PoDoFo 1.1 released and relicensed to LGPL2+ or MPL 2.0

PoDoFo 1.1 is out, and the headline isn‘t just what's new under the hood. A long-awaited licensing change finally lands, making the library more accessible to a wider range of projects and businesses.

Now available under a second license

PoDoFo has been historically distributed exclusively under the LGPLv2+ license. With 1.1, the library is also available under the MPL 2.0 license. While permissive in many respects, LGPL comes with conditions around how the library must be linked that may create friction when integrating it in commercial products. MPL 2.0 takes a lighter touch: only the PoDoFo source files themselves need to stay open if modified — your own application code is always unaffected, whether distributed as source or compiled binary. For companies that need a robust native PDF library but have been held back by licensing concerns, this opens a practical path forward.

Validating XMP metadata, the right way

Getting metadata right is essential for PDF/A archival documents, which have strict requirements on what the XMP must contain. PoDoFo 1.1 introduces a new PdfXMPPacket::PruneAndValidate(pdfaLevel) API that checks and cleans up XMP metadata against a target conformance level in a single call. The work behind this feature was first presented publicly at PDF Days Europe 2025 in Berlin: the presentation introduced an open-source implementation of the canonical XMP serialization algorithm defined in ISO 16684-2:2014, paired with a Relax NG schema covering the complete PDF XMP specification. That research is now available to every PoDoFo user as a first-class API call.

Signing documents across multiple steps

In some advanced scenarios, digital signing of PDFs can't happen in a single operation — for example, in distributed systems where the hash and the final signature are computed on different nodes. PoDoFo 1.1 addresses this with a fully resumable signing context: the new PdfSigningContext::DumpInPlace() and PdfSigningContext::Restore() functions allow a signing session to be saved to disk and picked up again later. This makes it straightforward to build multi-step or asynchronous signing workflows without workarounds or hacks.

Surviving imperfect PDFs

As is widely known, not every PDF out in the wild is well-formed. The time has come for PoDoFo to learn the lesson and improve resilience in several common cases: the parser will now attempt to reconstruct the document‘s cross-reference index when the original is broken, and can handle files with unusual data positioning before the standard %PDF- header. In practice, this means fewer failures when processing documents from untrusted or legacy sources.

Where to get it

PoDoFo 1.1.0 is available as a Long Term Supported version on GitHub, with packages through Homebrew, vcpkg, Conan and Linux distributions coming shortly.