Module cms 

CMS (PKCS#7 / RFC 5652) SignedData envelope construction and verification.

Produces standard CMS SignedData verifiable by OpenSSL, Thunderbird/RNP, Adobe, and other standards-compliant tools. Provides semantic types plus real DER encoding for SHA-256 digests and algorithm identifiers.

See TODO.roadmap/32-cert-delegation-cms-xmldsig.md for full spec.

Structs

AlgorithmIdentifier

Algorithm identifier (OID + optional parameters).

Attribute

CMS attribute (OID + values).

CmsVerificationResult

Result of CMS verification.

EncapContentInfo

Encapsulated content (the payload).

SignedData

SignedData structure as defined in RFC 5652 §5.1.

SignedDataBuilder

Builder for SignedData.

SignerInfo

Signer information per RFC 5652 §5.3.

SignerVerification

Per-signer verification result.

_ReExportEncapContentInfo

Re-export EncapContentInfo so consumers can build it without reaching into the signed_data module directly. Encapsulated content (the payload).

Enums

CmsError

Errors during CMS envelope construction.

DerError

Errors during DER encoding.

SignerIdentifier

Signer identifier variants.

Functions

build_detached_signature

Convenience: build a minimal detached CMS signature with one signer.

encode_signed_data_der

Encode a SignedData into DER bytes.

resolve_signer_certificate

Resolve the signing certificate for signer by walking the certificates array.

verify_signed_data

Verify a SignedData structure. The verifier callback receives (signer_index, public_key_der, signed_data_to_verify, signature_bytes) and returns Ok(()) if valid.