Cargo Features
Every Cargo feature across mudrit, mudrit-pdfsign, and mudrit-keystore — what it enables, its extra dependencies, and lean-build recipes
Mudrit is a Cargo workspace of three crates: mudrit-keystore (key discovery/signing backends),
mudrit-pdfsign (the PDF signing engine, backend-agnostic via &dyn Signer), and mudrit (a facade
re-exporting both). Most applications depend on mudrit alone; the feature names below are
identical across all three, mudrit simply forwards them down to the crate that implements them.
Default features
All three crates default to ["pfx", "pkcs11", "winstore"] — a fresh cargo add mudrit gets every
bundled signing backend. winstore compiles everywhere (it's a no-op stub off Windows, see
Backends), so the default set builds on Linux/macOS/Windows alike.
Feature matrix
| Feature | Crate(s) | Default | Enables | Extra dependencies |
|---|---|---|---|---|
pfx | keystore, pdfsign, mudrit | on | PfxSigner, PfxKeyStore — sign from a .pfx/.p12 file | p12-keystore, p256, p384, p521, rand_core |
pkcs11 | keystore, pdfsign, mudrit | on | Pkcs11Signer, Pkcs11KeyStore, Pkcs11MultiStore, Pkcs11Manager — sign via a PKCS#11 token/HSM | cryptoki, tracing, p256, p384, p521 |
winstore | keystore, pdfsign, mudrit | on | WinStoreSigner, WinStoreKeyStore, WinStorePicker — sign from the Windows certificate store | windows, p256, p384, p521 |
pkcs11-picker | keystore only | off | Pkcs11Picker, PickerLabels — the cross-platform Iced token picker (requires pkcs11) | iced, dark-light |
picker | mudrit only | off | Forwards to mudrit-keystore/pkcs11-picker; also turns on pkcs11 | (see pkcs11-picker) |
winstore-viewer | keystore only | off | view_certificate — native Windows certificate-properties dialog (requires winstore) | extra windows crate feature bundles (Gdi, Cryptography Catalog/Sip, WinTrust, Controls, WindowsAndMessaging) |
tokio | pdfsign, mudrit | off | Async wrappers around the signing pipeline | tokio |
picker vs pkcs11-picker
Depending directly on mudrit-keystore, the flag is pkcs11-picker. Depending on the mudrit facade,
the equivalent flag is picker (it enables mudrit-keystore/pkcs11-picker for you, plus pkcs11).
There is no mudrit-pdfsign equivalent — the picker is a keystore-level UI concern, mudrit-pdfsign
never depends on iced.
winstore-viewer is not forwarded
Unlike the other features, winstore-viewer is not re-exposed by mudrit-pdfsign or the mudrit
facade's feature table — it only exists on mudrit-keystore. To use view_certificate, depend on
mudrit-keystore directly with features = ["winstore", "winstore-viewer"] (or add it as a direct
dependency alongside mudrit) and reach it as mudrit_keystore::view_certificate /
mudrit::mudrit_keystore::view_certificate if mudrit re-exports the crate.
Always present, no feature required
These compile in regardless of which (if any) backend features are enabled — even
mudrit-pdfsign = { version = "...", default-features = false } still has them, since the signing
engine only needs &dyn Signer, never a concrete backend:
Signer,KeyStore,KeyEntrySignatureAlgorithmCertFilter,parse_certificate,CertDetailsmudrit_keystore::Error,mudrit_pdfsign::Error
This is what makes "bring your own Signer" possible with a minimal dependency footprint — implement
Signer against your own key source and none of pfx/pkcs11/winstore need to be enabled at all.
Lean-build recipes
Ship a single .pfx-backed signer — no PKCS#11 driver linkage, no Windows-only code paths pulled in
on other platforms' builds:
[dependencies]
mudrit = { version = "...", default-features = false, features = ["pfx"] }Enterprise HSM/token deployment with the multi-token manager and the Iced picker, nothing else:
[dependencies]
mudrit = { version = "...", default-features = false, features = ["pkcs11", "picker"] }Use only the always-present core — Signer, SignatureAlgorithm, CertFilter — against a custom key
source (e.g. a cloud KMS), with none of the bundled backends compiled in:
[dependencies]
mudrit = { version = "...", default-features = false }