,6 +27,7 @@
 #include <com/sun/star/lang/XInitialization.hpp>
 #include <com/sun/star/xml/sax/XDocumentHandler.hpp>
 #include <com/sun/star/xml/sax/XAttributeList.hpp>
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/xml/crypto/XXMLSignature.hpp>
 #include <com/sun/star/xml/crypto/XSEInitializer.hpp>
 #include <com/sun/star/xml/crypto/sax/XSecuritySAXEventKeeper.hpp>
@@ -360,6 +361,11 @@ public:
         const css::util::DateTime& rDateTime );
     void setDescription(sal_Int32 nSecurityId, const OUString& rDescription);
     void setSignatureLineId(sal_Int32 nSecurityId, const OUString& rSignatureLineId);
+    void
+    setSignatureLineValidGraphic(sal_Int32 nSecurityId,
+                                 const css::uno::Reference<css::graphic::XGraphic>& xValidGraphic);
+    void setSignatureLineInvalidGraphic(
+        sal_Int32 nSecurityId, const css::uno::Reference<css::graphic::XGraphic>& xInvalidGraphic);
 
     bool WriteSignature(
         const css::uno::Reference< css::xml::sax::XDocumentHandler >& xDocumentHandler,
diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
index 87e9b8bb3759..2c40f69b53f6 100644
--- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
+++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
@@ -104,11 +104,12 @@ public:
     sal_Bool SAL_CALL
     signDocumentContent(const css::uno::Reference<css::embed::XStorage>& xStorage,
                         const css::uno::Reference<css::io::XStream>& xSignStream) override;
-    sal_Bool SAL_CALL signDocumentContentWithCertificate(
+    sal_Bool SAL_CALL signSignatureLine(
         const css::uno::Reference<css::embed::XStorage>& Storage,
-        const css::uno::Reference<css::io::XStream>& xSignStream,
-        const css::uno::Reference<css::security::XCertificate>& xCertificate,
-        const OUString& rSignatureLineId) override;
+        const css::uno::Reference<css::io::XStream>& xSignStream, const OUString& aSignatureLineId,
+        const Reference<css::security::XCertificate>& xCertificate,
+        const Reference<css::graphic::XGraphic>& xValidGraphic,
+        const Reference<css::graphic::XGraphic>& xInvalidGraphic) override;
     css::uno::Sequence<css::security::DocumentSignatureInformation>
         SAL_CALL verifyDocumentContentSignatures(
             const css::uno::Reference<css::embed::XStorage>& xStorage,
@@ -223,10 +224,13 @@ sal_Bool DocumentDigitalSignatures::signDocumentContent(
     return ImplViewSignatures( rxStorage, xSignStream, DocumentSignatureMode::Content, false );
 }
 
-sal_Bool DocumentDigitalSignatures::signDocumentContentWithCertificate(
+sal_Bool DocumentDigitalSignatures::signSignatureLine(
     const Reference<css::embed::XStorage>& rxStorage,
     const Reference<css::io::XStream>& xSignStream,
-    const Reference<css::security::XCertificate>& xCertificate, const OUString& aSignatureLineId)
+    const OUString& aSignatureLineId,
+    const Reference<css::security::XCertificate>& xCertificate,
+    const Reference<css::graphic::XGraphic>& xValidGraphic,
+    const Reference<css::graphic::XGraphic>& xInvalidGraphic)
 {
     OSL_ENSURE(!m_sODFVersion.isEmpty(),
                "DocumentDigitalSignatures: ODF Version not set, assuming minimum 1.2");
@@ -251,7 +255,7 @@ sal_Bool DocumentDigitalSignatures::signDocumentContentWithCertificate(
     sal_Int32 nSecurityId;
     OUString aDescription("");
     bool bSuccess = aSignatureManager.add(xCertificate, xSecurityContext, aDescription, nSecurityId,
-                                          true, aSignatureLineId);
+                                          true, aSignatureLineId, xValidGraphic, xInvalidGraphic);
     if (!bSuccess)
         return false;
 
diff --git a/xmlsecurity/source/helper/documentsignaturemanager.cxx b/xmlsecurity/source/helper/documentsignaturemanager.cxx
index bb78c62272e4..f302f1a64955 100644
--- a/xmlsecurity/source/helper/documentsignaturemanager.cxx
+++ b/xmlsecurity/source/helper/documentsignaturemanager.cxx
@@ -29,6 +29,7 @@
 #include <com/sun/star/embed/XTransactedObject.hpp>
 #include <com/sun/star/xml/crypto/SEInitializer.hpp>
 #include <com/sun/star/lang/XServiceInfo.hpp>
+#include <com/sun/star/graphic/XGraphic.hpp>
 
