Insert output of pandoc as is

pandoc -f docbook -t rst qpdf-manual.xml >| /tmp/a.rst Insert /tmp/a.rst into existing index.rst

Insert output of pandoc as is
pandoc -f docbook -t rst qpdf-manual.xml >| /tmp/a.rst Insert /tmp/a.rst into existing index.rst
Jay Berkenbilt
1 parent 22d53f92
Showing 1 changed file with 6324 additions and 0 deletions
manual/index.rst
@@ -6,6 +6,6330 @@ QPDF version |release|
    :maxdepth: 2
    :caption: Contents:
  
+.. _acknowledgments:
+
+General Information
+===================
+
+QPDF is a program that does structural, content-preserving
+transformations on PDF files. QPDF's website is located at
+https://qpdf.sourceforge.io/. QPDF's source code is hosted on github at
+https://github.com/qpdf/qpdf.
+
+QPDF is licensed under `the Apache License, Version
+2.0 <http://www.apache.org/licenses/LICENSE-2.0>`__ (the "License").
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Versions of qpdf prior to version 7 were released under the terms of
+`the Artistic License, version
+2.0 <https://opensource.org/licenses/Artistic-2.0>`__. At your option,
+you may continue to consider qpdf to be licensed under those terms. The
+Apache License 2.0 permits everything that the Artistic License 2.0
+permits but is slightly less restrictive. Allowing the Artistic License
+to continue being used is primary to help people who may have to get
+specific approval to use qpdf in their products.
+
+QPDF is intentionally released with a permissive license. However, if
+there is some reason that the licensing terms don't work for your
+requirements, please feel free to contact the copyright holder to make
+other arrangements.
+
+QPDF was originally created in 2001 and modified periodically between
+2001 and 2005 during my employment at `Apex
+CoVantage <http://www.apexcovantage.com>`__. Upon my departure from
+Apex, the company graciously allowed me to take ownership of the
+software and continue maintaining as an open source project, a decision
+for which I am very grateful. I have made considerable enhancements to
+it since that time. I feel fortunate to have worked for people who would
+make such a decision. This work would not have been possible without
+their support.
+
+.. _ref.overview:
+
+What is QPDF?
+=============
+
+QPDF is a program that does structural, content-preserving
+transformations on PDF files. It could have been called something like
+*pdf-to-pdf*. It also provides many useful capabilities to developers of
+PDF-producing software or for people who just want to look at the
+innards of a PDF file to learn more about how they work.
+
+With QPDF, it is possible to copy objects from one PDF file into another
+and to manipulate the list of pages in a PDF file. This makes it
+possible to merge and split PDF files. The QPDF library also makes it
+possible for you to create PDF files from scratch. In this mode, you are
+responsible for supplying all the contents of the file, while the QPDF
+library takes care off all the syntactical representation of the
+objects, creation of cross references tables and, if you use them,
+object streams, encryption, linearization, and other syntactic details.
+You are still responsible for generating PDF content on your own.
+
+QPDF has been designed with very few external dependencies, and it is
+intentionally very lightweight. QPDF is *not* a PDF content creation
+library, a PDF viewer, or a program capable of converting PDF into other
+formats. In particular, QPDF knows nothing about the semantics of PDF
+content streams. If you are looking for something that can do that, you
+should look elsewhere. However, once you have a valid PDF file, QPDF can
+be used to transform that file in ways perhaps your original PDF
+creation can't handle. For example, many programs generate simple PDF
+files but can't password-protect them, web-optimize them, or perform
+other transformations of that type.
+
+.. _ref.installing:
+
+Building and Installing QPDF
+============================
+
+This chapter describes how to build and install qpdf. Please see also
+the @1@filename@1@README.md@2@filename@2@ and
+@1@filename@1@INSTALL@2@filename@2@ files in the source distribution.
+
+.. _ref.prerequisites:
+
+System Requirements
+-------------------
+
+The qpdf package has few external dependencies. In order to build qpdf,
+the following packages are required:
+
+-  A C++ compiler that supports C++-14.
+
+-  zlib: http://www.zlib.net/
+
+-  jpeg: http://www.ijg.org/files/ or https://libjpeg-turbo.org/
+
+-  *Recommended but not required:* gnutls: https://www.gnutls.org/ to be
+   able to use the gnutls crypto provider, and/or openssl:
+   https://openssl.org/ to be able to use the openssl crypto provider.
+
+-  gnu make 3.81 or newer: http://www.gnu.org/software/make
+
+-  perl version 5.8 or newer: http://www.perl.org/; required for running
+   the test suite. Starting with qpdf version 9.1.1, perl is no longer
+   required at runtime.
+
+-  GNU diffutils (any version): http://www.gnu.org/software/diffutils/
+   is required to run the test suite. Note that this is the version of
+   diff present on virtually all GNU/Linux systems. This is required
+   because the test suite uses @1@command@1@diff -u@2@command@2@.
+
+Part of qpdf's test suite does comparisons of the contents PDF files by
+converting them images and comparing the images. The image comparison
+tests are disabled by default. Those tests are not required for
+determining correctness of a qpdf build if you have not modified the
+code since the test suite also contains expected output files that are
+compared literally. The image comparison tests provide an extra check to
+make sure that any content transformations don't break the rendering of
+pages. Transformations that affect the content streams themselves are
+off by default and are only provided to help developers look into the
+contents of PDF files. If you are making deep changes to the library
+that cause changes in the contents of the files that qpdf generates,
+then you should enable the image comparison tests. Enable them by
+running @1@command@1@configure@2@command@2@ with the
+@1@option@1@--enable-test-compare-images@2@option@2@ flag. If you enable
+this, the following additional requirements are required by the test
+suite. Note that in no case are these items required to use qpdf.
+
+-  libtiff: http://www.remotesensing.org/libtiff/
+
+-  GhostScript version 8.60 or newer: http://www.ghostscript.com
+
+If you do not enable this, then you do not need to have tiff and
+ghostscript.
+
+Pre-built documentation is distributed with qpdf, so you should
+generally not need to rebuild the documentation. In order to build the
+documentation from its docbook sources, you need the docbook XML style
+sheets (http://downloads.sourceforge.net/docbook/). To build the PDF
+version of the documentation, you need Apache fop
+(http://xml.apache.org/fop/) version 0.94 or higher.
+
+.. _ref.building:
+
+Build Instructions
+------------------
+
+Building qpdf on UNIX is generally just a matter of running
+
+::
+
+   ./configure
+   make
+
+You can also run @1@command@1@make check@2@command@2@ to run the test
+suite and @1@command@1@make install@2@command@2@ to install. Please run
+@1@command@1@./configure --help@2@command@2@ for options on what can be
+configured. You can also set the value of ``DESTDIR`` during
+installation to install to a temporary location, as is common with many
+open source packages. Please see also the
+@1@filename@1@README.md@2@filename@2@ and
+@1@filename@1@INSTALL@2@filename@2@ files in the source distribution.
+
+Building on Windows is a little bit more complicated. For details,
+please see @1@filename@1@README-windows.md@2@filename@2@ in the source
+distribution. You can also download a binary distribution for Windows.
+There is a port of qpdf to Visual C++ version 6 in the
+@1@filename@1@contrib@2@filename@2@ area generously contributed by Jian
+Ma. This is also discussed in more detail in
+@1@filename@1@README-windows.md@2@filename@2@.
+
+While ``wchar_t`` is part of the C++ standard, qpdf uses it in only one
+place in the public API, and it's just in a helper function. It is
+possible to build qpdf on a system that doesn't have ``wchar_t``, and
+it's also possible to compile a program that uses qpdf on a system
+without ``wchar_t`` as long as you don't call that one method. This is a
+very unusual situation. For a detailed discussion, please see the
+top-level README.md file in qpdf's source distribution.
+
+There are some other things you can do with the build. Although qpdf
+uses @1@application@1@autoconf@2@application@2@, it does not use
+@1@application@1@automake@2@application@2@ but instead uses a
+hand-crafted non-recursive Makefile that requires gnu make. If you're
+really interested, please read the comments in the top-level
+@1@filename@1@Makefile@2@filename@2@.
+
+.. _ref.crypto:
+
+Crypto Providers
+----------------
+
+Starting with qpdf 9.1.0, the qpdf library can be built with multiple
+implementations of providers of cryptographic functions, which we refer
+to as "crypto providers." At the time of writing, a crypto
+implementation must provide MD5 and SHA2 (256, 384, and 512-bit) hashes
+and RC4 and AES256 with and without CBC encryption. In the future, if
+digital signature is added to qpdf, there may be additional requirements
+beyond this.
+
+Starting with qpdf version 9.1.0, the available implementations are
+``native`` and ``gnutls``. In qpdf 10.0.0, ``openssl`` was added.
+Additional implementations may be added if needed. It is also possible
+for a developer to provide their own implementation without modifying
+the qpdf library.
+
+.. _ref.crypto.build:
+
+Build Support For Crypto Providers
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When building with qpdf's build system, crypto providers can be enabled
+at build time using various @1@command@1@./configure@2@command@2@
+options. The default behavior is for
+@1@command@1@./configure@2@command@2@ to discover which crypto providers
+can be supported based on available external libraries, to build all
+available crypto providers, and to use an external provider as the
+default over the native one. This behavior can be changed with the
+following flags to @1@command@1@./configure@2@command@2@:
+
+-  @1@option@1@--enable-crypto-@1@replaceable@1@x@2@replaceable@2@@2@option@2@
+   (where @1@replaceable@1@x@2@replaceable@2@ is a supported crypto
+   provider): enable the @1@replaceable@1@x@2@replaceable@2@ crypto
+   provider, requiring any external dependencies it needs
+
+-  @1@option@1@--disable-crypto-@1@replaceable@1@x@2@replaceable@2@@2@option@2@:
+   disable the @1@replaceable@1@x@2@replaceable@2@ provider, and do not
+   link against its dependencies even if they are available
+
+-  @1@option@1@--with-default-crypto=@1@replaceable@1@x@2@replaceable@2@@2@option@2@:
+   make @1@replaceable@1@x@2@replaceable@2@ the default provider even if
+   a higher priority one is available
+
+-  @1@option@1@--disable-implicit-crypto@2@option@2@: only build crypto
+   providers that are explicitly requested with an
+   @1@option@1@--enable-crypto-@1@replaceable@1@x@2@replaceable@2@@2@option@2@
+   option
+
+For example, if you want to guarantee that the gnutls crypto provider is
+used and that the native provider is not built, you could run
+@1@command@1@./configure --enable-crypto-gnutls
+--disable-implicit-crypto@2@command@2@.
+
+If you build qpdf using your own build system, in order for qpdf to work
+at all, you need to enable at least one crypto provider. The file
+@1@filename@1@libqpdf/qpdf/qpdf-config.h.in@2@filename@2@ provides
+macros ``DEFAULT_CRYPTO``, whose value must be a string naming the
+default crypto provider, and various symbols starting with
+``USE_CRYPTO_``, at least one of which has to be enabled. Additionally,
+you must compile the source files that implement a crypto provider. To
+get a list of those files, look at
+@1@filename@1@libqpdf/build.mk@2@filename@2@. If you want to omit a
+particular crypto provider, as long as its ``USE_CRYPTO_`` symbol is
+undefined, you can completely ignore the source files that belong to a
+particular crypto provider. Additionally, crypto providers may have
+their own external dependencies that can be omitted if the crypto
+provider is not used. For example, if you are building qpdf yourself and
+are using an environment that does not support gnutls or openssl, you
+can ensure that ``USE_CRYPTO_NATIVE`` is defined, ``USE_CRYPTO_GNUTLS``
+is not defined, and ``DEFAULT_CRYPTO`` is defined to ``"native"``. Then
+you must include the source files used in the native implementation,
+some of which were added or renamed from earlier versions, to your
+build, and you can ignore
+@1@filename@1@QPDFCrypto_gnutls.cc@2@filename@2@. Always consult
+@1@filename@1@libqpdf/build.mk@2@filename@2@ to get the list of source
+files you need to build.
+
+.. _ref.crypto.runtime:
+
+Runtime Crypto Provider Selection
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can use the @1@option@1@--show-crypto@2@option@2@ option to
+@1@command@1@qpdf@2@command@2@ to get a list of available crypto
+providers. The default provider is always listed first, and the rest are
+listed in lexical order. Each crypto provider is listed on a line by
+itself with no other text, enabling the output of this command to be
+used easily in scripts.
+
+You can override which crypto provider is used by setting the
+``QPDF_CRYPTO_PROVIDER`` environment variable. There are few reasons to
+ever do this, but you might want to do it if you were explicitly trying
+to compare behavior of two different crypto providers while testing
+performance or reproducing a bug. It could also be useful for people who
+are implementing their own crypto providers.
+
+.. _ref.crypto.develop:
+
+Crypto Provider Information for Developers
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If you are writing code that uses libqpdf and you want to force a
+certain crypto provider to be used, you can call the method
+``QPDFCryptoProvider::setDefaultProvider``. The argument is the name of
+a built-in or developer-supplied provider. To add your own crypto
+provider, you have to create a class derived from ``QPDFCryptoImpl`` and
+register it with ``QPDFCryptoProvider``. For additional information, see
+comments in @1@filename@1@include/qpdf/QPDFCryptoImpl.hh@2@filename@2@.
+
+.. _ref.crypto.design:
+
+Crypto Provider Design Notes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This section describes a few bits of rationale for why the crypto
+provider interface was set up the way it was. You don't need to know any
+of this information, but it's provided for the record and in case it's
+interesting.
+
+As a general rule, I want to avoid as much as possible including large
+blocks of code that are conditionally compiled such that, in most
+builds, some code is never built. This is dangerous because it makes it
+very easy for invalid code to creep in unnoticed. As such, I want it to
+be possible to build qpdf with all available crypto providers, and this
+is the way I build qpdf for local development. At the same time, if a
+particular packager feels that it is a security liability for qpdf to
+use crypto functionality from other than a library that gets
+considerable scrutiny for this specific purpose (such as gnutls,
+openssl, or nettle), then I want to give that packager the ability to
+completely disable qpdf's native implementation. Or if someone wants to
+avoid adding a dependency on one of the external crypto providers, I
+don't want the availability of the provider to impose additional
+external dependencies within that environment. Both of these are
+situations that I know to be true for some users of qpdf.
+
+I want registration and selection of crypto providers to be thread-safe,
+and I want it to work deterministically for a developer to provide their
+own crypto provider and be able to set it up as the default. This was
+the primary motivation behind requiring C++-11 as doing so enabled me to
+exploit the guaranteed thread safety of local block static
+initialization. The ``QPDFCryptoProvider`` class uses a singleton
+pattern with thread-safe initialization to create the singleton instance
+of ``QPDFCryptoProvider`` and exposes only static methods in its public
+interface. In this way, if a developer wants to call any
+``QPDFCryptoProvider`` methods, the library guarantees the
+``QPDFCryptoProvider`` is fully initialized and all built-in crypto
+providers are registered. Making ``QPDFCryptoProvider`` actually know
+about all the built-in providers may seem a bit sad at first, but this
+choice makes it extremely clear exactly what the initialization behavior
+is. There's no question about provider implementations automatically
+registering themselves in a nondeterministic order. It also means that
+implementations do not need to know anything about the provider
+interface, which makes them easier to test in isolation. Another
+advantage of this approach is that a developer who wants to develop
+their own crypto provider can do so in complete isolation from the qpdf
+library and, with just two calls, can make qpdf use their provider in
+their application. If they decided to contribute their code, plugging it
+into the qpdf library would require a very small change to qpdf's source
+code.
+
+The decision to make the crypto provider selectable at runtime was one I
+struggled with a little, but I decided to do it for various reasons.
+Allowing an end user to switch crypto providers easily could be very
+useful for reproducing a potential bug. If a user reports a bug that
+some cryptographic thing is broken, I can easily ask that person to try
+with the ``QPDF_CRYPTO_PROVIDER`` variable set to different values. The
+same could apply in the event of a performance problem. This also makes
+it easier for qpdf's own test suite to exercise code with different
+providers without having to make every program that links with qpdf
+aware of the possibility of multiple providers. In qpdf's continuous
+integration environment, the entire test suite is run for each supported
+crypto provider. This is made simple by being able to select the
+provider using an environment variable.
+
+Finally, making crypto providers selectable in this way establish a
+pattern that I may follow again in the future for stream filter
+providers. One could imagine a future enhancement where someone could
+provide their own implementations for basic filters like
+``/FlateDecode`` or for other filters that qpdf doesn't support.
+Implementing the registration functions and internal storage of
+registered providers was also easier using C++-11's functional
+interfaces, which was another reason to require C++-11 at this time.
+
+.. _ref.packaging:
+
+Notes for Packagers
+-------------------
+
+If you are packaging qpdf for an operating system distribution, here are
+some things you may want to keep in mind:
+
+-  Starting in qpdf version 9.1.1, qpdf no longer has a runtime
+   dependency on perl. This is because fix-qdf was rewritten in C++.
+   However, qpdf still has a build-time dependency on perl.
+
+-  Make sure you are getting the intended behavior with regard to crypto
+   providers. Read `Build Support For Crypto
+   Providers <#ref.crypto.build>`__ for details.
+
+-  Passing @1@option@1@--enable-show-failed-test-output@2@option@2@ to
+   @1@command@1@./configure@2@command@2@ will cause any failed test
+   output to be written to the console. This can be very useful for
+   seeing test failures generated by autobuilders where you can't access
+   qtest.log after the fact.
+
+-  If qpdf's build environment detects the presence of autoconf and
+   related tools, it will check to ensure that automatically generated
+   files are up-to-date with recorded checksums and fail if it detects a
+   discrepancy. This feature is intended to prevent you from
+   accidentally forgetting to regenerate automatic files after modifying
+   their sources. If your packaging environment automatically refreshes
+   automatic files, it can cause this check to fail. Suppress qpdf's
+   checks by passing @1@option@1@--disable-check-autofiles@2@option@2@
+   to @1@command@1@/.configure@2@command@2@. This is safe since qpdf's
+   @1@command@1@autogen.sh@2@command@2@ just runs autotools in the
+   normal way.
+
+-  QPDF's @1@command@1@make install@2@command@2@ does not install
+   completion files by default, but as a packager, it's good if you
+   install them wherever your distribution expects such files to go. You
+   can find completion files to install in the
+   @1@filename@1@completions@2@filename@2@ directory.
+
+-  Packagers are encouraged to install the source files from the
+   @1@filename@1@examples@2@filename@2@ directory along with qpdf
+   development packages.
+
+.. _ref.using:
+
+Running QPDF
+============
+
+This chapter describes how to run the qpdf program from the command
+line.
+
+.. _ref.invocation:
+
+Basic Invocation
+----------------
+
+When running qpdf, the basic invocation is as follows:
+
+::
+
+   @1@command@1@qpdf@2@command@2@@1@option@1@ [ @1@replaceable@1@options@2@replaceable@2@ ] { @1@replaceable@1@infilename@2@replaceable@2@ | @1@option@1@--empty@2@option@2@ } [ @1@replaceable@1@page_selection_options@2@replaceable@2@ ] @1@replaceable@1@outfilename@2@replaceable@2@@2@option@2@
+
+This converts PDF file @1@option@1@infilename@2@option@2@ to PDF file
+@1@option@1@outfilename@2@option@2@. The output file is functionally
+identical to the input file but may have been structurally reorganized.
+Also, orphaned objects will be removed from the file. Many
+transformations are available as controlled by the options below. In
+place of @1@option@1@infilename@2@option@2@, the parameter
+@1@option@1@--empty@2@option@2@ may be specified. This causes qpdf to
+use a dummy input file that contains zero pages. The only normal use
+case for using @1@option@1@--empty@2@option@2@ would be if you were
+going to add pages from another source, as discussed in `Page Selection
+Options <#ref.page-selection>`__.
+
+If @1@option@1@@filename@2@option@2@ appears as a word anywhere in the
+command-line, it will be read line by line, and each line will be
+treated as a command-line argument. Leading and trailing whitespace is
+intentionally not removed from lines, which makes it possible to handle
+arguments that start or end with spaces. The @1@option@1@@-@2@option@2@
+option allows arguments to be read from standard input. This allows qpdf
+to be invoked with an arbitrary number of arbitrarily long arguments. It
+is also very useful for avoiding having to pass passwords on the command
+line. Note that the @1@option@1@@filename@2@option@2@ can't appear in
+the middle of an argument, so constructs such as
+@1@option@1@--arg=@option@2@option@2@ will not work. You would have to
+include the argument and its options together in the arguments file.
+
+@1@option@1@outfilename@2@option@2@ does not have to be seekable, even
+when generating linearized files. Specifying "@1@option@1@-@2@option@2@"
+as @1@option@1@outfilename@2@option@2@ means to write to standard
+output. If you want to overwrite the input file with the output, use the
+option @1@option@1@--replace-input@2@option@2@ and omit the output file
+name. You can't specify the same file as both the input and the output.
+If you do this, qpdf will tell you about the
+@1@option@1@--replace-input@2@option@2@ option.
+
+Most options require an output file, but some testing or inspection
+commands do not. These are specifically noted.
+
+.. _ref.exit-status:
+
+Exit Status
+~~~~~~~~~~~
+
+The exit status of @1@command@1@qpdf@2@command@2@ may be interpreted as
+follows:
+
+-  ``0``: no errors or warnings were found. The file may still have
+   problems qpdf can't detect. If
+   @1@option@1@--warning-exit-0@2@option@2@ was specified, exit status 0
+   is used even if there are warnings.
+
+-  ``2``: errors were found. qpdf was not able to fully process the
+   file.
+
+-  ``3``: qpdf encountered problems that it was able to recover from. In
+   some cases, the resulting file may still be damaged. Note that qpdf
+   still exits with status ``3`` if it finds warnings even when
+   @1@option@1@--no-warn@2@option@2@ is specified. With
+   @1@option@1@--warning-exit-0@2@option@2@, warnings without errors
+   exit with status 0 instead of 3.
+
+Note that @1@command@1@qpdf@2@command@2@ never exists with status ``1``.
+If you get an exit status of ``1``, it was something else, like the
+shell not being able to find or execute @1@command@1@qpdf@2@command@2@.
+
+.. _ref.shell-completion:
+
+Shell Completion
+----------------
+
+Starting in qpdf version 8.3.0, qpdf provides its own completion support
+for zsh and bash. You can enable bash completion with @1@command@1@eval
+$(qpdf --completion-bash)@2@command@2@ and zsh completion with
+@1@command@1@eval $(qpdf --completion-zsh)@2@command@2@. If
+@1@command@1@qpdf@2@command@2@ is not in your path, you should invoke it
+above with an absolute path. If you invoke it with a relative path, it
+will warn you, and the completion won't work if you're in a different
+directory.
+
+qpdf will use ``argv[0]`` to figure out where its executable is. This
+may produce unwanted results in some cases, especially if you are trying
+to use completion with copy of qpdf that is built from source. You can
+specify a full path to the qpdf you want to use for completion in the
+``QPDF_EXECUTABLE`` environment variable.
+
+.. _ref.basic-options:
+
+Basic Options
+-------------
+
+The following options are the most common ones and perform commonly
+needed transformations.
+
+@1@option@1@--help@2@option@2@
+   Display command-line invocation help.
+
+@1@option@1@--version@2@option@2@
+   Display the current version of qpdf.
+
+@1@option@1@--copyright@2@option@2@
+   Show detailed copyright information.
+
+@1@option@1@--show-crypto@2@option@2@
+   Show a list of available crypto providers, each on a line by itself.
+   The default provider is always listed first. See `Crypto
+   Providers <#ref.crypto>`__ for more information about crypto
+   providers.
+
+@1@option@1@--completion-bash@2@option@2@
+   Output a completion command you can eval to enable shell completion
+   from bash.
+
+@1@option@1@--completion-zsh@2@option@2@
+   Output a completion command you can eval to enable shell completion
+   from zsh.
+
+@1@option@1@--password=@1@replaceable@1@password@2@replaceable@2@@2@option@2@
+   Specifies a password for accessing encrypted files. To read the
+   password from a file or standard input, you can use
+   @1@option@1@--password-file@2@option@2@, added in qpdf 10.2. Note
+   that you can also use @1@option@1@@filename@2@option@2@ or
+   @1@option@1@@-@2@option@2@ as described above to put the password in
+   a file or pass it via standard input, but you would do so by
+   specifying the entire
+   @1@option@1@--password=@1@replaceable@1@password@2@replaceable@2@@2@option@2@
+   option in the file. Syntax such as
+   @1@option@1@--password=@filename@2@option@2@ won't work since
+   @1@option@1@@filename@2@option@2@ is not recognized in the middle of
+   an argument.
+
+@1@option@1@--password-file=@1@replaceable@1@filename@2@replaceable@2@@2@option@2@
+   Reads the first line from the specified file and uses it as the
+   password for accessing encrypted files.
+   @1@option@1@@1@replaceable@1@filename@2@replaceable@2@@2@option@2@
+   may be ``-`` to read the password from standard input. Note that, in
+   this case, the password is echoed and there is no prompt, so use with
+   caution.
+
+@1@option@1@--is-encrypted@2@option@2@
+   Silently exit with status 0 if the file is encrypted or status 2 if
+   the file is not encrypted. This is useful for shell scripts. Other
+   options are ignored if this is given. This option is mutually
+   exclusive with @1@option@1@--requires-password@2@option@2@. Both this
+   option and @1@option@1@--requires-password@2@option@2@ exit with
+   status 2 for non-encrypted files.
+
+@1@option@1@--requires-password@2@option@2@
+   Silently exit with status 0 if a password (other than as supplied) is
+   required. Exit with status 2 if the file is not encrypted. Exit with
+   status 3 if the file is encrypted but requires no password or the
+   correct password has been supplied. This is useful for shell scripts.
+   Note that any supplied password is used when opening the file. When
+   used with a @1@option@1@--password@2@option@2@ option, this option
+   can be used to check the correctness of the password. In that case,
+   an exit status of 3 means the file works with the supplied password.
+   This option is mutually exclusive with
+   @1@option@1@--is-encrypted@2@option@2@. Both this option and
+   @1@option@1@--is-encrypted@2@option@2@ exit with status 2 for
+   non-encrypted files.
+
+@1@option@1@--verbose@2@option@2@
+   Increase verbosity of output. For now, this just prints some
+   indication of any file that it creates.
+
+@1@option@1@--progress@2@option@2@
+   Indicate progress while writing files.
+
+@1@option@1@--no-warn@2@option@2@
+   Suppress writing of warnings to stderr. If warnings were detected and
+   suppressed, @1@command@1@qpdf@2@command@2@ will still exit with exit
+   code 3. See also @1@option@1@--warning-exit-0@2@option@2@.
+
+@1@option@1@--warning-exit-0@2@option@2@
+   If warnings are found but no errors, exit with exit code 0 instead 3.
+   When combined with @1@option@1@--no-warn@2@option@2@, the effect is
+   for @1@command@1@qpdf@2@command@2@ to completely ignore warnings.
+
+@1@option@1@--linearize@2@option@2@
+   Causes generation of a linearized (web-optimized) output file.
+
+@1@option@1@--replace-input@2@option@2@
+   If specified, the output file name should be omitted. This option
+   tells qpdf to replace the input file with the output. It does this by
+   writing to
+   @1@filename@1@@1@replaceable@1@infilename@2@replaceable@2@.~qpdf-temp#@2@filename@2@
+   and, when done, overwriting the input file with the temporary file.
+   If there were any warnings, the original input is saved as
+   @1@filename@1@@1@replaceable@1@infilename@2@replaceable@2@.~qpdf-orig@2@filename@2@.
+
+@1@option@1@--copy-encryption=file@2@option@2@
+   Encrypt the file using the same encryption parameters, including user
+   and owner password, as the specified file. Use
+   @1@option@1@--encryption-file-password@2@option@2@ to specify a
+   password if one is needed to open this file. Note that copying the
+   encryption parameters from a file also copies the first half of
+   ``/ID`` from the file since this is part of the encryption
+   parameters.
+
+@1@option@1@--encryption-file-password=password@2@option@2@
+   If the file specified with @1@option@1@--copy-encryption@2@option@2@
+   requires a password, specify the password using this option. Note
+   that only one of the user or owner password is required. Both
+   passwords will be preserved since QPDF does not distinguish between
+   the two passwords. It is possible to preserve encryption parameters,
+   including the owner password, from a file even if you don't know the
+   file's owner password.
+
+@1@option@1@--allow-weak-crypto@2@option@2@
+   Starting with version 10.4, qpdf issues warnings when requested to
+   create files using RC4 encryption. This option suppresses those
+   warnings. In future versions of qpdf, qpdf will refuse to create
+   files with weak cryptography when this flag is not given. See `Weak
+   Cryptography <#ref.weak-crypto>`__ for additional details.
+
+@1@option@1@--encrypt options --@2@option@2@
+   Causes generation an encrypted output file. Please see `Encryption
+   Options <#ref.encryption-options>`__ for details on how to specify
+   encryption parameters.
+
+@1@option@1@--decrypt@2@option@2@
+   Removes any encryption on the file. A password must be supplied if
+   the file is password protected.
+
+@1@option@1@--password-is-hex-key@2@option@2@
+   Overrides the usual computation/retrieval of the PDF file's
+   encryption key from user/owner password with an explicit
+   specification of the encryption key. When this option is specified,
+   the argument to the @1@option@1@--password@2@option@2@ option is
+   interpreted as a hexadecimal-encoded key value. This only applies to
+   the password used to open the main input file. It does not apply to
+   other files opened by @1@option@1@--pages@2@option@2@ or other
+   options or to files being written.
+
+   Most users will never have a need for this option, and no standard
+   viewers support this mode of operation, but it can be useful for
+   forensic or investigatory purposes. For example, if a PDF file is
+   encrypted with an unknown password, a brute-force attack using the
+   key directly is sometimes more efficient than one using the password.
+   Also, if a file is heavily damaged, it may be possible to derive the
+   encryption key and recover parts of the file using it directly. To
+   expose the encryption key used by an encrypted file that you can open
+   normally, use the @1@option@1@--show-encryption-key@2@option@2@
+   option.
+
+@1@option@1@--suppress-password-recovery@2@option@2@
+   Ordinarily, qpdf attempts to automatically compensate for passwords
+   specified in the wrong character encoding. This option suppresses
+   that behavior. Under normal conditions, there are no reasons to use
+   this option. See `Unicode Passwords <#ref.unicode-passwords>`__ for a
+   discussion
+
+@1@option@1@--password-mode=@1@replaceable@1@mode@2@replaceable@2@@2@option@2@
+   This option can be used to fine-tune how qpdf interprets Unicode
+   (non-ASCII) password strings passed on the command line. With the
+   exception of the @1@option@1@hex-bytes@2@option@2@ mode, these only
+   apply to passwords provided when encrypting files. The
+   @1@option@1@hex-bytes@2@option@2@ mode also applies to passwords
+   specified for reading files. For additional discussion of the
+   supported password modes and when you might want to use them, see
+   `Unicode Passwords <#ref.unicode-passwords>`__. The following modes
+   are supported:
+
+   -  @1@option@1@auto@2@option@2@: Automatically determine whether the
+      specified password is a properly encoded Unicode (UTF-8) string,
+      and transcode it as required by the PDF spec based on the type
+      encryption being applied. On Windows starting with version 8.4.0,
+      and on almost all other modern platforms, incoming passwords will
+      be properly encoded in UTF-8, so this is almost always what you
+      want.
+
+   -  @1@option@1@unicode@2@option@2@: Tells qpdf that the incoming
+      password is UTF-8, overriding whatever its automatic detection
+      determines. The only difference between this mode and
+      @1@option@1@auto@2@option@2@ is that qpdf will fail with an error
+      message if the password is not valid UTF-8 instead of falling back
+      to @1@option@1@bytes@2@option@2@ mode with a warning.
+
+   -  @1@option@1@bytes@2@option@2@: Interpret the password as a literal
+      byte string. For non-Windows platforms, this is what versions of
+      qpdf prior to 8.4.0 did. For Windows platforms, there is no way to
+      specify strings of binary data on the command line directly, but
+      you can use the @1@option@1@@filename@2@option@2@ option to do it,
+      in which case this option forces qpdf to respect the string of
+      bytes as provided. This option will allow you to encrypt PDF files
+      with passwords that will not be usable by other readers.
+
+   -  @1@option@1@hex-bytes@2@option@2@: Interpret the password as a
+      hex-encoded string. This provides a way to pass binary data as a
+      password on all platforms including Windows. As with
+      @1@option@1@bytes@2@option@2@, this option may allow creation of
+      files that can't be opened by other readers. This mode affects
+      qpdf's interpretation of passwords specified for decrypting files
+      as well as for encrypting them. It makes it possible to specify
+      strings that are encoded in some manner other than the system's
+      default encoding.
+
+@1@option@1@--rotate=[+|-]angle[:page-range]@2@option@2@
+   Apply rotation to specified pages. The
+   @1@option@1@page-range@2@option@2@ portion of the option value has
+   the same format as page ranges in `Page Selection
+   Options <#ref.page-selection>`__. If the page range is omitted, the
+   rotation is applied to all pages. The @1@option@1@angle@2@option@2@
+   portion of the parameter may be either 0, 90, 180, or 270. If
+   preceded by @1@option@1@+@2@option@2@ or @1@option@1@-@2@option@2@,
+   the angle is added to or subtracted from the specified pages'
+   original rotations. This is almost always what you want. Otherwise
+   the pages' rotations are set to the exact value, which may cause the
+   appearances of the pages to be inconsistent, especially for scans.
+   For example, the command @1@command@1@qpdf in.pdf out.pdf
+   --rotate=+90:2,4,6 --rotate=180:7-8@2@command@2@ would rotate pages
+   2, 4, and 6 90 degrees clockwise from their original rotation and
+   force the rotation of pages 7 through 8 to 180 degrees regardless of
+   their original rotation, and the command @1@command@1@qpdf in.pdf
+   out.pdf --rotate=+180@2@command@2@ would rotate all pages by 180
+   degrees.
