jnewbigin / pkcs7_detached Goto Github PK

from cryptography import x509
from cryptography.hazmat.backends.openssl.backend import backend # type: ignore
from cryptography.hazmat.bindings._openssl import ffi, lib # type: ignore
from cryptography.hazmat.bindings.openssl import binding

def verify_detached_signature_binary(document: bytes, signature: bytes, certificate: x509.Certificate) -> bool:
    # Load the string into a bio
    bio = backend._bytes_to_bio(signature) # pylint: disable=W0212

    # Create the pkcs7 object
    pkcs7_object = lib.d2i_PKCS7_bio(bio.bio, ffi.NULL)
    if pkcs7_object == ffi.NULL:
        binding._consume_errors(lib)
        raise ValueError("Unable to parse PKCS7 data")

    # Load the specified certificate
    stack = lib.sk_X509_new_null()
    res = lib.sk_X509_push(stack, certificate._x509) # type: ignore
    binding._openssl_assert(lib, res >= 1)

    # We need a CA store, even though we don't use it
    store = lib.X509_STORE_new()
    binding._openssl_assert(lib, store != ffi.NULL)

    # Load the document into a bio
    content = backend._bytes_to_bio(document) # pylint: disable=W0212

    # If PKCS7_NOVERIFY is set the signer's certificates are not chain verified.
    flags = lib.PKCS7_NOVERIFY

    # https://www.openssl.org/docs/man1.0.2/crypto/PKCS7_verify.html
    return lib.PKCS7_verify(pkcs7_object, stack, store, content.bio, ffi.NULL, flags) == 1