Method CheckSignature

smime/signeddata.go:39–100

()

}

func (s *SignedData) CheckSignature() (err error) {
	if len(s.Signers) == 0 {
		return fmt.Errorf("no signature found")
	}

	for _, signer := range s.Signers {
		var cert *x509.Certificate
		if cert, err = s.findCertFor(signer); err != nil {
			return
		}

		// check the revocation lists
		revoked := false
		for _, crl := range s.CRLs {
			if revokeerr := cert.CheckCRLSignature(crl); revokeerr != nil {
				revoked = true
			}
		}

		if revoked {
			if panictodo {
				panic("TODO: check counter signature")
			}
			// return fmt.Errorf("smime: certificate has been revoked")
		}

		data := s.Content
		if signer.RawSignedAttributes != nil {
			var attrvalue []byte
			if attrvalue, err = findSingleAttribute(signer.SignedAttributes, oidMessageDigest); err != nil {
				return errors.New("smime: message digest not found")
			}

			var digest []byte

			// the single message digest attribute should be OCTET STRING
			if _, err = asn1.Unmarshal(attrvalue, &digest); err != nil {
				return
			}

			calculated := data
			if hash := getDigestHashType(signer.DigestAlgorithm.Algorithm); hash.Available() {
				h := hash.New()
				h.Write(data)
				calculated = h.Sum(nil)
			}

			if !bytes.Equal(digest, calculated) {
				return errors.New("smime: message digest does not match content")
			}

			data = signer.RawSignedAttributes
		}

		algo := getSignatureAlgorithmFromOID(signer.SignatureAlgorithm.Algorithm)
		err = cert.CheckSignature(algo, data, signer.Signature)
		if err != nil {
			return