[18.0][MIG] report_qweb_signer: Migration to 18.0 #1105

chienandalu · 2025-12-17T11:41:14Z

superseds #1060

Refactor to use pyHanko and the new Odoo core certificate.certificate model.

For now, a minimal refactor has been made as PoC to:

Use PyHanko as the signer library (more complete, mantained and reliable)
Remove all the forme java pdfsigner stuff.
Be able to use Odoo core certificates.

Main pain points:

cryptography version is fixed in Odoo requirements.txt. This makes very hard for other libraries to work with that version.
The approach has been using the pyhanko-cli tool as backend so we can install it in it's own venv (or whatever isolation method is desired).

cc @moduon MT-11131

fyi @yajo

OCA Transbot updated translations from Transifex

These limits were being hit when printing PDF reports with just 80 pages. OCA Transbot updated translations from Transifex [UPD] Update report_qweb_signer.pot

- Good dependency chain - Context for forcing rendering PDF - Extra test [UPD] README.rst [UPD] Update report_qweb_signer.pot Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: reporting-engine-12.0/reporting-engine-12.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-12-0/reporting-engine-12-0-report_qweb_signer/ [UPD] README.rst

`render_qweb_pdf` must return a tuple of `(content, 'pdf')`

Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: reporting-engine-12.0/reporting-engine-12.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-12-0/reporting-engine-12-0-report_qweb_signer/

Fix website on manifest

[UPD] Update report_qweb_signer.pot [UPD] README.rst

Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: reporting-engine-13.0/reporting-engine-13.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-13-0/reporting-engine-13-0-report_qweb_signer/

…isible signatures

We don't want our custom parameters be reset every time the module updates. TT32256

…default and fix multicompany issue

…objects (print from wizard in some cases)

Add a new 'Allowed reports' field on the certificate. Only reports listed in this field can be signed. No report means all reports are allowed.

Currently translated at 26.0% (12 of 46 strings) Translation: reporting-engine-14.0/reporting-engine-14.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-14-0/reporting-engine-14-0-report_qweb_signer/it/

Currently translated at 63.0% (29 of 46 strings) Translation: reporting-engine-14.0/reporting-engine-14.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-14-0/reporting-engine-14-0-report_qweb_signer/sl/

Currently translated at 100.0% (46 of 46 strings) Translation: reporting-engine-14.0/reporting-engine-14.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-14-0/reporting-engine-14-0-report_qweb_signer/ca/

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: reporting-engine-14.0/reporting-engine-14.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-14-0/reporting-engine-14-0-report_qweb_signer/

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: reporting-engine-16.0/reporting-engine-16.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-16-0/reporting-engine-16-0-report_qweb_signer/

Currently translated at 100.0% (46 of 46 strings) Translation: reporting-engine-16.0/reporting-engine-16.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-16-0/reporting-engine-16-0-report_qweb_signer/es/

Currently translated at 100.0% (46 of 46 strings) Translation: reporting-engine-16.0/reporting-engine-16.0-report_qweb_signer Translate-URL: https://translation.odoo-community.org/projects/reporting-engine-16-0/reporting-engine-16-0-report_qweb_signer/it/

…es of pdf

…ography version for python < 3.12

Refactor to use pyHanko and the new Odoo core `certificate.certificate` model. For now, a minimal refactor has been made as PoC to: - Use PyHanko as the signer library (more complete, mantained and reliable) - Remove all the forme java pdfsigner stuff. - Be able to use Odoo core certificates. Main pain points: - `cryptography` version is fixed in Odoo `requirements.txt`. This makes very hard for other libraries to work with that version. - The approach has been using the `pyhanko-cli` tool as backend so we can install it in it's own `venv` (or whatever isolation method is desired). MT-11131

yajo

Thanks for the good work, it looks much better indeed.

Code review with some comments in code.

Please also review tests, which are failing.

yajo · 2026-01-21T09:00:40Z

report_qweb_signer/migrations/pre-migrate.py

+def migrate(cr, version):
+    # 1. Store certificate info (file path) to create the certs on post-mig
+    # 2. Transform report.certificate to their reports values
+    pass


issue: missing implementation.

yajo · 2026-01-21T09:02:28Z

report_qweb_signer/models/ir_actions_report.py

+            and self.signing_allow_only_one
+            and len(res_ids) > 1
+        ):
+            _logger.debug(


suggestion: higher importance

Suggested change

_logger.debug(

_logger.warning(

yajo · 2026-01-21T09:04:47Z

report_qweb_signer/models/ir_actions_report.py

+            ids = set(
+                self.env[self.model_id.model].search(safe_eval(self.signing_domain)).ids
+            )
+            res_ids = list(ids & set(res_ids))


Suggested change

ids = set(

self.env[self.model_id.model].search(safe_eval(self.signing_domain)).ids

)

res_ids = list(ids & set(res_ids))

res_ids = self.env[self.model_id.model].search([("id", "in", res_ids)] + safe_eval(self.signing_domain)).ids

yajo · 2026-01-21T09:05:33Z

report_qweb_signer/models/ir_actions_report.py

+
+    def _should_be_signed(self, res_ids: list) -> list:
+        """Not all the documents should be rendered. Let's find out the right ones"""
+        if not self._is_report_type_signable():


