VellumPdf.Signing 2.3.0

VellumPdf.Signing

The digital-signature add-on for VellumPdf, a dependency-free PDF library for .NET 10 implemented clean-room from ISO 32000. It applies PAdES / PKCS#7 detached CMS signatures to a VellumPdf.Kernel.PdfDocument or a VellumPdf.Layout.Document.

• PAdES levels B-B, B-T (RFC-3161 signature timestamp), B-LT (embedded OCSP/CRL in a /DSS), and B-LTA (archive document timestamp).
• Pluggable timestamp (ITimestampClient) and revocation (IRevocationClient) clients, with HTTP implementations included.
• Signs with HSM/PKCS#11/cloud-KMS certificates: PdfSignatureSettings.ExternalPrivateKey for a local synchronous key, or ExternalSigner (an IExternalSigner, via SignAsync) for a KMS whose signing call is a real network round-trip (Azure Key Vault, AWS KMS, GCP KMS).
• Keeps the core zero-dependency: this package is the only one that references System.Security.Cryptography.Pkcs.

Install

dotnet add package VellumPdf.Signing

Usage

using System.Security.Cryptography.X509Certificates;
using VellumPdf.Fonts;        // Standard14
using VellumPdf.Layout;       // Document
using VellumPdf.Layout.Core;  // TextStyle
using VellumPdf.Layout.Elements;
using VellumPdf.Signing;

using var doc = new Document();
doc.SetDefaultFont(new TextStyle { Font = Standard14.Helvetica, FontSize = 11 });
doc.Add(new Paragraph("Signed with VellumPdf."));

var settings = new PdfSignatureSettings
{
    Certificate = X509CertificateLoader.LoadPkcs12FromFile("signer.pfx", "password"),
    Level = PadesLevel.B_T,
    TimestampClient = new HttpTimestampClient(new Uri("https://timestamp.example/tsa")),
    Reason = "Approved",
};

using var output = File.OpenWrite("signed.pdf");
doc.Sign(output, settings);

Documentation

Package family and project home: https://github.com/Tim81/VellumPDF

The VellumPdf family

Roadmap

Planned direction, tracked as GitHub milestones. These are scopes, not commitments — the milestones carry no due dates. 2.3.0 is the latest published release.

Scope past 2.5 runs as two parallel tracks, because auditing the layout engine turned up more work than the PDF 2.0 conformance gap did. Both ship from the same version numbers.

Kernel and conformance

Layout

Editing existing documents. The only breaking milestone is 3.0.

What this library implements of ISO 32000-2 today is inventoried, reference by reference, in PDF 2.0 conformance. It emits a %PDF-2.0 header, which is not the same as conformance, and the table says which is which. The Reader guide and Layout guide each carry a capability table doing the same job for their own package, checked against the code and test suite rather than against this roadmap.

VellumPdf.Reader is marked Preview in the table above; expect its public surface to settle as these milestones land. VellumPdf.Conformance graduated to Stable in 2.0.

License

Apache-2.0. Source and issues: https://github.com/Tim81/VellumPDF