+
+@1@option@1@--keep-files-open=@1@replaceable@1@[yn]@2@replaceable@2@@2@option@2@
+   This option controls whether qpdf keeps individual files open while
+   merging. Prior to version 8.1.0, qpdf always kept all files open, but
+   this meant that the number of files that could be merged was limited
+   by the operating system's open file limit. Version 8.1.0 opened files
+   as they were referenced and closed them after each read, but this
+   caused a major performance impact. Version 8.2.0 optimized the
+   performance but did so in a way that, for local file systems, there
+   was a small but unavoidable performance hit, but for networked file
+   systems, the performance impact could be very high. Starting with
+   version 8.2.1, the default behavior is that files are kept open if no
+   more than 200 files are specified, but that the behavior can be
+   explicitly overridden with the
+   @1@option@1@--keep-files-open@2@option@2@ flag. If you are merging
+   more than 200 files but less than the operating system's max open
+   files limit, you may want to use
+   @1@option@1@--keep-files-open=y@2@option@2@, especially if working
+   over a networked file system. If you are using a local file system
+   where the overhead is low and you might sometimes merge more than the
+   OS limit's number of files from a script and are not worried about a
+   few seconds additional processing time, you may want to specify
+   @1@option@1@--keep-files-open=n@2@option@2@. The threshold for
+   switching may be changed from the default 200 with the
+   @1@option@1@--keep-files-open-threshold@2@option@2@ option.
+
+@1@option@1@--keep-files-open-threshold=@1@replaceable@1@count@2@replaceable@2@@2@option@2@
+   If specified, overrides the default value of 200 used as the
+   threshold for qpdf deciding whether or not to keep files open. See
+   @1@option@1@--keep-files-open@2@option@2@ for details.
+
+@1@option@1@--pages options --@2@option@2@
+   Select specific pages from one or more input files. See `Page
+   Selection Options <#ref.page-selection>`__ for details on how to do
+   page selection (splitting and merging).
+
+@1@option@1@--collate=@1@replaceable@1@n@2@replaceable@2@@2@option@2@
+   When specified, collate rather than concatenate pages from files
+   specified with @1@option@1@--pages@2@option@2@. With a numeric
+   argument, collate in groups of @1@replaceable@1@n@2@replaceable@2@.
+   The default is 1. See `Page Selection
+   Options <#ref.page-selection>`__ for additional details.
+
+@1@option@1@--flatten-rotation@2@option@2@
+   For each page that is rotated using the ``/Rotate`` key in the page's
+   dictionary, remove the ``/Rotate`` key and implement the identical
+   rotation semantics by modifying the page's contents. This option can
+   be useful to prepare files for buggy PDF applications that don't
+   properly handle rotated pages.
+
+@1@option@1@--split-pages=[n]@2@option@2@
+   Write each group of @1@option@1@n@2@option@2@ pages to a separate
+   output file. If @1@option@1@n@2@option@2@ is not specified, create
+   single pages. Output file names are generated as follows:
+
+   -  If the string ``%d`` appears in the output file name, it is
+      replaced with a range of zero-padded page numbers starting from 1.
+
+   -  Otherwise, if the output file name ends in
+      @1@filename@1@.pdf@2@filename@2@ (case insensitive), a zero-padded
+      page range, preceded by a dash, is inserted before the file
+      extension.
+
+   -  Otherwise, the file name is appended with a zero-padded page range
+      preceded by a dash.
+
+   Page ranges are a single number in the case of single-page groups or
+   two numbers separated by a dash otherwise. For example, if
+   @1@filename@1@infile.pdf@2@filename@2@ has 12 pages
+
+   -  @1@command@1@qpdf --split-pages infile.pdf %d-out@2@command@2@
+      would generate files @1@filename@1@01-out@2@filename@2@ through
+      @1@filename@1@12-out@2@filename@2@
+
+   -  @1@command@1@qpdf --split-pages=2 infile.pdf
+      outfile.pdf@2@command@2@ would generate files
+      @1@filename@1@outfile-01-02.pdf@2@filename@2@ through
+      @1@filename@1@outfile-11-12.pdf@2@filename@2@
+
+   -  @1@command@1@qpdf --split-pages infile.pdf
+      something.else@2@command@2@ would generate files
+      @1@filename@1@something.else-01@2@filename@2@ through
+      @1@filename@1@something.else-12@2@filename@2@
+
+   Note that outlines, threads, and other global features of the
+   original PDF file are not preserved. For each page of output, this
+   option creates an empty PDF and copies a single page from the output
+   into it. If you require the global data, you will have to run
+   @1@command@1@qpdf@2@command@2@ with the
+   @1@option@1@--pages@2@option@2@ option once for each file. Using
+   @1@option@1@--split-pages@2@option@2@ is much faster if you don't
+   require the global data.
+
+@1@option@1@--overlay options --@2@option@2@
+   Overlay pages from another file onto the output pages. See `Overlay
+   and Underlay Options <#ref.overlay-underlay>`__ for details on
+   overlay/underlay.
+
+@1@option@1@--underlay options --@2@option@2@
+   Overlay pages from another file onto the output pages. See `Overlay
+   and Underlay Options <#ref.overlay-underlay>`__ for details on
+   overlay/underlay.
+
+Password-protected files may be opened by specifying a password. By
+default, qpdf will preserve any encryption data associated with a file.
+If @1@option@1@--decrypt@2@option@2@ is specified, qpdf will attempt to
+remove any encryption information. If @1@option@1@--encrypt@2@option@2@
+is specified, qpdf will replace the document's encryption parameters
+with whatever is specified.
+
+Note that qpdf does not obey encryption restrictions already imposed on
+the file. Doing so would be meaningless since qpdf can be used to remove
+encryption from the file entirely. This functionality is not intended to
+be used for bypassing copyright restrictions or other restrictions
+placed on files by their producers.
+
+Prior to 8.4.0, in the case of passwords that contain characters that
+fall outside of 7-bit US-ASCII, qpdf left the burden of supplying
+properly encoded encryption and decryption passwords to the user.
+Starting in qpdf 8.4.0, qpdf does this automatically in most cases. For
+an in-depth discussion, please see `Unicode
+Passwords <#ref.unicode-passwords>`__. Previous versions of this manual
+described workarounds using the @1@command@1@iconv@2@command@2@ command.
+Such workarounds are no longer required or recommended with qpdf 8.4.0.
+However, for backward compatibility, qpdf attempts to detect those
+workarounds and do the right thing in most cases.
+
+.. _ref.encryption-options:
+
+Encryption Options
+------------------
+
+To change the encryption parameters of a file, use the --encrypt flag.
+The syntax is
+
+::
+
+   @1@option@1@--encrypt @1@replaceable@1@user-password@2@replaceable@2@ @1@replaceable@1@owner-password@2@replaceable@2@ @1@replaceable@1@key-length@2@replaceable@2@ [ @1@replaceable@1@restrictions@2@replaceable@2@ ] --@2@option@2@
+
+Note that "@1@option@1@--@2@option@2@" terminates parsing of encryption
+flags and must be present even if no restrictions are present.
+
+Either or both of the user password and the owner password may be empty
+strings. Starting in qpdf 10.2, qpdf defaults to not allowing creation
+of PDF files with a non-empty user password, an empty owner password,
+and a 256-bit key since such files can be opened with no password. If
+you want to create such files, specify the encryption option
+@1@option@1@--allow-insecure@2@option@2@, as described below.
+
+The value for
+@1@option@1@@1@replaceable@1@key-length@2@replaceable@2@@2@option@2@ may
+be 40, 128, or 256. The restriction flags are dependent upon key length.
+When no additional restrictions are given, the default is to be fully
+permissive.
+
+If @1@option@1@@1@replaceable@1@key-length@2@replaceable@2@@2@option@2@
+is 40, the following restriction options are available:
+
+@1@option@1@--print=[yn]@2@option@2@
+   Determines whether or not to allow printing.
+
+@1@option@1@--modify=[yn]@2@option@2@
+   Determines whether or not to allow document modification.
+
+@1@option@1@--extract=[yn]@2@option@2@
+   Determines whether or not to allow text/image extraction.
+
+@1@option@1@--annotate=[yn]@2@option@2@
+   Determines whether or not to allow comments and form fill-in and
+   signing.
+
+If @1@option@1@@1@replaceable@1@key-length@2@replaceable@2@@2@option@2@
+is 128, the following restriction options are available:
+
+@1@option@1@--accessibility=[yn]@2@option@2@
+   Determines whether or not to allow accessibility to visually
+   impaired. The qpdf library disregards this field when AES is used or
+   when 256-bit encryption is used. You should really never disable
+   accessibility, but qpdf lets you do it in case you need to configure
+   a file this way for testing purposes. The PDF spec says that
+   conforming readers should disregard this permission and always allow
+   accessibility.
+
+@1@option@1@--extract=[yn]@2@option@2@
+   Determines whether or not to allow text/graphic extraction.
+
+@1@option@1@--assemble=[yn]@2@option@2@
+   Determines whether document assembly (rotation and reordering of
+   pages) is allowed.
+
+@1@option@1@--annotate=[yn]@2@option@2@
+   Determines whether modifying annotations is allowed. This includes
+   adding comments and filling in form fields. Also allows editing of
+   form fields if @1@option@1@--modify-other=y@2@option@2@ is given.
+
+@1@option@1@--form=[yn]@2@option@2@
+   Determines whether filling form fields is allowed.
+
+@1@option@1@--modify-other=[yn]@2@option@2@
+   Allow all document editing except those controlled separately by the
+   @1@option@1@--assemble@2@option@2@,
+   @1@option@1@--annotate@2@option@2@, and
+   @1@option@1@--form@2@option@2@ options.
+
+@1@option@1@--print=@1@replaceable@1@print-opt@2@replaceable@2@@2@option@2@
+   Controls printing access.
+   @1@option@1@@1@replaceable@1@print-opt@2@replaceable@2@@2@option@2@
+   may be one of the following:
+
+   -  @1@option@1@full@2@option@2@: allow full printing
+
+   -  @1@option@1@low@2@option@2@: allow low-resolution printing only
+
+   -  @1@option@1@none@2@option@2@: disallow printing
+
+@1@option@1@--modify=@1@replaceable@1@modify-opt@2@replaceable@2@@2@option@2@
+   Controls modify access. This way of controlling modify access has
+   less granularity than new options added in qpdf 8.4.
+   @1@option@1@@1@replaceable@1@modify-opt@2@replaceable@2@@2@option@2@
+   may be one of the following:
+
+   -  @1@option@1@all@2@option@2@: allow full document modification
+
+   -  @1@option@1@annotate@2@option@2@: allow comment authoring, form
+      operations, and document assembly
+
+   -  @1@option@1@form@2@option@2@: allow form field fill-in and signing
+      and document assembly
+
+   -  @1@option@1@assembly@2@option@2@: allow document assembly only
+
+   -  @1@option@1@none@2@option@2@: allow no modifications
+
+   Using the @1@option@1@--modify@2@option@2@ option does not allow you
+   to create certain combinations of permissions such as allowing form
+   filling but not allowing document assembly. Starting with qpdf 8.4,
+   you can either just use the other options to control fields
+   individually, or you can use something like @1@option@1@--modify=form
+   --assembly=n@2@option@2@ to fine tune.
+
+@1@option@1@--cleartext-metadata@2@option@2@
+   If specified, any metadata stream in the document will be left
+   unencrypted even if the rest of the document is encrypted. This also
+   forces the PDF version to be at least 1.5.
+
+@1@option@1@--use-aes=[yn]@2@option@2@
+   If @1@option@1@--use-aes=y@2@option@2@ is specified, AES encryption
+   will be used instead of RC4 encryption. This forces the PDF version
+   to be at least 1.6.
+
+@1@option@1@--allow-insecure@2@option@2@
+   From qpdf 10.2, qpdf defaults to not allowing creation of PDF files
+   where the user password is non-empty, the owner password is empty,
+   and a 256-bit key is in use. Files created in this way are insecure
+   since they can be opened without a password. Users would ordinarily
+   never want to create such files. If you are using qpdf to
+   intentionally created strange files for testing (a definite valid use
+   of qpdf!), this option allows you to create such insecure files.
+
+@1@option@1@--force-V4@2@option@2@
+   Use of this option forces the ``/V`` and ``/R`` parameters in the
+   document's encryption dictionary to be set to the value ``4``. As
+   qpdf will automatically do this when required, there is no reason to
+   ever use this option. It exists primarily for use in testing qpdf
+   itself. This option also forces the PDF version to be at least 1.5.
+
+If @1@option@1@@1@replaceable@1@key-length@2@replaceable@2@@2@option@2@
+is 256, the minimum PDF version is 1.7 with extension level 8, and the
+AES-based encryption format used is the PDF 2.0 encryption method
+supported by Acrobat X. the same options are available as with 128 bits
+with the following exceptions:
+
+@1@option@1@--use-aes@2@option@2@
+   This option is not available with 256-bit keys. AES is always used
+   with 256-bit encryption keys.
+
+@1@option@1@--force-V4@2@option@2@
+   This option is not available with 256 keys.
+
+@1@option@1@--force-R5@2@option@2@
+   If specified, qpdf sets the minimum version to 1.7 at extension level
+   3 and writes the deprecated encryption format used by Acrobat version
+   IX. This option should not be used in practice to generate PDF files
+   that will be in general use, but it can be useful to generate files
+   if you are trying to test proper support in another application for
+   PDF files encrypted in this way.
+
+The default for each permission option is to be fully permissive.
+
+.. _ref.page-selection:
+
+Page Selection Options
+----------------------
+
+Starting with qpdf 3.0, it is possible to split and merge PDF files by
+selecting pages from one or more input files. Whatever file is given as
+the primary input file is used as the starting point, but its pages are
+replaced with pages as specified.
+
+::
+
+   @1@option@1@--pages @1@replaceable@1@input-file@2@replaceable@2@ [ @1@replaceable@1@--password=password@2@replaceable@2@ ] [ @1@replaceable@1@page-range@2@replaceable@2@ ] [ ... ] --@2@option@2@
+
+Multiple input files may be specified. Each one is given as the name of
+the input file, an optional password (if required to open the file), and
+the range of pages. Note that "@1@option@1@--@2@option@2@" terminates
+parsing of page selection flags.
+
+Starting with qpf 8.4, the special input file name
+"@1@filename@1@.@2@filename@2@" can be used as a shortcut for the
+primary input filename.
+
+For each file that pages should be taken from, specify the file, a
+password needed to open the file (if any), and a page range. The
+password needs to be given only once per file. If any of the input files
+are the same as the primary input file or the file used to copy
+encryption parameters (if specified), you do not need to repeat the
+password here. The same file can be repeated multiple times. If a file
+that is repeated has a password, the password only has to be given the
+first time. All non-page data (info, outlines, page numbers, etc.) are
+taken from the primary input file. To discard these, use
+@1@option@1@--empty@2@option@2@ as the primary input.
+
+Starting with qpdf 5.0.0, it is possible to omit the page range. If qpdf
+sees a value in the place where it expects a page range and that value
+is not a valid range but is a valid file name, qpdf will implicitly use
+the range ``1-z``, meaning that it will include all pages in the file.
+This makes it possible to easily combine all pages in a set of files
+with a command like @1@command@1@qpdf --empty out.pdf --pages \*.pdf
+--@2@command@2@.
+
+The page range is a set of numbers separated by commas, ranges of
+numbers separated dashes, or combinations of those. The character "z"
+represents the last page. A number preceded by an "r" indicates to count
+from the end, so ``r3-r1`` would be the last three pages of the
+document. Pages can appear in any order. Ranges can appear with a high
+number followed by a low number, which causes the pages to appear in
+reverse. Numbers may be repeated in a page range. A page range may be
+optionally appended with ``:even`` or ``:odd`` to indicate only the even
+or odd pages in the given range. Note that even and odd refer to the
+positions within the specified, range, not whether the original number
+is even or odd.
+
+Example page ranges:
+
+-  ``1,3,5-9,15-12``: pages 1, 3, 5, 6, 7, 8, 9, 15, 14, 13, and 12 in
+   that order.
+
+-  ``z-1``: all pages in the document in reverse
+
+-  ``r3-r1``: the last three pages of the document
+
+-  ``r1-r3``: the last three pages of the document in reverse order
+
+-  ``1-20:even``: even pages from 2 to 20
+
+-  ``5,7-9,12:odd``: pages 5, 8, and, 12, which are the pages in odd
+   positions from among the original range, which represents pages 5, 7,
+   8, 9, and 12.
+
+Starting in qpdf version 8.3, you can specify the
+@1@option@1@--collate@2@option@2@ option. Note that this option is
+specified outside of @1@option@1@--pages ... --@2@option@2@. When
+@1@option@1@--collate@2@option@2@ is specified, it changes the meaning
+of @1@option@1@--pages@2@option@2@ so that the specified files, as
+modified by page ranges, are collated rather than concatenated. For
+example, if you add the files @1@filename@1@odd.pdf@2@filename@2@ and
+@1@filename@1@even.pdf@2@filename@2@ containing odd and even pages of a
+document respectively, you could run @1@command@1@qpdf --collate odd.pdf
+--pages odd.pdf even.pdf -- all.pdf@2@command@2@ to collate the pages.
+This would pick page 1 from odd, page 1 from even, page 2 from odd, page
+2 from even, etc. until all pages have been included. Any number of
+files and page ranges can be specified. If any file has fewer pages,
+that file is just skipped when its pages have all been included. For
+example, if you ran @1@command@1@qpdf --collate --empty --pages a.pdf
+1-5 b.pdf 6-4 c.pdf r1 -- out.pdf@2@command@2@, you would get the
+following pages in this order:
+
+-  a.pdf page 1
+
+-  b.pdf page 6
+
+-  c.pdf last page
+
+-  a.pdf page 2
+
+-  b.pdf page 5
+
+-  a.pdf page 3
+
+-  b.pdf page 4
+
+-  a.pdf page 4
+
+-  a.pdf page 5
+
+Starting in qpdf version 10.2, you may specify a numeric argument to
+@1@option@1@--collate@2@option@2@. With
+@1@option@1@--collate=@1@replaceable@1@n@2@replaceable@2@@2@option@2@,
+pull groups of @1@replaceable@1@n@2@replaceable@2@ pages from each file,
+again, stopping when there are no more pages. For example, if you ran
+@1@command@1@qpdf --collate=2 --empty --pages a.pdf 1-5 b.pdf 6-4 c.pdf
+r1 -- out.pdf@2@command@2@, you would get the following pages in this
+order:
+
+-  a.pdf page 1
+
+-  a.pdf page 2
+
+-  b.pdf page 6
+
+-  b.pdf page 5
+
+-  c.pdf last page
+
+-  a.pdf page 3
+
+-  a.pdf page 4
+
+-  b.pdf page 4
+
+-  a.pdf page 5
+
+Starting in qpdf version 8.3, when you split and merge files, any page
+labels (page numbers) are preserved in the final file. It is expected
+that more document features will be preserved by splitting and merging.
+In the mean time, semantics of splitting and merging vary across
+features. For example, the document's outlines (bookmarks) point to
+actual page objects, so if you select some pages and not others,
+bookmarks that point to pages that are in the output file will work, and
+remaining bookmarks will not work. A future version of
+@1@command@1@qpdf@2@command@2@ may do a better job at handling these
+issues. (Note that the qpdf library already contains all of the APIs
+required in order to implement this in your own application if you need
+it.) In the mean time, you can always use
+@1@option@1@--empty@2@option@2@ as the primary input file to avoid
+copying all of that from the first file. For example, to take pages 1
+through 5 from a @1@filename@1@infile.pdf@2@filename@2@ while preserving
+all metadata associated with that file, you could use
+
+::
+
+   @1@command@1@qpdf@2@command@2@ @1@option@1@infile.pdf --pages . 1-5 -- outfile.pdf@2@option@2@
+
+If you wanted pages 1 through 5 from
+@1@filename@1@infile.pdf@2@filename@2@ but you wanted the rest of the
+metadata to be dropped, you could instead run
+
+::
+
+   @1@command@1@qpdf@2@command@2@ @1@option@1@--empty --pages infile.pdf 1-5 -- outfile.pdf@2@option@2@
+
+If you wanted to take pages 1 through 5 from
+@1@filename@1@file1.pdf@2@filename@2@ and pages 11 through 15 from
+@1@filename@1@file2.pdf@2@filename@2@ in reverse, taking document-level
+metadata from @1@filename@1@file2.pdf@2@filename@2@, you would run
+
+::
+
+   @1@command@1@qpdf@2@command@2@ @1@option@1@file2.pdf --pages file1.pdf 1-5 . 15-11 -- outfile.pdf@2@option@2@
+
+If, for some reason, you wanted to take the first page of an encrypted
+file called @1@filename@1@encrypted.pdf@2@filename@2@ with password
+``pass`` and repeat it twice in an output file, and if you wanted to
+drop document-level metadata but preserve encryption, you would use
+
+::
+
+   @1@command@1@qpdf@2@command@2@ @1@option@1@--empty --copy-encryption=encrypted.pdf --encryption-file-password=pass
+   --pages encrypted.pdf --password=pass 1 ./encrypted.pdf --password=pass 1 --
+   outfile.pdf@2@option@2@
+
+Note that we had to specify the password all three times because giving
+a password as @1@option@1@--encryption-file-password@2@option@2@ doesn't
+count for page selection, and as far as qpdf is concerned,
+@1@filename@1@encrypted.pdf@2@filename@2@ and
+@1@filename@1@./encrypted.pdf@2@filename@2@ are separated files. These
+are all corner cases that most users should hopefully never have to be
+bothered with.
+
+Prior to version 8.4, it was not possible to specify the same page from
+the same file directly more than once, and the workaround of specifying
+the same file in more than one way was required. Version 8.4 removes
+this limitation, but there is still a valid use case. When you specify
+the same page from the same file more than once, qpdf will share objects
+between the pages. If you are going to do further manipulation on the
+file and need the two instances of the same original page to be deep
+copies, then you can specify the file in two different ways. For example
+@1@command@1@qpdf in.pdf --pages . 1 ./in.pdf 1 -- out.pdf@2@command@2@
+would create a file with two copies of the first page of the input, and
+the two copies would share any objects in common. This includes fonts,
+images, and anything else the page references.
+
+.. _ref.overlay-underlay:
+
+Overlay and Underlay Options
+----------------------------
+
+Starting with qpdf 8.4, it is possible to overlay or underlay pages from
+other files onto the output generated by qpdf. Specify overlay or
+underlay as follows:
+
+::
+
+   { @1@option@1@--overlay@2@option@2@ | @1@option@1@--underlay@2@option@2@ } @1@replaceable@1@file@2@replaceable@2@ [ @1@option@1@options@2@option@2@ ] @1@option@1@--@2@option@2@
+
+Overlay and underlay options are processed late, so they can be combined
+with other like merging and will apply to the final output. The
+@1@option@1@--overlay@2@option@2@ and @1@option@1@--underlay@2@option@2@
+options work the same way, except underlay pages are drawn underneath
+the page to which they are applied, possibly obscured by the original
+page, and overlay files are drawn on top of the page to which they are
+applied, possibly obscuring the page. You can combine overlay and
+underlay.
+
+The default behavior of overlay and underlay is that pages are taken
+from the overlay/underlay file in sequence and applied to corresponding
+pages in the output until there are no more output pages. If the overlay
+or underlay file runs out of pages, remaining output pages are left
+alone. This behavior can be modified by options, which are provided
+between the @1@option@1@--overlay@2@option@2@ or
+@1@option@1@--underlay@2@option@2@ flag and the
+@1@option@1@--@2@option@2@ option. The following options are supported:
+
+-  @1@option@1@--password=password@2@option@2@: supply a password if the
+   overlay/underlay file is encrypted.
+
+-  @1@option@1@--to=page-range@2@option@2@: a range of pages in the same
+   form at described in `Page Selection Options <#ref.page-selection>`__
+   indicates which pages in the output should have the overlay/underlay
+   applied. If not specified, overlay/underlay are applied to all pages.
+
+-  @1@option@1@--from=[page-range]@2@option@2@: a range of pages that
+   specifies which pages in the overlay/underlay file will be used for
+   overlay or underlay. If not specified, all pages will be used. This
+   can be explicitly specified to be empty if
+   @1@option@1@--repeat@2@option@2@ is used.
+
+-  @1@option@1@--repeat=page-range@2@option@2@: an optional range of
+   pages that specifies which pages in the overlay/underlay file will be
+   repeated after the "from" pages are used up. If you want to repeat a
+   range of pages starting at the beginning, you can explicitly use
+   @1@option@1@--from=@2@option@2@.
+
+Here are some examples.
+
+-  @1@command@1@--overlay o.pdf --to=1-5 --from=1-3 --repeat=4
+   --@2@command@2@: overlay the first three pages from file
+   @1@filename@1@o.pdf@2@filename@2@ onto the first three pages of the
+   output, then overlay page 4 from @1@filename@1@o.pdf@2@filename@2@
+   onto pages 4 and 5 of the output. Leave remaining output pages
+   untouched.
+
+-  @1@command@1@--underlay footer.pdf --from= --repeat=1,2
+   --@2@command@2@: Underlay page 1 of
+   @1@filename@1@footer.pdf@2@filename@2@ on all odd output pages, and
+   underlay page 2 of @1@filename@1@footer.pdf@2@filename@2@ on all even
+   output pages.
+
+.. _ref.attachments:
+
+Embedded Files/Attachments Options
+----------------------------------
+
+Starting with qpdf 10.2, you can work with file attachments in PDF files
+from the command line. The following options are available:
+
+@1@option@1@--list-attachments@2@option@2@
+   Show the "key" and stream number for embedded files. With
+   @1@option@1@--verbose@2@option@2@, additional information, including
+   preferred file name, description, dates, and more are also displayed.
+   The key is usually but not always equal to the file name, and is
+   needed by some of the other options.
+
+@1@option@1@--show-attachment=@1@replaceable@1@key@2@replaceable@2@@2@option@2@
+   Write the contents of the specified attachment to standard output as
+   binary data. The key should match one of the keys shown by
+   @1@option@1@--list-attachments@2@option@2@. If specified multiple
+   times, only the last attachment will be shown.
+
+@1@option@1@--add-attachment @1@replaceable@1@file@2@replaceable@2@ @1@replaceable@1@options@2@replaceable@2@ --@2@option@2@
+   Add or replace an attachment with the contents of
+   @1@replaceable@1@file@2@replaceable@2@. This may be specified more
+   than once. The following additional options may appear before the
+   ``--`` that ends this option:
+
+   @1@option@1@--key=@1@replaceable@1@key@2@replaceable@2@@2@option@2@
+      The key to use to register the attachment in the embedded files
+      table. Defaults to the last path element of
+      @1@replaceable@1@file@2@replaceable@2@.
+
+   @1@option@1@--filename=@1@replaceable@1@name@2@replaceable@2@@2@option@2@
+      The file name to be used for the attachment. This is what is
+      usually displayed to the user and is the name most graphical PDF
+      viewers will use when saving a file. It defaults to the last path
+      element of @1@replaceable@1@file@2@replaceable@2@.
+
+   @1@option@1@--creationdate=@1@replaceable@1@date@2@replaceable@2@@2@option@2@
+      The attachment's creation date in PDF format; defaults to the
+      current time. The date format is explained below.
+
+   @1@option@1@--moddate=@1@replaceable@1@date@2@replaceable@2@@2@option@2@
+      The attachment's modification date in PDF format; defaults to the
+      current time. The date format is explained below.
+
+   @1@option@1@--mimetype=@1@replaceable@1@type/subtype@2@replaceable@2@@2@option@2@
+      The mime type for the attachment, e.g. ``text/plain`` or
+      ``application/pdf``. Note that the mimetype appears in a field
+      called ``/Subtype`` in the PDF but actually includes the full type
+      and subtype of the mime type.
+
+   @1@option@1@--description=@1@replaceable@1@"text"@2@replaceable@2@@2@option@2@
+      Descriptive text for the attachment, displayed by some PDF
+      viewers.
+
+   @1@option@1@--replace@2@option@2@
+      Indicates that any existing attachment with the same key should be
+      replaced by the new attachment. Otherwise,
+      @1@command@1@qpdf@2@command@2@ gives an error if an attachment
+      with that key is already present.
+
+@1@option@1@--remove-attachment=@1@replaceable@1@key@2@replaceable@2@@2@option@2@
+   Remove the specified attachment. This doesn't only remove the
+   attachment from the embedded files table but also clears out the file
+   specification. That means that any potential internal links to the
+   attachment will be broken. This option may be specified multiple
+   times. Run with @1@option@1@--verbose@2@option@2@ to see status of
+   the removal.
+
+@1@option@1@--copy-attachments-from @1@replaceable@1@file@2@replaceable@2@ @1@replaceable@1@options@2@replaceable@2@ --@2@option@2@
+   Copy attachments from another file. This may be specified more than
+   once. The following additional options may appear before the ``--``
+   that ends this option:
+
+   @1@option@1@--password=@1@replaceable@1@password@2@replaceable@2@@2@option@2@
+      If required, the password needed to open
+      @1@replaceable@1@file@2@replaceable@2@
+
+   @1@option@1@--prefix=@1@replaceable@1@prefix@2@replaceable@2@@2@option@2@
+      Only required if the file from which attachments are being copied
+      has attachments with keys that conflict with attachments already
+      in the file. In this case, the specified prefix will be prepended
+      to each key. This affects only the key in the embedded files
+      table, not the file name. The PDF specification doesn't preclude
+      multiple attachments having the same file name.
+
+When a date is required, the date should conform to the PDF date format
+specification, which is
+``D:``\ @1@replaceable@1@yyyymmddhhmmss<z>@2@replaceable@2@, where
+@1@replaceable@1@<z>@2@replaceable@2@ is either ``Z`` for UTC or a
+timezone offset in the form @1@replaceable@1@-hh'mm'@2@replaceable@2@ or
+@1@replaceable@1@+hh'mm'@2@replaceable@2@. Examples:
+``D:20210207161528-05'00'``, ``D:20210207211528Z``.
+
+.. _ref.advanced-parsing:
+
+Advanced Parsing Options
+------------------------
+
+These options control aspects of how qpdf reads PDF files. Mostly these
+are of use to people who are working with damaged files. There is little
+reason to use these options unless you are trying to solve specific
+problems. The following options are available:
+
+@1@option@1@--suppress-recovery@2@option@2@
+   Prevents qpdf from attempting to recover damaged files.
+
+@1@option@1@--ignore-xref-streams@2@option@2@
+   Tells qpdf to ignore any cross-reference streams.
+
+Ordinarily, qpdf will attempt to recover from certain types of errors in
+PDF files. These include errors in the cross-reference table, certain
+types of object numbering errors, and certain types of stream length
+errors. Sometimes, qpdf may think it has recovered but may not have
+actually recovered, so care should be taken when using this option as
+some data loss is possible. The
+@1@option@1@--suppress-recovery@2@option@2@ option will prevent qpdf
+from attempting recovery. In this case, it will fail on the first error
+that it encounters.
+
+Ordinarily, qpdf reads cross-reference streams when they are present in
+a PDF file. If @1@option@1@--ignore-xref-streams@2@option@2@ is
+specified, qpdf will ignore any cross-reference streams for hybrid PDF
+files. The purpose of hybrid files is to make some content available to
+viewers that are not aware of cross-reference streams. It is almost
+never desirable to ignore them. The only time when you might want to use
+this feature is if you are testing creation of hybrid PDF files and wish
+to see how a PDF consumer that doesn't understand object and
+cross-reference streams would interpret such a file.
+
+.. _ref.advanced-transformation:
+
+Advanced Transformation Options
+-------------------------------
+
+These transformation options control fine points of how qpdf creates the
+output file. Mostly these are of use only to people who are very
+familiar with the PDF file format or who are PDF developers. The
+following options are available:
+
+@1@option@1@--compress-streams=@1@replaceable@1@[yn]@2@replaceable@2@@2@option@2@
+   By default, or with @1@option@1@--compress-streams=y@2@option@2@,
+   qpdf will compress any stream with no other filters applied to it
+   with the ``/FlateDecode`` filter when it writes it. To suppress this
+   behavior and preserve uncompressed streams as uncompressed, use
+   @1@option@1@--compress-streams=n@2@option@2@.
+
+@1@option@1@--decode-level=@1@replaceable@1@option@2@replaceable@2@@2@option@2@
+   Controls which streams qpdf tries to decode. The default is
+   @1@option@1@generalized@2@option@2@. The following options are
+   available:
+
+   -  @1@option@1@none@2@option@2@: do not attempt to decode any streams
+
+   -  @1@option@1@generalized@2@option@2@: decode streams filtered with
+      supported generalized filters: ``/LZWDecode``, ``/FlateDecode``,
+      ``/ASCII85Decode``, and ``/ASCIIHexDecode``. We define generalized
+      filters as those to be used for general-purpose compression or
+      encoding, as opposed to filters specifically designed for image
+      data. Note that, by default, streams already compressed with
+      ``/FlateDecode`` are not uncompressed and recompressed unless you
+      also specify @1@option@1@--recompress-flate@2@option@2@.
+
+   -  @1@option@1@specialized@2@option@2@: in addition to generalized,
+      decode streams with supported non-lossy specialized filters;
+      currently this is just ``/RunLengthDecode``
+
+   -  @1@option@1@all@2@option@2@: in addition to generalized and
+      specialized, decode streams with supported lossy filters;
+      currently this is just ``/DCTDecode`` (JPEG)
+
+@1@option@1@--stream-data=@1@replaceable@1@option@2@replaceable@2@@2@option@2@
+   Controls transformation of stream data. This option predates the
+   @1@option@1@--compress-streams@2@option@2@ and
+   @1@option@1@--decode-level@2@option@2@ options. Those options can be
+   used to achieve the same affect with more control. The value of
+   @1@option@1@@1@replaceable@1@option@2@replaceable@2@@2@option@2@ may
+   be one of the following:
+
+   -  @1@option@1@compress@2@option@2@: recompress stream data when
+      possible (default); equivalent to
+      @1@option@1@--compress-streams=y@2@option@2@
+      @1@option@1@--decode-level=generalized@2@option@2@. Does not
+      recompress streams already compressed with ``/FlateDecode`` unless
+      @1@option@1@--recompress-flate@2@option@2@ is also specified.
+
+   -  @1@option@1@preserve@2@option@2@: leave all stream data as is;
+      equivalent to @1@option@1@--compress-streams=n@2@option@2@
+      @1@option@1@--decode-level=none@2@option@2@
+
+   -  @1@option@1@uncompress@2@option@2@: uncompress stream data
+      compressed with generalized filters when possible; equivalent to
+      @1@option@1@--compress-streams=n@2@option@2@
+      @1@option@1@--decode-level=generalized@2@option@2@
+
+@1@option@1@--recompress-flate@2@option@2@
+   By default, streams already compressed with ``/FlateDecode`` are left
+   alone rather than being uncompressed and recompressed. This option
+   causes qpdf to uncompress and recompress the streams. There is a
+   significant performance cost to using this option, but you probably
+   want to use it if you specify
+   @1@option@1@--compression-level@2@option@2@.