Suggested change

if not self._is_report_type_signable():

if not self._is_report_type_signable() or not res_ids:

yajo · 2026-01-21T09:09:28Z

report_qweb_signer/readme/CONTRIBUTORS.md

  > - Antonio Espinosa
  > - Pedro M. Baeza
  > - Jairo Llopis
  > - David Vidal


suggestion: IMHO Moduon deserves a mention, after this huge refactor.

antespi and others added 30 commits December 17, 2025 11:15

report_qweb_signer addon

ffd7aed

report_qweb_signer: Add feature request

17a61bd

OCA Transbot updated translations from Transifex

[MIG] report_qweb_signer: Migration to 10.0

e293e9e

OCA Transbot updated translations from Transifex

fix test_report_qweb_signer - tests were causing travis to stall

1444bad

[FIX] report_qweb_signer: Remove hardcoded memory limits

e24a1f4

These limits were being hit when printing PDF reports with just 80 pages. OCA Transbot updated translations from Transifex [UPD] Update report_qweb_signer.pot

[FIX] README syntax

31ebaa3

[MIG] report_qweb_designer: Migration to 12.0

028750f

[FIX] report_qweb_signer: reprint report crash

e85318f

`render_qweb_pdf` must return a tuple of `(content, 'pdf')`

[FIX] report_qweb_signer

4b4e790

Fix website on manifest

[IMP] report_qweb_signer: Black python code

0d3f07f

[MIG] report_qweb_signer: Migration to 13.0

2e3579e

[UPD] Update report_qweb_signer.pot [UPD] README.rst

Apply dotfiles

afc60cc

report_qweb_signer 13.0.1.0.1

81a57e5

[IMP] report_qweb_signer add endesive

bafcf83

[UPD] Update report_qweb_signer.pot

9980be9

[MIG] report_qweb_signer: Migration to 14.0 updating java's lib for v…

420b910

…isible signatures

[FIX] report_qweb_signer: noupdate defaults

7ed625d

We don't want our custom parameters be reset every time the module updates. TT32256

[IMP] report_qweb_signer: Signature visible parameter not include by …

fd8dd9c

…default and fix multicompany issue

[FIX] report_qweb_signer: Fix when report is printed without related …

6f7646d

…objects (print from wizard in some cases)

[FIX] report_qweb_signer: Handle multi-company correctly

7ceaa55

[UPD] Update report_qweb_signer.pot

f8a4398

[UPD] README.rst

a7d9797

[IMP] report_qweb_signer: keep env company if company is not defined

6deed7e

[IMP] report_qweb_signer: Add default-jre-headless for GH

48cfc33

report_qweb_signer 14.0.1.0.1

5da5c02

[IMP] report_qweb_signer: allowed reports on certificate

c13f1bf

Add a new 'Allowed reports' field on the certificate. Only reports listed in this field can be signed. No report means all reports are allowed.

[ADD] report_qweb_signer: add pedrobaeza idea in ROADMAP

07c1788

OCA-git-bot and others added 26 commits December 17, 2025 11:15

report_qweb_signer 14.0.2.0.1

f37a7bf

Update CONFIGURE.rst

46d513e

[UPD] README.rst

8c43239

report_qweb_signer 14.0.2.0.2

6721806

[UPD] README.rst

7815c6a

[IMP] pre-commit lint

7f54ab1

[UPD] Update report_qweb_signer.pot

902540f

[BOT] post-merge updates

c7338c3

[MIG] report_qweb_signer to 16.0

eba0934

[UPD] Update report_qweb_signer.pot

f4e19f8

[BOT] post-merge updates

a1c194a

[IMP] add missing _is_report_type_signable to allow signing other typ…

7faf8ac

…es of pdf

[BOT] post-merge updates

77b11d2

[REF] report_qweb_signer: make signing functions reusable

f24d09f

[BOT] post-merge updates

ecd37e7

[FIX] endesive 2.19.0 version is not compatible with odoo pined crypt…

0338b10

…ography version for python < 3.12

[BOT] post-merge updates

93aed07

[IMP] report_qweb_signer: pre-commit auto fixes

a5d346f

chienandalu force-pushed the 18.0-mig-report_qweb_signer branch from 29937cb to 71070b5 Compare December 17, 2025 14:06

chienandalu force-pushed the 18.0-mig-report_qweb_signer branch from 71070b5 to 212514f Compare December 18, 2025 12:06

yajo requested changes Jan 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[18.0][MIG] report_qweb_signer: Migration to 18.0 #1105

[18.0][MIG] report_qweb_signer: Migration to 18.0 #1105

Uh oh!

chienandalu commented Dec 17, 2025

Uh oh!

yajo left a comment

Uh oh!

yajo Jan 21, 2026

Uh oh!

yajo Jan 21, 2026

Uh oh!

yajo Jan 21, 2026

Uh oh!

yajo Jan 21, 2026

Uh oh!

yajo Jan 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

	if not self._is_report_type_signable():
	if not self._is_report_type_signable() or not res_ids:

Uh oh!

[18.0][MIG] report_qweb_signer: Migration to 18.0 #1105

Are you sure you want to change the base?

[18.0][MIG] report_qweb_signer: Migration to 18.0 #1105

Uh oh!

Conversation

chienandalu commented Dec 17, 2025

Uh oh!

yajo left a comment

Choose a reason for hiding this comment

Uh oh!

yajo Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

yajo Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

yajo Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

yajo Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

yajo Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants