Getting Started

Mudrit is a pure-Rust PDF digital-signing SDK, split into a key-management layer and a PDF-signing layer joined by one small Signer trait. This page gets you from zero to a signed PDF.

Install

Add the all-in-one facade crate, mudrit — it re-exports both layers behind use mudrit::prelude::*;. Pick the delivery method that matches your licence:

[dependencies]
# default features = ["pfx", "pkcs11", "winstore"]
mudrit = { git = "ssh://git@git.trexolab.com/trexolab/mudrit.git", tag = "v0.1.0" }

[registries.trexolab]
index = "sparse+https://cargo.trexolab.com/index/"   # provided with your licence

[dependencies]
mudrit = { version = "0.1", registry = "trexolab" }

[dependencies]
# point at the licensed source bundle you received
mudrit = { path = "vendor/mudrit/crates/mudrit" }

Prefer the sub-crates directly for a leaner build: mudrit-keystore for pure key management (no PDF engine) or mudrit-pdfsign for the engine with your own Signer. See Architecture for how the crates relate.

Choose your features

Cargo features decide what actually compiles, so you never pay for a backend you don't use. The GUI and native-viewer stacks are opt-in.

mudrit = { git = "ssh://git@git.trexolab.com/trexolab/mudrit.git", tag = "v0.1.0", default-features = false, features = ["pfx"] }

The full feature reference lists every feature, its crate, and its extra dependencies.

Sign your first PDF

use mudrit::prelude::*;

let signer = PfxSigner::from_file("cert.pfx", "password")?;

let cfg = SignConfig::builder()
    .place("L", [350, 60, 560, 160])?     // last page + box (points)
    .approval()                           // ordinary signature (omit to certify)
    .reason("Approved")
    .location("Delhi")
    .build();

let signed = sign_pdf(std::fs::read("input.pdf")?, &signer, &cfg)?;
std::fs::write("signed.pdf", &signed)?;

Swapping the key source is the only change needed to sign from a token or the Windows store — the config and sign_pdf call stay identical:

let signer = WinStoreSigner::select()?;                 // native Windows picker
let signer = Pkcs11Signer::open(dll, pin, serial)?;     // PKCS#11 token by serial

Add standards-grade features

Everything below is a one-line addition to the builder. Each links to a full guide:

let cfg = SignConfig::builder()
    .place("1,3,5-7,L", [350, 60, 560, 160])?        // keyword page selector + box
    .certify(Certify::FormsAndSignatures)            // certifying (DocMDP) signature
    .pades(PadesLevel::B_LTA)                         // PAdES archive profile
    .timestamp(Timestamp::url(DEFAULT_TSA_URL))       // RFC-3161 timestamp
    .ltv(true)                                        // embed DSS → "LTV enabled"
    .encrypt(OutputEncryption::password("open-pw"))   // AES-128 protected output
    .reason("Document signed").location("Delhi")
    .build();