+
+@1@option@1@--compression-level=@1@replaceable@1@level@2@replaceable@2@@2@option@2@
+   When writing new streams that are compressed with ``/FlateDecode``,
+   use the specified compression level. The value of
+   @1@option@1@level@2@option@2@ should be a number from 1 to 9 and is
+   passed directly to zlib, which implements deflate compression. Note
+   that qpdf doesn't uncompress and recompress streams by default. To
+   have this option apply to already compressed streams, you should also
+   specify @1@option@1@--recompress-flate@2@option@2@. If your goal is
+   to shrink the size of PDF files, you should also use
+   @1@option@1@--object-streams=generate@2@option@2@.
+
+@1@option@1@--normalize-content=[yn]@2@option@2@
+   Enables or disables normalization of content streams. Content
+   normalization is enabled by default in QDF mode. Please see `QDF
+   Mode <#ref.qdf>`__ for additional discussion of QDF mode.
+
+@1@option@1@--object-streams=@1@replaceable@1@mode@2@replaceable@2@@2@option@2@
+   Controls handling of object streams. The value of
+   @1@option@1@@1@replaceable@1@mode@2@replaceable@2@@2@option@2@ may be
+   one of the following:
+
+   -  @1@option@1@preserve@2@option@2@: preserve original object streams
+      (default)
+
+   -  @1@option@1@disable@2@option@2@: don't write any object streams
+
+   -  @1@option@1@generate@2@option@2@: use object streams wherever
+      possible
+
+@1@option@1@--preserve-unreferenced@2@option@2@
+   Tells qpdf to preserve objects that are not referenced when writing
+   the file. Ordinarily any object that is not referenced in a traversal
+   of the document from the trailer dictionary will be discarded. This
+   may be useful in working with some damaged files or inspecting files
+   with known unreferenced objects.
+
+   This flag is ignored for linearized files and has the effect of
+   causing objects in the new file to be written in order by object ID
+   from the original file. This does not mean that object numbers will
+   be the same since qpdf may create stream lengths as direct or
+   indirect differently from the original file, and the original file
+   may have gaps in its numbering.
+
+   See also @1@option@1@--preserve-unreferenced-resources@2@option@2@,
+   which does something completely different.
+
+@1@option@1@--remove-unreferenced-resources=@1@replaceable@1@option@2@replaceable@2@@2@option@2@
+   The @1@replaceable@1@option@2@replaceable@2@ may be ``auto``,
+   ``yes``, or ``no``. The default is ``auto``.
+
+   Starting with qpdf 8.1, when splitting pages, qpdf is able to attempt
+   to remove images and fonts that are not used by a page even if they
+   are referenced in the page's resources dictionary. When shared
+   resources are in use, this behavior can greatly reduce the file sizes
+   of split pages, but the analysis is very slow. In versions from 8.1
+   through 9.1.1, qpdf did this analysis by default. Starting in qpdf
+   10.0.0, if ``auto`` is used, qpdf does a quick analysis of the file
+   to determine whether the file is likely to have unreferenced objects
+   on pages, a pattern that frequently occurs when resource dictionaries
+   are shared across multiple pages and rarely occurs otherwise. If it
+   discovers this pattern, then it will attempt to remove unreferenced
+   resources. Usually this means you get the slower splitting speed only
+   when it's actually going to create smaller files. You can suppress
+   removal of unreferenced resources altogether by specifying ``no`` or
+   force it to do the full algorithm by specifying ``yes``.
+
+   Other than cases in which you don't care about file size and care a
+   lot about runtime, there are few reasons to use this option,
+   especially now that ``auto`` mode is supported. One reason to use
+   this is if you suspect that qpdf is removing resources it shouldn't
+   be removing. If you encounter that case, please report it as bug at
+   https://github.com/qpdf/qpdf/issues/.
+
+@1@option@1@--preserve-unreferenced-resources@2@option@2@
+   This is a synonym for
+   @1@option@1@--remove-unreferenced-resources=no@2@option@2@.
+
+   See also @1@option@1@--preserve-unreferenced@2@option@2@, which does
+   something completely different.
+
+@1@option@1@--newline-before-endstream@2@option@2@
+   Tells qpdf to insert a newline before the ``endstream`` keyword, not
+   counted in the length, after any stream content even if the last
+   character of the stream was a newline. This may result in two
+   newlines in some cases. This is a requirement of PDF/A. While qpdf
+   doesn't specifically know how to generate PDF/A-compliant PDFs, this
+   at least prevents it from removing compliance on already compliant
+   files.
+
+@1@option@1@--linearize-pass1=@1@replaceable@1@file@2@replaceable@2@@2@option@2@
+   Write the first pass of linearization to the named file. The
+   resulting file is not a valid PDF file. This option is useful only
+   for debugging ``QPDFWriter``'s linearization code. When qpdf
+   linearizes files, it writes the file in two passes, using the first
+   pass to calculate sizes and offsets that are required for hint tables
+   and the linearization dictionary. Ordinarily, the first pass is
+   discarded. This option enables it to be captured.
+
+@1@option@1@--coalesce-contents@2@option@2@
+   When a page's contents are split across multiple streams, this option
+   causes qpdf to combine them into a single stream. Use of this option
+   is never necessary for ordinary usage, but it can help when working
+   with some files in some cases. For example, this can also be combined
+   with QDF mode or content normalization to make it easier to look at
+   all of a page's contents at once.
+
+@1@option@1@--flatten-annotations=@1@replaceable@1@option@2@replaceable@2@@2@option@2@
+   This option collapses annotations into the pages' contents with
+   special handling for form fields. Ordinarily, an annotation is
+   rendered separately and on top of the page. Combining annotations
+   into the page's contents effectively freezes the placement of the
+   annotations, making them look right after various page
+   transformations. The library functionality backing this option was
+   added for the benefit of programs that want to create *n-up* page
+   layouts and other similar things that don't work well with
+   annotations. The @1@replaceable@1@option@2@replaceable@2@ parameter
+   may be any of the following:
+
+   -  @1@option@1@all@2@option@2@: include all annotations that are not
+      marked invisible or hidden
+
+   -  @1@option@1@print@2@option@2@: only include annotations that
+      indicate that they should appear when the page is printed
+
+   -  @1@option@1@screen@2@option@2@: omit annotations that indicate
+      they should not appear on the screen
+
+   Note that form fields are special because the annotations that are
+   used to render filled-in form fields may become out of date from the
+   fields' values if the form is filled in by a program that doesn't
+   know how to update the appearances. If qpdf detects this case, its
+   default behavior is not to flatten those annotations because doing so
+   would cause the value of the form field to be lost. This gives you a
+   chance to go back and resave the form with a program that knows how
+   to generate appearances. QPDF itself can generate appearances with
+   some limitations. See the
+   @1@option@1@--generate-appearances@2@option@2@ option below.
+
+@1@option@1@--generate-appearances@2@option@2@
+   If a file contains interactive form fields and indicates that the
+   appearances are out of date with the values of the form, this flag
+   will regenerate appearances, subject to a few limitations. Note that
+   there is not usually a reason to do this, but it can be necessary
+   before using the @1@option@1@--flatten-annotations@2@option@2@
+   option. Most of these are not a problem with well-behaved PDF files.
+   The limitations are as follows:
+
+   -  Radio button and checkbox appearances use the pre-set values in
+      the PDF file. QPDF just makes sure that the correct appearance is
+      displayed based on the value of the field. This is fine for PDF
+      files that create their forms properly. Some PDF writers save
+      appearances for fields when they change, which could cause some
+      controls to have inconsistent appearances.
+
+   -  For text fields and list boxes, any characters that fall outside
+      of US-ASCII or, if detected, "Windows ANSI" or "Mac Roman"
+      encoding, will be replaced by the ``?`` character.
+
+   -  Quadding is ignored. Quadding is used to specify whether the
+      contents of a field should be left, center, or right aligned with
+      the field.
+
+   -  Rich text, multi-line, and other more elaborate formatting
+      directives are ignored.
+
+   -  There is no support for multi-select fields or signature fields.
+
+   If qpdf doesn't do a good enough job with your form, use an external
+   application to save your filled-in form before processing it with
+   qpdf.
+
+@1@option@1@--optimize-images@2@option@2@
+   This flag causes qpdf to recompress all images that are not
+   compressed with DCT (JPEG) using DCT compression as long as doing so
+   decreases the size in bytes of the image data and the image does not
+   fall below minimum specified dimensions. Useful information is
+   provided when used in combination with
+   @1@option@1@--verbose@2@option@2@. See also the
+   @1@option@1@--oi-min-width@2@option@2@,
+   @1@option@1@--oi-min-height@2@option@2@, and
+   @1@option@1@--oi-min-area@2@option@2@ options. By default, starting
+   in qpdf 8.4, inline images are converted to regular images and
+   optimized as well. Use @1@option@1@--keep-inline-images@2@option@2@
+   to prevent inline images from being included.
+
+@1@option@1@--oi-min-width=@1@replaceable@1@width@2@replaceable@2@@2@option@2@
+   Avoid optimizing images whose width is below the specified amount. If
+   omitted, the default is 128 pixels. Use 0 for no minimum.
+
+@1@option@1@--oi-min-height=@1@replaceable@1@height@2@replaceable@2@@2@option@2@
+   Avoid optimizing images whose height is below the specified amount.
+   If omitted, the default is 128 pixels. Use 0 for no minimum.
+
+@1@option@1@--oi-min-area=@1@replaceable@1@area-in-pixels@2@replaceable@2@@2@option@2@
+   Avoid optimizing images whose pixel count (width × height) is below
+   the specified amount. If omitted, the default is 16,384 pixels. Use 0
+   for no minimum.
+
+@1@option@1@--externalize-inline-images@2@option@2@
+   Convert inline images to regular images. By default, images whose
+   data is at least 1,024 bytes are converted when this option is
+   selected. Use @1@option@1@--ii-min-bytes@2@option@2@ to change the
+   size threshold. This option is implicitly selected when
+   @1@option@1@--optimize-images@2@option@2@ is selected. Use
+   @1@option@1@--keep-inline-images@2@option@2@ to exclude inline images
+   from image optimization.
+
+@1@option@1@--ii-min-bytes=@1@replaceable@1@bytes@2@replaceable@2@@2@option@2@
+   Avoid converting inline images whose size is below the specified
+   minimum size to regular images. If omitted, the default is 1,024
+   bytes. Use 0 for no minimum.
+
+@1@option@1@--keep-inline-images@2@option@2@
+   Prevent inline images from being included in image optimization. This
+   option has no affect when @1@option@1@--optimize-images@2@option@2@
+   is not specified.
+
+@1@option@1@--remove-page-labels@2@option@2@
+   Remove page labels from the output file.
+
+@1@option@1@--qdf@2@option@2@
+   Turns on QDF mode. For additional information on QDF, please see `QDF
+   Mode <#ref.qdf>`__. Note that @1@option@1@--linearize@2@option@2@
+   disables QDF mode.
+
+@1@option@1@--min-version=@1@replaceable@1@version@2@replaceable@2@@2@option@2@
+   Forces the PDF version of the output file to be at least
+   @1@replaceable@1@version@2@replaceable@2@. In other words, if the
+   input file has a lower version than the specified version, the
+   specified version will be used. If the input file has a higher
+   version, the input file's original version will be used. It is seldom
+   necessary to use this option since qpdf will automatically increase
+   the version as needed when adding features that require newer PDF
+   readers.
+
+   The version number may be expressed in the form
+   @1@replaceable@1@major.minor.extension-level@2@replaceable@2@, in
+   which case the version is interpreted as
+   @1@replaceable@1@major.minor@2@replaceable@2@ at extension level
+   @1@replaceable@1@extension-level@2@replaceable@2@. For example,
+   version ``1.7.8`` represents version 1.7 at extension level 8. Note
+   that minimal syntax checking is done on the command line.
+
+@1@option@1@--force-version=@1@replaceable@1@version@2@replaceable@2@@2@option@2@
+   This option forces the PDF version to be the exact version specified
+   *even when the file may have content that is not supported in that
+   version*. The version number is interpreted in the same way as with
+   @1@option@1@--min-version@2@option@2@ so that extension levels can be
+   set. In some cases, forcing the output file's PDF version to be lower
+   than that of the input file will cause qpdf to disable certain
+   features of the document. Specifically, 256-bit keys are disabled if
+   the version is less than 1.7 with extension level 8 (except R5 is
+   disabled if less than 1.7 with extension level 3), AES encryption is
+   disabled if the version is less than 1.6, cleartext metadata and
+   object streams are disabled if less than 1.5, 128-bit encryption keys
+   are disabled if less than 1.4, and all encryption is disabled if less
+   than 1.3. Even with these precautions, qpdf won't be able to do
+   things like eliminate use of newer image compression schemes,
+   transparency groups, or other features that may have been added in
+   more recent versions of PDF.
+
+   As a general rule, with the exception of big structural things like
+   the use of object streams or AES encryption, PDF viewers are supposed
+   to ignore features in files that they don't support from newer
+   versions. This means that forcing the version to a lower version may
+   make it possible to open your PDF file with an older version, though
+   bear in mind that some of the original document's functionality may
+   be lost.
+
+By default, when a stream is encoded using non-lossy filters that qpdf
+understands and is not already compressed using a good compression
+scheme, qpdf will uncompress and recompress streams. Assuming proper
+filter implements, this is safe and generally results in smaller files.
+This behavior may also be explicitly requested with
+@1@option@1@--stream-data=compress@2@option@2@.
+
+When @1@option@1@--normalize-content=y@2@option@2@ is specified, qpdf
+will attempt to normalize whitespace and newlines in page content
+streams. This is generally safe but could, in some cases, cause damage
+to the content streams. This option is intended for people who wish to
+study PDF content streams or to debug PDF content. You should not use
+this for "production" PDF files.
+
+When normalizing content, if qpdf runs into any lexical errors, it will
+print a warning indicating that content may be damaged. The only
+situation in which qpdf is known to cause damage during content
+normalization is when a page's contents are split across multiple
+streams and streams are split in the middle of a lexical token such as a
+string, name, or inline image. Note that files that do this are invalid
+since the PDF specification states that content streams are not to be
+split in the middle of a token. If you want to inspect the original
+content streams in an uncompressed format, you can always run with
+@1@option@1@--qdf --normalize-content=n@2@option@2@ for a QDF file
+without content normalization, or alternatively
+@1@option@1@--stream-data=uncompress@2@option@2@ for a regular non-QDF
+mode file with uncompressed streams. These will both uncompress all the
+streams but will not attempt to normalize content. Please note that if
+you are using content normalization or QDF mode for the purpose of
+manually inspecting files, you don't have to care about this.
+
+Object streams, also known as compressed objects, were introduced into
+the PDF specification at version 1.5, corresponding to Acrobat 6. Some
+older PDF viewers may not support files with object streams. qpdf can be
+used to transform files with object streams to files without object
+streams or vice versa. As mentioned above, there are three object stream
+modes: @1@option@1@preserve@2@option@2@,
+@1@option@1@disable@2@option@2@, and @1@option@1@generate@2@option@2@.
+
+In @1@option@1@preserve@2@option@2@ mode, the relationship to objects
+and the streams that contain them is preserved from the original file.
+In @1@option@1@disable@2@option@2@ mode, all objects are written as
+regular, uncompressed objects. The resulting file should be readable by
+older PDF viewers. (Of course, the content of the files may include
+features not supported by older viewers, but at least the structure will
+be supported.) In @1@option@1@generate@2@option@2@ mode, qpdf will
+create its own object streams. This will usually result in more compact
+PDF files, though they may not be readable by older viewers. In this
+mode, qpdf will also make sure the PDF version number in the header is
+at least 1.5.
+
+The @1@option@1@--qdf@2@option@2@ flag turns on QDF mode, which changes
+some of the defaults described above. Specifically, in QDF mode, by
+default, stream data is uncompressed, content streams are normalized,
+and encryption is removed. These defaults can still be overridden by
+specifying the appropriate options as described above. Additionally, in
+QDF mode, stream lengths are stored as indirect objects, objects are
+laid out in a less efficient but more readable fashion, and the
+documents are interspersed with comments that make it easier for the
+user to find things and also make it possible for
+@1@command@1@fix-qdf@2@command@2@ to work properly. QDF mode is intended
+for people, mostly developers, who wish to inspect or modify PDF files
+in a text editor. For details, please see `QDF Mode <#ref.qdf>`__.
+
+.. _ref.testing-options:
+
+Testing, Inspection, and Debugging Options
+------------------------------------------
+
+These options can be useful for digging into PDF files or for use in
+automated test suites for software that uses the qpdf library. When any
+of the options in this section are specified, no output file should be
+given. The following options are available:
+
+@1@option@1@--deterministic-id@2@option@2@
+   Causes generation of a deterministic value for /ID. This prevents use
+   of timestamp and output file name information in the /ID generation.
+   Instead, at some slight additional runtime cost, the /ID field is
+   generated to include a digest of the significant parts of the content
+   of the output PDF file. This means that a given qpdf operation should
+   generate the same /ID each time it is run, which can be useful when
+   caching results or for generation of some test data. Use of this flag
+   is not compatible with creation of encrypted files.
+
+@1@option@1@--static-id@2@option@2@
+   Causes generation of a fixed value for /ID. This is intended for
+   testing only. Never use it for production files. If you are trying to
+   get the same /ID each time for a given file and you are not
+   generating encrypted files, consider using the
+   @1@option@1@--deterministic-id@2@option@2@ option.
+
+@1@option@1@--static-aes-iv@2@option@2@
+   Causes use of a static initialization vector for AES-CBC. This is
+   intended for testing only so that output files can be reproducible.
+   Never use it for production files. This option in particular is not
+   secure since it significantly weakens the encryption.
+
+@1@option@1@--no-original-object-ids@2@option@2@
+   Suppresses inclusion of original object ID comments in QDF files.
+   This can be useful when generating QDF files for test purposes,
+   particularly when comparing them to determine whether two PDF files
+   have identical content.
+
+@1@option@1@--show-encryption@2@option@2@
+   Shows document encryption parameters. Also shows the document's user
+   password if the owner password is given.
+
+@1@option@1@--show-encryption-key@2@option@2@
+   When encryption information is being displayed, as when
+   @1@option@1@--check@2@option@2@ or
+   @1@option@1@--show-encryption@2@option@2@ is given, display the
+   computed or retrieved encryption key as a hexadecimal string. This
+   value is not ordinarily useful to users, but it can be used as the
+   argument to @1@option@1@--password@2@option@2@ if the
+   @1@option@1@--password-is-hex-key@2@option@2@ is specified. Note
+   that, when PDF files are encrypted, passwords and other metadata are
+   used only to compute an encryption key, and the encryption key is
+   what is actually used for encryption. This enables retrieval of that
+   key.
+
+@1@option@1@--check-linearization@2@option@2@
+   Checks file integrity and linearization status.
+
+@1@option@1@--show-linearization@2@option@2@
+   Checks and displays all data in the linearization hint tables.
+
+@1@option@1@--show-xref@2@option@2@
+   Shows the contents of the cross-reference table in a human-readable
+   form. This is especially useful for files with cross-reference
+   streams which are stored in a binary format.
+
+@1@option@1@--show-object=trailer|obj[,gen]@2@option@2@
+   Show the contents of the given object. This is especially useful for
+   inspecting objects that are inside of object streams (also known as
+   "compressed objects").
+
+@1@option@1@--raw-stream-data@2@option@2@
+   When used along with the @1@option@1@--show-object@2@option@2@
+   option, if the object is a stream, shows the raw stream data instead
+   of object's contents.
+
+@1@option@1@--filtered-stream-data@2@option@2@
+   When used along with the @1@option@1@--show-object@2@option@2@
+   option, if the object is a stream, shows the filtered stream data
+   instead of object's contents. If the stream is filtered using filters
+   that qpdf does not support, an error will be issued.
+
+@1@option@1@--show-npages@2@option@2@
+   Prints the number of pages in the input file on a line by itself.
+   Since the number of pages appears by itself on a line, this option
+   can be useful for scripting if you need to know the number of pages
+   in a file.
+
+@1@option@1@--show-pages@2@option@2@
+   Shows the object and generation number for each page dictionary
+   object and for each content stream associated with the page. Having
+   this information makes it more convenient to inspect objects from a
+   particular page.
+
+@1@option@1@--with-images@2@option@2@
+   When used along with @1@option@1@--show-pages@2@option@2@, also shows
+   the object and generation numbers for the image objects on each page.
+   (At present, information about images in shared resource dictionaries
+   are not output by this command. This is discussed in a comment in the
+   source code.)
+
+@1@option@1@--json@2@option@2@
+   Generate a JSON representation of the file. This is described in
+   depth in `QPDF JSON <#ref.json>`__
+
+@1@option@1@--json-help@2@option@2@
+   Describe the format of the JSON output.
+
+@1@option@1@--json-key=key@2@option@2@
+   This option is repeatable. If specified, only top-level keys
+   specified will be included in the JSON output. If not specified, all
+   keys will be shown.
+
+@1@option@1@--json-object=trailer|obj[,gen]@2@option@2@
+   This option is repeatable. If specified, only specified objects will
+   be shown in the "``objects``" key of the JSON output. If absent, all
+   objects will be shown.
+
+@1@option@1@--check@2@option@2@
+   Checks file structure and well as encryption, linearization, and
+   encoding of stream data. A file for which
+   @1@option@1@--check@2@option@2@ reports no errors may still have
+   errors in stream data content but should otherwise be structurally
+   sound. If @1@option@1@--check@2@option@2@ any errors, qpdf will exit
+   with a status of 2. There are some recoverable conditions that
+   @1@option@1@--check@2@option@2@ detects. These are issued as warnings
+   instead of errors. If qpdf finds no errors but finds warnings, it
+   will exit with a status of 3 (as of version 2.0.4). When
+   @1@option@1@--check@2@option@2@ is combined with other options,
+   checks are always performed before any other options are processed.
+   For erroneous files, @1@option@1@--check@2@option@2@ will cause qpdf
+   to attempt to recover, after which other options are effectively
+   operating on the recovered file. Combining
+   @1@option@1@--check@2@option@2@ with other options in this way can be
+   useful for manually recovering severely damaged files. Note that
+   @1@option@1@--check@2@option@2@ produces no output to standard output
+   when everything is valid, so if you are using this to
+   programmatically validate files in bulk, it is safe to run without
+   output redirected to @1@filename@1@/dev/null@2@filename@2@ and just
+   check for a 0 exit code.
+
+The @1@option@1@--raw-stream-data@2@option@2@ and
+@1@option@1@--filtered-stream-data@2@option@2@ options are ignored
+unless @1@option@1@--show-object@2@option@2@ is given. Either of these
+options will cause the stream data to be written to standard output. In
+order to avoid commingling of stream data with other output, it is
+recommend that these objects not be combined with other test/inspection
+options.
+
+If @1@option@1@--filtered-stream-data@2@option@2@ is given and
+@1@option@1@--normalize-content=y@2@option@2@ is also given, qpdf will
+attempt to normalize the stream data as if it is a page content stream.
+This attempt will be made even if it is not a page content stream, in
+which case it will produce unusable results.
+
+.. _ref.unicode-passwords:
+
+Unicode Passwords
+-----------------
+
+At the library API level, all methods that perform encryption and
+decryption interpret passwords as strings of bytes. It is up to the
+caller to ensure that they are appropriately encoded. Starting with qpdf
+version 8.4.0, qpdf will attempt to make this easier for you when
+interact with qpdf via its command line interface. The PDF specification
+requires passwords used to encrypt files with 40-bit or 128-bit
+encryption to be encoded with PDF Doc encoding. This encoding is a
+single-byte encoding that supports ISO-Latin-1 and a handful of other
+commonly used characters. It has a large overlap with Windows ANSI but
+is not exactly the same. There is generally not a way to provide PDF Doc
+encoded strings on the command line. As such, qpdf versions prior to
+8.4.0 would often create PDF files that couldn't be opened with other
+software when given a password with non-ASCII characters to encrypt a
+file with 40-bit or 128-bit encryption. Starting with qpdf 8.4.0, qpdf
+recognizes the encoding of the parameter and transcodes it as needed.
+The rest of this section provides the details about exactly how qpdf
+behaves. Most users will not need to know this information, but it might
+be useful if you have been working around qpdf's old behavior or if you
+are using qpdf to generate encrypted files for testing other PDF
+software.
+
+A note about Windows: when qpdf builds, it attempts to determine what it
+has to do to use ``wmain`` instead of ``main`` on Windows. The ``wmain``
+function is an alternative entry point that receives all arguments as
+UTF-16-encoded strings. When qpdf starts up this way, it converts all
+the strings to UTF-8 encoding and then invokes the regular main. This
+means that, as far as qpdf is concerned, it receives its command-line
+arguments with UTF-8 encoding, just as it would in any modern Linux or
+UNIX environment.
+
+If a file is being encrypted with 40-bit or 128-bit encryption and the
+supplied password is not a valid UTF-8 string, qpdf will fall back to
+the behavior of interpreting the password as a string of bytes. If you
+have old scripts that encrypt files by passing the output of
+@1@command@1@iconv@2@command@2@ to qpdf, you no longer need to do that,
+but if you do, qpdf should still work. The only exception would be for
+the extremely unlikely case of a password that is encoded with a
+single-byte encoding but also happens to be valid UTF-8. Such a password
+would contain strings of even numbers of characters that alternate
+between accented letters and symbols. In the extremely unlikely event
+that you are intentionally using such passwords and qpdf is thwarting
+you by interpreting them as UTF-8, you can use
+@1@option@1@--password-mode=bytes@2@option@2@ to suppress qpdf's
+automatic behavior.
+
+The @1@option@1@--password-mode@2@option@2@ option, as described earlier
+in this chapter, can be used to change qpdf's interpretation of supplied
+passwords. There are very few reasons to use this option. One would be
+the unlikely case described in the previous paragraph in which the
+supplied password happens to be valid UTF-8 but isn't supposed to be
+UTF-8. Your best bet would be just to provide the password as a valid
+UTF-8 string, but you could also use
+@1@option@1@--password-mode=bytes@2@option@2@. Another reason to use
+@1@option@1@--password-mode=bytes@2@option@2@ would be to intentionally
+generate PDF files encrypted with passwords that are not properly
+encoded. The qpdf test suite does this to generate invalid files for the
+purpose of testing its password recovery capability. If you were trying
+to create intentionally incorrect files for a similar purposes, the
+@1@option@1@bytes@2@option@2@ password mode can enable you to do this.
+
+When qpdf attempts to decrypt a file with a password that contains
+non-ASCII characters, it will generate a list of alternative passwords
+by attempting to interpret the password as each of a handful of
+different coding systems and then transcode them to the required format.
+This helps to compensate for the supplied password being given in the
+wrong coding system, such as would happen if you used the
+@1@command@1@iconv@2@command@2@ workaround that was previously needed.
+It also generates passwords by doing the reverse operation: translating
+from correct in incorrect encoding of the password. This would enable
+qpdf to decrypt files using passwords that were improperly encoded by
+whatever software encrypted the files, including older versions of qpdf
+invoked without properly encoded passwords. The combination of these two
+recovery methods should make qpdf transparently open most encrypted
+files with the password supplied correctly but in the wrong coding
+system. There are no real downsides to this behavior, but if you don't
+want qpdf to do this, you can use the
+@1@option@1@--suppress-password-recovery@2@option@2@ option. One reason
+to do that is to ensure that you know the exact password that was used
+to encrypt the file.
+
+With these changes, qpdf now generates compliant passwords in most
+cases. There are still some exceptions. In particular, the PDF
+specification directs compliant writers to normalize Unicode passwords
+and to perform certain transformations on passwords with bidirectional
+text. Implementing this functionality requires using a real Unicode
+library like ICU. If a client application that uses qpdf wants to do
+this, the qpdf library will accept the resulting passwords, but qpdf
+will not perform these transformations itself. It is possible that this
+will be addressed in a future version of qpdf. The ``QPDFWriter``
+methods that enable encryption on the output file accept passwords as
+strings of bytes.
+
+Please note that the @1@option@1@--password-is-hex-key@2@option@2@
+option is unrelated to all this. This flag bypasses the normal process
+of going from password to encryption string entirely, allowing the raw
+encryption key to be specified directly. This is useful for forensic
+purposes or for brute-force recovery of files with unknown passwords.
+
+.. _ref.qdf:
+
+QDF Mode
+========
+
+In QDF mode, qpdf creates PDF files in what we call @1@firstterm@1@QDF
+form@2@firstterm@2@. A PDF file in QDF form, sometimes called a QDF
+file, is a completely valid PDF file that has ``%QDF-1.0`` as its third
+line (after the pdf header and binary characters) and has certain other
+characteristics. The purpose of QDF form is to make it possible to edit
+PDF files, with some restrictions, in an ordinary text editor. This can
+be very useful for experimenting with different PDF constructs or for
+making one-off edits to PDF files (though there are other reasons why
+this may not always work). Note that QDF mode does not support
+linearized files. If you enable linearization, QDF mode is automatically
+disabled.
+
+It is ordinarily very difficult to edit PDF files in a text editor for
+two reasons: most meaningful data in PDF files is compressed, and PDF
+files are full of offset and length information that makes it hard to
+add or remove data. A QDF file is organized in a manner such that, if
+edits are kept within certain constraints, the
+@1@command@1@fix-qdf@2@command@2@ program, distributed with qpdf, is
+able to restore edited files to a correct state. The
+@1@command@1@fix-qdf@2@command@2@ program takes no command-line
+arguments. It reads a possibly edited QDF file from standard input and
+writes a repaired file to standard output.
+
+The following attributes characterize a QDF file:
+
+-  All objects appear in numerical order in the PDF file, including when
+   objects appear in object streams.
+
+-  Objects are printed in an easy-to-read format, and all line endings
+   are normalized to UNIX line endings.
+
+-  Unless specifically overridden, streams appear uncompressed (when
+   qpdf supports the filters and they are compressed with a non-lossy
+   compression scheme), and most content streams are normalized (line
+   endings are converted to just a UNIX-style linefeeds).
+
+-  All streams lengths are represented as indirect objects, and the
+   stream length object is always the next object after the stream. If
+   the stream data does not end with a newline, an extra newline is
+   inserted, and a special comment appears after the stream indicating
+   that this has been done.
+
+-  If the PDF file contains object streams, if object stream *n*
+   contains *k* objects, those objects are numbered from *n+1* through
+   *n+k*, and the object number/offset pairs appear on a separate line
+   for each object. Additionally, each object in the object stream is
+   preceded by a comment indicating its object number and index. This
+   makes it very easy to find objects in object streams.
+
+-  All beginnings of objects, ``stream`` tokens, ``endstream`` tokens,
+   and ``endobj`` tokens appear on lines by themselves. A blank line
+   follows every ``endobj`` token.
+
+-  If there is a cross-reference stream, it is unfiltered.
+
+-  Page dictionaries and page content streams are marked with special
+   comments that make them easy to find.
+
+-  Comments precede each object indicating the object number of the
+   corresponding object in the original file.
+
+When editing a QDF file, any edits can be made as long as the above
+constraints are maintained. This means that you can freely edit a page's
+content without worrying about messing up the QDF file. It is also
+possible to add new objects so long as those objects are added after the
+last object in the file or subsequent objects are renumbered. If a QDF
+file has object streams in it, you can always add the new objects before
+the xref stream and then change the number of the xref stream, since
+nothing generally ever references it by number.
+
+It is not generally practical to remove objects from QDF files without
+messing up object numbering, but if you remove all references to an
+object, you can run qpdf on the file (after running
+@1@command@1@fix-qdf@2@command@2@), and qpdf will omit the now-orphaned
+object.
+
+When @1@command@1@fix-qdf@2@command@2@ is run, it goes through the file
+and recomputes the following parts of the file:
+
+-  the ``/N``, ``/W``, and ``/First`` keys of all object stream
+   dictionaries
+
+-  the pairs of numbers representing object numbers and offsets of
+   objects in object streams
+
+-  all stream lengths
+
+-  the cross-reference table or cross-reference stream
+
+-  the offset to the cross-reference table or cross-reference stream
+   following the ``startxref`` token
+
+.. _ref.using-library:
+
+Using the QPDF Library
+======================
+
+.. _ref.using.from-cxx:
+
+Using QPDF from C++
+-------------------
+
+The source tree for the qpdf package has an
+@1@filename@1@examples@2@filename@2@ directory that contains a few
+example programs. The @1@filename@1@qpdf/qpdf.cc@2@filename@2@ source
+file also serves as a useful example since it exercises almost all of
+the qpdf library's public interface. The best source of documentation on
+the library itself is reading comments in
+@1@filename@1@include/qpdf/QPDF.hh@2@filename@2@,
+@1@filename@1@include/qpdf/QPDFWriter.hh@2@filename@2@, and
+@1@filename@1@include/qpdf/QPDFObjectHandle.hh@2@filename@2@.
+
+All header files are installed in the
+@1@filename@1@include/qpdf@2@filename@2@ directory. It is recommend that
+you use ``#include
+    <qpdf/QPDF.hh>`` rather than adding
+@1@filename@1@include/qpdf@2@filename@2@ to your include path.
+
+When linking against the qpdf static library, you may also need to
+specify ``-lz -ljpeg`` on your link command. If your system understands
+how to read libtool @1@filename@1@.la@2@filename@2@ files, this may not
+be necessary.
+
+The qpdf library is safe to use in a multithreaded program, but no
+individual ``QPDF`` object instance (including ``QPDF``,
+``QPDFObjectHandle``, or ``QPDFWriter``) can be used in more than one
+thread at a time. Multiple threads may simultaneously work with
+different instances of these and all other QPDF objects.
+
+.. _ref.using.other-languages:
+
+Using QPDF from other languages
+-------------------------------
+
+The qpdf library is implemented in C++, which makes it hard to use
+directly in other languages. There are a few things that can help.
