Detached CMS
sign_detached_cms and CmsOptions — standalone detached CMS/PKCS#7 signatures over arbitrary bytes, no PDF involved
sign_detached_cms produces a standalone detached CMS/PKCS#7 signature (a .p7s) over arbitrary
bytes — XML, ZIP, firmware, anything. It shares the same CMS core as the PDF engine; the only
difference is what gets hashed into the messageDigest signed attribute (the ByteRange for a PDF,
your raw bytes here). The content is not embedded: a verifier recomputes the digest over the
original data and checks it against the CMS.
sign_detached_cms
pub fn sign_detached_cms(signer: &dyn Signer, data: &[u8], opts: &CmsOptions) -> Result<Vec<u8>>The signer's algorithm selects the digest + signature scheme (RSA
PKCS#1 / PSS / ECDSA). Works with every Signer backend — PFX, PKCS#11
token, Windows store, or a custom implementation.
use mudrit_keystore::PfxSigner;
use mudrit_pdfsign::{sign_detached_cms, CmsOptions};
let signer = PfxSigner::from_file("samples/ABC12.pfx", "ABC12")?;
let data = std::fs::read("invoice.xml")?;
let p7s = sign_detached_cms(&signer, &data, &CmsOptions::default())?;
std::fs::write("invoice.xml.p7s", &p7s)?; // detached signature, next to the file
# Ok::<(), Box<dyn std::error::Error>>(())CmsOptions
Clone + Debug, #[non_exhaustive].
Prop
Type
Constructors and methods
Prop
Type
use mudrit_pdfsign::{CmsOptions, Timestamp};
let opts = CmsOptions::default()
.timestamp(Timestamp::url("http://timestamp.comodoca.com")) // RFC-3161 signature timestamp
.signing_certificate(true); // ESS signing-certificate-v2Next
Deferred Signing
prepare_signature, PreparedSignature, and SigningCertificate — split PDF preparation from an external hash-then-sign key operation
Batch & Async
sign_batch, BatchOptions, sign_pdf_async, and sign_batch_async — parallel batch signing and Tokio wrappers, with the Send/Sync bounds each needs