Detached CMS

Not every document is a PDF. sign_detached_cms produces a standalone detached CMS / PKCS#7 signature — a .p7s — over arbitrary bytes: XML, ZIP archives, firmware images, invoices, or any raw buffer. It shares the same CMS core as the PDF engine, so the same key backends (PFX, PKCS#11 token, Windows store, custom) and the same algorithms (RSA PKCS#1 / PSS, ECDSA) apply.

use mudrit_keystore::PfxSigner;
use mudrit_pdfsign::{sign_detached_cms, CmsOptions};

let signer = PfxSigner::from_file("samples/ABC12.pfx", "ABC12")?;
let data   = std::fs::read("invoice.xml")?;

let p7s = sign_detached_cms(&signer, &data, &CmsOptions::default())?;
std::fs::write("invoice.xml.p7s", &p7s)?;   // detached signature, next to the file

Options — CmsOptions

Start from CmsOptions::default() (no timestamp, with the ESS signing-certificate attribute) and chain the setters. CmsOptions is #[non_exhaustive]; construct it via default() / new().

use mudrit_pdfsign::{CmsOptions, Timestamp};

let opts = CmsOptions::default()
    .timestamp(Timestamp::url("http://timestamp.comodoca.com"))  // RFC-3161 signature timestamp
    .signing_certificate(true)                                   // ESS signing-certificate-v2
    .signing_time(true);                                         // PKCS#9 signingTime (legacy)

let p7s = sign_detached_cms(&signer, &data, &opts)?;

When to reach for it

• Non-PDF documents — sign an XML e-invoice, a firmware blob, or a release archive where a PDF signature has nowhere to live.
• Interoperable output — the .p7s is standard detached CMS, so verifiers outside the PDF world (OpenSSL, Java, .NET) recompute and check it the same way.
• The same identity everywhere — the key backend that signs your PDFs signs these bytes too, so a token or HSM identity produces both without extra plumbing.

The signer's algorithm() selects the digest and signature scheme, so a token that signs PDFs as ECDSA P-256 produces an ECDSA .p7s here with no extra configuration.

Next