+
+"C"
+   The qpdf library includes a "C" language interface that provides a
+   subset of the overall capabilities. The header file
+   @1@filename@1@qpdf/qpdf-c.h@2@filename@2@ includes information about
+   its use. As long as you use a C++ linker, you can link C programs
+   with qpdf and use the C API. For languages that can directly load
+   methods from a shared library, the C API can also be useful. People
+   have reported success using the C API from other languages on Windows
+   by directly calling functions in the DLL.
+
+Python
+   A Python module called
+   `pikepdf <https://pypi.org/project/pikepdf/>`__ provides a clean and
+   highly functional set of Python bindings to the qpdf library. Using
+   pikepdf, you can work with PDF files in a natural way and combine
+   qpdf's capabilities with other functionality provided by Python's
+   rich standard library and available modules.
+
+Other Languages
+   Starting with version 8.3.0, the @1@command@1@qpdf@2@command@2@
+   command-line tool can produce a JSON representation of the PDF file's
+   non-content data. This can facilitate interacting programmatically
+   with PDF files through qpdf's command line interface. For more
+   information, please see `QPDF JSON <#ref.json>`__.
+
+.. _ref.unicode-files:
+
+A Note About Unicode File Names
+-------------------------------
+
+When strings are passed to qpdf library routines either as ``char*`` or
+as ``std::string``, they are treated as byte arrays except where
+otherwise noted. When Unicode is desired, qpdf wants UTF-8 unless
+otherwise noted in comments in header files. In modern UNIX/Linux
+environments, this generally does the right thing. In Windows, it's a
+bit more complicated. Starting in qpdf 8.4.0, passwords that contain
+Unicode characters are handled much better, and starting in qpdf 8.4.1,
+the library attempts to properly handle Unicode characters in filenames.
+In particular, in Windows, if a UTF-8 encoded string is used as a
+filename in either ``QPDF`` or ``QPDFWriter``, it is internally
+converted to ``wchar_t*``, and Unicode-aware Windows APIs are used. As
+such, qpdf will generally operate properly on files with non-ASCII
+characters in their names as long as the filenames are UTF-8 encoded for
+passing into the qpdf library API, but there are still some rough edges,
+such as the encoding of the filenames in error messages our CLI output
+messages. Patches or bug reports are welcome for any continuing issues
+with Unicode file names in Windows.
+
+.. _ref.weak-crypto:
+
+Weak Cryptography
+=================
+
+Start with version 10.4, qpdf is taking steps to reduce the likelihood
+of a user *accidentally* creating PDF files with insecure cryptography
+but will continue to allow creation of such files indefinitely with
+explicit acknowledgment.
+
+The PDF file format makes use of RC4, which is known to be a weak
+cryptography algorithm, and MD5, which is a weak hashing algorithm. In
+version 10.4, qpdf generates warnings for some (but not all) cases of
+writing files with weak cryptography when invoked from the command-line.
+These warnings can be suppressed using the
+@1@option@1@--allow-weak-crypto@2@option@2@ option.
+
+It is planned for qpdf version 11 to be stricter, making it an error to
+write files with insecure cryptography from the command-line tool in
+most cases without specifying the
+@1@option@1@--allow-weak-crypto@2@option@2@ flag and also to require
+explicit steps when using the C++ library to enable use of insecure
+cryptography.
+
+Note that qpdf must always retain support for weak cryptographic
+algorithms since this is required for reading older PDF files that use
+it. Additionally, qpdf will always retain the ability to create files
+using weak cryptographic algorithms since, as a development tool, qpdf
+explicitly supports creating older or deprecated types of PDF files
+since these are sometimes needed to test or work with older versions of
+software. Even if other cryptography libraries drop support for RC4 or
+MD5, qpdf can always fall back to its internal implementations of those
+algorithms, so they are not going to disappear from qpdf.
+
+.. _ref.json:
+
+QPDF JSON
+=========
+
+.. _ref.json-overview:
+
+Overview
+--------
+
+Beginning with qpdf version 8.3.0, the @1@command@1@qpdf@2@command@2@
+command-line program can produce a JSON representation of the
+non-content data in a PDF file. It includes a dump in JSON format of all
+objects in the PDF file excluding the content of streams. This JSON
+representation makes it very easy to look in detail at the structure of
+a given PDF file, and it also provides a great way to work with PDF
+files programmatically from the command-line in languages that can't
+call or link with the qpdf library directly. Note that stream data can
+be extracted from PDF files using other qpdf command-line options.
+
+.. _ref.json-guarantees:
+
+JSON Guarantees
+---------------
+
+The qpdf JSON representation includes a JSON serialization of the raw
+objects in the PDF file as well as some computed information in a more
+easily extracted format. QPDF provides some guarantees about its JSON
+format. These guarantees are designed to simplify the experience of a
+developer working with the JSON format.
+
+Compatibility
+   The top-level JSON object output is a dictionary. The JSON output
+   contains various nested dictionaries and arrays. With the exception
+   of dictionaries that are populated by the fields of objects from the
+   file, all instances of a dictionary are guaranteed to have exactly
+   the same keys. Future versions of qpdf are free to add additional
+   keys but not to remove keys or change the type of object that a key
+   points to. The qpdf program validates this guarantee, and in the
+   unlikely event that a bug in qpdf should cause it to generate data
+   that doesn't conform to this rule, it will ask you to file a bug
+   report.
+
+   The top-level JSON structure contains a "``version``" key whose value
+   is simple integer. The value of the ``version`` key will be
+   incremented if a non-compatible change is made. A non-compatible
+   change would be any change that involves removal of a key, a change
+   to the format of data pointed to by a key, or a semantic change that
+   requires a different interpretation of a previously existing key. A
+   strong effort will be made to avoid breaking compatibility.
+
+Documentation
+   The @1@command@1@qpdf@2@command@2@ command can be invoked with the
+   @1@option@1@--json-help@2@option@2@ option. This will output a JSON
+   structure that has the same structure as the JSON output that qpdf
+   generates, except that each field in the help output is a description
+   of the corresponding field in the JSON output. The specific
+   guarantees are as follows:
+
+   -  A dictionary in the help output means that the corresponding
+      location in the actual JSON output is also a dictionary with
+      exactly the same keys; that is, no keys present in help are absent
+      in the real output, and no keys will be present in the real output
+      that are not in help. As a special case, if the dictionary has a
+      single key whose name starts with ``<`` and ends with ``>``, it
+      means that the JSON output is a dictionary that can have any keys,
+      each of which conforms to the value of the special key. This is
+      used for cases in which the keys of the dictionary are things like
+      object IDs.
+
+   -  A string in the help output is a description of the item that
+      appears in the corresponding location of the actual output. The
+      corresponding output can have any format.
+
+   -  An array in the help output always contains a single element. It
+      indicates that the corresponding location in the actual output is
+      also an array, and that each element of the array has whatever
+      format is implied by the single element of the help output's
+      array.
+
+   For example, the help output indicates includes a "``pagelabels``"
+   key whose value is an array of one element. That element is a
+   dictionary with keys "``index``" and "``label``". In addition to
+   describing the meaning of those keys, this tells you that the actual
+   JSON output will contain a ``pagelabels`` array, each of whose
+   elements is a dictionary that contains an ``index`` key, a ``label``
+   key, and no other keys.
+
+Directness and Simplicity
+   The JSON output contains the value of every object in the file, but
+   it also contains some processed data. This is analogous to how qpdf's
+   library interface works. The processed data is similar to the helper
+   functions in that it allows you to look at certain aspects of the PDF
+   file without having to understand all the nuances of the PDF
+   specification, while the raw objects allow you to mine the PDF for
+   anything that the higher-level interfaces are lacking.
+
+.. _json.limitations:
+
+Limitations of JSON Representation
+----------------------------------
+
+There are a few limitations to be aware of with the JSON structure:
+
+-  Strings, names, and indirect object references in the original PDF
+   file are all converted to strings in the JSON representation. In the
+   case of a "normal" PDF file, you can tell the difference because a
+   name starts with a slash (``/``), and an indirect object reference
+   looks like ``n n R``, but if there were to be a string that looked
+   like a name or indirect object reference, there would be no way to
+   tell this from the JSON output. Note that there are certain cases
+   where you know for sure what something is, such as knowing that
+   dictionary keys in objects are always names and that certain things
+   in the higher-level computed data are known to contain indirect
+   object references.
+
+-  The JSON format doesn't support binary data very well. Mostly the
+   details are not important, but they are presented here for
+   information. When qpdf outputs a string in the JSON representation,
+   it converts the string to UTF-8, assuming usual PDF string semantics.
+   Specifically, if the original string is UTF-16, it is converted to
+   UTF-8. Otherwise, it is assumed to have PDF doc encoding, and is
+   converted to UTF-8 with that assumption. This causes strange things
+   to happen to binary strings. For example, if you had the binary
+   string ``<038051>``, this would be output to the JSON as ``\u0003•Q``
+   because ``03`` is not a printable character and ``80`` is the bullet
+   character in PDF doc encoding and is mapped to the Unicode value
+   ``2022``. Since ``51`` is ``Q``, it is output as is. If you wanted to
+   convert back from here to a binary string, would have to recognize
+   Unicode values whose code points are higher than ``0xFF`` and map
+   those back to their corresponding PDF doc encoding characters. There
+   is no way to tell the difference between a Unicode string that was
+   originally encoded as UTF-16 or one that was converted from PDF doc
+   encoding. In other words, it's best if you don't try to use the JSON
+   format to extract binary strings from the PDF file, but if you really
+   had to, it could be done. Note that qpdf's
+   @1@option@1@--show-object@2@option@2@ option does not have this
+   limitation and will reveal the string as encoded in the original
+   file.
+
+.. _json.considerations:
+
+JSON: Special Considerations
+----------------------------
+
+For the most part, the built-in JSON help tells you everything you need
+to know about the JSON format, but there are a few non-obvious things to
+be aware of:
+
+-  While qpdf guarantees that keys present in the help will be present
+   in the output, those fields may be null or empty if the information
+   is not known or absent in the file. Also, if you specify
+   @1@option@1@--json-keys@2@option@2@, the keys that are not listed
+   will be excluded entirely except for those that
+   @1@option@1@--json-help@2@option@2@ says are always present.
+
+-  In a few places, there are keys with names containing
+   ``pageposfrom1``. The values of these keys are null or an integer. If
+   an integer, they point to a page index within the file numbering from
+   1. Note that JSON indexes from 0, and you would also use 0-based
+   indexing using the API. However, 1-based indexing is easier in this
+   case because the command-line syntax for specifying page ranges is
+   1-based. If you were going to write a program that looked through the
+   JSON for information about specific pages and then use the
+   command-line to extract those pages, 1-based indexing is easier.
+   Besides, it's more convenient to subtract 1 from a program in a real
+   programming language than it is to add 1 from shell code.
+
+-  The image information included in the ``page`` section of the JSON
+   output includes the key "``filterable``". Note that the value of this
+   field may depend on the @1@option@1@--decode-level@2@option@2@ that
+   you invoke qpdf with. The JSON output includes a top-level key
+   "``parameters``" that indicates the decode level used for computing
+   whether a stream was filterable. For example, jpeg images will be
+   shown as not filterable by default, but they will be shown as
+   filterable if you run @1@command@1@qpdf --json
+   --decode-level=all@2@command@2@.
+
+.. _ref.design:
+
+Design and Library Notes
+========================
+
+.. _ref.design.intro:
+
+Introduction
+------------
+
+This section was written prior to the implementation of the qpdf package
+and was subsequently modified to reflect the implementation. In some
+cases, for purposes of explanation, it may differ slightly from the
+actual implementation. As always, the source code and test suite are
+authoritative. Even if there are some errors, this document should serve
+as a road map to understanding how this code works.
+
+In general, one should adhere strictly to a specification when writing
+but be liberal in reading. This way, the product of our software will be
+accepted by the widest range of other programs, and we will accept the
+widest range of input files. This library attempts to conform to that
+philosophy whenever possible but also aims to provide strict checking
+for people who want to validate PDF files. If you don't want to see
+warnings and are trying to write something that is tolerant, you can
+call ``setSuppressWarnings(true)``. If you want to fail on the first
+error, you can call ``setAttemptRecovery(false)``. The default behavior
+is to generating warnings for recoverable problems. Note that recovery
+will not always produce the desired results even if it is able to get
+through the file. Unlike most other PDF files that produce generic
+warnings such as "This file is damaged,", qpdf generally issues a
+detailed error message that would be most useful to a PDF developer.
+This is by design as there seems to be a shortage of PDF validation
+tools out there. This was, in fact, one of the major motivations behind
+the initial creation of qpdf.
+
+.. _ref.design-goals:
+
+Design Goals
+------------
+
+The QPDF package includes support for reading and rewriting PDF files.
+It aims to hide from the user details involving object locations,
+modified (appended) PDF files, the directness/indirectness of objects,
+and stream filters including encryption. It does not aim to hide
+knowledge of the object hierarchy or content stream contents. Put
+another way, a user of the qpdf library is expected to have knowledge
+about how PDF files work, but is not expected to have to keep track of
+bookkeeping details such as file positions.
+
+A user of the library never has to care whether an object is direct or
+indirect, though it is possible to determine whether an object is direct
+or not if this information is needed. All access to objects deals with
+this transparently. All memory management details are also handled by
+the library.
+
+The ``PointerHolder`` object is used internally by the library to deal
+with memory management. This is basically a smart pointer object very
+similar in spirit to C++-11's ``std::shared_ptr`` object, but predating
+it by several years. This library also makes use of a technique for
+giving fine-grained access to methods in one class to other classes by
+using public subclasses with friends and only private members that in
+turn call private methods of the containing class. See
+``QPDFObjectHandle::Factory`` as an example.
+
+The top-level qpdf class is ``QPDF``. A ``QPDF`` object represents a PDF
+file. The library provides methods for both accessing and mutating PDF
+files.
+
+The primary class for interacting with PDF objects is
+``QPDFObjectHandle``. Instances of this class can be passed around by
+value, copied, stored in containers, etc. with very low overhead.
+Instances of ``QPDFObjectHandle`` created by reading from a file will
+always contain a reference back to the ``QPDF`` object from which they
+were created. A ``QPDFObjectHandle`` may be direct or indirect. If
+indirect, the ``QPDFObject`` the ``PointerHolder`` initially points to
+is a null pointer. In this case, the first attempt to access the
+underlying ``QPDFObject`` will result in the ``QPDFObject`` being
+resolved via a call to the referenced ``QPDF`` instance. This makes it
+essentially impossible to make coding errors in which certain things
+will work for some PDF files and not for others based on which objects
+are direct and which objects are indirect.
+
+Instances of ``QPDFObjectHandle`` can be directly created and modified
+using static factory methods in the ``QPDFObjectHandle`` class. There
+are factory methods for each type of object as well as a convenience
+method ``QPDFObjectHandle::parse`` that creates an object from a string
+representation of the object. Existing instances of ``QPDFObjectHandle``
+can also be modified in several ways. See comments in
+@1@filename@1@QPDFObjectHandle.hh@2@filename@2@ for details.
+
+An instance of ``QPDF`` is constructed by using the class's default
+constructor. If desired, the ``QPDF`` object may be configured with
+various methods that change its default behavior. Then the
+``QPDF::processFile()`` method is passed the name of a PDF file, which
+permanently associates the file with that QPDF object. A password may
+also be given for access to password-protected files. QPDF does not
+enforce encryption parameters and will treat user and owner passwords
+equivalently. Either password may be used to access an encrypted file.
+``QPDF`` will allow recovery of a user password given an owner password.
+The input PDF file must be seekable. (Output files written by
+``QPDFWriter`` need not be seekable, even when creating linearized
+files.) During construction, ``QPDF`` validates the PDF file's header,
+and then reads the cross reference tables and trailer dictionaries. The
+``QPDF`` class keeps only the first trailer dictionary though it does
+read all of them so it can check the ``/Prev`` key. ``QPDF`` class users
+may request the root object and the trailer dictionary specifically. The
+cross reference table is kept private. Objects may then be requested by
+number of by walking the object tree.
+
+When a PDF file has a cross-reference stream instead of a
+cross-reference table and trailer, requesting the document's trailer
+dictionary returns the stream dictionary from the cross-reference stream
+instead.
+
+There are some convenience routines for very common operations such as
+walking the page tree and returning a vector of all page objects. For
+full details, please see the header files
+@1@filename@1@QPDF.hh@2@filename@2@ and
+@1@filename@1@QPDFObjectHandle.hh@2@filename@2@. There are also some
+additional helper classes that provide higher level API functions for
+certain document constructions. These are discussed in `Helper
+Classes <#ref.helper-classes>`__.
+
+.. _ref.helper-classes:
+
+Helper Classes
+--------------
+
+QPDF version 8.1 introduced the concept of helper classes. Helper
+classes are intended to contain higher level APIs that allow developers
+to work with certain document constructs at an abstraction level above
+that of ``QPDFObjectHandle`` while staying true to qpdf's philosophy of
+not hiding document structure from the developer. As with qpdf in
+general, the goal is take away some of the more tedious bookkeeping
+aspects of working with PDF files, not to remove the need for the
+developer to understand how the PDF construction in question works. The
+driving factor behind the creation of helper classes was to allow the
+evolution of higher level interfaces in qpdf without polluting the
+interfaces of the main top-level classes ``QPDF`` and
+``QPDFObjectHandle``.
+
+There are two kinds of helper classes: *document* helpers and *object*
+helpers. Document helpers are constructed with a reference to a ``QPDF``
+object and provide methods for working with structures that are at the
+document level. Object helpers are constructed with an instance of a
+``QPDFObjectHandle`` and provide methods for working with specific types
+of objects.
+
+Examples of document helpers include ``QPDFPageDocumentHelper``, which
+contains methods for operating on the document's page trees, such as
+enumerating all pages of a document and adding and removing pages; and
+``QPDFAcroFormDocumentHelper``, which contains document-level methods
+related to interactive forms, such as enumerating form fields and
+creating mappings between form fields and annotations.
+
+Examples of object helpers include ``QPDFPageObjectHelper`` for
+performing operations on pages such as page rotation and some operations
+on content streams, ``QPDFFormFieldObjectHelper`` for performing
+operations related to interactive form fields, and
+``QPDFAnnotationObjectHelper`` for working with annotations.
+
+It is always possible to retrieve the underlying ``QPDF`` reference from
+a document helper and the underlying ``QPDFObjectHandle`` reference from
+an object helper. Helpers are designed to be helpers, not wrappers. The
+intention is that, in general, it is safe to freely intermix operations
+that use helpers with operations that use the underlying objects.
+Document and object helpers do not attempt to provide a complete
+interface for working with the things they are helping with, nor do they
+attempt to encapsulate underlying structures. They just provide a few
+methods to help with error-prone, repetitive, or complex tasks. In some
+cases, a helper object may cache some information that is expensive to
+gather. In such cases, the helper classes are implemented so that their
+own methods keep the cache consistent, and the header file will provide
+a method to invalidate the cache and a description of what kinds of
+operations would make the cache invalid. If in doubt, you can always
+discard a helper class and create a new one with the same underlying
+objects, which will ensure that you have discarded any stale
+information.
+
+By Convention, document helpers are called
+``QPDFSomethingDocumentHelper`` and are derived from
+``QPDFDocumentHelper``, and object helpers are called
+``QPDFSomethingObjectHelper`` and are derived from ``QPDFObjectHelper``.
+For details on specific helpers, please see their header files. You can
+find them by looking at
+@1@filename@1@include/qpdf/QPDF*DocumentHelper.hh@2@filename@2@ and
+@1@filename@1@include/qpdf/QPDF*ObjectHelper.hh@2@filename@2@.
+
+In order to avoid creation of circular dependencies, the following
+general guidelines are followed with helper classes:
+
+-  Core class interfaces do not know about helper classes. For example,
+   no methods of ``QPDF`` or ``QPDFObjectHandle`` will include helper
+   classes in their interfaces.
+
+-  Interfaces of object helpers will usually not use document helpers in
+   their interfaces. This is because it is much more useful for document
+   helpers to have methods that return object helpers. Most operations
+   in PDF files start at the document level and go from there to the
+   object level rather than the other way around. It can sometimes be
+   useful to map back from object-level structures to document-level
+   structures. If there is a desire to do this, it will generally be
+   provided by a method in the document helper class.
+
+-  Most of the time, object helpers don't know about other object
+   helpers. However, in some cases, one type of object may be a
+   container for another type of object, in which case it may make sense
+   for the outer object to know about the inner object. For example,
+   there are methods in the ``QPDFPageObjectHelper`` that know
+   ``QPDFAnnotationObjectHelper`` because references to annotations are
+   contained in page dictionaries.
+
+-  Any helper or core library class may use helpers in their
+   implementations.
+
+Prior to qpdf version 8.1, higher level interfaces were added as
+"convenience functions" in either ``QPDF`` or ``QPDFObjectHandle``. For
+compatibility, older convenience functions for operating with pages will
+remain in those classes even as alternatives are provided in helper
+classes. Going forward, new higher level interfaces will be provided
+using helper classes.
+
+.. _ref.implementation-notes:
+
+Implementation Notes
+--------------------
+
+This section contains a few notes about QPDF's internal implementation,
+particularly around what it does when it first processes a file. This
+section is a bit of a simplification of what it actually does, but it
+could serve as a starting point to someone trying to understand the
+implementation. There is nothing in this section that you need to know
+to use the qpdf library.
+
+``QPDFObject`` is the basic PDF Object class. It is an abstract base
+class from which are derived classes for each type of PDF object.
+Clients do not interact with Objects directly but instead interact with
+``QPDFObjectHandle``.
+
+When the ``QPDF`` class creates a new object, it dynamically allocates
+the appropriate type of ``QPDFObject`` and immediately hands the pointer
+to an instance of ``QPDFObjectHandle``. The parser reads a token from
+the current file position. If the token is a not either a dictionary or
+array opener, an object is immediately constructed from the single token
+and the parser returns. Otherwise, the parser iterates in a special mode
+in which it accumulates objects until it finds a balancing closer.
+During this process, the "``R``" keyword is recognized and an indirect
+``QPDFObjectHandle`` may be constructed.
+
+The ``QPDF::resolve()`` method, which is used to resolve an indirect
+object, may be invoked from the ``QPDFObjectHandle`` class. It first
+checks a cache to see whether this object has already been read. If not,
+it reads the object from the PDF file and caches it. It the returns the
+resulting ``QPDFObjectHandle``. The calling object handle then replaces
+its ``PointerHolder<QDFObject>`` with the one from the newly returned
+``QPDFObjectHandle``. In this way, only a single copy of any direct
+object need exist and clients can access objects transparently without
+knowing caring whether they are direct or indirect objects.
+Additionally, no object is ever read from the file more than once. That
+means that only the portions of the PDF file that are actually needed
+are ever read from the input file, thus allowing the qpdf package to
+take advantage of this important design goal of PDF files.
+
+If the requested object is inside of an object stream, the object stream
+itself is first read into memory. Then the tokenizer reads objects from
+the memory stream based on the offset information stored in the stream.
+Those individual objects are cached, after which the temporary buffer
+holding the object stream contents are discarded. In this way, the first
+time an object in an object stream is requested, all objects in the
+stream are cached.
+
+The following example should clarify how ``QPDF`` processes a simple
+file.
+
+-  Client constructs ``QPDF`` ``pdf`` and calls
+   ``pdf.processFile("a.pdf");``.
+
+-  The ``QPDF`` class checks the beginning of
+   @1@filename@1@a.pdf@2@filename@2@ for a PDF header. It then reads the
+   cross reference table mentioned at the end of the file, ensuring that
+   it is looking before the last ``%%EOF``. After getting to ``trailer``
+   keyword, it invokes the parser.
+
+-  The parser sees "``<<``", so it calls itself recursively in
+   dictionary creation mode.
+
+-  In dictionary creation mode, the parser keeps accumulating objects
+   until it encounters "``>>``". Each object that is read is pushed onto
+   a stack. If "``R``" is read, the last two objects on the stack are
+   inspected. If they are integers, they are popped off the stack and
+   their values are used to construct an indirect object handle which is
+   then pushed onto the stack. When "``>>``" is finally read, the stack
+   is converted into a ``QPDF_Dictionary`` which is placed in a
+   ``QPDFObjectHandle`` and returned.
+
+-  The resulting dictionary is saved as the trailer dictionary.
+
+-  The ``/Prev`` key is searched. If present, ``QPDF`` seeks to that
+   point and repeats except that the new trailer dictionary is not
+   saved. If ``/Prev`` is not present, the initial parsing process is
+   complete.
+
+   If there is an encryption dictionary, the document's encryption
+   parameters are initialized.
+
+-  The client requests root object. The ``QPDF`` class gets the value of
+   root key from trailer dictionary and returns it. It is an unresolved
+   indirect ``QPDFObjectHandle``.
+
+-  The client requests the ``/Pages`` key from root
+   ``QPDFObjectHandle``. The ``QPDFObjectHandle`` notices that it is
+   indirect so it asks ``QPDF`` to resolve it. ``QPDF`` looks in the
+   object cache for an object with the root dictionary's object ID and
+   generation number. Upon not seeing it, it checks the cross reference
+   table, gets the offset, and reads the object present at that offset.
+   It stores the result in the object cache and returns the cached
+   result. The calling ``QPDFObjectHandle`` replaces its object pointer
+   with the one from the resolved ``QPDFObjectHandle``, verifies that it
+   a valid dictionary object, and returns the (unresolved indirect)
+   ``QPDFObject`` handle to the top of the Pages hierarchy.
+
+   As the client continues to request objects, the same process is
+   followed for each new requested object.
+
+.. _ref.casting:
+
+Casting Policy
+--------------
+
+This section describes the casting policy followed by qpdf's
+implementation. This is no concern to qpdf's end users and largely of no
+concern to people writing code that uses qpdf, but it could be of
+interest to people who are porting qpdf to a new platform or who are
+making modifications to the code.
+
+The C++ code in qpdf is free of old-style casts except where unavoidable
+(e.g. where the old-style cast is in a macro provided by a third-party
+header file). When there is a need for a cast, it is handled, in order
+of preference, by rewriting the code to avoid the need for a cast,
+calling ``const_cast``, calling ``static_cast``, calling
+``reinterpret_cast``, or calling some combination of the above. As a
+last resort, a compiler-specific ``#pragma`` may be used to suppress a
+warning that we don't want to fix. Examples may include suppressing
+warnings about the use of old-style casts in code that is shared between
+C and C++ code.
+
+The ``QIntC`` namespace, provided by
+@1@filename@1@include/qpdf/QIntC.hh@2@filename@2@, implements safe
+functions for converting between integer types. These functions do range
+checking and throw a ``std::range_error``, which is subclass of
+``std::runtime_error``, if conversion from one integer type to another
+results in loss of information. There are many cases in which we have to
+move between different integer types because of incompatible integer
+types used in interoperable interfaces. Some are unavoidable, such as
+moving between sizes and offsets, and others are there because of old
+code that is too in entrenched to be fixable without breaking source
+compatibility and causing pain for users. QPDF is compiled with extra
+warnings to detect conversions with potential data loss, and all such
+cases should be fixed by either using a function from ``QIntC`` or a
+``static_cast``.
+
+When the intention is just to switch the type because of exchanging data
+between incompatible interfaces, use ``QIntC``. This is the usual case.
+However, there are some cases in which we are explicitly intending to
+use the exact same bit pattern with a different type. This is most
+common when switching between signed and unsigned characters. A lot of
+qpdf's code uses unsigned characters internally, but ``std::string`` and
+``char`` are signed. Using ``QIntC::to_char`` would be wrong for
+converting from unsigned to signed characters because a negative
+``char`` value and the corresponding ``unsigned
+    char`` value greater than 127 *mean the same thing*. There are also
+cases in which we use ``static_cast`` when working with bit fields where
+we are not representing a numerical value but rather a bunch of bits
+packed together in some integer type. Also note that ``size_t`` and
+``long`` both typically differ between 32-bit and 64-bit environments,
+so sometimes an explicit cast may not be needed to avoid warnings on one
+platform but may be needed on another. A conversion with ``QIntC``
+should always be used when the types are different even if the
+underlying size is the same. QPDF's CI build builds on 32-bit and 64-bit
+platforms, and the test suite is very thorough, so it is hard to make
+any of the potential errors here without being caught in build or test.
+
+Non-const ``unsigned char*`` is used in the ``Pipeline`` interface. The
+pipeline interface has a ``write`` call that uses ``unsigned
+    char*`` without a ``const`` qualifier. The main reason for this is
+to support pipelines that make calls to third-party libraries, such as
+zlib, that don't include ``const`` in their interfaces. Unfortunately,
+there are many places in the code where it is desirable to have ``const
+    char*`` with pipelines. None of the pipeline implementations in qpdf
+currently modify the data passed to write, and doing so would be counter
+to the intent of ``Pipeline``, but there is nothing in the code to
+prevent this from being done. There are places in the code where
+``const_cast`` is used to remove the const-ness of pointers going into
+``Pipeline``\ s. This could theoretically be unsafe, but there is
+adequate testing to assert that it is safe and will remain safe in
+qpdf's code.
+
+.. _ref.encryption:
+
+Encryption
+----------
+
+Encryption is supported transparently by qpdf. When opening a PDF file,
+if an encryption dictionary exists, the ``QPDF`` object processes this
+dictionary using the password (if any) provided. The primary decryption
+key is computed and cached. No further access is made to the encryption
+dictionary after that time. When an object is read from a file, the
+object ID and generation of the object in which it is contained is
+always known. Using this information along with the stored encryption
+key, all stream and string objects are transparently decrypted. Raw
+encrypted objects are never stored in memory. This way, nothing in the
+library ever has to know or care whether it is reading an encrypted
+file.
+
+An interface is also provided for writing encrypted streams and strings
+given an encryption key. This is used by ``QPDFWriter`` when it rewrites
+encrypted files.
+
+When copying encrypted files, unless otherwise directed, qpdf will
+preserve any encryption in force in the original file. qpdf can do this
+with either the user or the owner password. There is no difference in
+capability based on which password is used. When 40 or 128 bit
+encryption keys are used, the user password can be recovered with the
+owner password. With 256 keys, the user and owner passwords are used
+independently to encrypt the actual encryption key, so while either can
+be used, the owner password can no longer be used to recover the user
+password.
+
+Starting with version 4.0.0, qpdf can read files that are not encrypted
+but that contain encrypted attachments, but it cannot write such files.
+qpdf also requires the password to be specified in order to open the
+file, not just to extract attachments, since once the file is open, all
+decryption is handled transparently. When copying files like this while
+preserving encryption, qpdf will apply the file's encryption to
+everything in the file, not just to the attachments. When decrypting the
+file, qpdf will decrypt the attachments. In general, when copying PDF
+files with multiple encryption formats, qpdf will choose the newest
+format. The only exception to this is that clear-text metadata will be
+preserved as clear-text if it is that way in the original file.
+
+One point of confusion some people have about encrypted PDF files is
+that encryption is not the same as password protection. Password
+protected files are always encrypted, but it is also possible to create
+encrypted files that do not have passwords. Internally, such files use
+the empty string as a password, and most readers try the empty string
+first to see if it works and prompt for a password only if the empty
+string doesn't work. Normally such files have an empty user password and
+a non-empty owner password. In that way, if the file is opened by an
+ordinary reader without specification of password, the restrictions
+specified in the encryption dictionary can be enforced. Most users
+wouldn't even realize such a file was encrypted. Since qpdf always
+ignores the restrictions (except for the purpose of reporting what they
+are), qpdf doesn't care which password you use. QPDF will allow you to
+create PDF files with non-empty user passwords and empty owner
+passwords. Some readers will require a password when you open these
+files, and others will open the files without a password and not enforce
+restrictions. Having a non-empty user password and an empty owner
+password doesn't really make sense because it would mean that opening
+the file with the user password would be more restrictive than not
+supplying a password at all. QPDF also allows you to create PDF files
+with the same password as both the user and owner password. Some readers
+will not ever allow such files to be accessed without restrictions
+because they never try the password as the owner password if it works as
+the user password. Nonetheless, one of the powerful aspects of qpdf is
+that it allows you to finely specify the way encrypted files are
+created, even if the results are not useful to some readers. One use
+case for this would be for testing a PDF reader to ensure that it
+handles odd configurations of input files.
+
+.. _ref.random-numbers:
+
+Random Number Generation
+------------------------
+
+QPDF generates random numbers to support generation of encrypted data.
+Starting in qpdf 10.0.0, qpdf uses the crypto provider as its source of
+random numbers. Older versions used the OS-provided source of secure
+random numbers or, if allowed at build time, insecure random numbers
+from stdlib. Starting with version 5.1.0, you can disable use of
+OS-provided secure random numbers at build time. This is especially
+useful on Windows if you want to avoid a dependency on Microsoft's
+cryptography API. You can also supply your own random data provider. For
+details on how to do this, please refer to the top-level README.md file
+in the source distribution and to comments in
+@1@filename@1@QUtil.hh@2@filename@2@.
+
+.. _ref.adding-and-remove-pages:
+
+Adding and Removing Pages
+-------------------------
+
+While qpdf's API has supported adding and modifying objects for some
+time, version 3.0 introduces specific methods for adding and removing
+pages. These are largely convenience routines that handle two tricky
+issues: pushing inheritable resources from the ``/Pages`` tree down to
+individual pages and manipulation of the ``/Pages`` tree itself. For
+details, see ``addPage`` and surrounding methods in
+@1@filename@1@QPDF.hh@2@filename@2@.
+
+.. _ref.reserved-objects:
+
+Reserving Object Numbers
+------------------------
+
+Version 3.0 of qpdf introduced the concept of reserved objects. These
+are seldom needed for ordinary operations, but there are cases in which
+you may want to add a series of indirect objects with references to each
+other to a ``QPDF`` object. This causes a problem because you can't
+determine the object ID that a new indirect object will have until you
+add it to the ``QPDF`` object with ``QPDF::makeIndirectObject``. The
+only way to add two mutually referential objects to a ``QPDF`` object
+prior to version 3.0 would be to add the new objects first and then make
+them refer to each other after adding them. Now it is possible to create
+a @1@firstterm@1@reserved object@2@firstterm@2@ using
+``QPDFObjectHandle::newReserved``. This is an indirect object that stays
+"unresolved" even if it is queried for its type. So now, if you want to
+create a set of mutually referential objects, you can create
+reservations for each one of them and use those reservations to
+construct the references. When finished, you can call
+``QPDF::replaceReserved`` to replace the reserved objects with the real
+ones. This functionality will never be needed by most applications, but
+it is used internally by QPDF when copying objects from other PDF files,
+as discussed in `Copying Objects From Other PDF
+Files <#ref.foreign-objects>`__. For an example of how to use reserved
+objects, search for ``newReserved`` in
+@1@filename@1@test_driver.cc@2@filename@2@ in qpdf's sources.