 #include <comphelper/base64.hxx>
 #include <comphelper/storagehelper.hxx>
@@ -46,6 +47,8 @@
 #include <pdfsignaturehelper.hxx>
 
 using namespace css;
+using namespace css::graphic;
+using namespace css::uno;
 
 DocumentSignatureManager::DocumentSignatureManager(
     const uno::Reference<uno::XComponentContext>& xContext, DocumentSignatureMode eMode)
@@ -266,7 +269,8 @@ bool DocumentSignatureManager::add(
     const uno::Reference<security::XCertificate>& xCert,
     const uno::Reference<xml::crypto::XXMLSecurityContext>& xSecurityContext,
     const OUString& rDescription, sal_Int32& nSecurityId, bool bAdESCompliant,
-    const OUString& rSignatureLineId)
+    const OUString& rSignatureLineId, const Reference<XGraphic> xValidGraphic,
+    const Reference<XGraphic> xInvalidGraphic)
 {
     if (!xCert.is())
     {
@@ -388,6 +392,12 @@ bool DocumentSignatureManager::add(
     if (!rSignatureLineId.isEmpty())
         maSignatureHelper.SetSignatureLineId(nSecurityId, rSignatureLineId);
 
+    if (xValidGraphic.is())
+        maSignatureHelper.SetSignatureLineValidGraphic(nSecurityId, xValidGraphic);
+
+    if (xInvalidGraphic.is())
+        maSignatureHelper.SetSignatureLineInvalidGraphic(nSecurityId, xInvalidGraphic);
+
     // We open a signature stream in which the existing and the new
     //signature is written. ImplGetSignatureInformation (later in this function) will
     //then read the stream and fill maCurrentSignatureInformations. The final signature
diff --git a/xmlsecurity/source/helper/xmlsignaturehelper.cxx b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
index 0ae2c9524f28..e754bb3368f6 100644
--- a/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+++ b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
@@ -56,6 +56,7 @@
 #define OOXML_SIGNATURE_SIGNATURE "http://schemas.openxmlformats.org/package/2006/relationships/digital-signature/signature"
 
 using namespace ::com::sun::star;
+using namespace ::com::sun::star::graphic;
 using namespace ::com::sun::star::uno;
 
 XMLSignatureHelper::XMLSignatureHelper( const uno::Reference< uno::XComponentContext >& rxCtx)
@@ -154,6 +155,18 @@ void XMLSignatureHelper::SetSignatureLineId(sal_Int32 nSecurityId, const OUStrin
     mpXSecController->setSignatureLineId(nSecurityId, rSignatureLineId);
 }
 
+void XMLSignatureHelper::SetSignatureLineValidGraphic(
+    sal_Int32 nSecurityId, const css::uno::Reference<XGraphic>& xValidGraphic)
+{
+    mpXSecController->setSignatureLineValidGraphic(nSecurityId, xValidGraphic);
+}
+
+void XMLSignatureHelper::SetSignatureLineInvalidGraphic(
+    sal_Int32 nSecurityId, const css::uno::Reference<XGraphic>& xInvalidGraphic)
+{
+    mpXSecController->setSignatureLineInvalidGraphic(nSecurityId, xInvalidGraphic);
+}
+
 void XMLSignatureHelper::AddForSigning( sal_Int32 nSecurityId, const OUString& uri, bool bBinary, bool bXAdESCompliantIfODF )
 {
     mpXSecController->signAStream( nSecurityId, uri, bBinary, bXAdESCompliantIfODF );
diff --git a/xmlsecurity/source/helper/xsecctl.cxx b/xmlsecurity/source/helper/xsecctl.cxx
index 0d97dd3456fb..e5bae1f199af 100644
--- a/xmlsecurity/source/helper/xsecctl.cxx
+++ b/xmlsecurity/source/helper/xsecctl.cxx
@@ -40,6 +40,7 @@
 #include <xmloff/attrlist.hxx>
 #include <rtl/math.hxx>
 #include <rtl/ref.hxx>
+#include <svx/xoutbmp.hxx>
 #include <unotools/datetime.hxx>
 #include <comphelper/ofopxmlhelper.hxx>
 #include <sax/tools/converter.hxx>
@@ -857,7 +858,9 @@ void XSecController::exportSignature(
                 }
                 xDocumentHandler->endElement( "SignatureProperty" );
 
