On Fri, Sep 04, 2026 at 01:40:09PM +0200, Theo Buehler wrote:
> On Thu, Sep 03, 2026 at 10:43:02PM +0200, Theo Buehler wrote:
> > This moves the retrieval of the EE cert and the check of absence of CRLs
> > to the earliest possible moment. The signtime check must come after we
> > extracted the signed attributes so it's a bit lonely right now. We can
> > fix this later.
> 
> One reason I wanted to do this was to reduce the noise in a follow up.
> However, below is a slightly larger diff that should be easy enough to
> review. It effectively still hoists the cert/crl checks but looks quite
> different.
> 
> There is a huge messy part in the CMS validation code that deals with
> things needing the SignerInfo (the OpenSSL version of it, that is).
> All this stuff does not need cleanup at exit and is very long, boring
> and meandering code which is concerned with requirements from RFC 6488
> which are largely independent of the econtent validation and parsing.
> 
> So pull all this into a helper and pass in the few things we need.
> The only info we want to retain is that the object is well-formed and
> its signtime. Since we need to pass in the cert, we call the helper
> after extraction and before validation of the signtime against the cert.
> 
> The main point is that cms_parse_validate() finally becomes somewhat
> manageable in size.

OK job@