Quick Start

This guide takes you from an ordinary PDF to a signed, verifiable OSDF package and back - in about a minute.

1. Create a package from a PDF

bash

osdf create ./contract.pdf --out contract.osdf

2. Sign it

bash

osdf sign contract.osdf --key ./signing.key

The signer's identity, the canonical payload digest, and the algorithm identifiers are recorded in the manifest.

3. Verify it

bash

osdf verify contract.osdf

text

Document verification Overall: PASS Container safety  [PASS] ZIP archive readable  [PASS] ZIP paths are safe  [PASS] No duplicate paths  [PASS] No trailing bytes  [PASS] OSDF magic header recognized  [PASS] Container byte length matches Manifest integrity  [PASS] Manifest parsed  [PASS] Declared objects present  [PASS] Object sizes match  [PASS] Object hashes match  [PASS] No undeclared objects Revision integrity  [PASS] Revision chain valid  [PASS] Parent revision commitment valid    not applicable for this revision  [PASS] Current revision metadata valid Signatures  [PASS] Signature structure valid  [PASS] Signature cryptographically valid    1 signature(s) verified  [INFO] Signer identity not yet resolved Transparency  [INFO] Ledger verification not configured  [INFO] Revocation checking not configured Verification mode  [INFO] Offline cryptographic verification    embedded package data and configured trust material only  [INFO] Live latest-revision check not performed    offline verification - local revision not compared to a live ledger  [INFO] Revocation status not checked  [INFO] Signer identity not yet resolved Document ID: urn:osdf:doc: . . . Revision: 1Profile: OSDF-CoreSignatures: 1

4. Inspect the internals

bash

osdf inspect contract.osdf --json

5. Export a portable PDF rendition

bash

osdf export-pdf contract.osdf --out contract.pdf

What's next

Embed verification in CI with the Verification API
Explore the container structure
Pick an SDK for your language