-                if (!signatureInfo.ouSignatureLineId.isEmpty())
+                if (!signatureInfo.ouSignatureLineId.isEmpty()
+                    && signatureInfo.aValidSignatureImage.is()
+                    && signatureInfo.aInvalidSignatureImage.is())
                 {
                     pAttributeList = new SvXMLAttributeList();
                     pAttributeList->AddAttribute(
@@ -869,12 +872,48 @@ void XSecController::exportSignature(
                         "SignatureProperty",
                         cssu::Reference<cssxs::XAttributeList>(pAttributeList));
                     {
-                        // Write SignatureLineId element
                         xDocumentHandler->startElement(
-                            "loext:SignatureLineId",
+                            "loext:SignatureLine",
                             cssu::Reference<cssxs::XAttributeList>(new SvXMLAttributeList()));
-                        xDocumentHandler->characters(signatureInfo.ouSignatureLineId);
-                        xDocumentHandler->endElement("loext:SignatureLineId");
+
+                        {
+                            // Write SignatureLineId element
+                            xDocumentHandler->startElement(
+                                "loext:SignatureLineId",
+                                cssu::Reference<cssxs::XAttributeList>(new SvXMLAttributeList()));
+                            xDocumentHandler->characters(signatureInfo.ouSignatureLineId);
+                            xDocumentHandler->endElement("loext:SignatureLineId");
+                        }
+
+                        {
+                            // Write SignatureLineId element
+                            xDocumentHandler->startElement(
+                                "loext:SignatureLineValidImage",
+                                cssu::Reference<cssxs::XAttributeList>(new SvXMLAttributeList()));
+
+                            OUString aGraphicInBase64;
+                            Graphic aGraphic(signatureInfo.aValidSignatureImage);
+                            if (!XOutBitmap::GraphicToBase64(aGraphic, aGraphicInBase64, false))
+                                SAL_WARN("xmlsecurity.helper", "could not convert graphic to base64");
+
+                            xDocumentHandler->characters(aGraphicInBase64);
+                            xDocumentHandler->endElement("loext:SignatureLineValidImage");
+                        }
+
+                        {
+                            // Write SignatureLineId element
+                            xDocumentHandler->startElement(
+                                "loext:SignatureLineInvalidImage",
+                                cssu::Reference<cssxs::XAttributeList>(new SvXMLAttributeList()));
+                            OUString aGraphicInBase64;
+                            Graphic aGraphic(signatureInfo.aInvalidSignatureImage);
+                            if (!XOutBitmap::GraphicToBase64(aGraphic, aGraphicInBase64, false))
+                                SAL_WARN("xmlsecurity.helper", "could not convert graphic to base64");
+                            xDocumentHandler->characters(aGraphicInBase64);
+                            xDocumentHandler->endElement("loext:SignatureLineInvalidImage");
+                        }
+
+                        xDocumentHandler->endElement("loext:SignatureLine");
                     }
                     xDocumentHandler->endElement("SignatureProperty");
                 }
diff --git a/xmlsecurity/source/helper/xsecparser.cxx b/xmlsecurity/source/helper/xsecparser.cxx
index 4218ab571f53..e20716f0a487 100644
--- a/xmlsecurity/source/helper/xsecparser.cxx
+++ b/xmlsecurity/source/helper/xsecparser.cxx
@@ -45,6 +45,8 @@ XSecParser::XSecParser(XMLSignatureHelper& rXMLSignatureHelper,
     , m_bInDate(false)
     , m_bInDescription(false)
     , m_bInSignatureLineId(false)
+    , m_bInSignatureLineValidImage(false)
+    , m_bInSignatureLineInvalidImage(false)
     , m_pXSecController(pXSecController)
     , m_bReferenceUnresolved(false)
     , m_nReferenceDigestID(cssxc::DigestID::SHA1)
@@ -265,6 +267,16 @@ void SAL_CALL XSecParser::startElement(
             m_ouSignatureLineId.clear();
             m_bInSignatureLineId = true;
         }
+        else if (aName == "loext:SignatureLineValidImage")
+        {
+            m_ouSignatureLineValidImage.clear();
+            m_bInSignatureLineValidImage = true;
+        }
+        else if (aName == "loext:SignatureLineInvalidImage")
+        {
+            m_ouSignatureLineInvalidImage.clear();
+            m_bInSignatureLineInvalidImage = true;
+        }
 
         if (m_xNextHandler.is())
         {
@@ -379,6 +391,16 @@ void SAL_CALL XSecParser::endElement( const OUString& aName )
             m_pXSecController->setSignatureLineId( m_ouSignatureLineId );
             m_bInSignatureLineId = false;
         }
+        else if (aName == "loext:SignatureLineValidImage")
+        {
+            m_pXSecController->setValidSignatureImage( m_ouSignatureLineValidImage );
+            m_bInSignatureLineValidImage = false;
+        }
+        else if (aName == "loext:SignatureLineInvalidImage")
+        {
+            m_pXSecController->setInvalidSignatureImage( m_ouSignatureLineInvalidImage );
+            m_bInSignatureLineInvalidImage = false;
+        }
 
