gopdfrab

gopdfrab is an open-source Go library and command-line tool that checks whether a PDF meets the PDF/A-1b archival standard and converts it into a compliant file when it doesn't. PDF/A is the ISO 19005 format that archives, courts, banks, and records systems ask for because it pins down fonts, colour, and metadata so a document renders the same way decades from now. Producing and verifying those files has usually meant shelling out to a Java tool such as veraPDF or PDFBox, or paying for a commercial SDK, which is awkward inside a Go service and a non-starter in a serverless function that has to start in milliseconds. gopdfrab exists so a Go program can do the whole job in-process, as a single dependency, with nothing else installed on the box.

Verification runs 159 checks organised into 11 groups, following the ISO 19005-1 rules and adding object-model checks derived from the Arlington PDF Model. The project reports passing all 204 files in the Isartor suite and all 569 in the veraPDF corpus, the two test sets the industry uses to judge PDF/A validators, and it states that files it converts go on to pass veraPDF's own PDF/A-1b validation. That second claim matters more than it sounds, because a converter that only satisfies its own checker isn't much use when the receiving archive runs a different one.

Conversion works as a verify-and-fix loop. Pre-emptive fixups handle the common problems first, then each failed check drives a targeted repair, and the document is verified again until it passes. Rasterising a page into an image is the last resort, used only when an in-place repair isn't possible, and a residual report lists any objects or content that couldn't be carried across, so nothing disappears silently. The library also opens files encrypted with RC4, AES-128, or AES-256, and it recovers damaged PDFs by scanning for objects and rebuilding the cross-reference table before the checks even start.

Because it's pure Go with zero runtime dependencies, it cross-compiles anywhere Go does, including WebAssembly. The project's own site uses that build to run a validator and a converter directly in the browser, where files never leave your machine. Processing is concurrent and goroutine-safe, verification profiles can be customised, and the codebase is fuzzed and stress-tested against programmatically malformed PDFs. The README also describes semantic oracles that keep behaviour deterministic, and claims single-file verification around 160 times faster than veraPDF with an 11 times smaller memory footprint. The published benchmarks claim 2,939 files a second against 155 for PDFBox and 130 for veraPDF, a 12.3 MB deployment footprint, and single-file latency of about 9.5 ms, which is why the project pitches itself for edge and serverless environments where a JVM would never finish starting in time.

It's built for Go developers who need compliance inside their own software rather than as a separate service, and for teams that process documents in bulk, whether that's an archive ingest pipeline, a document management product, or a one-off batch conversion. The CLI exposes verify and convert subcommands with exit codes that map onto conformant, non-conformant, and error, so it drops into scripts without any output parsing. On the library side the API is short. You open a document, ask whether it's PDF/A, and call Convert with the target level. What separates it from the established validators is that combination of a small static binary, in-process use, and a conversion path that repairs files instead of only reporting on them.

The limits are clear. Only PDF/A-1b is implemented today, with PDF/A-2, 3, and 4 on the roadmap, so anyone who needs the newer levels will have to wait or keep a second tool around. The rasterisation fallback trades searchable text and structure for a guaranteed-valid image when a page can't be repaired, and the residual report is where you find out that it happened. It's also a young project with a very small community, so you're relying on its published test-suite results rather than years of production use, and the commercial licence pricing isn't listed anywhere on the site. The site's compare and roadmap pages are the place to check what's planned before you build on it.

The code is dual-licensed under the AGPL 3.0 and a commercial licence for closed-source use, with commercial terms available on request. Contributions require signing a contributor licence agreement. Install the library with go get github.com/voidrab/gopdfrab, install the CLI from the cmd package with go install, or try the browser tools on the site first to see what it does with your files. The validator checks a file against ISO 19005-1 and the converter hands back a PDF/A-1b document, both running locally as WebAssembly. The maintainers publish contact@voidrab.com in the footer.