+
+.. _ref.foreign-objects:
+
+Copying Objects From Other PDF Files
+------------------------------------
+
+Version 3.0 of qpdf introduced the ability to copy objects into a
+``QPDF`` object from a different ``QPDF`` object, which we refer to as
+@1@firstterm@1@foreign objects@2@firstterm@2@. This allows arbitrary
+merging of PDF files. The "from" ``QPDF`` object must remain valid after
+the copy as discussed in the note below. The
+@1@command@1@qpdf@2@command@2@ command-line tool provides limited
+support for basic page selection, including merging in pages from other
+files, but the library's API makes it possible to implement arbitrarily
+complex merging operations. The main method for copying foreign objects
+is ``QPDF::copyForeignObject``. This takes an indirect object from
+another ``QPDF`` and copies it recursively into this object while
+preserving all object structure, including circular references. This
+means you can add a direct object that you create from scratch to a
+``QPDF`` object with ``QPDF::makeIndirectObject``, and you can add an
+indirect object from another file with ``QPDF::copyForeignObject``. The
+fact that ``QPDF::makeIndirectObject`` does not automatically detect a
+foreign object and copy it is an explicit design decision. Copying a
+foreign object seems like a sufficiently significant thing to do that it
+should be done explicitly.
+
+The other way to copy foreign objects is by passing a page from one
+``QPDF`` to another by calling ``QPDF::addPage``. In contrast to
+``QPDF::makeIndirectObject``, this method automatically distinguishes
+between indirect objects in the current file, foreign objects, and
+direct objects.
+
+Please note: when you copy objects from one ``QPDF`` to another, the
+source ``QPDF`` object must remain valid until you have finished with
+the destination object. This is because the original object is still
+used to retrieve any referenced stream data from the copied object.
+
+.. _ref.rewriting:
+
+Writing PDF Files
+-----------------
+
+The qpdf library supports file writing of ``QPDF`` objects to PDF files
+through the ``QPDFWriter`` class. The ``QPDFWriter`` class has two
+writing modes: one for non-linearized files, and one for linearized
+files. See `Linearization <#ref.linearization>`__ for a description of
+linearization is implemented. This section describes how we write
+non-linearized files including the creation of QDF files (see `QDF
+Mode <#ref.qdf>`__.
+
+This outline was written prior to implementation and is not exactly
+accurate, but it provides a correct "notional" idea of how writing
+works. Look at the code in ``QPDFWriter`` for exact details.
+
+-  Initialize state:
+
+   -  next object number = 1
+
+   -  object queue = empty
+
+   -  renumber table: old object id/generation to new id/0 = empty
+
+   -  xref table: new id -> offset = empty
+
+-  Create a QPDF object from a file.
+
+-  Write header for new PDF file.
+
+-  Request the trailer dictionary.
+
+-  For each value that is an indirect object, grab the next object
+   number (via an operation that returns and increments the number). Map
+   object to new number in renumber table. Push object onto queue.
+
+-  While there are more objects on the queue:
+
+   -  Pop queue.
+
+   -  Look up object's new number *n* in the renumbering table.
+
+   -  Store current offset into xref table.
+
+   -  Write ``@1@replaceable@1@n@2@replaceable@2@ 0 obj``.
+
+   -  If object is null, whether direct or indirect, write out null,
+      thus eliminating unresolvable indirect object references.
+
+   -  If the object is a stream stream, write stream contents, piped
+      through any filters as required, to a memory buffer. Use this
+      buffer to determine the stream length.
+
+   -  If object is not a stream, array, or dictionary, write out its
+      contents.
+
+   -  If object is an array or dictionary (including stream), traverse
+      its elements (for array) or values (for dictionaries), handling
+      recursive dictionaries and arrays, looking for indirect objects.
+      When an indirect object is found, if it is not resolvable, ignore.
+      (This case is handled when writing it out.) Otherwise, look it up
+      in the renumbering table. If not found, grab the next available
+      object number, assign to the referenced object in the renumbering
+      table, and push the referenced object onto the queue. As a special
+      case, when writing out a stream dictionary, replace length,
+      filters, and decode parameters as required.
+
+      Write out dictionary or array, replacing any unresolvable indirect
+      object references with null (pdf spec says reference to
+      non-existent object is legal and resolves to null) and any
+      resolvable ones with references to the renumbered objects.
+
+   -  If the object is a stream, write ``stream\n``, the stream contents
+      (from the memory buffer), and ``\nendstream\n``.
+
+   -  When done, write ``endobj``.
+
+Once we have finished the queue, all referenced objects will have been
+written out and all deleted objects or unreferenced objects will have
+been skipped. The new cross-reference table will contain an offset for
+every new object number from 1 up to the number of objects written. This
+can be used to write out a new xref table. Finally we can write out the
+trailer dictionary with appropriately computed /ID (see spec, 8.3, File
+Identifiers), the cross reference table offset, and ``%%EOF``.
+
+.. _ref.filtered-streams:
+
+Filtered Streams
+----------------
+
+Support for streams is implemented through the ``Pipeline`` interface
+which was designed for this package.
+
+When reading streams, create a series of ``Pipeline`` objects. The
+``Pipeline`` abstract base requires implementation ``write()`` and
+``finish()`` and provides an implementation of ``getNext()``. Each
+pipeline object, upon receiving data, does whatever it is going to do
+and then writes the data (possibly modified) to its successor.
+Alternatively, a pipeline may be an end-of-the-line pipeline that does
+something like store its output to a file or a memory buffer ignoring a
+successor. For additional details, look at
+@1@filename@1@Pipeline.hh@2@filename@2@.
+
+``QPDF`` can read raw or filtered streams. When reading a filtered
+stream, the ``QPDF`` class creates a ``Pipeline`` object for one of each
+appropriate filter object and chains them together. The last filter
+should write to whatever type of output is required. The ``QPDF`` class
+has an interface to write raw or filtered stream contents to a given
+pipeline.
+
+.. _ref.object-accessors:
+
+Object Accessor Methods
+-----------------------
+
+@1@comment: This section is referenced in QPDFObjectHandle.hh @1@
+
+For general information about how to access instances of
+``QPDFObjectHandle``, please see the comments in
+@1@filename@1@QPDFObjectHandle.hh@2@filename@2@. Search for "Accessor
+methods". This section provides a more in-depth discussion of the
+behavior and the rationale for the behavior.
+
+*Why were type errors made into warnings?* When type checks were
+introduced into qpdf in the early days, it was expected that type errors
+would only occur as a result of programmer error. However, in practice,
+type errors would occur with malformed PDF files because of assumptions
+made in code, including code within the qpdf library and code written by
+library users. The most common case would be chaining calls to
+``getKey()`` to access keys deep within a dictionary. In many cases,
+qpdf would be able to recover from these situations, but the old
+behavior often resulted in crashes rather than graceful recovery. For
+this reason, the errors were changed to warnings.
+
+*Why even warn about type errors when the user can't usually do anything
+about them?* Type warnings are extremely valuable during development.
+Since it's impossible to catch at compile time things like typos in
+dictionary key names or logic errors around what the structure of a PDF
+file might be, the presence of type warnings can save lots of developer
+time. They have also proven useful in exposing issues in qpdf itself
+that would have otherwise gone undetected.
+
+*Can there be a type-safe ``QPDFObjectHandle``?* It would be great if
+``QPDFObjectHandle`` could be more strongly typed so that you'd have to
+have check that something was of a particular type before calling
+type-specific accessor methods. However, implementing this at this stage
+of the library's history would be quite difficult, and it would make a
+the common pattern of drilling into an object no longer work. While it
+would be possible to have a parallel interface, it would create a lot of
+extra code. If qpdf were written in a language like rust, an interface
+like this would make a lot of sense, but, for a variety of reasons, the
+qpdf API is consistent with other APIs of its time, relying on exception
+handling to catch errors. The underlying PDF objects are inherently not
+type-safe. Forcing stronger type safety in ``QPDFObjectHandle`` would
+ultimately cause a lot more code to have to be written and would like
+make software that uses qpdf more brittle, and even so, checks would
+have to occur at runtime.
+
+*Why do type errors sometimes raise exceptions?* The way warnings work
+in qpdf requires a ``QPDF`` object to be associated with an object
+handle for a warning to be issued. It would be nice if this could be
+fixed, but it would require major changes to the API. Rather than
+throwing away these conditions, we convert them to exceptions. It's not
+that bad though. Since any object handle that was read from a file has
+an associated ``QPDF`` object, it would only be type errors on objects
+that were created explicitly that would cause exceptions, and in that
+case, type errors are much more likely to be the result of a coding
+error than invalid input.
+
+*Why does the behavior of a type exception differ between the C and C++
+API?* There is no way to throw and catch exceptions in C short of
+something like ``setjmp`` and ``longjmp``, and that approach is not
+portable across language barriers. Since the C API is often used from
+other languages, it's important to keep things as simple as possible.
+Starting in qpdf 10.5, exceptions that used to crash code using the C
+API will be written to stderr by default, and it is possible to register
+an error handler. There's no reason that the error handler can't
+simulate exception handling in some way, such as by using ``setjmp`` and
+``longjmp`` or by setting some variable that can be checked after
+library calls are made. In retrospect, it might have been better if the
+C API object handle methods returned error codes like the other methods
+and set return values in passed-in pointers, but this would complicate
+both the implementation and the use of the library for a case that is
+actually quite rare and largely avoidable.
+
+.. _ref.linearization:
+
+Linearization
+=============
+
+This chapter describes how ``QPDF`` and ``QPDFWriter`` implement
+creation and processing of linearized PDFS.
+
+.. _ref.linearization-strategy:
+
+Basic Strategy for Linearization
+--------------------------------
+
+To avoid the incestuous problem of having the qpdf library validate its
+own linearized files, we have a special linearized file checking mode
+which can be invoked via @1@command@1@qpdf
+--check-linearization@2@command@2@ (or @1@command@1@qpdf
+--check@2@command@2@). This mode reads the linearization parameter
+dictionary and the hint streams and validates that object ordering,
+parameters, and hint stream contents are correct. The validation code
+was first tested against linearized files created by external tools
+(Acrobat and pdlin) and then used to validate files created by
+``QPDFWriter`` itself.
+
+.. _ref.linearized.preparation:
+
+Preparing For Linearization
+---------------------------
+
+Before creating a linearized PDF file from any other PDF file, the PDF
+file must be altered such that all page attributes are propagated down
+to the page level (and not inherited from parents in the ``/Pages``
+tree). We also have to know which objects refer to which other objects,
+being concerned with page boundaries and a few other cases. We refer to
+this part of preparing the PDF file as
+@1@firstterm@1@optimization@2@firstterm@2@, discussed in
+`Optimization <#ref.optimization>`__. Note the, in this context, the
+term @1@firstterm@1@optimization@2@firstterm@2@ is a qpdf term, and the
+term @1@firstterm@1@linearization@2@firstterm@2@ is a term from the PDF
+specification. Do not be confused by the fact that many applications
+refer to linearization as optimization or web optimization.
+
+When creating linearized PDF files from optimized PDF files, there are
+really only a few issues that need to be dealt with:
+
+-  Creation of hints tables
+
+-  Placing objects in the correct order
+
+-  Filling in offsets and byte sizes
+
+.. _ref.optimization:
+
+Optimization
+------------
+
+In order to perform various operations such as linearization and
+splitting files into pages, it is necessary to know which objects are
+referenced by which pages, page thumbnails, and root and trailer
+dictionary keys. It is also necessary to ensure that all page-level
+attributes appear directly at the page level and are not inherited from
+parents in the pages tree.
+
+We refer to the process of enforcing these constraints as
+@1@firstterm@1@optimization@2@firstterm@2@. As mentioned above, note
+that some applications refer to linearization as optimization. Although
+this optimization was initially motivated by the need to create
+linearized files, we are using these terms separately.
+
+PDF file optimization is implemented in the
+@1@filename@1@QPDF_optimization.cc@2@filename@2@ source file. That file
+is richly commented and serves as the primary reference for the
+optimization process.
+
+After optimization has been completed, the private member variables
+``obj_user_to_objects`` and ``object_to_obj_users`` in ``QPDF`` have
+been populated. Any object that has more than one value in the
+``object_to_obj_users`` table is shared. Any object that has exactly one
+value in the ``object_to_obj_users`` table is private. To find all the
+private objects in a page or a trailer or root dictionary key, one
+merely has make this determination for each element in the
+``obj_user_to_objects`` table for the given page or key.
+
+Note that pages and thumbnails have different object user types, so the
+above test on a page will not include objects referenced by the page's
+thumbnail dictionary and nothing else.
+
+.. _ref.linearization.writing:
+
+Writing Linearized Files
+------------------------
+
+We will create files with only primary hint streams. We will never write
+overflow hint streams. (As of PDF version 1.4, Acrobat doesn't either,
+and they are never necessary.) The hint streams contain offset
+information to objects that point to where they would be if the hint
+stream were not present. This means that we have to calculate all object
+positions before we can generate and write the hint table. This means
+that we have to generate the file in two passes. To make this reliable,
+``QPDFWriter`` in linearization mode invokes exactly the same code twice
+to write the file to a pipeline.
+
+In the first pass, the target pipeline is a count pipeline chained to a
+discard pipeline. The count pipeline simply passes its data through to
+the next pipeline in the chain but can return the number of bytes passed
+through it at any intermediate point. The discard pipeline is an end of
+line pipeline that just throws its data away. The hint stream is not
+written and dummy values with adequate padding are stored in the first
+cross reference table, linearization parameter dictionary, and /Prev key
+of the first trailer dictionary. All the offset, length, object
+renumbering information, and anything else we need for the second pass
+is stored.
+
+At the end of the first pass, this information is passed to the ``QPDF``
+class which constructs a compressed hint stream in a memory buffer and
+returns it. ``QPDFWriter`` uses this information to write a complete
+hint stream object into a memory buffer. At this point, the length of
+the hint stream is known.
+
+In the second pass, the end of the pipeline chain is a regular file
+instead of a discard pipeline, and we have known values for all the
+offsets and lengths that we didn't have in the first pass. We have to
+adjust offsets that appear after the start of the hint stream by the
+length of the hint stream, which is known. Anything that is of variable
+length is padded, with the padding code surrounding any writing code
+that differs in the two passes. This ensures that changes to the way
+things are represented never results in offsets that were gathered
+during the first pass becoming incorrect for the second pass.
+
+Using this strategy, we can write linearized files to a non-seekable
+output stream with only a single pass to disk or wherever the output is
+going.
+
+.. _ref.linearization-data:
+
+Calculating Linearization Data
+------------------------------
+
+Once a file is optimized, we have information about which objects access
+which other objects. We can then process these tables to decide which
+part (as described in "Linearized PDF Document Structure" in the PDF
+specification) each object is contained within. This tells us the exact
+order in which objects are written. The ``QPDFWriter`` class asks for
+this information and enqueues objects for writing in the proper order.
+It also turns on a check that causes an exception to be thrown if an
+object is encountered that has not already been queued. (This could
+happen only if there were a bug in the traversal code used to calculate
+the linearization data.)
+
+.. _ref.linearization-issues:
+
+Known Issues with Linearization
+-------------------------------
+
+There are a handful of known issues with this linearization code. These
+issues do not appear to impact the behavior of linearized files which
+still work as intended: it is possible for a web browser to begin to
+display them before they are fully downloaded. In fact, it seems that
+various other programs that create linearized files have many of these
+same issues. These items make reference to terminology used in the
+linearization appendix of the PDF specification.
+
+-  Thread Dictionary information keys appear in part 4 with the rest of
+   Threads instead of in part 9. Objects in part 9 are not grouped
+   together functionally.
+
+-  We are not calculating numerators for shared object positions within
+   content streams or interleaving them within content streams.
+
+-  We generate only page offset, shared object, and outline hint tables.
+   It would be relatively easy to add some additional tables. We gather
+   most of the information needed to create thumbnail hint tables. There
+   are comments in the code about this.
+
+.. _ref.linearization-debugging:
+
+Debugging Note
+--------------
+
+The @1@command@1@qpdf --show-linearization@2@command@2@ command can show
+the complete contents of linearization hint streams. To look at the raw
+data, you can extract the filtered contents of the linearization hint
+tables using @1@command@1@qpdf --show-object=n
+--filtered-stream-data@2@command@2@. Then, to convert this into a bit
+stream (since linearization tables are bit streams written without
+regard to byte boundaries), you can pipe the resulting data through the
+following perl code:
+
+::
+
+   use bytes;
+   binmode STDIN;
+   undef $/;
+   my $a = <STDIN>;
+   my @ch = split(//, $a);
+   map { printf("%08b", ord($_)) } @ch;
+   print "\n";
+
+.. _ref.object-and-xref-streams:
+
+Object and Cross-Reference Streams
+==================================
+
+This chapter provides information about the implementation of object
+stream and cross-reference stream support in qpdf.
+
+.. _ref.object-streams:
+
+Object Streams
+--------------
+
+Object streams can contain any regular object except the following:
+
+-  stream objects
+
+-  objects with generation > 0
+
+-  the encryption dictionary
+
+-  objects containing the /Length of another stream
+
+In addition, Adobe reader (at least as of version 8.0.0) appears to not
+be able to handle having the document catalog appear in an object stream
+if the file is encrypted, though this is not specifically disallowed by
+the specification.
+
+There are additional restrictions for linearized files. See
+`Implications for Linearized
+Files <#ref.object-streams-linearization>`__\ for details.
+
+The PDF specification refers to objects in object streams as "compressed
+objects" regardless of whether the object stream is compressed.
+
+The generation number of every object in an object stream must be zero.
+It is possible to delete and replace an object in an object stream with
+a regular object.
+
+The object stream dictionary has the following keys:
+
+-  ``/N``: number of objects
+
+-  ``/First``: byte offset of first object
+
+-  ``/Extends``: indirect reference to stream that this extends
+
+Stream collections are formed with ``/Extends``. They must form a
+directed acyclic graph. These can be used for semantic information and
+are not meaningful to the PDF document's syntactic structure. Although
+qpdf preserves stream collections, it never generates them and doesn't
+make use of this information in any way.
+
+The specification recommends limiting the number of objects in object
+stream for efficiency in reading and decoding. Acrobat 6 uses no more
+than 100 objects per object stream for linearized files and no more 200
+objects per stream for non-linearized files. ``QPDFWriter``, in object
+stream generation mode, never puts more than 100 objects in an object
+stream.
+
+Object stream contents consists of *N* pairs of integers, each of which
+is the object number and the byte offset of the object relative to the
+first object in the stream, followed by the objects themselves,
+concatenated.
+
+.. _ref.xref-streams:
+
+Cross-Reference Streams
+-----------------------
+
+For non-hybrid files, the value following ``startxref`` is the byte
+offset to the xref stream rather than the word ``xref``.
+
+For hybrid files (files containing both xref tables and cross-reference
+streams), the xref table's trailer dictionary contains the key
+``/XRefStm`` whose value is the byte offset to a cross-reference stream
+that supplements the xref table. A PDF 1.5-compliant application should
+read the xref table first. Then it should replace any object that it has
+already seen with any defined in the xref stream. Then it should follow
+any ``/Prev`` pointer in the original xref table's trailer dictionary.
+The specification is not clear about what should be done, if anything,
+with a ``/Prev`` pointer in the xref stream referenced by an xref table.
+The ``QPDF`` class ignores it, which is probably reasonable since, if
+this case were to appear for any sensible PDF file, the previous xref
+table would probably have a corresponding ``/XRefStm`` pointer of its
+own. For example, if a hybrid file were appended, the appended section
+would have its own xref table and ``/XRefStm``. The appended xref table
+would point to the previous xref table which would point the
+``/XRefStm``, meaning that the new ``/XRefStm`` doesn't have to point to
+it.
+
+Since xref streams must be read very early, they may not be encrypted,
+and the may not contain indirect objects for keys required to read them,
+which are these:
+
+-  ``/Type``: value ``/XRef``
+
+-  ``/Size``: value *n+1*: where *n* is highest object number (same as
+   ``/Size`` in the trailer dictionary)
+
+-  ``/Index`` (optional): value
+   ``[@1@replaceable@1@n count@2@replaceable@2@ ...]`` used to determine
+   which objects' information is stored in this stream. The default is
+   ``[0 /Size]``.
+
+-  ``/Prev``: value @1@replaceable@1@offset@2@replaceable@2@: byte
+   offset of previous xref stream (same as ``/Prev`` in the trailer
+   dictionary)
+
+-  ``/W [...]``: sizes of each field in the xref table
+
+The other fields in the xref stream, which may be indirect if desired,
+are the union of those from the xref table's trailer dictionary.
+
+.. _ref.xref-stream-data:
+
+Cross-Reference Stream Data
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The stream data is binary and encoded in big-endian byte order. Entries
+are concatenated, and each entry has a length equal to the total of the
+entries in ``/W`` above. Each entry consists of one or more fields, the
+first of which is the type of the field. The number of bytes for each
+field is given by ``/W`` above. A 0 in ``/W`` indicates that the field
+is omitted and has the default value. The default value for the field
+type is "``1``". All other default values are "``0``".
+
+PDF 1.5 has three field types:
+
+-  0: for free objects. Format: ``0 obj
+           next-generation``, same as the free table in a traditional
+   cross-reference table
+
+-  1: regular non-compressed object. Format: ``1 offset
+          generation``
+
+-  2: for objects in object streams. Format: ``2
+          object-stream-number index``, the number of object stream
+   containing the object and the index within the object stream of the
+   object.
+
+It seems standard to have the first entry in the table be ``0 0 0``
+instead of ``0 0 ffff`` if there are no deleted objects.
+
+.. _ref.object-streams-linearization:
+
+Implications for Linearized Files
+---------------------------------
+
+For linearized files, the linearization dictionary, document catalog,
+and page objects may not be contained in object streams.
+
+Objects stored within object streams are given the highest range of
+object numbers within the main and first-page cross-reference sections.
+
+It is okay to use cross-reference streams in place of regular xref
+tables. There are on special considerations.
+
+Hint data refers to object streams themselves, not the objects in the
+streams. Shared object references should also be made to the object
+streams. There are no reference in any hint tables to the object numbers
+of compressed objects (objects within object streams).
+
+When numbering objects, all shared objects within both the first and
+second halves of the linearized files must be numbered consecutively
+after all normal uncompressed objects in that half.
+
+.. _ref.object-stream-implementation:
+
+Implementation Notes
+--------------------
+
+There are three modes for writing object streams:
+@1@option@1@disable@2@option@2@, @1@option@1@preserve@2@option@2@, and
+@1@option@1@generate@2@option@2@. In disable mode, we do not generate
+any object streams, and we also generate an xref table rather than xref
+streams. This can be used to generate PDF files that are viewable with
+older readers. In preserve mode, we write object streams such that
+written object streams contain the same objects and ``/Extends``
+relationships as in the original file. This is equal to disable if the
+file has no object streams. In generate, we create object streams
+ourselves by grouping objects that are allowed in object streams
+together in sets of no more than 100 objects. We also ensure that the
+PDF version is at least 1.5 in generate mode, but we preserve the
+version header in the other modes. The default is
+@1@option@1@preserve@2@option@2@.
+
+We do not support creation of hybrid files. When we write files, even in
+preserve mode, we will lose any xref tables and merge any appended
+sections.
+
+.. _ref.release-notes:
+
+Release Notes
+=============
+
+For a detailed list of changes, please see the file
+@1@filename@1@ChangeLog@2@filename@2@ in the source distribution.
+
+10.5.0: XXX Month dd, YYYY
+   -  Library Enhancements
+
+      -  Since qpdf version 8, using object accessor methods on an
+         instance of ``QPDFObjectHandle`` may create warnings if the
+         object is not of the expected type. These warnings now have an
+         error code of ``qpdf_e_object`` instead of
+         ``qpdf_e_damaged_pdf``. Also, comments have been added to
+         @1@filename@1@QPDFObjectHandle.hh@2@filename@2@ to explain in
+         more detail what the behavior is. See `Object Accessor
+         Methods <#ref.object-accessors>`__ for a more in-depth
+         discussion.
+
+      -  Overhaul error handling for the object handle functions in the
+         C API. See comments in the "Object handling" section of
+         @1@filename@1@include/qpdf/qpdf-c.h@2@filename@2@ for details.
+         In particular, exceptions thrown by the underlying C++ code
+         when calling object accessors are caught and converted into
+         errors. The errors can be trapped by registering an error
+         handler with ``qpdf_register_oh_error_handler`` or will be
+         written to stderr if no handler is registered.
+
+      -  Add ``qpdf_get_last_string_length`` to the C API to get the
+         length of the last string that was returned. This is needed to
+         handle strings that contain embedded null characters.
+
+      -  Add ``qpdf_oh_is_initialized`` and
+         ``qpdf_oh_new_uninitialized`` to the C API to make it possible
+         to work with uninitialized objects.
+
+      -  Add ``qpdf_oh_new_object`` to the C API. This allows you to
+         clone an object handle.
+
+      -  Add ``qpdf_get_object_by_id``, ``qpdf_make_indirect_object``,
+         and ``qpdf_replace_object``, exposing the corresponding methods
+         in ``QPDF`` and ``QPDFObjectHandle``.
+
+10.4.0: November 16, 2021
+   -  Handling of Weak Cryptography Algorithms
+
+      -  From the qpdf CLI, the
+         @1@option@1@--allow-weak-crypto@2@option@2@ is now required to
+         suppress a warning when explicitly creating PDF files using RC4
+         encryption. While qpdf will always retain the ability to read
+         and write such files, doing so will require explicit
+         acknowledgment moving forward. For qpdf 10.4, this change only
+         affects the command-line tool. Starting in qpdf 11, there will
+         be small API changes to require explicit acknowledgment in
+         those cases as well. For additional information, see `Weak
+         Cryptography <#ref.weak-crypto>`__.
+
+   -  Bug Fixes
+
+      -  Fix potential bounds error when handling shell completion that
+         could occur when given bogus input.
+
+      -  Properly handle overlay/underlay on completely empty pages
+         (with no resource dictionary).
+
+      -  Fix crash that could occur under certain conditions when using
+         @1@option@1@--pages@2@option@2@ with files that had form
+         fields.
+
+   -  Library Enhancements
+
+      -  Make ``QPDF::findPage`` functions public.
+
+      -  Add methods to ``Pl_Flate`` to be able to receive warnings on
+         certain recoverable conditions.
+
+      -  Add an extra check to the library to detect when foreign
+         objects are inserted directly (instead of using
+         ``QPDF::copyForeignObject``) at the time of insertion rather
+         than when the file is written. Catching the error sooner makes
+         it much easier to locate the incorrect code.
+
+   -  CLI Enhancements
+
+      -  Improve diagnostics around parsing
+         @1@option@1@--pages@2@option@2@ command-line options
+
+   -  Packaging Changes
+
+      -  The Windows binary distribution is now built with crypto
+         provided by OpenSSL 3.0.
+
+10.3.2: May 8, 2021
+   -  Bug Fixes
+
+      -  When generating a file while preserving object streams,
+         unreferenced objects are correctly removed unless
+         @1@option@1@--preserve-unreferenced@2@option@2@ is specified.
+
+   -  Library Enhancements
+
+      -  When adding a page that already exists, make a shallow copy
+         instead of throwing an exception. This makes the library
+         behavior consistent with the CLI behavior. See
+         @1@filename@1@ChangeLog@2@filename@2@ for additional notes.
+
+10.3.1: March 11, 2021
+   -  Bug Fixes
+
+      -  Form field copying failed on files where /DR was a direct
+         object in the document-level form dictionary.
+
+10.3.0: March 4, 2021
+   -  Bug Fixes
+
+      -  The code for handling form fields when copying pages from
+         10.2.0 was not quite right and didn't work in a number of
+         situations, such as when the same page was copied multiple
+         times or when there were conflicting resource or field names
+         across multiple copies. The 10.3.0 code has been much more
+         thoroughly tested with more complex cases and with a multitude
+         of readers and should be much closer to correct. The 10.2.0
+         code worked well enough for page splitting or for copying pages
+         with form fields into documents that didn't already have them
+         but was still not quite correct in handling of field-level
+         resources.
+
+      -  When ``QPDF::replaceObject`` or ``QPDF::swapObjects`` is
+         called, existing ``QPDFObjectHandle`` instances no longer point
+         to the old objects. The next time they are accessed, they
+         automatically notice the change to the underlying object and
+         update themselves. This resolves a very longstanding source of
+         confusion, albeit in a very rarely used method call.
+
+      -  Fix form field handling code to look for default appearances,
+         quadding, and default resources in the right places. The code
+         was not looking for things in the document-level interactive
+         form dictionary that it was supposed to be finding there. This
+         required adding a few new methods to
+         ``QPDFFormFieldObjectHelper``.
+
+   -  Library Enhancements
+
+      -  Reworked the code that handles copying annotations and form
+         fields during page operations. There were additional methods
+         added to the public API from 10.2.0 and a one deprecation of a
+         method added in 10.2.0. The majority of the API changes are in
+         methods most people would never call and that will hopefully be
+         superseded by higher-level interfaces for handling page copies.
+         Please see the @1@filename@1@ChangeLog@2@filename@2@ file for
+         details.
+
+      -  The method ``QPDF::numWarnings`` was added so that you can tell
+         whether any warnings happened during a specific block of code.
+
+10.2.0: February 23, 2021
+   -  CLI Behavior Changes
+
+      -  Operations that work on combining pages are much better about
+         protecting form fields. In particular,
+         @1@option@1@--split-pages@2@option@2@ and
+         @1@option@1@--pages@2@option@2@ now preserve interaction form
+         functionality by copying the relevant form field information
+         from the original files. Additionally, if you use
+         @1@option@1@--pages@2@option@2@ to select only some pages from
+         the original input file, unused form fields are removed, which
+         prevents lots of unused annotations from being retained.
+
+      -  By default, @1@command@1@qpdf@2@command@2@ no longer allows
+         creation of encrypted PDF files whose user password is
+         non-empty and owner password is empty when a 256-bit key is in
+         use. The @1@option@1@--allow-insecure@2@option@2@ option,
+         specified inside the @1@option@1@--encrypt@2@option@2@ options,
+         allows creation of such files. Behavior changes in the CLI are
+         avoided when possible, but an exception was made here because
+         this is security-related. qpdf must always allow creation of
+         weird files for testing purposes, but it should not default to
+         letting users unknowingly create insecure files.
+
+   -  Library Behavior Changes
+
+      -  Note: the changes in this section cause differences in output
+         in some cases. These differences change the syntax of the PDF
+         but do not change the semantics (meaning). I make a strong
+         effort to avoid gratuitous changes in qpdf's output so that
+         qpdf changes don't break people's tests. In this case, the
+         changes significantly improve the readability of the generated
+         PDF and don't affect any output that's generated by simple
+         transformation. If you are annoyed by having to update test
+         files, please rest assured that changes like this have been and
+         will continue to be rare events.
+
+      -  ``QPDFObjectHandle::newUnicodeString`` now uses whichever of
+         ASCII, PDFDocEncoding, of UTF-16 is sufficient to encode all
+         the characters in the string. This reduces needless encoding in
+         UTF-16 of strings that can be encoded in ASCII. This change may
+         cause qpdf to generate different output than before when form
+         field values are set using ``QPDFFormFieldObjectHelper`` but
+         does not change the meaning of the output.
+
+      -  The code that places form XObjects and also the code that
+         flattens rotations trim trailing zeroes from real numbers that
+         they calculate. This causes slight (but semantically
+         equivalent) differences in generated appearance streams and
+         form XObject invocations in overlay/underlay code or in user
+         code that calls the methods that place form XObjects on a page.
+
+   -  CLI Enhancements
+
+      -  Add new command line options for listing, saving, adding,
+         removing, and and copying file attachments. See `Embedded
+         Files/Attachments Options <#ref.attachments>`__ for details.
+
+      -  Page splitting and merging operations, as well as
+         @1@option@1@--flatten-rotation@2@option@2@, are better behaved
+         with respect to annotations and interactive form fields. In
+         most cases, interactive form field functionality and proper
+         formatting and functionality of annotations is preserved by
+         these operations. There are still some cases that aren't
+         perfect, such as when functionality of annotations depends on
+         document-level data that qpdf doesn't yet understand or when
+         there are problems with referential integrity among form fields
+         and annotations (e.g., when a single form field object or its
+         associated annotations are shared across multiple pages, a case
+         that is out of spec but that works in most viewers anyway).
+
+      -  The option
+         @1@option@1@--password-file=@1@replaceable@1@filename@2@replaceable@2@@2@option@2@
+         can now be used to read the decryption password from a file.
+         You can use ``-`` as the file name to read the password from
+         standard input. This is an easier/more obvious way to read
+         passwords from files or standard input than using
+         @1@option@1@@file@2@option@2@ for this purpose.
+
+      -  Add some information about attachments to the json output, and
+         added ``attachments`` as an additional json key. The
+         information included here is limited to the preferred name and
+         content stream and a reference to the file spec object. This is
+         enough detail for clients to avoid the hassle of navigating a
+         name tree and provides what is needed for basic enumeration and
+         extraction of attachments. More detailed information can be
+         obtained by following the reference to the file spec object.
+
+      -  Add numeric option to @1@option@1@--collate@2@option@2@. If
+         @1@option@1@--collate=@1@replaceable@1@n@2@replaceable@2@@2@option@2@
+         is given, take pages in groups of
+         @1@replaceable@1@n@2@replaceable@2@ from the given files.
+
+      -  It is now valid to provide @1@option@1@--rotate=0@2@option@2@
+         to clear rotation from a page.
+
+   -  Library Enhancements
+
+      -  This release includes numerous additions to the API. Not all
+         changes are listed here. Please see the
+         @1@filename@1@ChangeLog@2@filename@2@ file in the source
+         distribution for a comprehensive list. Highlights appear below.
