PAdES Profiles

PAdES (PDF Advanced Electronic Signatures, ETSI EN 319 142) is the European baseline for long-lived PDF signatures. Selecting a level with .pades(...) produces a PAdES signature instead of the legacy adbe.pkcs7.detached form: it switches the signature's SubFilter to ETSI.CAdES.detached and adds the ESS signing-certificate-v2 signed attribute (RFC 5035, which binds the signature to the exact signing certificate).

use mudrit_pdfsign::prelude::*;

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .pades(PadesLevel::B_LTA)     // signing-cert-v2 + TSA + DSS(OCSP+CRL+VRI) + doc timestamp
    .build();

let signed = sign_pdf(&pdf, &signer, &cfg)?;   // Adobe: valid + "LTV enabled" + a document timestamp

The four baseline levels

Each level builds on the one below it — you pick the top level you want and Mudrit pulls in everything beneath it:

Automatic wiring per level

Selecting a level auto-enables the lower-level requirements, so you don't wire timestamp / ltv separately:

You can still tune the LTV behaviour of a B-LT/B-LTA sign with the same knobs as a plain LTV document — inject ValidationMaterial, go .offline(true), or demand LtvPolicy::Require — because the archival levels feed through the same DSS machinery.

Combining with certification

PAdES composes with a certifying (DocMDP) signature. Certify first, then choose the profile — the archive stamp keeps the DocMDP valid:

let cfg = SignConfig::builder()
    .place("F", [350, 60, 560, 160])?
    .certify(Certify::FormsAndSignatures)   // DocMDP certifying signature
    .pades(PadesLevel::B_LTA)               // stays DocMDP-valid under the archive stamp
    .build();

A B-LTA signature end to end

B_LTA is the fullest baseline: signing-certificate-v2, a signature timestamp, the DSS with CRLs + OCSP + /VRI, and a trailing document timestamp — a single call produces all of it.

use mudrit_pdfsign::prelude::*;

let signer = PfxSigner::from_file("samples/ABC12.pfx", "ABC12")?;
let pdf    = std::fs::read("in.pdf")?;

let cfg = SignConfig::builder()
    .place("1,L", [350, 60, 560, 160])?
    .pades(PadesLevel::B_LTA)
    .reason("Long-term archival signature")
    .location("Delhi")
    .build();

let signed = sign_pdf(&pdf, &signer, &cfg)?;
std::fs::write("out.pdf", &signed)?;

Next