Cookbook
Copy-paste Rust recipes for signing PDFs with Mudrit in your own project, grouped by category
The cookbook is a set of copy-paste Rust recipes. Each one is a self-contained snippet you drop
straight into your own project — use mudrit::prelude::*;, point it at your DSC and input PDF,
handle the Result — not a program you have to check out and run. The recipes are grouped by
category below.
Copy-paste recipes — the runnable programs ship with the source bundle
Every recipe on these pages is a self-contained snippet for your own project: paste it in, swap
the placeholder paths for your DSC and input PDF, and handle the ?. Mudrit is a proprietary
SDK — the full runnable example programs (one .rs per recipe) and the verification harness
are not part of this public documentation and are not needed to use the SDK; they ship only with the
licensed source bundle. Where a recipe cites a repo example name (e.g. sign_pfx), that is an
optional pointer for licensees and internal readers who have the bundle — you never need it to copy
the recipe.
How the recipes are written
Every recipe imports the facade prelude and uses realistic variable names and placeholder paths:
use mudrit::prelude::*;
let signer = PfxSigner::from_file("signer.pfx", "password")?; // your DSC — file / token / store
let pdf = std::fs::read("input.pdf")?; // the document you want to sign
let cfg = SignConfig::builder()
.place("L", [350, 60, 560, 160])?
.reason("Approved")
.build();
let signed = sign_pdf(&pdf, &signer, &cfg)?;
std::fs::write("signed.pdf", &signed)?;Swapping the key source (PfxSigner → Pkcs11Signer → WinStoreSigner → your own Signer) is the
only change needed to sign from a token, the Windows store, or a cloud KMS — the SignConfig and the
sign_pdf call stay identical. See Signing Backends.
For licensees with the source bundle
Each recipe cites a repo example name (e.g. sign_pfx). If you hold the licensed source bundle, run
any of them from the workspace root as a normal Cargo example — cargo run -p mudrit --example sign_pfx — using the bundled samples/ fixtures. These programs are a convenience for validating
the engine, not a prerequisite for integrating the SDK.
Bundled test fixtures (source bundle)
The example programs in the source bundle read their inputs from a workspace-root samples/
directory and write outputs to temp/. If you have the bundle, these are the fixtures they use; if
you don't, they are simply the stand-ins the recipes reference — substitute your own files.
| File | What it is |
|---|---|
ABC12.pfx | RSA test cert, password ABC12 ("DS TEST CERTIFICATE 06") — the default signer in most examples |
ecdsa-p256.pfx / ecdsa-p384.pfx / ecdsa-p521.pfx | ECDSA test certs on each NIST curve, password ecdsa |
blank.pdf | one-page blank PDF, the default signing target |
10-pg-blank.pdf | ten-page blank PDF, used by multi-page / placement recipes |
test_protected.pdf | password-protected PDF, open password asd — used by the encrypted-input recipes |
Test certificate only
ABC12.pfx and the ecdsa-*.pfx files are TEST certificates, bundled only so the source-bundle
programs and test suite run out of the box. Never use them for a real signature — in your own project
supply your own DSC (a .pfx / .p12, a PKCS#11 token, or a Windows-store certificate).
Internal SDK validation
Beyond the per-recipe programs, the source bundle also carries an internal verification harness —
a 65-scenario matrix run against every keystore and every algorithm, writing one PDF per scenario
into temp/<keystore>/<mechanism>/. That harness is a tool for SDK developers validating the engine,
not something integrators run. It is documented, for completeness, in the
Advanced page's Internal section.
Browse by category
Basics
Minimal sign, placement, metadata, digest/algorithm selection, batch, size tuning.
Integration & Server
Detached CMS, deferred (hash-then-sign), existing fields, seed values, LTV, batch, async.
Signature Shapes
Single / multi / chained signatures, certification, field-lock, multi-party workflows.
Encryption
Sign a protected PDF, protect the output, AES-256.
Inspection & Key Selection
Certificate parsing, filtering, and typed error handling — offline, no signing.
Advanced (Network / Hardware)
PAdES levels, PDF/A, custom TSA, Windows store, PKCS#11 tokens, SoftHSM diagnostics.
Independently Usable Crates
Each crate — mudrit-keystore, mudrit-pdfsign — used entirely on its own.