+
+      -  Add ``QPDFObjectHandle::ditems()`` and
+         ``QPDFObjectHandle::aitems()`` that enable C++-style iteration,
+         including range-for iteration, over dictionary and array
+         QPDFObjectHandles. See comments in
+         @1@filename@1@include/qpdf/QPDFObjectHandle.hh@2@filename@2@
+         and
+         @1@filename@1@examples/pdf-name-number-tree.cc@2@filename@2@
+         for details.
+
+      -  Add ``QPDFObjectHandle::copyStream`` for making a copy of a
+         stream within the same ``QPDF`` instance.
+
+      -  Add new helper classes for supporting file attachments, also
+         known as embedded files. New classes are
+         ``QPDFEmbeddedFileDocumentHelper``,
+         ``QPDFFileSpecObjectHelper``, and ``QPDFEFStreamObjectHelper``.
+         See their respective headers for details and
+         @1@filename@1@examples/pdf-attach-file.cc@2@filename@2@ for an
+         example.
+
+      -  Add a version of ``QPDFObjectHandle::parse`` that takes a
+         ``QPDF`` pointer as context so that it can parse strings
+         containing indirect object references. This is illustrated in
+         @1@filename@1@examples/pdf-attach-file.cc@2@filename@2@.
+
+      -  Re-implement ``QPDFNameTreeObjectHelper`` and
+         ``QPDFNumberTreeObjectHelper`` to be more efficient, add an
+         iterator-based API, give them the capability to repair broken
+         trees, and create methods for modifying the trees. With this
+         change, qpdf has a robust read/write implementation of name and
+         number trees.
+
+      -  Add new versions of ``QPDFObjectHandle::replaceStreamData``
+         that take ``std::function`` objects for cases when you need
+         something between a static string and a full-fledged
+         StreamDataProvider. Using this with ``QUtil::file_provider`` is
+         a very easy way to create a stream from the contents of a file.
+
+      -  The ``QPDFMatrix`` class, formerly a private, internal class,
+         has been added to the public API. See
+         @1@filename@1@include/qpdf/QPDFMatrix.hh@2@filename@2@ for
+         details. This class is for working with transformation
+         matrices. Some methods in ``QPDFPageObjectHelper`` make use of
+         this to make information about transformation matrices
+         available. For an example, see
+         @1@filename@1@examples/pdf-overlay-page.cc@2@filename@2@.
+
+      -  Several new methods were added to
+         ``QPDFAcroFormDocumentHelper`` for adding, removing, getting
+         information about, and enumerating form fields.
+
+      -  Add method
+         ``QPDFAcroFormDocumentHelper::transformAnnotations``, which
+         applies a transformation to each annotation on a page.
+
+      -  Add ``QPDFPageObjectHelper::copyAnnotations``, which copies
+         annotations and, if applicable, associated form fields, from
+         one page to another, possibly transforming the rectangles.
+
+   -  Build Changes
+
+      -  A C++-14 compiler is now required to build qpdf. There is no
+         intention to require anything newer than that for a while.
+         C++-14 includes modest enhancements to C++-11 and appears to be
+         supported about as widely as C++-11.
+
+   -  Bug Fixes
+
+      -  The @1@option@1@--flatten-rotation@2@option@2@ option applies
+         transformations to any annotations that may be on the page.
+
+      -  If a form XObject lacks a resources dictionary, consider any
+         names in that form XObject to be referenced from the containing
+         page. This is compliant with older PDF versions. Also detect if
+         any form XObjects have any unresolved names and, if so, don't
+         remove unreferenced resources from them or from the page that
+         contains them. Unfortunately this has the side effect of
+         preventing removal of unreferenced resources in some cases
+         where names appear that don't refer to resources, such as with
+         tagged PDF. This is a bit of a corner case that is not likely
+         to cause a significant problem in practice, but the only side
+         effect would be lack of removal of shared resources. A future
+         version of qpdf may be more sophisticated in its detection of
+         names that refer to resources.
+
+      -  Properly handle strings if they appear in inline image
+         dictionaries while externalizing inline images.
+
+10.1.0: January 5, 2021
+   -  CLI Enhancements
+
+      -  Add @1@option@1@--flatten-rotation@2@option@2@ command-line
+         option, which causes all pages that are rotated using
+         parameters in the page's dictionary to instead be identically
+         rotated in the page's contents. The change is not user-visible
+         for compliant PDF readers but can be used to work around broken
+         PDF applications that don't properly handle page rotation.
+
+   -  Library Enhancements
+
+      -  Support for user-provided (pluggable, modular) stream filters.
+         It is now possible to derive a class from ``QPDFStreamFilter``
+         and register it with ``QPDF`` so that regular library methods,
+         including those used by ``QPDFWriter``, can decode streams with
+         filters not directly supported by the library. The example
+         @1@filename@1@examples/pdf-custom-filter.cc@2@filename@2@
+         illustrates how to use this capability.
+
+      -  Add methods to ``QPDFPageObjectHelper`` to iterate through
+         XObjects on a page or form XObjects, possibly recursing into
+         nested form XObjects: ``forEachXObject``, ``ForEachImage``,
+         ``forEachFormXObject``.
+
+      -  Enhance several methods in ``QPDFPageObjectHelper`` to work
+         with form XObjects as well as pages, as noted in comments. See
+         @1@filename@1@ChangeLog@2@filename@2@ for a full list.
+
+      -  Rename some functions in ``QPDFPageObjectHelper``, while
+         keeping old names for compatibility:
+
+         -  ``getPageImages`` to ``getImages``
+
+         -  ``filterPageContents`` to ``filterContents``
+
+         -  ``pipePageContents`` to ``pipeContents``
+
+         -  ``parsePageContents`` to ``parseContents``
+
+      -  Add method ``QPDFPageObjectHelper::getFormXObjects`` to return
+         a map of form XObjects directly on a page or form XObject
+
+      -  Add new helper methods to ``QPDFObjectHandle``:
+         ``isFormXObject``, ``isImage``
+
+      -  Add the optional ``allow_streams`` parameter
+         ``QPDFObjectHandle::makeDirect``. When
+         ``QPDFObjectHandle::makeDirect`` is called in this way, it
+         preserves references to streams rather than throwing an
+         exception.
+
+      -  Add ``QPDFObjectHandle::setFilterOnWrite`` method. Calling this
+         on a stream prevents ``QPDFWriter`` from attempting to
+         uncompress, recompress, or otherwise filter a stream even if it
+         could. Developers can use this to protect streams that are
+         optimized should be protected from ``QPDFWriter``'s default
+         behavior for any other reason.
+
+      -  Add ``ostream`` ``<<`` operator for ``QPDFObjGen``. This is
+         useful to have for debugging.
+
+      -  Add method ``QPDFPageObjectHelper::flattenRotation``, which
+         replaces a page's ``/Rotate`` keyword by rotating the page
+         within the content stream and altering the page's bounding
+         boxes so the rendering is the same. This can be used to work
+         around buggy PDF readers that can't properly handle page
+         rotation.
+
+   -  C API Enhancements
+
+      -  Add several new functions to the C API for working with
+         objects. These are wrappers around many of the methods in
+         ``QPDFObjectHandle``. Their inclusion adds considerable new
+         capability to the C API.
+
+      -  Add ``qpdf_register_progress_reporter`` to the C API,
+         corresponding to ``QPDFWriter::registerProgressReporter``.
+
+   -  Performance Enhancements
+
+      -  Improve steps ``QPDFWriter`` takes to prepare a ``QPDF`` object
+         for writing, resulting in about an 8% improvement in write
+         performance while allowing indirect objects to appear in
+         ``/DecodeParms``.
+
+      -  When extracting pages, the @1@command@1@qpdf@2@command@2@ CLI
+         only removes unreferenced resources from the pages that are
+         being kept, resulting in a significant performance improvement
+         when extracting small numbers of pages from large, complex
+         documents.
+
+   -  Bug Fixes
+
+      -  ``QPDFPageObjectHelper::externalizeInlineImages`` was not
+         externalizing images referenced from form XObjects that
+         appeared on the page.
+
+      -  ``QPDFObjectHandle::filterPageContents`` was broken for pages
+         with multiple content streams.
+
+      -  Tweak zsh completion code to behave a little better with
+         respect to path completion.
+
+10.0.4: November 21, 2020
+   -  Bug Fixes
+
+      -  Fix a handful of integer overflows. This includes cases found
+         by fuzzing as well as having qpdf not do range checking on
+         unused values in the xref stream.
+
+10.0.3: October 31, 2020
+   -  Bug Fixes
+
+      -  The fix to the bug involving copying streams with indirect
+         filters was incorrect and introduced a new, more serious bug.
+         The original bug has been fixed correctly, as has the bug
+         introduced in 10.0.2.
+
+10.0.2: October 27, 2020
+   -  Bug Fixes
+
+      -  When concatenating content streams, as with
+         @1@option@1@--coalesce-contents@2@option@2@, there were cases
+         in which qpdf would merge two lexical tokens together, creating
+         invalid results. A newline is now inserted between merged
+         content streams if one is not already present.
+
+      -  Fix an internal error that could occur when copying foreign
+         streams whose stream data had been replaced using a stream data
+         provider if those streams had indirect filters or decode
+         parameters. This is a rare corner case.
+
+      -  Ensure that the caller's locale settings do not change the
+         results of numeric conversions performed internally by the qpdf
+         library. Note that the problem here could only be caused when
+         the qpdf library was used programmatically. Using the qpdf CLI
+         already ignored the user's locale for numeric conversion.
+
+      -  Fix several instances in which warnings were not suppressed in
+         spite of @1@option@1@--no-warn@2@option@2@ and/or errors or
+         warnings were written to standard output rather than standard
+         error.
+
+      -  Fixed a memory leak that could occur under specific
+         circumstances when
+         @1@option@1@--object-streams=generate@2@option@2@ was used.
+
+      -  Fix various integer overflows and similar conditions found by
+         the OSS-Fuzz project.
+
+   -  Enhancements
+
+      -  New option @1@option@1@--warning-exit-0@2@option@2@ causes qpdf
+         to exit with a status of ``0`` rather than ``3`` if there are
+         warnings but no errors. Combine with
+         @1@option@1@--no-warn@2@option@2@ to completely ignore
+         warnings.
+
+      -  Performance improvements have been made to
+         ``QPDF::processMemoryFile``.
+
+      -  The OpenSSL crypto provider produces more detailed error
+         messages.
+
+   -  Build Changes
+
+      -  The option @1@option@1@--disable-rpath@2@option@2@ is now
+         supported by qpdf's @1@command@1@./configure@2@command@2@
+         script. Some distributions' packaging standards recommended the
+         use of this option.
+
+      -  Selection of a printf format string for ``long
+                   long`` has been moved from ``ifdefs`` to an autoconf
+         test. If you are using your own build system, you will need to
+         provide a value for ``LL_FMT`` in
+         @1@filename@1@libqpdf/qpdf/qpdf-config.h@2@filename@2@, which
+         would typically be ``"%lld"`` or, for some Windows compilers,
+         ``"%I64d"``.
+
+      -  Several improvements were made to build-time configuration of
+         the OpenSSL crypto provider.
+
+      -  A nearly stand-alone Linux binary zip file is now included with
+         the qpdf release. This is built on an older (but supported)
+         Ubuntu LTS release, but would work on most reasonably recent
+         Linux distributions. It contains only the executables and
+         required shared libraries that would not be present on a
+         minimal system. It can be used for including qpdf in a minimal
+         environment, such as a docker container. The zip file is also
+         known to work as a layer in AWS Lambda.
+
+      -  QPDF's automated build has been migrated from Azure Pipelines
+         to GitHub Actions.
+
+   -  Windows-specific Changes
+
+      -  The Windows executables distributed with qpdf releases now use
+         the OpenSSL crypto provider by default. The native crypto
+         provider is also compiled in and can be selected at runtime
+         with the ``QPDF_CRYPTO_PROVIDER`` environment variable.
+
+      -  Improvements have been made to how a cryptographic provider is
+         obtained in the native Windows crypto implementation. However
+         mostly this is shadowed by OpenSSL being used by default.
+
+10.0.1: April 9, 2020
+   -  Bug Fixes
+
+      -  10.0.0 introduced a bug in which calling
+         ``QPDFObjectHandle::getStreamData`` on a stream that can't be
+         filtered was returning the raw data instead of throwing an
+         exception. This is now fixed.
+
+      -  Fix a bug that was preventing qpdf from linking with some
+         versions of clang on some platforms.
+
+   -  Enhancements
+
+      -  Improve the @1@filename@1@pdf-invert-images@2@filename@2@
+         example to avoid having to load all the images into RAM at the
+         same time.
+
+10.0.0: April 6, 2020
+   -  Performance Enhancements
+
+      -  The qpdf library and executable should run much faster in this
+         version than in the last several releases. Several internal
+         library optimizations have been made, and there has been
+         improved behavior on page splitting as well. This version of
+         qpdf should outperform any of the 8.x or 9.x versions.
+
+   -  Incompatible API (source-level) Changes (minor)
+
+      -  The ``QUtil::srandom`` method was removed. It didn't do
+         anything unless insecure random numbers were compiled in, and
+         they have been off by default for a long time. If you were
+         calling it, just remove the call since it wasn't doing anything
+         anyway.
+
+   -  Build/Packaging Changes
+
+      -  Add a ``openssl`` crypto provider, which is implemented with
+         OpenSSL and also works with BoringSSL. Thanks to Dean Scarff
+         for this contribution. If you maintain qpdf for a distribution,
+         pay special attention to make sure that you are including
+         support for the crypto providers you want. Package maintainers
+         will have to weigh the advantages of allowing users to pick a
+         crypto provider at runtime against the disadvantages of adding
+         more dependencies to qpdf.
+
+      -  Allow qpdf to built on stripped down systems whose C/C++
+         libraries lack the ``wchar_t`` type. Search for ``wchar_t`` in
+         qpdf's README.md for details. This should be very rare, but it
+         is known to be helpful in some embedded environments.
+
+   -  CLI Enhancements
+
+      -  Add ``objectinfo`` key to the JSON output. This will be a place
+         to put computed metadata or other information about PDF objects
+         that are not immediately evident in other ways or that seem
+         useful for some other reason. In this version, information is
+         provided about each object indicating whether it is a stream
+         and, if so, what its length and filters are. Without this, it
+         was not possible to tell conclusively from the JSON output
+         alone whether or not an object was a stream. Run
+         @1@command@1@qpdf --json-help@2@command@2@ for details.
+
+      -  Add new option
+         @1@option@1@--remove-unreferenced-resources@2@option@2@ which
+         takes ``auto``, ``yes``, or ``no`` as arguments. The new
+         ``auto`` mode, which is the default, performs a fast heuristic
+         over a PDF file when splitting pages to determine whether the
+         expensive process of finding and removing unreferenced
+         resources is likely to be of benefit. For most files, this new
+         default will result in a significant performance improvement
+         for splitting pages. See `Advanced Transformation
+         Options <#ref.advanced-transformation>`__ for a more detailed
+         discussion.
+
+      -  The @1@option@1@--preserve-unreferenced-resources@2@option@2@
+         is now just a synonym for
+         @1@option@1@--remove-unreferenced-resources=no@2@option@2@.
+
+      -  If the ``QPDF_EXECUTABLE`` environment variable is set when
+         invoking @1@command@1@qpdf --bash-completion@2@command@2@ or
+         @1@command@1@qpdf --zsh-completion@2@command@2@, the completion
+         command that it outputs will refer to qpdf using the value of
+         that variable rather than what @1@command@1@qpdf@2@command@2@
+         determines its executable path to be. This can be useful when
+         wrapping @1@command@1@qpdf@2@command@2@ with a script, working
+         with a version in the source tree, using an AppImage, or other
+         situations where there is some indirection.
+
+   -  Library Enhancements
+
+      -  Random number generation is now delegated to the crypto
+         provider. The old behavior is still used by the native crypto
+         provider. It is still possible to provide your own random
+         number generator.
+
+      -  Add a new version of
+         ``QPDFObjectHandle::StreamDataProvider::provideStreamData``
+         that accepts the ``suppress_warnings`` and ``will_retry``
+         options and allows a success code to be returned. This makes it
+         possible to implement a ``StreamDataProvider`` that calls
+         ``pipeStreamData`` on another stream and to pass the response
+         back to the caller, which enables better error handling on
+         those proxied streams.
+
+      -  Update ``QPDFObjectHandle::pipeStreamData`` to return an
+         overall success code that goes beyond whether or not filtered
+         data was written successfully. This allows better error
+         handling of cases that were not filtering errors. You have to
+         call this explicitly. Methods in previously existing APIs have
+         the same semantics as before.
+
+      -  The ``QPDFPageObjectHelper::placeFormXObject`` method now
+         allows separate control over whether it should be willing to
+         shrink or expand objects to fit them better into the
+         destination rectangle. The previous behavior was that shrinking
+         was allowed but expansion was not. The previous behavior is
+         still the default.
+
+      -  When calling the C API, any non-zero value passed to a boolean
+         parameter is treated as ``TRUE``. Previously only the value
+         ``1`` was accepted. This makes the C API behave more like most
+         C interfaces and is known to improve compatibility with some
+         Windows environments that dynamically load the DLL and call
+         functions from it.
+
+      -  Add ``QPDFObjectHandle::unsafeShallowCopy`` for copying only
+         top-level dictionary keys or array items. This is unsafe
+         because it creates a situation in which changing a lower-level
+         item in one object may also change it in another object, but
+         for cases in which you *know* you are only inserting or
+         replacing top-level items, it is much faster than
+         ``QPDFObjectHandle::shallowCopy``.
+
+      -  Add ``QPDFObjectHandle::filterAsContents``, which filter's a
+         stream's data as a content stream. This is useful for parsing
+         the contents for form XObjects in the same way as parsing page
+         content streams.
+
+   -  Bug Fixes
+
+      -  When detecting and removing unreferenced resources during page
+         splitting, traverse into form XObjects and handle their
+         resources dictionaries as well.
+
+      -  The same error recovery is applied to streams in other than the
+         primary input file when merging or splitting pages.
+
+9.1.1: January 26, 2020
+   -  Build/Packaging Changes
+
+      -  The fix-qdf program was converted from perl to C++. As such,
+         qpdf no longer has a runtime dependency on perl.
+
+   -  Library Enhancements
+
+      -  Added new helper routine ``QUtil::call_main_from_wmain`` which
+         converts ``wchar_t`` arguments to UTF-8 encoded strings. This
+         is useful for qpdf because library methods expect file names to
+         be UTF-8 encoded, even on Windows
+
+      -  Added new ``QUtil::read_lines_from_file`` methods that take
+         ``FILE*`` arguments and that allow preservation of end-of-line
+         characters. This also fixes a bug where
+         ``QUtil::read_lines_from_file`` wouldn't work properly with
+         Unicode filenames.
+
+   -  CLI Enhancements
+
+      -  Added options @1@option@1@--is-encrypted@2@option@2@ and
+         @1@option@1@--requires-password@2@option@2@ for testing whether
+         a file is encrypted or requires a password other than the
+         supplied (or empty) password. These communicate via exit
+         status, making them useful for shell scripts. They also work on
+         encrypted files with unknown passwords.
+
+      -  Added ``encrypt`` key to JSON options. With the exception of
+         the reconstructed user password for older encryption formats,
+         this provides the same information as
+         @1@option@1@--show-encryption@2@option@2@ but in a consistent,
+         parseable format. See output of @1@command@1@qpdf
+         --json-help@2@command@2@ for details.
+
+   -  Bug Fixes
+
+      -  In QDF mode, be sure not to write more than one XRef stream to
+         a file, even when
+         @1@option@1@--preserve-unreferenced@2@option@2@ is used.
+         @1@command@1@fix-qdf@2@command@2@ assumes that there is only
+         one XRef stream, and that it appears at the end of the file.
+
+      -  When externalizing inline images, properly handle images whose
+         color space is a reference to an object in the page's resource
+         dictionary.
+
+      -  Windows-specific fix for acquiring crypt context with a new
+         keyset.
+
+9.1.0: November 17, 2019
+   -  Build Changes
+
+      -  A C++-11 compiler is now required to build qpdf.
+
+      -  A new crypto provider that uses gnutls for crypto functions is
+         now available and can be enabled at build time. See `Crypto
+         Providers <#ref.crypto>`__ for more information about crypto
+         providers and `Build Support For Crypto
+         Providers <#ref.crypto.build>`__ for specific information about
+         the build.
+
+   -  Library Enhancements
+
+      -  Incorporate contribution from Masamichi Hosoda to properly
+         handle signature dictionaries by not including them in object
+         streams, formatting the ``Contents`` key has a hexadecimal
+         string, and excluding the ``/Contents`` key from encryption and
+         decryption.
+
+      -  Incorporate contribution from Masamichi Hosoda to provide new
+         API calls for getting file-level information about input and
+         output files, enabling certain operations on the files at the
+         file level rather than the object level. New methods include
+         ``QPDF::getXRefTable()``,
+         ``QPDFObjectHandle::getParsedOffset()``,
+         ``QPDFWriter::getRenumberedObjGen(QPDFObjGen)``, and
+         ``QPDFWriter::getWrittenXRefTable()``.
+
+      -  Support build-time and runtime selectable crypto providers.
+         This includes the addition of new classes
+         ``QPDFCryptoProvider`` and ``QPDFCryptoImpl`` and the
+         recognition of the ``QPDF_CRYPTO_PROVIDER`` environment
+         variable. Crypto providers are described in depth in `Crypto
+         Providers <#ref.crypto>`__.
+
+   -  CLI Enhancements
+
+      -  Addition of the @1@option@1@--show-crypto@2@option@2@ option in
+         support of selectable crypto providers, as described in `Crypto
+         Providers <#ref.crypto>`__.
+
+      -  Allow ``:even`` or ``:odd`` to be appended to numeric ranges
+         for specification of the even or odd pages from among the pages
+         specified in the range.
+
+      -  Fix shell wildcard expansion behavior (``*`` and ``?``) of the
+         @1@command@1@qpdf.exe@2@command@2@ as built my MSVC.
+
+9.0.2: October 12, 2019
+   -  Bug Fix
+
+      -  Fix the name of the temporary file used by
+         @1@option@1@--replace-input@2@option@2@ so that it doesn't
+         require path splitting and works with paths include
+         directories.
+
+9.0.1: September 20, 2019
+   -  Bug Fixes/Enhancements
+
+      -  Fix some build and test issues on big-endian systems and
+         compilers with characters that are unsigned by default. The
+         problems were in build and test only. There were no actual bugs
+         in the qpdf library itself relating to endianness or unsigned
+         characters.
+
+      -  When a dictionary has a duplicated key, report this with a
+         warning. The behavior of the library in this case is unchanged,
+         but the error condition is no longer silently ignored.
+
+      -  When a form field's display rectangle is erroneously specified
+         with inverted coordinates, detect and correct this situation.
+         This avoids some form fields from being flipped when flattening
+         annotations on files with this condition.
+
+9.0.0: August 31, 2019
+   -  Incompatible API (source-level) Changes (minor)
+
+      -  The method ``QUtil::strcasecmp`` has been renamed to
+         ``QUtil::str_compare_nocase``. This incompatible change is
+         necessary to enable qpdf to build on platforms that define
+         ``strcasecmp`` as a macro.
+
+      -  The ``QPDF::copyForeignObject`` method had an overloaded
+         version that took a boolean parameter that was not used. If you
+         were using this version, just omit the extra parameter.
+
+      -  There was a version ``QPDFTokenizer::expectInlineImage`` that
+         took no arguments. This version has been removed since it
+         caused the tokenizer to return incorrect inline images. A new
+         version was added some time ago that produces correct output.
+         This is a very low level method that doesn't make sense to call
+         outside of qpdf's lexical engine. There are higher level
+         methods for tokenizing content streams.
+
+      -  Change ``QPDFOutlineDocumentHelper::getTopLevelOutlines`` and
+         ``QPDFOutlineObjectHelper::getKids`` to return a
+         ``std::vector`` instead of a ``std::list`` of
+         ``QPDFOutlineObjectHelper`` objects.
+
+      -  Remove method ``QPDFTokenizer::allowPoundAnywhereInName``. This
+         function would allow creation of name tokens whose value would
+         change when unparsed, which is never the correct behavior.
+
+   -  CLI Enhancements
+
+      -  The @1@option@1@--replace-input@2@option@2@ option may be given
+         in place of an output file name. This causes qpdf to overwrite
+         the input file with the output. See the description of
+         @1@option@1@--replace-input@2@option@2@ in `Basic
+         Options <#ref.basic-options>`__ for more details.
+
+      -  The @1@option@1@--recompress-flate@2@option@2@ instructs
+         @1@command@1@qpdf@2@command@2@ to recompress streams that are
+         already compressed with ``/FlateDecode``. Useful with
+         @1@option@1@--compression-level@2@option@2@.
+
+      -  The
+         @1@option@1@--compression-level=@1@replaceable@1@level@2@replaceable@2@@2@option@2@
+         sets the zlib compression level used for any streams compressed
+         by ``/FlateDecode``. Most effective when combined with
+         @1@option@1@--recompress-flate@2@option@2@.
+
+   -  Library Enhancements
+
+      -  A new namespace ``QIntC``, provided by
+         @1@filename@1@qpdf/QIntC.hh@2@filename@2@, provides safe
+         conversion methods between different integer types. These
+         conversion methods do range checking to ensure that the cast
+         can be performed with no loss of information. Every use of
+         ``static_cast`` in the library was inspected to see if it could
+         use one of these safe converters instead. See `Casting
+         Policy <#ref.casting>`__ for additional details.
+
+      -  Method ``QPDF::anyWarnings`` tells whether there have been any
+         warnings without clearing the list of warnings.
+
+      -  Method ``QPDF::closeInputSource`` closes or otherwise releases
+         the input source. This enables the input file to be deleted or
+         renamed.
+
+      -  New methods have been added to ``QUtil`` for converting back
+         and forth between strings and unsigned integers:
+         ``uint_to_string``, ``uint_to_string_base``,
+         ``string_to_uint``, and ``string_to_ull``.
+
+      -  New methods have been added to ``QPDFObjectHandle`` that return
+         the value of ``Integer`` objects as ``int`` or ``unsigned int``
+         with range checking and sensible fallback values, and a new
+         method was added to return an unsigned value. This makes it
+         easier to write code that is safe from unintentional data loss.
+         Functions: ``getUIntValue``, ``getIntValueAsInt``,
+         ``getUIntValueAsUInt``.
+
+      -  When parsing content streams with
+         ``QPDFObjectHandle::ParserCallbacks``, in place of the method
+         ``handleObject(QPDFObjectHandle)``, the developer may override
+         ``handleObject(QPDFObjectHandle, size_t offset,
+                   size_t length)``. If this method is defined, it will
+         be invoked with the object along with its offset and length
+         within the overall contents being parsed. Intervening spaces
+         and comments are not included in offset and length.
+         Additionally, a new method ``contentSize(size_t)`` may be
+         implemented. If present, it will be called prior to the first
+         call to ``handleObject`` with the total size in bytes of the
+         combined contents.
+
+      -  New methods ``QPDF::userPasswordMatched`` and
+         ``QPDF::ownerPasswordMatched`` have been added to enable a
+         caller to determine whether the supplied password was the user
+         password, the owner password, or both. This information is also
+         displayed by @1@command@1@qpdf --show-encryption@2@command@2@
+         and @1@command@1@qpdf --check@2@command@2@.
+
+      -  Static method ``Pl_Flate::setCompressionLevel`` can be called
+         to set the zlib compression level globally used by all
+         instances of Pl_Flate in deflate mode.
+
+      -  The method ``QPDFWriter::setRecompressFlate`` can be called to
+         tell ``QPDFWriter`` to uncompress and recompress streams
+         already compressed with ``/FlateDecode``.
+
+      -  The underlying implementation of QPDF arrays has been enhanced
+         to be much more memory efficient when dealing with arrays with
+         lots of nulls. This enables qpdf to use drastically less memory
+         for certain types of files.
+
+      -  When traversing the pages tree, if nodes are encountered with
+         invalid types, the types are fixed, and a warning is issued.
+
+      -  A new helper method ``QUtil::read_file_into_memory`` was added.
+
+      -  All conditions previously reported by
+         ``QPDF::checkLinearization()`` as errors are now presented as
+         warnings.
+
+      -  Name tokens containing the ``#`` character not preceded by two
+         hexadecimal digits, which is invalid in PDF 1.2 and above, are
+         properly handled by the library: a warning is generated, and
+         the name token is properly preserved, even if invalid, in the
+         output. See @1@filename@1@ChangeLog@2@filename@2@ for a more
+         complete description of this change.
+
+   -  Bug Fixes
+
+      -  A small handful of memory issues, assertion failures, and
+         unhandled exceptions that could occur on badly mangled input
+         files have been fixed. Most of these problems were found by
+         Google's OSS-Fuzz project.
+
+      -  When @1@command@1@qpdf --check@2@command@2@ or
+         @1@command@1@qpdf --check-linearization@2@command@2@ encounters
+         a file with linearization warnings but not errors, it now
+         properly exits with exit code 3 instead of 2.
+
+      -  The @1@option@1@--completion-bash@2@option@2@ and
+         @1@option@1@--completion-zsh@2@option@2@ options now work
+         properly when qpdf is invoked as an AppImage.
+
+      -  Calling ``QPDFWriter::set*EncryptionParameters`` on a
+         ``QPDFWriter`` object whose output filename has not yet been
+         set no longer produces a segmentation fault.
+
+      -  When reading encrypted files, follow the spec more closely
+         regarding encryption key length. This allows qpdf to open
+         encrypted files in most cases when they have invalid or missing
+         /Length keys in the encryption dictionary.
+
+   -  Build Changes
+
+      -  On platforms that support it, qpdf now builds with
+         @1@option@1@-fvisibility=hidden@2@option@2@. If you build qpdf
+         with your own build system, this is now safe to use. This
+         prevents methods that are not part of the public API from being
+         exported by the shared library, and makes qpdf's ELF shared
+         libraries (used on Linux, MacOS, and most other UNIX flavors)
+         behave more like the Windows DLL. Since the DLL already behaves
+         in much this way, it is unlikely that there are any methods
+         that were accidentally not exported. However, with ELF shared
+         libraries, typeinfo for some classes has to be explicitly
+         exported. If there are problems in dynamically linked code
+         catching exceptions or subclassing, this could be the reason.
+         If you see this, please report a bug at
+         https://github.com/qpdf/qpdf/issues/.
+
+      -  QPDF is now compiled with integer conversion and sign
+         conversion warnings enabled. Numerous changes were made to the
+         library to make this safe.
+
+      -  QPDF's @1@command@1@make install@2@command@2@ target explicitly
+         specifies the mode to use when installing files instead of
+         relying the user's umask. It was previously doing this for some
+         files but not others.
+
+      -  If @1@command@1@pkg-config@2@command@2@ is available, use it to
+         locate @1@filename@1@libjpeg@2@filename@2@ and
+         @1@filename@1@zlib@2@filename@2@ dependencies, falling back on
+         old behavior if unsuccessful.
+
+   -  Other Notes
+
+      -  QPDF has been fully integrated into `Google's OSS-Fuzz
+         project <https://github.com/google/oss-fuzz>`__. This project
+         exercises code with randomly mutated inputs and is great for
+         discovering hidden security crashes and security issues.
+         Several bugs found by oss-fuzz have already been fixed in qpdf.
+
+8.4.2: May 18, 2019
+   This release has just one change: correction of a buffer overrun in
+   the Windows code used to open files. Windows users should take this
+   update. There are no code changes that affect non-Windows releases.
+
+8.4.1: April 27, 2019
+   -  Enhancements
+
+      -  When @1@command@1@qpdf --version@2@command@2@ is run, it will
+         detect if the qpdf CLI was built with a different version of
+         qpdf than the library, which may indicate a problem with the
+         installation.
+
+      -  New option @1@option@1@--remove-page-labels@2@option@2@ will
+         remove page labels before generating output. This used to
+         happen if you ran @1@command@1@qpdf --empty --pages ..
+         --@2@command@2@, but the behavior changed in qpdf 8.3.0. This
+         option enables people who were relying on the old behavior to
+         get it again.
+
+      -  New option
+         @1@option@1@--keep-files-open-threshold=@1@replaceable@1@count@2@replaceable@2@@2@option@2@
+         can be used to override number of files that qpdf will use to
+         trigger the behavior of not keeping all files open when merging
+         files. This may be necessary if your system allows fewer than
+         the default value of 200 files to be open at the same time.
+
+   -  Bug Fixes
+
+      -  Handle Unicode characters in filenames on Windows. The changes
+         to support Unicode on the CLI in Windows broke Unicode
+         filenames for Windows.
+
+      -  Slightly tighten logic that determines whether an object is a
+         page. This should resolve problems in some rare files where
+         some non-page objects were passing qpdf's test for whether
+         something was a page, thus causing them to be erroneously lost
+         during page splitting operations.
+
+      -  Revert change that included preservation of outlines
+         (bookmarks) in @1@option@1@--split-pages@2@option@2@. The way
+         it was implemented in 8.3.0 and 8.4.0 caused a very significant
+         degradation of performance for splitting certain files. A
+         future release of qpdf may re-introduce the behavior in a more
+         performant and also more correct fashion.
+
+      -  In JSON mode, add missing leading 0 to decimal values between
+         -1 and 1 even if not present in the input. The JSON
+         specification requires the leading 0. The PDF specification
+         does not.
+
+8.4.0: February 1, 2019
+   -  Command-line Enhancements
+
+      -  *Non-compatible CLI change:* The qpdf command-line tool
+         interprets passwords given at the command-line differently from
+         previous releases when the passwords contain non-ASCII
+         characters. In some cases, the behavior differs from previous
+         releases. For a discussion of the current behavior, please see
+         `Unicode Passwords <#ref.unicode-passwords>`__. The
+         incompatibilities are as follows:
+
+         -  On Windows, qpdf now receives all command-line options as
+            Unicode strings if it can figure out the appropriate
+            compile/link options. This is enabled at least for MSVC and
+            mingw builds. That means that if non-ASCII strings are
+            passed to the qpdf CLI in Windows, qpdf will now correctly
+            receive them. In the past, they would have either been
+            encoded as Windows code page 1252 (also known as "Windows
+            ANSI" or as something unintelligible. In almost all cases,
+            qpdf is able to properly interpret Unicode arguments now,
+            whereas in the past, it would almost never interpret them
+            properly. The result is that non-ASCII passwords given to
+            the qpdf CLI on Windows now have a much greater chance of
+            creating PDF files that can be opened by a variety of
+            readers. In the past, usually files encrypted from the
+            Windows CLI using non-ASCII passwords would not be readable
+            by most viewers. Note that the current version of qpdf is
+            able to decrypt files that it previously created using the
+            previously supplied password.
