Certifying & Locking

Mudrit produces two kinds of signature. An approval signature (the default) says "I sign this"; a certifying signature additionally declares, through the PDF DocMDP transform, what changes stay permitted afterwards — and locks anything else.

Approval vs certifying

By default sign_pdf makes an approval signature. Call .certify(…) to make the signature a certifying (DocMDP) one instead; .approval() restores the default explicitly.

use mudrit_pdfsign::prelude::*;

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .approval()                             // the default — an ordinary signature
    .build();

use mudrit_pdfsign::prelude::*;

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .certify(Certify::FormsAndSignatures)   // DocMDP /P level 2; must be the first signature
    .build();

The three certification levels map to the DocMDP /P value — what a later editor may still change without invalidating the certification:

Certify, then approve

A common workflow: one party certifies the document (locking structure but allowing further signatures), and a second party later appends an approval signature. Because the certification was made at FormsAndSignatures (or …AndAnnotations), the appended signature is permitted and both stay valid.

// party A certifies at /P level 2 (forms + signatures allowed)
let certified = sign_pdf(&pdf, &signer_a, &cfg_certify)?;

// party B appends an approval signature — sign_pdf detects the existing signature and appends
let approved = sign_pdf(&certified, &signer_b, &cfg_approve)?;   // both valid

sign_pdf detects that the input is already signed and appends an incremental revision rather than rebuilding the file (which would break the existing signatures). See the certify_then_approve example.

Field locking (FieldMDP)

Where DocMDP governs the whole document, FieldMDP locks specific form fields at signing time — so filled fields can't be altered after this signature. The lower-level add_locked_signature applies a FieldMDP field-lock together with LTV and a timestamp for explicit control:

use mudrit_pdfsign::add_locked_signature;

let signed = add_locked_signature(&input, page, rect, field, &signer, tsa)?;

Next