PAdES
PadesLevel (B-B / B-T / B-LT / B-LTA) and what each level auto-enables, field by field
PadesLevel selects a PAdES baseline profile (ETSI EN 319 142-1). Selecting a level switches the
signature's SubFilter to ETSI.CAdES.detached and adds the ESS signing-certificate-v2 signed
attribute (RFC 5035). Set via SignConfigBuilder::pades. PadesLevel is #[non_exhaustive] and
its variants use the underscore naming ETSI itself uses (B_B, not BB).
let cfg = SignConfig::builder()
.place("F", [350, 60, 560, 160])?
.pades(PadesLevel::B_LT)
.build();PadesLevel
Each level builds on the one below it.
Prop
Type
Selecting a level auto-enables the lower levels' requirements (a timestamp for B-T and up, LTV for
B-LT and up), so you don't have to wire timestamp/ltv separately on the builder — though an
explicit timestamp source you did set is still honoured instead of the fallback
DEFAULT_TSA_URL.
| Level | SubFilter + signing-cert-v2 | + Signature timestamp | + DSS (LTV) | + Document timestamp |
|---|---|---|---|---|
B_B | ✓ | |||
B_T | ✓ | ✓ | ||
B_LT | ✓ | ✓ | ✓ | |
B_LTA | ✓ | ✓ | ✓ | ✓ |
Query methods
Prop
Type
sign_pdf uses these internally to layer the archival revisions: B-LT/B-LTA append a /DSS
revision after the base signature, and B-LTA additionally appends a document-timestamp revision
(equivalent to calling add_document_timestamp).
B-B/B-T carry no archival revision.
Encrypted output is not supported with PAdES-B-LT / B-LTA — the archival DSS and document-timestamp
revisions must be written in plaintext. Use PAdES-B-B / B-T with .encrypt(...), or drop
.encrypt(...) for an LT/LTA archive.