+
+         -  The PDF specification requires passwords to be encoded as
+            UTF-8 for 256-bit encryption and with PDF Doc encoding for
+            40-bit or 128-bit encryption. Older versions of qpdf left it
+            up to the user to provide passwords with the correct
+            encoding. The qpdf CLI now detects when a password is given
+            with UTF-8 encoding and automatically transcodes it to what
+            the PDF spec requires. While this is almost always the
+            correct behavior, it is possible to override the behavior if
+            there is some reason to do so. This is discussed in more
+            depth in `Unicode Passwords <#ref.unicode-passwords>`__.
+
+      -  New options
+         @1@option@1@--externalize-inline-images@2@option@2@,
+         @1@option@1@--ii-min-bytes@2@option@2@, and
+         @1@option@1@--keep-inline-images@2@option@2@ control qpdf's
+         handling of inline images and possible conversion of them to
+         regular images. By default,
+         @1@option@1@--optimize-images@2@option@2@ now also applies to
+         inline images. These options are discussed in `Advanced
+         Transformation Options <#ref.advanced-transformation>`__.
+
+      -  Add options @1@option@1@--overlay@2@option@2@ and
+         @1@option@1@--underlay@2@option@2@ for overlaying or
+         underlaying pages of other files onto output pages. See
+         `Overlay and Underlay Options <#ref.overlay-underlay>`__ for
+         details.
+
+      -  When opening an encrypted file with a password, if the
+         specified password doesn't work and the password contains any
+         non-ASCII characters, qpdf will try a number of alternative
+         passwords to try to compensate for possible character encoding
+         errors. This behavior can be suppressed with the
+         @1@option@1@--suppress-password-recovery@2@option@2@ option.
+         See `Unicode Passwords <#ref.unicode-passwords>`__ for a full
+         discussion.
+
+      -  Add the @1@option@1@--password-mode@2@option@2@ option to
+         fine-tune how qpdf interprets password arguments, especially
+         when they contain non-ASCII characters. See `Unicode
+         Passwords <#ref.unicode-passwords>`__ for more information.
+
+      -  In the @1@option@1@--pages@2@option@2@ option, it is now
+         possible to copy the same page more than once from the same
+         file without using the previous workaround of specifying two
+         different paths to the same file.
+
+      -  In the @1@option@1@--pages@2@option@2@ option, allow use of "."
+         as a shortcut for the primary input file. That way, you can do
+         @1@command@1@qpdf in.pdf --pages . 1-2 -- out.pdf@2@command@2@
+         instead of having to repeat @1@filename@1@in.pdf@2@filename@2@
+         in the command.
+
+      -  When encrypting with 128-bit and 256-bit encryption, new
+         encryption options @1@option@1@--assemble@2@option@2@,
+         @1@option@1@--annotate@2@option@2@,
+         @1@option@1@--form@2@option@2@, and
+         @1@option@1@--modify-other@2@option@2@ allow more fine-grained
+         granularity in configuring options. Before, the
+         @1@option@1@--modify@2@option@2@ option only configured certain
+         predefined groups of permissions.
+
+   -  Bug Fixes and Enhancements
+
+      -  *Potential data-loss bug:* Versions of qpdf between 8.1.0 and
+         8.3.0 had a bug that could cause page splitting and merging
+         operations to drop some font or image resources if the PDF
+         file's internal structure shared these resource lists across
+         pages and if some but not all of the pages in the output did
+         not reference all the fonts and images. Using the
+         @1@option@1@--preserve-unreferenced-resources@2@option@2@
+         option would work around the incorrect behavior. This bug was
+         the result of a typo in the code and a deficiency in the test
+         suite. The case that triggered the error was known, just not
+         handled properly. This case is now exercised in qpdf's test
+         suite and properly handled.
+
+      -  When optimizing images, detect and refuse to optimize images
+         that can't be converted to JPEG because of bit depth or color
+         space.
+
+      -  Linearization and page manipulation APIs now detect and recover
+         from files that have duplicate Page objects in the pages tree.
+
+      -  Using older option
+         @1@option@1@--stream-data=compress@2@option@2@ with object
+         streams, object streams and xref streams were not compressed.
+
+      -  When the tokenizer returns inline image tokens, delimiters
+         following ``ID`` and ``EI`` operators are no longer excluded.
+         This makes it possible to reliably extract the actual image
+         data.
+
+   -  Library Enhancements
+
+      -  Add method ``QPDFPageObjectHelper::externalizeInlineImages`` to
+         convert inline images to regular images.
+
+      -  Add method ``QUtil::possible_repaired_encodings()`` to generate
+         a list of strings that represent other ways the given string
+         could have been encoded. This is the method the QPDF CLI uses
+         to generate the strings it tries when recovering incorrectly
+         encoded Unicode passwords.
+
+      -  Add new versions of
+         ``QPDFWriter::setR{3,4,5,6}EncryptionParameters`` that allow
+         more granular setting of permissions bits. See
+         @1@filename@1@QPDFWriter.hh@2@filename@2@ for details.
+
+      -  Add new versions of the transcoders from UTF-8 to single-byte
+         coding systems in ``QUtil`` that report success or failure
+         rather than just substituting a specified unknown character.
+
+      -  Add method ``QUtil::analyze_encoding()`` to determine whether a
+         string has high-bit characters and is appears to be UTF-16 or
+         valid UTF-8 encoding.
+
+      -  Add new method ``QPDFPageObjectHelper::shallowCopyPage()`` to
+         copy a new page that is a "shallow copy" of a page. The
+         resulting object is an indirect object ready to be passed to
+         ``QPDFPageDocumentHelper::addPage()`` for either the original
+         ``QPDF`` object or a different one. This is what the
+         @1@command@1@qpdf@2@command@2@ command-line tool uses to copy
+         the same page multiple times from the same file during
+         splitting and merging operations.
+
+      -  Add method ``QPDF::getUniqueId()``, which returns a unique
+         identifier for the given QPDF object. The identifier will be
+         unique across the life of the application. The returned value
+         can be safely used as a map key.
+
+      -  Add method ``QPDF::setImmediateCopyFrom``. This further
+         enhances qpdf's ability to allow a ``QPDF`` object from which
+         objects are being copied to go out of scope before the
+         destination object is written. If you call this method on a
+         ``QPDF`` instances, objects copied *from* this instance will be
+         copied immediately instead of lazily. This option uses more
+         memory but allows the source object to go out of scope before
+         the destination object is written in all cases. See comments in
+         @1@filename@1@QPDF.hh@2@filename@2@ for details.
+
+      -  Add method ``QPDFPageObjectHelper::getAttribute`` for
+         retrieving an attribute from the page dictionary taking
+         inheritance into consideration, and optionally making a copy if
+         your intention is to modify the attribute.
+
+      -  Fix long-standing limitation of
+         ``QPDFPageObjectHelper::getPageImages`` so that it now properly
+         reports images from inherited resources dictionaries,
+         eliminating the need to call
+         ``QPDFPageDocumentHelper::pushInheritedAttributesToPage`` in
+         this case.
+
+      -  Add method ``QPDFObjectHandle::getUniqueResourceName`` for
+         finding an unused name in a resource dictionary.
+
+      -  Add method ``QPDFPageObjectHelper::getFormXObjectForPage`` for
+         generating a form XObject equivalent to a page. The resulting
+         object can be used in the same file or copied to another file
+         with ``copyForeignObject``. This can be useful for implementing
+         underlay, overlay, n-up, thumbnails, or any other functionality
+         requiring replication of pages in other contexts.
+
+      -  Add method ``QPDFPageObjectHelper::placeFormXObject`` for
+         generating content stream text that places a given form XObject
+         on a page, centered and fit within a specified rectangle. This
+         method takes care of computing the proper transformation matrix
+         and may optionally compensate for rotation or scaling of the
+         destination page.
+
+   -  Build Improvements
+
+      -  Add new configure option
+         @1@option@1@--enable-avoid-windows-handle@2@option@2@, which
+         causes the preprocessor symbol ``AVOID_WINDOWS_HANDLE`` to be
+         defined. When defined, qpdf will avoid referencing the Windows
+         ``HANDLE`` type, which is disallowed with certain versions of
+         the Windows SDK.
+
+      -  For Windows builds, attempt to determine what options, if any,
+         have to be passed to the compiler and linker to enable use of
+         ``wmain``. This causes the preprocessor symbol
+         ``WINDOWS_WMAIN`` to be defined. If you do your own builds with
+         other compilers, you can define this symbol to cause ``wmain``
+         to be used. This is needed to allow the Windows
+         @1@command@1@qpdf@2@command@2@ command to receive Unicode
+         command-line options.
+
+8.3.0: January 7, 2019
+   -  Command-line Enhancements
+
+      -  Shell completion: you can now use eval @1@command@1@$(qpdf
+         --completion-bash)@2@command@2@ and eval @1@command@1@$(qpdf
+         --completion-zsh)@2@command@2@ to enable shell completion for
+         bash and zsh.
+
+      -  Page numbers (also known as page labels) are now preserved when
+         merging and splitting files with the
+         @1@option@1@--pages@2@option@2@ and
+         @1@option@1@--split-pages@2@option@2@ options.
+
+      -  Bookmarks are partially preserved when splitting pages with the
+         @1@option@1@--split-pages@2@option@2@ option. Specifically, the
+         outlines dictionary and some supporting metadata are copied
+         into the split files. The result is that all bookmarks from the
+         original file appear, those that point to pages that are
+         preserved work, and those that point to pages that are not
+         preserved don't do anything. This is an interim step toward
+         proper support for bookmarks in splitting and merging
+         operations.
+
+      -  Page collation: add new option
+         @1@option@1@--collate@2@option@2@. When specified, the
+         semantics of @1@option@1@--pages@2@option@2@ change from
+         concatenation to collation. See `Page Selection
+         Options <#ref.page-selection>`__ for examples and discussion.
+
+      -  Generation of information in JSON format, primarily to
+         facilitate use of qpdf from languages other than C++. Add new
+         options @1@option@1@--json@2@option@2@,
+         @1@option@1@--json-key@2@option@2@, and
+         @1@option@1@--json-object@2@option@2@ to generate a JSON
+         representation of the PDF file. Run @1@command@1@qpdf
+         --json-help@2@command@2@ to get a description of the JSON
+         format. For more information, see `QPDF JSON <#ref.json>`__.
+
+      -  The @1@option@1@--generate-appearances@2@option@2@ flag will
+         cause qpdf to generate appearances for form fields if the PDF
+         file indicates that form field appearances are out of date.
+         This can happen when PDF forms are filled in by a program that
+         doesn't know how to regenerate the appearances of the filled-in
+         fields.
+
+      -  The @1@option@1@--flatten-annotations@2@option@2@ flag can be
+         used to *flatten* annotations, including form fields.
+         Ordinarily, annotations are drawn separately from the page.
+         Flattening annotations is the process of combining their
+         appearances into the page's contents. You might want to do this
+         if you are going to rotate or combine pages using a tool that
+         doesn't understand about annotations. You may also want to use
+         @1@option@1@--generate-appearances@2@option@2@ when using this
+         flag since annotations for outdated form fields are not
+         flattened as that would cause loss of information.
+
+      -  The @1@option@1@--optimize-images@2@option@2@ flag tells qpdf
+         to recompresses every image using DCT (JPEG) compression as
+         long as the image is not already compressed with lossy
+         compression and recompressing the image reduces its size. The
+         additional options @1@option@1@--oi-min-width@2@option@2@,
+         @1@option@1@--oi-min-height@2@option@2@, and
+         @1@option@1@--oi-min-area@2@option@2@ prevent recompression of
+         images whose width, height, or pixel area (width × height) are
+         below a specified threshold.
+
+      -  The @1@option@1@--show-object@2@option@2@ option can now be
+         given as @1@option@1@--show-object=trailer@2@option@2@ to show
+         the trailer dictionary.
+
+   -  Bug Fixes and Enhancements
+
+      -  QPDF now automatically detects and recovers from dangling
+         references. If a PDF file contained an indirect reference to a
+         non-existent object, which is valid, when adding a new object
+         to the file, it was possible for the new object to take the
+         object ID of the dangling reference, thereby causing the
+         dangling reference to point to the new object. This case is now
+         prevented.
+
+      -  Fixes to form field setting code: strings are always written in
+         UTF-16 format, and checkboxes and radio buttons are handled
+         properly with respect to synchronization of values and
+         appearance states.
+
+      -  The ``QPDF::checkLinearization()`` no longer causes the program
+         to crash when it detects problems with linearization data.
+         Instead, it issues a normal warning or error.
+
+      -  Ordinarily qpdf treats an argument of the form
+         @1@option@1@@file@2@option@2@ to mean that command-line options
+         should be read from @1@filename@1@file@2@filename@2@. Now, if
+         @1@filename@1@file@2@filename@2@ does not exist but
+         @1@filename@1@@file@2@filename@2@ does, qpdf will treat
+         @1@filename@1@@file@2@filename@2@ as a regular option. This
+         makes it possible to work more easily with PDF files whose
+         names happen to start with the ``@`` character.
+
+   -  Library Enhancements
+
+      -  Remove the restriction in most cases that the source QPDF
+         object used in a ``QPDF::copyForeignObject`` call has to stick
+         around until the destination QPDF is written. The exceptional
+         case is when the source stream gets is data using a
+         QPDFObjectHandle::StreamDataProvider. For a more in-depth
+         discussion, see comments around ``copyForeignObject`` in
+         @1@filename@1@QPDF.hh@2@filename@2@.
+
+      -  Add new method ``QPDFWriter::getFinalVersion()``, which returns
+         the PDF version that will ultimately be written to the final
+         file. See comments in @1@filename@1@QPDFWriter.hh@2@filename@2@
+         for some restrictions on its use.
+
+      -  Add several methods for transcoding strings to some of the
+         character sets used in PDF files: ``QUtil::utf8_to_ascii``,
+         ``QUtil::utf8_to_win_ansi``, ``QUtil::utf8_to_mac_roman``, and
+         ``QUtil::utf8_to_utf16``. For the single-byte encodings that
+         support only a limited character sets, these methods replace
+         unsupported characters with a specified substitute.
+
+      -  Add new methods to ``QPDFAnnotationObjectHelper`` and
+         ``QPDFFormFieldObjectHelper`` for querying flags and
+         interpretation of different field types. Define constants in
+         @1@filename@1@qpdf/Constants.h@2@filename@2@ to help with
+         interpretation of flag values.
+
+      -  Add new methods
+         ``QPDFAcroFormDocumentHelper::generateAppearancesIfNeeded`` and
+         ``QPDFFormFieldObjectHelper::generateAppearance`` for
+         generating appearance streams. See discussion in
+         @1@filename@1@QPDFFormFieldObjectHelper.hh@2@filename@2@ for
+         limitations.
+
+      -  Add two new helper functions for dealing with resource
+         dictionaries: ``QPDFObjectHandle::getResourceNames()`` returns
+         a list of all second-level keys, which correspond to the names
+         of resources, and ``QPDFObjectHandle::mergeResources()`` merges
+         two resources dictionaries as long as they have non-conflicting
+         keys. These methods are useful for certain types of objects
+         that resolve resources from multiple places, such as form
+         fields.
+
+      -  Add methods ``QPDFPageDocumentHelper::flattenAnnotations()``
+         and
+         ``QPDFAnnotationObjectHelper::getPageContentForAppearance()``
+         for handling low-level details of annotation flattening.
+
+      -  Add new helper classes: ``QPDFOutlineDocumentHelper``,
+         ``QPDFOutlineObjectHelper``, ``QPDFPageLabelDocumentHelper``,
+         ``QPDFNameTreeObjectHelper``, and
+         ``QPDFNumberTreeObjectHelper``.
+
+      -  Add method ``QPDFObjectHandle::getJSON()`` that returns a JSON
+         representation of the object. Call ``serialize()`` on the
+         result to convert it to a string.
+
+      -  Add a simple JSON serializer. This is not a complete or
+         general-purpose JSON library. It allows assembly and
+         serialization of JSON structures with some restrictions, which
+         are described in the header file. This is the serializer used
+         by qpdf's new JSON representation.
+
+      -  Add new ``QPDFObjectHandle::Matrix`` class along with a few
+         convenience methods for dealing with six-element numerical
+         arrays as matrices.
+
+      -  Add new method ``QPDFObjectHandle::wrapInArray``, which returns
+         the object itself if it is an array, or an array containing the
+         object otherwise. This is a common construct in PDF. This
+         method prevents you from having to explicitly test whether
+         something is a single element or an array.
+
+   -  Build Improvements
+
+      -  It is no longer necessary to run
+         @1@command@1@autogen.sh@2@command@2@ to build from a pristine
+         checkout. Automatically generated files are now committed so
+         that it is possible to build on platforms without autoconf
+         directly from a clean checkout of the repository. The
+         @1@command@1@configure@2@command@2@ script detects if the files
+         are out of date when it also determines that the tools are
+         present to regenerate them.
+
+      -  Pull requests and the master branch are now built automatically
+         in `Azure
+         Pipelines <https://dev.azure.com/qpdf/qpdf/_build>`__, which is
+         free for open source projects. The build includes Linux, mac,
+         Windows 32-bit and 64-bit with mingw and MSVC, and an AppImage
+         build. Official qpdf releases are now built with Azure
+         Pipelines.
+
+   -  Notes for Packagers
+
+      -  A new section has been added to the documentation with notes
+         for packagers. Please see `Notes for
+         Packagers <#ref.packaging>`__.
+
+      -  The qpdf detects out-of-date automatically generated files. If
+         your packaging system automatically refreshes libtool or
+         autoconf files, it could cause this check to fail. To avoid
+         this problem, pass
+         @1@option@1@--disable-check-autofiles@2@option@2@ to
+         @1@command@1@configure@2@command@2@.
+
+      -  If you would like to have qpdf completion enabled
+         automatically, you can install completion files in the
+         distribution's default location. You can find sample completion
+         files to install in the @1@filename@1@completions@2@filename@2@
+         directory.
+
+8.2.1: August 18, 2018
+   -  Command-line Enhancements
+
+      -  Add
+         @1@option@1@--keep-files-open=@1@replaceable@1@[yn]@2@replaceable@2@@2@option@2@
+         to override default determination of whether to keep files open
+         when merging. Please see the discussion of
+         @1@option@1@--keep-files-open@2@option@2@ in `Basic
+         Options <#ref.basic-options>`__ for additional details.
+
+8.2.0: August 16, 2018
+   -  Command-line Enhancements
+
+      -  Add @1@option@1@--no-warn@2@option@2@ option to suppress
+         issuing warning messages. If there are any conditions that
+         would have caused warnings to be issued, the exit status is
+         still 3.
+
+   -  Bug Fixes and Optimizations
+
+      -  Performance fix: optimize page merging operation to avoid
+         unnecessary open/close calls on files being merged. This solves
+         a dramatic slow-down that was observed when merging certain
+         types of files.
+
+      -  Optimize how memory was used for the TIFF predictor,
+         drastically improving performance and memory usage for files
+         containing high-resolution images compressed with Flate using
+         the TIFF predictor.
+
+      -  Bug fix: end of line characters were not properly handled
+         inside strings in some cases.
+
+      -  Bug fix: using @1@option@1@--progress@2@option@2@ on very small
+         files could cause an infinite loop.
+
+   -  API enhancements
+
+      -  Add new class ``QPDFSystemError``, derived from
+         ``std::runtime_error``, which is now thrown by
+         ``QUtil::throw_system_error``. This enables the triggering
+         ``errno`` value to be retrieved.
+
+      -  Add ``ClosedFileInputSource::stayOpen`` method, enabling a
+         ``ClosedFileInputSource`` to stay open during manually
+         indicated periods of high activity, thus reducing the overhead
+         of frequent open/close operations.
+
+   -  Build Changes
+
+      -  For the mingw builds, change the name of the DLL import library
+         from @1@filename@1@libqpdf.a@2@filename@2@ to
+         @1@filename@1@libqpdf.dll.a@2@filename@2@ to more accurately
+         reflect that it is an import library rather than a static
+         library. This potentially clears the way for supporting a
+         static library in the future, though presently, the qpdf
+         Windows build only builds the DLL and executables.
+
+8.1.0: June 23, 2018
+   -  Usability Improvements
+
+      -  When splitting files, qpdf detects fonts and images that the
+         document metadata claims are referenced from a page but are not
+         actually referenced and omits them from the output file. This
+         change can cause a significant reduction in the size of split
+         PDF files for files created by some software packages. In some
+         cases, it can also make page splitting slower. Prior versions
+         of qpdf would believe the document metadata and sometimes
+         include all the images from all the other pages even though the
+         pages were no longer present. In the unlikely event that the
+         old behavior should be desired, or if you have a case where
+         page splitting is very slow, the old behavior (and speed) can
+         be enabled by specifying
+         @1@option@1@--preserve-unreferenced-resources@2@option@2@. For
+         additional details, please see `Advanced Transformation
+         Options <#ref.advanced-transformation>`__.
+
+      -  When merging multiple PDF files, qpdf no longer leaves all the
+         files open. This makes it possible to merge numbers of files
+         that may exceed the operating system's limit for the maximum
+         number of open files.
+
+      -  The @1@option@1@--rotate@2@option@2@ option's syntax has been
+         extended to make the page range optional. If you specify
+         @1@option@1@--rotate=@1@replaceable@1@angle@2@replaceable@2@@2@option@2@
+         without specifying a page range, the rotation will be applied
+         to all pages. This can be especially useful for adjusting a PDF
+         created from a multi-page document that was scanned upside
+         down.
+
+      -  When merging multiple files, the
+         @1@option@1@--verbose@2@option@2@ option now prints information
+         about each file as it operates on that file.
+
+      -  When the @1@option@1@--progress@2@option@2@ option is
+         specified, qpdf will print a running indicator of its best
+         guess at how far through the writing process it is. Note that,
+         as with all progress meters, it's an approximation. This option
+         is implemented in a way that makes it useful for software that
+         uses the qpdf library; see API Enhancements below.
+
+   -  Bug Fixes
+
+      -  Properly decrypt files that use revision 3 of the standard
+         security handler but use 40 bit keys (even though revision 3
+         supports 128-bit keys).
+
+      -  Limit depth of nested data structures to prevent crashes from
+         certain types of malformed (malicious) PDFs.
+
+      -  In "newline before endstream" mode, insert the required extra
+         newline before the ``endstream`` at the end of object streams.
+         This one case was previously omitted.
+
+   -  API Enhancements
+
+      -  The first round of higher level "helper" interfaces has been
+         introduced. These are designed to provide a more convenient way
+         of interacting with certain document features than using
+         ``QPDFObjectHandle`` directly. For details on helpers, see
+         `Helper Classes <#ref.helper-classes>`__. Specific additional
+         interfaces are described below.
+
+      -  Add two new document helper classes: ``QPDFPageDocumentHelper``
+         for working with pages, and ``QPDFAcroFormDocumentHelper`` for
+         working with interactive forms. No old methods have been
+         removed, but ``QPDFPageDocumentHelper`` is now the preferred
+         way to perform operations on pages rather than calling the old
+         methods in ``QPDFObjectHandle`` and ``QPDF`` directly. Comments
+         in the header files direct you to the new interfaces. Please
+         see the header files and @1@filename@1@ChangeLog@2@filename@2@
+         for additional details.
+
+      -  Add three new object helper class: ``QPDFPageObjectHelper`` for
+         pages, ``QPDFFormFieldObjectHelper`` for interactive form
+         fields, and ``QPDFAnnotationObjectHelper`` for annotations. All
+         three classes are fairly sparse at the moment, but they have
+         some useful, basic functionality.
+
+      -  A new example program
+         @1@filename@1@examples/pdf-set-form-values.cc@2@filename@2@ has
+         been added that illustrates use of the new document and object
+         helpers.
+
+      -  The method ``QPDFWriter::registerProgressReporter`` has been
+         added. This method allows you to register a function that is
+         called by ``QPDFWriter`` to update your idea of the percentage
+         it thinks it is through writing its output. Client programs can
+         use this to implement reasonably accurate progress meters. The
+         @1@command@1@qpdf@2@command@2@ command line tool uses this to
+         implement its @1@option@1@--progress@2@option@2@ option.
+
+      -  New methods ``QPDFObjectHandle::newUnicodeString`` and
+         ``QPDFObject::unparseBinary`` have been added to allow for more
+         convenient creation of strings that are explicitly encoded
+         using big-endian UTF-16. This is useful for creating strings
+         that appear outside of content streams, such as labels, form
+         fields, outlines, document metadata, etc.
+
+      -  A new class ``QPDFObjectHandle::Rectangle`` has been added to
+         ease working with PDF rectangles, which are just arrays of four
+         numeric values.
+
+8.0.2: March 6, 2018
+   -  When a loop is detected while following cross reference streams or
+      tables, treat this as damage instead of silently ignoring the
+      previous table. This prevents loss of otherwise recoverable data
+      in some damaged files.
+
+   -  Properly handle pages with no contents.
+
+8.0.1: March 4, 2018
+   -  Disregard data check errors when uncompressing ``/FlateDecode``
+      streams. This is consistent with most other PDF readers and allows
+      qpdf to recover data from another class of malformed PDF files.
+
+   -  On the command line when specifying page ranges, support preceding
+      a page number by "r" to indicate that it should be counted from
+      the end. For example, the range ``r3-r1`` would indicate the last
+      three pages of a document.
+
+8.0.0: February 25, 2018
+   -  Packaging and Distribution Changes
+
+      -  QPDF is now distributed as an
+         `AppImage <https://appimage.org/>`__ in addition to all the
+         other ways it is distributed. The AppImage can be found in the
+         download area with the other packages. Thanks to Kurt Pfeifle
+         and Simon Peter for their contributions.
+
+   -  Bug Fixes
+
+      -  ``QPDFObjectHandle::getUTF8Val`` now properly treats
+         non-Unicode strings as encoded with PDF Doc Encoding.
+
+      -  Improvements to handling of objects in PDF files that are not
+         of the expected type. In most cases, qpdf will be able to warn
+         for such cases rather than fail with an exception. Previous
+         versions of qpdf would sometimes fail with errors such as
+         "operation for dictionary object attempted on object of wrong
+         type". This situation should be mostly or entirely eliminated
+         now.
+
+   -  Enhancements to the @1@command@1@qpdf@2@command@2@ Command-line
+      Tool. All new options listed here are documented in more detail in
+      `Running QPDF <#ref.using>`__.
+
+      -  The option
+         @1@option@1@--linearize-pass1=@1@replaceable@1@file@2@replaceable@2@@2@option@2@
+         has been added for debugging qpdf's linearization code.
+
+      -  The option @1@option@1@--coalesce-contents@2@option@2@ can be
+         used to combine content streams of a page whose contents are an
+         array of streams into a single stream.
+
+   -  API Enhancements. All new API calls are documented in their
+      respective classes' header files. There are no non-compatible
+      changes to the API.
+
+      -  Add function ``qpdf_check_pdf`` to the C API. This function
+         does basic checking that is a subset of what @1@command@1@qpdf
+         --check@2@command@2@ performs.
+
+      -  Major enhancements to the lexical layer of qpdf. For a complete
+         list of enhancements, please refer to the
+         @1@filename@1@ChangeLog@2@filename@2@ file. Most of the changes
+         result in improvements to qpdf's ability handle erroneous
+         files. It is also possible for programs to handle whitespace,
+         comments, and inline images as tokens.
+
+      -  New API for working with PDF content streams at a lexical
+         level. The new class ``QPDFObjectHandle::TokenFilter`` allows
+         the developer to provide token handlers. Token filters can be
+         used with several different methods in ``QPDFObjectHandle`` as
+         well as with a lower-level interface. See comments in
+         @1@filename@1@QPDFObjectHandle.hh@2@filename@2@ as well as the
+         new examples
+         @1@filename@1@examples/pdf-filter-tokens.cc@2@filename@2@ and
+         @1@filename@1@examples/pdf-count-strings.cc@2@filename@2@ for
+         details.
+
+7.1.1: February 4, 2018
+   -  Bug fix: files whose /ID fields were other than 16 bytes long can
+      now be properly linearized
+
+   -  A few compile and link issues have been corrected for some
+      platforms.
+
+7.1.0: January 14, 2018
+   -  PDF files contain streams that may be compressed with various
+      compression algorithms which, in some cases, may be enhanced by
+      various predictor functions. Previously only the PNG up predictor
+      was supported. In this version, all the PNG predictors as well as
+      the TIFF predictor are supported. This increases the range of
+      files that qpdf is able to handle.
+
+   -  QPDF now allows a raw encryption key to be specified in place of a
+      password when opening encrypted files, and will optionally display
+      the encryption key used by a file. This is a non-standard
+      operation, but it can be useful in certain situations. Please see
+      the discussion of @1@option@1@--password-is-hex-key@2@option@2@ in
+      `Basic Options <#ref.basic-options>`__ or the comments around
+      ``QPDF::setPasswordIsHexKey`` in
+      @1@filename@1@QPDF.hh@2@filename@2@ for additional details.
+
+   -  Bug fix: numbers ending with a trailing decimal point are now
+      properly recognized as numbers.
+
+   -  Bug fix: when building qpdf from source on some platforms
+      (especially MacOS), the build could get confused by older versions
+      of qpdf installed on the system. This has been corrected.
+
+7.0.0: September 15, 2017
+   -  Packaging and Distribution Changes
+
+      -  QPDF's primary license is now `version 2.0 of the Apache
+         License <http://www.apache.org/licenses/LICENSE-2.0>`__ rather
+         than version 2.0 of the Artistic License. You may still, at
+         your option, consider qpdf to be licensed with version 2.0 of
+         the Artistic license.
+
+      -  QPDF no longer has a dependency on the PCRE (Perl-Compatible
+         Regular Expression) library. QPDF now has an added dependency
+         on the JPEG library.
+
+   -  Bug Fixes
+
+      -  This release contains many bug fixes for various infinite
+         loops, memory leaks, and other memory errors that could be
+         encountered with specially crafted or otherwise erroneous PDF
+         files.
+
+   -  New Features
+
+      -  QPDF now supports reading and writing streams encoded with JPEG
+         or RunLength encoding. Library API enhancements and
+         command-line options have been added to control this behavior.
+         See command-line options
+         @1@option@1@--compress-streams@2@option@2@ and
+         @1@option@1@--decode-level@2@option@2@ and methods
+         ``QPDFWriter::setCompressStreams`` and
+         ``QPDFWriter::setDecodeLevel``.
+
+      -  QPDF is much better at recovering from broken files. In most
+         cases, qpdf will skip invalid objects and will preserve broken
+         stream data by not attempting to filter broken streams. QPDF is
+         now able to recover or at least not crash on dozens of broken
+         test files I have received over the past few years.
+
+      -  Page rotation is now supported and accessible from both the
+         library and the command line.
+
+      -  ``QPDFWriter`` supports writing files in a way that preserves
+         PCLm compliance in support of driverless printing. This is very
+         specialized and is only useful to applications that already
+         know how to create PCLm files.
+
+   -  Enhancements to the @1@command@1@qpdf@2@command@2@ Command-line
+      Tool. All new options listed here are documented in more detail in
+      `Running QPDF <#ref.using>`__.
+
+      -  Command-line arguments can now be read from files or standard
+         input using ``@file`` or ``@-`` syntax. Please see `Basic
+         Invocation <#ref.invocation>`__.
+
+      -  @1@option@1@--rotate@2@option@2@: request page rotation
+
+      -  @1@option@1@--newline-before-endstream@2@option@2@: ensure that
+         a newline appears before every ``endstream`` keyword in the
+         file; used to prevent qpdf from breaking PDF/A compliance on
+         already compliant files.
+
+      -  @1@option@1@--preserve-unreferenced@2@option@2@: preserve
+         unreferenced objects in the input PDF
+
+      -  @1@option@1@--split-pages@2@option@2@: break output into chunks
+         with fixed numbers of pages
+
+      -  @1@option@1@--verbose@2@option@2@: print the name of each
+         output file that is created
+
+      -  @1@option@1@--compress-streams@2@option@2@ and
+         @1@option@1@--decode-level@2@option@2@ replace
+         @1@option@1@--stream-data@2@option@2@ for improving granularity
+         of controlling compression and decompression of stream data.
+         The @1@option@1@--stream-data@2@option@2@ option will remain
+         available.
+
+      -  When running @1@command@1@qpdf --check@2@command@2@ with other
+         options, checks are always run first. This enables qpdf to
+         perform its full recovery logic before outputting other
+         information. This can be especially useful when manually
+         recovering broken files, looking at qpdf's regenerated cross
+         reference table, or other similar operations.
+
+      -  Process @1@command@1@--pages@2@command@2@ earlier so that other
+         options like @1@option@1@--show-pages@2@option@2@ or
+         @1@option@1@--split-pages@2@option@2@ can operate on the file
+         after page splitting/merging has occurred.
+
+   -  API Changes. All new API calls are documented in their respective
+      classes' header files.
+
+      -  ``QPDFObjectHandle::rotatePage``: apply rotation to a page
+         object
+
+      -  ``QPDFWriter::setNewlineBeforeEndstream``: force newline to
+         appear before ``endstream``
+
+      -  ``QPDFWriter::setPreserveUnreferencedObjects``: preserve
+         unreferenced objects that appear in the input PDF. The default
+         behavior is to discard them.
+
+      -  New ``Pipeline`` types ``Pl_RunLength`` and ``Pl_DCT`` are
+         available for developers who wish to produce or consume
+         RunLength or DCT stream data directly. The
+         @1@filename@1@examples/pdf-create.cc@2@filename@2@ example
+         illustrates their use.
+
+      -  ``QPDFWriter::setCompressStreams`` and
+         ``QPDFWriter::setDecodeLevel`` methods control handling of
+         different types of stream compression.
+
+      -  Add new C API functions ``qpdf_set_compress_streams``,
+         ``qpdf_set_decode_level``,
+         ``qpdf_set_preserve_unreferenced_objects``, and
+         ``qpdf_set_newline_before_endstream`` corresponding to the new
+         ``QPDFWriter`` methods.
