LTV
LtvPolicy, ValidationMaterial, and LtvReport — the long-term-validation policy, pre-fetched revocation material, and what a sign actually embedded
Long-term validation embeds the signer's certificate chain and revocation evidence (CRLs / OCSP) in
the document's /DSS so a signature stays checkable offline and after the certificate expires. Three
types drive it: LtvPolicy (what to do when revocation material is unobtainable),
ValidationMaterial (pre-fetched material + the online/offline switch), and
LtvReport (what actually landed in the /DSS). See the LTV guide
for the walkthrough.
LtvPolicy
What to do when LTV revocation material can't be fully obtained. #[non_exhaustive]. The effective
policy on SignConfig is ltv_policy if set, else derived from the ltv
bool: true → BestEffort, false → Off.
Prop
Type
use mudrit_pdfsign::prelude::*;
let cfg = SignConfig::builder()
.place("F", [350, 60, 560, 160])?
.ltv_policy(LtvPolicy::Require) // no silent half-LTV
.build();
# Ok::<(), mudrit_pdfsign::Error>(())SignConfig::ltv_effective() returns the resolved policy: an explicit ltv_policy wins over the
ltv bool.
ValidationMaterial
Pre-fetched validation material to embed in the /DSS, and whether to also fetch live. Default
derives an empty, online instance — the historical ltv: true behaviour.
Prop
Type
Methods
Prop
Type
use mudrit_pdfsign::ValidationMaterial;
# let (crl_der, ocsp_der, issuer_der) = (vec![0u8], vec![0u8], vec![0u8]);
let vm = ValidationMaterial::new()
.add_crl(crl_der)
.add_ocsp(ocsp_der)
.add_cert(issuer_der)
.offline(true); // use ONLY the injected material — no networkAttach it with SignConfigBuilder::validation_material(vm). .offline(true) is also available
directly on the builder (SignConfigBuilder::offline) as a shorthand for setting it here.
LtvReport
What LTV material a sign actually embedded — returned by
sign_pdf_reported so a BestEffort sign is never silent about an
incomplete /DSS. Plain struct: Debug + Clone + Copy + PartialEq + Eq + Default.
Prop
Type
let (signed, report) = sign_pdf_reported(&pdf, &signer, &cfg)?;
if !report.complete {
eprintln!("signed without revocation info: {} certs, no CRL/OCSP", report.certs);
}