Long-Term Validation

A digital signature is only as verifiable as the material a validator can reach at validation time. Once the signer's certificate expires — or its revocation endpoints go offline — an otherwise-perfect signature becomes "validity unknown". Long-Term Validation (LTV) fixes this by embedding everything a validator needs inside the PDF, so the signature stays checkable offline and after the certificate's lifetime.

What goes in the DSS

Mudrit writes a Document Security Store (/DSS, per PAdES / ISO 32000-2): the signer's certificate chain plus its revocation evidence — CRLs and OCSP responses — and a /VRI (Validation-Related Information) entry keyed to the signature. Adobe reports this as "LTV enabled".

Turn it on with .ltv(true):

use mudrit_pdfsign::prelude::*;

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .timestamp(Timestamp::url("http://timestamp.comodoca.com")) // trusted time to anchor validity
    .ltv(true)                                                   // embed the DSS → "LTV enabled"
    .build();

let signed = sign_pdf(&pdf, &signer, &cfg)?;

Policy: .ltv(true) vs LtvPolicy

.ltv(true) is a convenience that maps to a policy. For full control, set one explicitly with .ltv_policy(...) — an explicit policy always wins over the bool.

.ltv_policy(LtvPolicy::Require)   // no silent half-LTV — fail if revocation can't be fetched

BestEffort never lies — sign_pdf_reported

BestEffort (what .ltv(true) selects) won't abort on a partial DSS, but it also won't hide it. Sign with sign_pdf_reported to get an LtvReport of exactly what landed in the /DSS:

let (signed, report) = sign_pdf_reported(&pdf, &signer, &cfg)?;
if !report.complete {
    eprintln!("signed without revocation info: {} certs, no CRL/OCSP", report.certs);
}

Pre-fetched material and going offline

By default the engine fetches CRLs and OCSP responses live over plain HTTP while signing. A restricted or air-gapped deployment can instead inject material it already holds — a revocation cache, an offline bundle — via ValidationMaterial, and set .offline(true) to skip the network entirely and embed only what you supplied.

let vm = ValidationMaterial::new()
    .add_cert(issuer_der)   // an extra chain cert for /DSS /Certs
    .add_crl(crl_der)       // a pre-fetched CRL (DER)
    .add_ocsp(ocsp_der)     // a pre-fetched OCSP response (DER)
    .offline(true);         // use ONLY the injected material — no fetches

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .ltv(true)
    .validation_material(vm)
    .build();

Next