+
+6.0.0: November 10, 2015
+   -  Implement @1@option@1@--deterministic-id@2@option@2@ command-line
+      option and ``QPDFWriter::setDeterministicID`` as well as C API
+      function ``qpdf_set_deterministic_ID`` for generating a
+      deterministic ID for non-encrypted files. When this option is
+      selected, the ID of the file depends on the contents of the output
+      file, and not on transient items such as the timestamp or output
+      file name.
+
+   -  Make qpdf more tolerant of files whose xref table entries are not
+      the correct length.
+
+5.1.3: May 24, 2015
+   -  Bug fix: fix-qdf was not properly handling files that contained
+      object streams with more than 255 objects in them.
+
+   -  Bug fix: qpdf was not properly initializing Microsoft's secure
+      crypto provider on fresh Windows installations that had not had
+      any keys created yet.
+
+   -  Fix a few errors found by Gynvael Coldwind and Mateusz Jurczyk of
+      the Google Security Team. Please see the ChangeLog for details.
+
+   -  Properly handle pages that have no contents at all. There were
+      many cases in which qpdf handled this fine, but a few methods
+      blindly obtained page contents with handling the possibility that
+      there were no contents.
+
+   -  Make qpdf more robust for a few more kinds of problems that may
+      occur in invalid PDF files.
+
+5.1.2: June 7, 2014
+   -  Bug fix: linearizing files could create a corrupted output file
+      under extremely unlikely file size circumstances. See ChangeLog
+      for details. The odds of getting hit by this are very low, though
+      one person did.
+
+   -  Bug fix: qpdf would fail to write files that had streams with
+      decode parameters referencing other streams.
+
+   -  New example program: @1@command@1@pdf-split-pages@2@command@2@:
+      efficiently split PDF files into individual pages. The example
+      program does this more efficiently than using @1@command@1@qpdf
+      --pages@2@command@2@ to do it.
+
+   -  Packaging fix: Visual C++ binaries did not support Windows XP.
+      This has been rectified by updating the compilers used to generate
+      the release binaries.
+
+5.1.1: January 14, 2014
+   -  Performance fix: copying foreign objects could be very slow with
+      certain types of files. This was most likely to be visible during
+      page splitting and was due to traversing the same objects multiple
+      times in some cases.
+
+5.1.0: December 17, 2013
+   -  Added runtime option (``QUtil::setRandomDataProvider``) to supply
+      your own random data provider. You can use this if you want to
+      avoid using the OS-provided secure random number generation
+      facility or stdlib's less secure version. See comments in
+      include/qpdf/QUtil.hh for details.
+
+   -  Fixed image comparison tests to not create 12-bit-per-pixel images
+      since some versions of tiffcmp have bugs in comparing them in some
+      cases. This increases the disk space required by the image
+      comparison tests, which are off by default anyway.
+
+   -  Introduce a number of small fixes for compilation on the latest
+      clang in MacOS and the latest Visual C++ in Windows.
+
+   -  Be able to handle broken files that end the xref table header with
+      a space instead of a newline.
+
+5.0.1: October 18, 2013
+   -  Thanks to a detailed review by Florian Weimer and the Red Hat
+      Product Security Team, this release includes a number of
+      non-user-visible security hardening changes. Please see the
+      ChangeLog file in the source distribution for the complete list.
+
+   -  When available, operating system-specific secure random number
+      generation is used for generating initialization vectors and other
+      random values used during encryption or file creation. For the
+      Windows build, this results in an added dependency on Microsoft's
+      cryptography API. To disable the OS-specific cryptography and use
+      the old version, pass the
+      @1@option@1@--enable-insecure-random@2@option@2@ option to
+      @1@command@1@./configure@2@command@2@.
+
+   -  The @1@command@1@qpdf@2@command@2@ command-line tool now issues a
+      warning when @1@option@1@-accessibility=n@2@option@2@ is specified
+      for newer encryption versions stating that the option is ignored.
+      qpdf, per the spec, has always ignored this flag, but it
+      previously did so silently. This warning is issued only by the
+      command-line tool, not by the library. The library's handling of
+      this flag is unchanged.
+
+5.0.0: July 10, 2013
+   -  Bug fix: previous versions of qpdf would lose objects with
+      generation != 0 when generating object streams. Fixing this
+      required changes to the public API.
+
+   -  Removed methods from public API that were only supposed to be
+      called by QPDFWriter and couldn't realistically be called anywhere
+      else. See ChangeLog for details.
+
+   -  New ``QPDFObjGen`` class added to represent an object
+      ID/generation pair. ``QPDFObjectHandle::getObjGen()`` is now
+      preferred over ``QPDFObjectHandle::getObjectID()`` and
+      ``QPDFObjectHandle::getGeneration()`` as it makes it less likely
+      for people to accidentally write code that ignores the generation
+      number. See @1@filename@1@QPDF.hh@2@filename@2@ and
+      @1@filename@1@QPDFObjectHandle.hh@2@filename@2@ for additional
+      notes.
+
+   -  Add @1@option@1@--show-npages@2@option@2@ command-line option to
+      the @1@command@1@qpdf@2@command@2@ command to show the number of
+      pages in a file.
+
+   -  Allow omission of the page range within
+      @1@option@1@--pages@2@option@2@ for the
+      @1@command@1@qpdf@2@command@2@ command. When omitted, the page
+      range is implicitly taken to be all the pages in the file.
+
+   -  Various enhancements were made to support different types of
+      broken files or broken readers. Details can be found in
+      @1@filename@1@ChangeLog@2@filename@2@.
+
+4.1.0: April 14, 2013
+   -  Note to people including qpdf in distributions: the
+      @1@filename@1@.la@2@filename@2@ files generated by libtool are now
+      installed by qpdf's @1@command@1@make install@2@command@2@ target.
+      Before, they were not installed. This means that if your
+      distribution does not want to include
+      @1@filename@1@.la@2@filename@2@ files, you must remove them as
+      part of your packaging process.
+
+   -  Major enhancement: API enhancements have been made to support
+      parsing of content streams. This enhancement includes the
+      following changes:
+
+      -  ``QPDFObjectHandle::parseContentStream`` method parses objects
+         in a content stream and calls handlers in a callback class. The
+         example
+         @1@filename@1@examples/pdf-parse-content.cc@2@filename@2@
+         illustrates how this may be used.
+
+      -  ``QPDFObjectHandle`` can now represent operators and inline
+         images, object types that may only appear in content streams.
+
+      -  Method ``QPDFObjectHandle::getTypeCode()`` returns an
+         enumerated type value representing the underlying object type.
+         Method ``QPDFObjectHandle::getTypeName()`` returns a text
+         string describing the name of the type of a
+         ``QPDFObjectHandle`` object. These methods can be used for more
+         efficient parsing and debugging/diagnostic messages.
+
+   -  @1@command@1@qpdf --check@2@command@2@ now parses all pages'
+      content streams in addition to doing other checks. While there are
+      still many types of errors that cannot be detected, syntactic
+      errors in content streams will now be reported.
+
+   -  Minor compilation enhancements have been made to facilitate easier
+      for support for a broader range of compilers and compiler
+      versions.
+
+      -  Warning flags have been moved into a separate variable in
+         @1@filename@1@autoconf.mk@2@filename@2@
+
+      -  The configure flag @1@option@1@--enable-werror@2@option@2@ work
+         for Microsoft compilers
+
+      -  All MSVC CRT security warnings have been resolved.
+
+      -  All C-style casts in C++ Code have been replaced by C++ casts,
+         and many casts that had been included to suppress higher
+         warning levels for some compilers have been removed, primarily
+         for clarity. Places where integer type coercion occurs have
+         been scrutinized. A new casting policy has been documented in
+         the manual. This is of concern mainly to people porting qpdf to
+         new platforms or compilers. It is not visible to programmers
+         writing code that uses the library
+
+      -  Some internal limits have been removed in code that converts
+         numbers to strings. This is largely invisible to users, but it
+         does trigger a bug in some older versions of mingw-w64's C++
+         library. See @1@filename@1@README-windows.md@2@filename@2@ in
+         the source distribution if you think this may affect you. The
+         copy of the DLL distributed with qpdf's binary distribution is
+         not affected by this problem.
+
+   -  The RPM spec file previously included with qpdf has been removed.
+      This is because virtually all Linux distributions include qpdf now
+      that it is a dependency of CUPS filters.
+
+   -  A few bug fixes are included:
+
+      -  Overridden compressed objects are properly handled. Before,
+         there were certain constructs that could cause qpdf to see old
+         versions of some objects. The most usual manifestation of this
+         was loss of filled in form values for certain files.
+
+      -  Installation no longer uses GNU/Linux-specific versions of some
+         commands, so @1@command@1@make install@2@command@2@ works on
+         Solaris with native tools.
+
+      -  The 64-bit mingw Windows binary package no longer includes a
+         32-bit DLL.
+
+4.0.1: January 17, 2013
+   -  Fix detection of binary attachments in test suite to avoid false
+      test failures on some platforms.
+
+   -  Add clarifying comment in @1@filename@1@QPDF.hh@2@filename@2@ to
+      methods that return the user password explaining that it is no
+      longer possible with newer encryption formats to recover the user
+      password knowing the owner password. In earlier encryption
+      formats, the user password was encrypted in the file using the
+      owner password. In newer encryption formats, a separate encryption
+      key is used on the file, and that key is independently encrypted
+      using both the user password and the owner password.
+
+4.0.0: December 31, 2012
+   -  Major enhancement: support has been added for newer encryption
+      schemes supported by version X of Adobe Acrobat. This includes use
+      of 127-character passwords, 256-bit encryption keys, and the
+      encryption scheme specified in ISO 32000-2, the PDF 2.0
+      specification. This scheme can be chosen from the command line by
+      specifying use of 256-bit keys. qpdf also supports the deprecated
+      encryption method used by Acrobat IX. This encryption style has
+      known security weaknesses and should not be used in practice.
+      However, such files exist "in the wild," so support for this
+      scheme is still useful. New methods
+      ``QPDFWriter::setR6EncryptionParameters`` (for the PDF 2.0 scheme)
+      and ``QPDFWriter::setR5EncryptionParameters`` (for the deprecated
+      scheme) have been added to enable these new encryption schemes.
+      Corresponding functions have been added to the C API as well.
+
+   -  Full support for Adobe extension levels in PDF version
+      information. Starting with PDF version 1.7, corresponding to ISO
+      32000, Adobe adds new functionality by increasing the extension
+      level rather than increasing the version. This support includes
+      addition of the ``QPDF::getExtensionLevel`` method for retrieving
+      the document's extension level, addition of versions of
+      ``QPDFWriter::setMinimumPDFVersion`` and
+      ``QPDFWriter::forcePDFVersion`` that accept an extension level,
+      and extended syntax for specifying forced and minimum versions on
+      the command line as described in `Advanced Transformation
+      Options <#ref.advanced-transformation>`__. Corresponding functions
+      have been added to the C API as well.
+
+   -  Minor fixes to prevent qpdf from referencing objects in the file
+      that are not referenced in the file's overall structure. Most
+      files don't have any such objects, but some files have contain
+      unreferenced objects with errors, so these fixes prevent qpdf from
+      needlessly rejecting or complaining about such objects.
+
+   -  Add new generalized methods for reading and writing files from/to
+      programmer-defined sources. The method
+      ``QPDF::processInputSource`` allows the programmer to use any
+      input source for the input file, and
+      ``QPDFWriter::setOutputPipeline`` allows the programmer to write
+      the output file through any pipeline. These methods would make it
+      possible to perform any number of specialized operations, such as
+      accessing external storage systems, creating bindings for qpdf in
+      other programming languages that have their own I/O systems, etc.
+
+   -  Add new method ``QPDF::getEncryptionKey`` for retrieving the
+      underlying encryption key used in the file.
+
+   -  This release includes a small handful of non-compatible API
+      changes. While effort is made to avoid such changes, all the
+      non-compatible API changes in this version were to parts of the
+      API that would likely never be used outside the library itself. In
+      all cases, the altered methods or structures were parts of the
+      ``QPDF`` that were public to enable them to be called from either
+      ``QPDFWriter`` or were part of validation code that was
+      over-zealous in reporting problems in parts of the file that would
+      not ordinarily be referenced. In no case did any of the removed
+      methods do anything worse that falsely report error conditions in
+      files that were broken in ways that didn't matter. The following
+      public parts of the ``QPDF`` class were changed in a
+      non-compatible way:
+
+      -  Updated nested ``QPDF::EncryptionData`` class to add fields
+         needed by the newer encryption formats, member variables
+         changed to private so that future changes will not require
+         breaking backward compatibility.
+
+      -  Added additional parameters to ``compute_data_key``, which is
+         used by ``QPDFWriter`` to compute the encryption key used to
+         encrypt a specific object.
+
+      -  Removed the method ``flattenScalarReferences``. This method was
+         previously used prior to writing a new PDF file, but it has the
+         undesired side effect of causing qpdf to read objects in the
+         file that were not referenced. Some otherwise files have
+         unreferenced objects with errors in them, so this could cause
+         qpdf to reject files that would be accepted by virtually all
+         other PDF readers. In fact, qpdf relied on only a very small
+         part of what flattenScalarReferences did, so only this part has
+         been preserved, and it is now done directly inside
+         ``QPDFWriter``.
+
+      -  Removed the method ``decodeStreams``. This method was used by
+         the @1@option@1@--check@2@option@2@ option of the
+         @1@command@1@qpdf@2@command@2@ command-line tool to force all
+         streams in the file to be decoded, but it also suffered from
+         the problem of opening otherwise unreferenced streams and thus
+         could report false positive. The
+         @1@option@1@--check@2@option@2@ option now causes qpdf to go
+         through all the motions of writing a new file based on the
+         original one, so it will always reference and check exactly
+         those parts of a file that any ordinary viewer would check.
+
+      -  Removed the method ``trimTrailerForWrite``. This method was
+         used by ``QPDFWriter`` to modify the original QPDF object by
+         removing fields from the trailer dictionary that wouldn't apply
+         to the newly written file. This functionality, though generally
+         harmless, was a poor implementation and has been replaced by
+         having QPDFWriter filter these out when copying the trailer
+         rather than modifying the original QPDF object. (Note that qpdf
+         never modifies the original file itself.)
+
+   -  Allow the PDF header to appear anywhere in the first 1024 bytes of
+      the file. This is consistent with what other readers do.
+
+   -  Fix the @1@command@1@pkg-config@2@command@2@ files to list zlib
+      and pcre in ``Requires.private`` to better support static linking
+      using @1@command@1@pkg-config@2@command@2@.
+
+3.0.2: September 6, 2012
+   -  Bug fix: ``QPDFWriter::setOutputMemory`` did not work when not
+      used with ``QPDFWriter::setStaticID``, which made it pretty much
+      useless. This has been fixed.
+
+   -  New API call ``QPDFWriter::setExtraHeaderText`` inserts additional
+      text near the header of the PDF file. The intended use case is to
+      insert comments that may be consumed by a downstream application,
+      though other use cases may exist.
+
+3.0.1: August 11, 2012
+   -  Version 3.0.0 included addition of files for
+      @1@command@1@pkg-config@2@command@2@, but this was not mentioned
+      in the release notes. The release notes for 3.0.0 were updated to
+      mention this.
+
+   -  Bug fix: if an object stream ended with a scalar object not
+      followed by space, qpdf would incorrectly report that it
+      encountered a premature EOF. This bug has been in qpdf since
+      version 2.0.
+
+3.0.0: August 2, 2012
+   -  Acknowledgment: I would like to express gratitude for the
+      contributions of Tobias Hoffmann toward the release of qpdf
+      version 3.0. He is responsible for most of the implementation and
+      design of the new API for manipulating pages, and contributed code
+      and ideas for many of the improvements made in version 3.0.
+      Without his work, this release would certainly not have happened
+      as soon as it did, if at all.
+
+   -  *Non-compatible API change:* The version of
+      ``QPDFObjectHandle::replaceStreamData`` that uses a
+      ``StreamDataProvider`` no longer requires (or accepts) a
+      ``length`` parameter. See
+      `appendix_title <#ref.upgrading-to-3.0>`__ for an explanation.
+      While care is taken to avoid non-compatible API changes in
+      general, an exception was made this time because the new interface
+      offers an opportunity to significantly simplify calling code.
+
+   -  Support has been added for large files. The test suite verifies
+      support for files larger than 4 gigabytes, and manual testing has
+      verified support for files larger than 10 gigabytes. Large file
+      support is available for both 32-bit and 64-bit platforms as long
+      as the compiler and underlying platforms support it.
+
+   -  Support for page selection (splitting and merging PDF files) has
+      been added to the @1@command@1@qpdf@2@command@2@ command-line
+      tool. See `Page Selection Options <#ref.page-selection>`__.
+
+   -  Options have been added to the @1@command@1@qpdf@2@command@2@
+      command-line tool for copying encryption parameters from another
+      file. See `Basic Options <#ref.basic-options>`__.
+
+   -  New methods have been added to the ``QPDF`` object for adding and
+      removing pages. See `Adding and Removing
+      Pages <#ref.adding-and-remove-pages>`__.
+
+   -  New methods have been added to the ``QPDF`` object for copying
+      objects from other PDF files. See `Copying Objects From Other PDF
+      Files <#ref.foreign-objects>`__
+
+   -  A new method ``QPDFObjectHandle::parse`` has been added for
+      constructing ``QPDFObjectHandle`` objects from a string
+      description.
+
+   -  Methods have been added to ``QPDFWriter`` to allow writing to an
+      already open stdio ``FILE*`` addition to writing to standard
+      output or a named file. Methods have been added to ``QPDF`` to be
+      able to process a file from an already open stdio ``FILE*``. This
+      makes it possible to read and write PDF from secure temporary
+      files that have been unlinked prior to being fully read or
+      written.
+
+   -  The ``QPDF::emptyPDF`` can be used to allow creation of PDF files
+      from scratch. The example
+      @1@filename@1@examples/pdf-create.cc@2@filename@2@ illustrates how
+      it can be used.
+
+   -  Several methods to take ``PointerHolder<Buffer>`` can now also
+      accept ``std::string`` arguments.
+
+   -  Many new convenience methods have been added to the library, most
+      in ``QPDFObjectHandle``. See @1@filename@1@ChangeLog@2@filename@2@
+      for a full list.
+
+   -  When building on a platform that supports ELF shared libraries
+      (such as Linux), symbol versions are enabled by default. They can
+      be disabled by passing
+      @1@option@1@--disable-ld-version-script@2@option@2@ to
+      @1@command@1@./configure@2@command@2@.
+
+   -  The file @1@filename@1@libqpdf.pc@2@filename@2@ is now installed
+      to support @1@command@1@pkg-config@2@command@2@.
+
+   -  Image comparison tests are off by default now since they are not
+      needed to verify a correct build or port of qpdf. They are needed
+      only when changing the actual PDF output generated by qpdf. You
+      should enable them if you are making deep changes to qpdf itself.
+      See @1@filename@1@README.md@2@filename@2@ for details.
+
+   -  Large file tests are off by default but can be turned on with
+      @1@command@1@./configure@2@command@2@ or by setting an environment
+      variable before running the test suite. See
+      @1@filename@1@README.md@2@filename@2@ for details.
+
+   -  When qpdf's test suite fails, failures are not printed to the
+      terminal anymore by default. Instead, find them in
+      @1@filename@1@build/qtest.log@2@filename@2@. For packagers who are
+      building with an autobuilder, you can add the
+      @1@option@1@--enable-show-failed-test-output@2@option@2@ option to
+      @1@command@1@./configure@2@command@2@ to restore the old behavior.
+
+2.3.1: December 28, 2011
+   -  Fix thread-safety problem resulting from non-thread-safe use of
+      the PCRE library.
+
+   -  Made a few minor documentation fixes.
+
+   -  Add workaround for a bug that appears in some versions of
+      ghostscript to the test suite
+
+   -  Fix minor build issue for Visual C++ 2010.
+
+2.3.0: August 11, 2011
+   -  Bug fix: when preserving existing encryption on encrypted files
+      with cleartext metadata, older qpdf versions would generate
+      password-protected files with no valid password. This operation
+      now works. This bug only affected files created by copying
+      existing encryption parameters; explicit encryption with
+      specification of cleartext metadata worked before and continues to
+      work.
+
+   -  Enhance ``QPDFWriter`` with a new constructor that allows you to
+      delay the specification of the output file. When using this
+      constructor, you may now call ``QPDFWriter::setOutputFilename`` to
+      specify the output file, or you may use
+      ``QPDFWriter::setOutputMemory`` to cause ``QPDFWriter`` to write
+      the resulting PDF file to a memory buffer. You may then use
+      ``QPDFWriter::getBuffer`` to retrieve the memory buffer.
+
+   -  Add new API call ``QPDF::replaceObject`` for replacing objects by
+      object ID
+
+   -  Add new API call ``QPDF::swapObjects`` for swapping two objects by
+      object ID
+
+   -  Add ``QPDFObjectHandle::getDictAsMap`` and
+      ``QPDFObjectHandle::getArrayAsVector`` to allow retrieval of
+      dictionary objects as maps and array objects as vectors.
+
+   -  Add functions ``qpdf_get_info_key`` and ``qpdf_set_info_key`` to
+      the C API for manipulating string fields of the document's
+      ``/Info`` dictionary.
+
+   -  Add functions ``qpdf_init_write_memory``,
+      ``qpdf_get_buffer_length``, and ``qpdf_get_buffer`` to the C API
+      for writing PDF files to a memory buffer instead of a file.
+
+2.2.4: June 25, 2011
+   -  Fix installation and compilation issues; no functionality changes.
+
+2.2.3: April 30, 2011
+   -  Handle some damaged streams with incorrect characters following
+      the stream keyword.
+
+   -  Improve handling of inline images when normalizing content
+      streams.
+
+   -  Enhance error recovery to properly handle files that use object 0
+      as a regular object, which is specifically disallowed by the spec.
+
+2.2.2: October 4, 2010
+   -  Add new function ``qpdf_read_memory`` to the C API to call
+      ``QPDF::processMemoryFile``. This was an omission in qpdf 2.2.1.
+
+2.2.1: October 1, 2010
+   -  Add new method ``QPDF::setOutputStreams`` to replace ``std::cout``
+      and ``std::cerr`` with other streams for generation of diagnostic
+      messages and error messages. This can be useful for GUIs or other
+      applications that want to capture any output generated by the
+      library to present to the user in some other way. Note that QPDF
+      does not write to ``std::cout`` (or the specified output stream)
+      except where explicitly mentioned in
+      @1@filename@1@QPDF.hh@2@filename@2@, and that the only use of the
+      error stream is for warnings. Note also that output of warnings is
+      suppressed when ``setSuppressWarnings(true)`` is called.
+
+   -  Add new method ``QPDF::processMemoryFile`` for operating on PDF
+      files that are loaded into memory rather than in a file on disk.
+
+   -  Give a warning but otherwise ignore empty PDF objects by treating
+      them as null. Empty object are not permitted by the PDF
+      specification but have been known to appear in some actual PDF
+      files.
+
+   -  Handle inline image filter abbreviations when the appear as stream
+      filter abbreviations. The PDF specification does not allow use of
+      stream filter abbreviations in this way, but Adobe Reader and some
+      other PDF readers accept them since they sometimes appear
+      incorrectly in actual PDF files.
+
+   -  Implement miscellaneous enhancements to ``PointerHolder`` and
+      ``Buffer`` to support other changes.
+
+2.2.0: August 14, 2010
+   -  Add new methods to ``QPDFObjectHandle`` (``newStream`` and
+      ``replaceStreamData`` for creating new streams and replacing
+      stream data. This makes it possible to perform a wide range of
+      operations that were not previously possible.
+
+   -  Add new helper method in ``QPDFObjectHandle``
+      (``addPageContents``) for appending or prepending new content
+      streams to a page. This method makes it possible to manipulate
+      content streams without having to be concerned whether a page's
+      contents are a single stream or an array of streams.
+
+   -  Add new method in ``QPDFObjectHandle``: ``replaceOrRemoveKey``,
+      which replaces a dictionary key with a given value unless the
+      value is null, in which case it removes the key instead.
+
+   -  Add new method in ``QPDFObjectHandle``: ``getRawStreamData``,
+      which returns the raw (unfiltered) stream data into a buffer. This
+      complements the ``getStreamData`` method, which returns the
+      filtered (uncompressed) stream data and can only be used when the
+      stream's data is filterable.
+
+   -  Provide two new examples:
+      @1@command@1@pdf-double-page-size@2@command@2@ and
+      @1@command@1@pdf-invert-images@2@command@2@ that illustrate the
+      newly added interfaces.
+
+   -  Fix a memory leak that would cause loss of a few bytes for every
+      object involved in a cycle of object references. Thanks to Jian Ma
+      for calling my attention to the leak.
+
+2.1.5: April 25, 2010
+   -  Remove restriction of file identifier strings to 16 bytes. This
+      unnecessary restriction was preventing qpdf from being able to
+      encrypt or decrypt files with identifier strings that were not
+      exactly 16 bytes long. The specification imposes no such
+      restriction.
+
+2.1.4: April 18, 2010
+   -  Apply the same padding calculation fix from version 2.1.2 to the
+      main cross reference stream as well.
+
+   -  Since @1@command@1@qpdf --check@2@command@2@ only performs limited
+      checks, clarify the output to make it clear that there still may
+      be errors that qpdf can't check. This should make it less
+      surprising to people when another PDF reader is unable to read a
+      file that qpdf thinks is okay.
+
+2.1.3: March 27, 2010
+   -  Fix bug that could cause a failure when rewriting PDF files that
+      contain object streams with unreferenced objects that in turn
+      reference indirect scalars.
+
+   -  Don't complain about (invalid) AES streams that aren't a multiple
+      of 16 bytes. Instead, pad them before decrypting.
+
+2.1.2: January 24, 2010
+   -  Fix bug in padding around first half cross reference stream in
+      linearized files. The bug could cause an assertion failure when
+      linearizing certain unlucky files.
+
+2.1.1: December 14, 2009
+   -  No changes in functionality; insert missing include in an internal
+      library header file to support gcc 4.4, and update test suite to
+      ignore broken Adobe Reader installations.
+
+2.1: October 30, 2009
+   -  This is the first version of qpdf to include Windows support. On
+      Windows, it is possible to build a DLL. Additionally, a partial
+      C-language API has been introduced, which makes it possible to
+      call qpdf functions from non-C++ environments. I am very grateful
+      to Žarko Gajić (http://zarko-gajic.iz.hr/) for tirelessly testing
+      numerous pre-release versions of this DLL and providing many
+      excellent suggestions on improving the interface.
+
+      For programming to the C interface, please see the header file
+      @1@filename@1@qpdf/qpdf-c.h@2@filename@2@ and the example
+      @1@filename@1@examples/pdf-linearize.c@2@filename@2@.
+
+   -  Žarko Gajić has written a Delphi wrapper for qpdf, which can be
+      downloaded from qpdf's download side. Žarko's Delphi wrapper is
+      released with the same licensing terms as qpdf itself and comes
+      with this disclaimer: "Delphi wrapper unit
+      @1@filename@1@qpdf.pas@2@filename@2@ created by Žarko Gajić
+      (http://zarko-gajic.iz.hr/). Use at your own risk and for whatever
+      purpose you want. No support is provided. Sample code is
+      provided."
+
+   -  Support has been added for AES encryption and crypt filters.
+      Although qpdf does not presently support files that use PKI-based
+      encryption, with the addition of AES and crypt filters, qpdf is
+      now be able to open most encrypted files created with newer
+      versions of Acrobat or other PDF creation software. Note that I
+      have not been able to get very many files encrypted in this way,
+      so it's possible there could still be some cases that qpdf can't
+      handle. Please report them if you find them.
+
+   -  Many error messages have been improved to include more information
+      in hopes of making qpdf a more useful tool for PDF experts to use
+      in manually recovering damaged PDF files.
+
+   -  Attempt to avoid compressing metadata streams if possible. This is
+      consistent with other PDF creation applications.
+
+   -  Provide new command-line options for AES encrypt, cleartext
+      metadata, and setting the minimum and forced PDF versions of
+      output files.
+
+   -  Add additional methods to the ``QPDF`` object for querying the
+      document's permissions. Although qpdf does not enforce these
+      permissions, it does make them available so that applications that
+      use qpdf can enforce permissions.
+
+   -  The @1@option@1@--check@2@option@2@ option to
+      @1@command@1@qpdf@2@command@2@ has been extended to include some
+      additional information.
+
+   -  There have been a handful of non-compatible API changes. For
+      details, see `appendix_title <#ref.upgrading-to-2.1>`__.
+
+2.0.6: May 3, 2009
+   -  Do not attempt to uncompress streams that have decode parameters
+      we don't recognize. Earlier versions of qpdf would have rejected
+      files with such streams.
+
+2.0.5: March 10, 2009
+   -  Improve error handling in the LZW decoder, and fix a small error
+      introduced in the previous version with regard to handling full
+      tables. The LZW decoder has been more strongly verified in this
+      release.
+
+2.0.4: February 21, 2009
+   -  Include proper support for LZW streams encoded without the "early
+      code change" flag. Special thanks to Atom Smasher who reported the
+      problem and provided an input file compressed in this way, which I
+      did not previously have.
+
+   -  Implement some improvements to file recovery logic.
+
+2.0.3: February 15, 2009
+   -  Compile cleanly with gcc 4.4.
+
+   -  Handle strings encoded as UTF-16BE properly.
+
+2.0.2: June 30, 2008
+   -  Update test suite to work properly with a
+      non-@1@command@1@bash@2@command@2@
+      @1@filename@1@/bin/sh@2@filename@2@ and with Perl 5.10. No changes
+      were made to the actual qpdf source code itself for this release.
+
+2.0.1: May 6, 2008
+   -  No changes in functionality or interface. This release includes
+      fixes to the source code so that qpdf compiles properly and passes
+      its test suite on a broader range of platforms. See
+      @1@filename@1@ChangeLog@2@filename@2@ in the source distribution
+      for details.
+
+2.0: April 29, 2008
+   -  First public release.
+
+.. _ref.upgrading-to-2.1:
+
+Upgrading from 2.0 to 2.1
+=========================
+
+Although, as a general rule, we like to avoid introducing source-level
+incompatibilities in qpdf's interface, there were a few non-compatible
+changes made in this version. A considerable amount of source code that
+uses qpdf will probably compile without any changes, but in some cases,
+you may have to update your code. The changes are enumerated here. There
+are also some new interfaces; for those, please refer to the header
+files.
+
+-  QPDF's exception handling mechanism now uses ``std::logic_error`` for
+   internal errors and ``std::runtime_error`` for runtime errors in
+   favor of the now removed ``QEXC`` classes used in previous versions.
+   The ``QEXC`` exception classes predated the addition of the
+   @1@filename@1@<stdexcept>@2@filename@2@ header file to the C++
+   standard library. Most of the exceptions thrown by the qpdf library
+   itself are still of type ``QPDFExc`` which is now derived from
+   ``std::runtime_error``. Programs that caught an instance of
+   ``std::exception`` and displayed it by calling the ``what()`` method
+   will not need to be changed.
+
+-  The ``QPDFExc`` class now internally represents various fields of the
+   error condition and provides interfaces for querying them. Among the
+   fields is a numeric error code that can help applications act
+   differently on (a small number of) different error conditions. See
+   @1@filename@1@QPDFExc.hh@2@filename@2@ for details.
+
+-  Warnings can be retrieved from qpdf as instances of ``QPDFExc``
+   instead of strings.
+
+-  The nested ``QPDF::EncryptionData`` class's constructor takes an
+   additional argument. This class is primarily intended to be used by
+   ``QPDFWriter``. There's not really anything useful an end-user
+   application could do with it. It probably shouldn't really be part of
+   the public interface to begin with. Likewise, some of the methods for
+   computing internal encryption dictionary parameters have changed to
+   support ``/R=4`` encryption.
+
+-  The method ``QPDF::getUserPassword`` has been removed since it didn't
+   do what people would think it did. There are now two new methods:
+   ``QPDF::getPaddedUserPassword`` and ``QPDF::getTrimmedUserPassword``.
+   The first one does what the old ``QPDF::getUserPassword`` method used
+   to do, which is to return the password with possible binary padding
+   as specified by the PDF specification. The second one returns a
+   human-readable password string.
+
+-  The enumerated types that used to be nested in ``QPDFWriter`` have
+   moved to top-level enumerated types and are now defined in the file
+   @1@filename@1@qpdf/Constants.h@2@filename@2@. This enables them to be
+   shared by both the C and C++ interfaces.
+
+.. _ref.upgrading-to-3.0:
+
+Upgrading to 3.0
+================
+
+For the most part, the API for qpdf version 3.0 is backward compatible
+with versions 2.1 and later. There are two exceptions:
+
+-  The method ``QPDFObjectHandle::replaceStreamData`` that uses a
+   ``StreamDataProvider`` to provide the stream data no longer takes a
+   ``length`` parameter. While it would have been easy enough to keep
+   the parameter for backward compatibility, in this case, the parameter
+   was removed since this provides the user an opportunity to simplify
+   the calling code. This method was introduced in version 2.2. At the
+   time, the ``length`` parameter was required in order to ensure that
+   calls to the stream data provider returned the same length for a
+   specific stream every time they were invoked. In particular, the
+   linearization code depends on this. Instead, qpdf 3.0 and newer check
+   for that constraint explicitly. The first time the stream data
+   provider is called for a specific stream, the actual length is saved,
+   and subsequent calls are required to return the same number of bytes.
+   This means the calling code no longer has to compute the length in
+   advance, which can be a significant simplification. If your code
+   fails to compile because of the extra argument and you don't want to
+   make other changes to your code, just omit the argument.
+
+-  Many methods take ``long long`` instead of other integer types. Most
+   if not all existing code should compile fine with this change since
+   such parameters had always previously been smaller types. This change
+   was required to support files larger than two gigabytes in size.
+
+.. _ref.upgrading-to-4.0:
+
+Upgrading to 4.0
+================
+
+While version 4.0 includes a few non-compatible API changes, it is very
+unlikely that anyone's code would have used any of those parts of the
+API since they generally required information that would only be
+available inside the library. In the unlikely event that you should run
+into trouble, please see the ChangeLog. See also
+`appendix_title <#ref.release-notes>`__ for a complete list of the
+non-compatible API changes made in this version.
+
+
+
 Indices and tables
 ==================