gnutls_pkcs7_verify_direct(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_pkcs7_verify_direct 💖

okay so bestie, welcome to the manual page for gnutls_pkcs7_verify_direct, a lil' function from the gnutls crew. it lives in the gnutls family of man pages (you know, the ones you man when you're deep in TLS land at 2am 🌙). let's get into it, no cap.

✨ NAME ✨

gnutls_pkcs7_verify_direct — it's an API function, bestie. that's the whole vibe. 🎀

🌸 SYNOPSIS 🌸

#include <gnutls/pkcs7.h>

int gnutls_pkcs7_verify_direct(gnutls_pkcs7_t pkcs7, gnutls_x509_crt_t
signer, unsigned idx, const gnutls_datum_t * data, unsigned flags);

yes the signature is long, we're not even gonna pretend it's not 💀

🦋 ARGUMENTS 🦋

  • gnutls_pkcs7_t pkcs7 — this should contain a gnutls_pkcs7_t type. like, it's gotta be the right kinda thing or we're not doing anything.
  • gnutls_x509_crt_t signer — the certificate that you believe signed the structure. you're bringing your theory, this function is checking your homework.
  • unsigned idx — the index of the signature info you want checked. pick your fighter 🔥
  • const gnutls_datum_t * data — the data that needs verifying, or NULL.
  • unsigned flags — zero, or an OR list of gnutls_certificate_verify_flags. your settings, your rules ✨

💅 DESCRIPTION 💅

so what does this icon actually do? it verifies the data you handed over against the signature that's chillin' inside the SignedData of the PKCS 7 structure. and here's the tea: if the data you provided is NULL, then it just uses the data sitting in the encapsulatedContent field instead. convenient, honestly. 👑

note that, unlike gnutls_pkcs7_verify(), this function does not verify the key purpose of the signer. so it's fully on the caller — that's you, bestie — to verify the intended purpose of the signer -e.g., via gnutls_x509_crt_get_key_purpose_oid(), or gnutls_x509_crt_check_key_purpose(). don't skip that step, i'm literally begging 🙏

also, since GnuTLS 3.5.6 this function introduces checks in the end certificate ( signer ), including time checks and key usage checks. so it's giving thorough. it's giving responsible. we love that for us. 💖

⭐ RETURNS ⭐

  • on success, GNUTLS_E_SUCCESS (0) is returned 🎉
  • otherwise you get a negative error value (rip)
  • a verification error results in a GNUTLS_E_PK_SIG_VERIFY_FAILED
  • and if there's no encapsulated data to verify, you get a GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE

basically: zero = slay, negative = go read the error, bestie. 🌈

🎀 SINCE 🎀

3.4.2 — an oldie but a goodie, it's been serving since way back. 👑

🐛 REPORTING BUGS 🐛

found a bug? don't gatekeep it, report it to <bugs@gnutls.org>.

home page: https://www.gnutls.org

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

👀 SEE ALSO 👀

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/

and that's the whole page, bestie 🫶 this was gnutls 3.8.13, page gnutls_pkcs7_verify_direct(3), and you can find it hanging out in the gnutls section 3 man pages. go verify something responsibly, mwah 💋✨

📦 where this page comes from