         if (m_xNextHandler.is())
         {
@@ -458,6 +480,14 @@ void SAL_CALL XSecParser::characters( const OUString& aChars )
     {
         m_ouSignatureLineId += aChars;
     }
+    else if (m_bInSignatureLineValidImage)
+    {
+        m_ouSignatureLineValidImage += aChars;
+    }
+    else if (m_bInSignatureLineInvalidImage)
+    {
+        m_ouSignatureLineInvalidImage += aChars;
+    }
 
     if (m_xNextHandler.is())
     {
diff --git a/xmlsecurity/source/helper/xsecparser.hxx b/xmlsecurity/source/helper/xsecparser.hxx
index e1c4515ce941..42b63975ecb9 100644
--- a/xmlsecurity/source/helper/xsecparser.hxx
+++ b/xmlsecurity/source/helper/xsecparser.hxx
@@ -68,6 +68,8 @@ private:
     /// Characters of a <dc:description> element, as just read from XML.
     OUString m_ouDescription;
     OUString m_ouSignatureLineId;
+    OUString m_ouSignatureLineValidImage;
+    OUString m_ouSignatureLineInvalidImage;
 
     /*
      * whether inside a particular element
@@ -86,6 +88,8 @@ private:
     bool m_bInDate;
     bool m_bInDescription;
     bool m_bInSignatureLineId;
+    bool m_bInSignatureLineValidImage;
+    bool m_bInSignatureLineInvalidImage;
 
     /*
      * the XSecController collaborating with XSecParser
diff --git a/xmlsecurity/source/helper/xsecsign.cxx b/xmlsecurity/source/helper/xsecsign.cxx
index 3202c4c4a1c1..b4c050e3b7a2 100644
--- a/xmlsecurity/source/helper/xsecsign.cxx
+++ b/xmlsecurity/source/helper/xsecsign.cxx
@@ -21,6 +21,7 @@
 #include <xsecctl.hxx>
 #include <certificate.hxx>
 
+#include <com/sun/star/graphic/XGraphic.hpp>
 #include <com/sun/star/xml/crypto/sax/ElementMarkPriority.hpp>
 #include <com/sun/star/xml/crypto/sax/XReferenceResolvedBroadcaster.hpp>
 #include <com/sun/star/xml/crypto/sax/XBlockerMonitor.hpp>
@@ -33,7 +34,9 @@
 #include <framework/signaturecreatorimpl.hxx>
 #include <framework/saxeventkeeperimpl.hxx>
 
-using namespace com::sun::star;
+using namespace css;
+using namespace css::uno;
+using namespace css::graphic;
 namespace cssu = com::sun::star::uno;
 namespace cssl = com::sun::star::lang;
 namespace cssxc = com::sun::star::xml::crypto;
@@ -308,6 +311,44 @@ void XSecController::setSignatureLineId(sal_Int32 nSecurityId, const OUString& r
     }
 }
 
+void XSecController::setSignatureLineValidGraphic(sal_Int32 nSecurityId,
+                                                  const Reference<XGraphic>& xValidGraphic)
+{
+    int nIndex = findSignatureInfor(nSecurityId);
+
+    if (nIndex == -1)
+    {
+        InternalSignatureInformation aInformation(nSecurityId, nullptr);
+        aInformation.signatureInfor.aValidSignatureImage = xValidGraphic;
+        m_vInternalSignatureInformations.push_back(aInformation);
+    }
+    else
+    {
+        SignatureInformation& rInformation
+            = m_vInternalSignatureInformations[nIndex].signatureInfor;
+        rInformation.aValidSignatureImage = xValidGraphic;
+    }
+}
+
+void XSecController::setSignatureLineInvalidGraphic(
+    sal_Int32 nSecurityId, const Reference<XGraphic>& xInvalidGraphic)
+{
+    int nIndex = findSignatureInfor(nSecurityId);
+
+    if (nIndex == -1)
+    {
+        InternalSignatureInformation aInformation(nSecurityId, nullptr);
+        aInformation.signatureInfor.aInvalidSignatureImage = xInvalidGraphic;
+        m_vInternalSignatureInformations.push_back(aInformation);
+    }
+    else
+    {
+        SignatureInformation& rInformation
+            = m_vInternalSignatureInformations[nIndex].signatureInfor;
+        rInformation.aInvalidSignatureImage = xInvalidGraphic;
+    }
+}
+
 bool XSecController::WriteSignature(
     const cssu::Reference<cssxs::XDocumentHandler>& xDocumentHandler,
     bool bXAdESCompliantIfODF )