pkcs7_verify(9)

✨ NAME ✨

okay bestie, welcome to pkcs7_verify(9) from the Kernel API Manual — it’s giving “verify a PKCS#7 message” and honestly it ate. 💅

pkcs7_verify — Verify a PKCS#7 message. 🎀

🌸 SYNOPSIS 🌸

int pkcs7_verify (struct pkcs7_message *pkcs7 , enum key_being_used_for usage );

🎀 ARGUMENTS 🎀

• pkcs7 — The PKCS#7 message to be verified. 🫶
• usage — The use to which the key is being put. 🔑

💅 DESCRIPTION 💅

So the vibe check here is internal consistency, bestie. pkcs7_verify verifies that a PKCS#7 message is internally consistent — that is, the data digest matches the digest in AuthAttrs, and any signature in the message or one of the X.509 certificates it carries that matches another X.509 cert in the message can be verified. ✨

Important: this does not look to match the contents of the PKCS#7 message against any external public keys. Not me checking outside the group chat. 🙈

It returns these in order of descending priority, like a ranked list of outcomes:

1. -EKEYREJECTED — a key was selected that had a usage restriction at odds with the specified usage, or:
2. -EKEYREJECTED — a signature failed to match for which we found an appropriate X.509 certificate, or:
3. -EBADMSG — some part of the message was invalid, or:
4. 0 — a signature chain passed verification, or:
5. -EKEYREJECTED — a blacklisted key was encountered, or:
6. -ENOPKG — none of the signature chains are verifiable because suitable crypto modules couldn't be found. 😭

🦋 SEE ALSO 🦋

• Kernel file ./crypto/asymmetric_keys/pkcs7_verify.c 👀
• pkcs7_supply_detached_data(9) 🫶

mwah 💖 this page comes from ./crypto/asymmetric_keys, dated October 2026 — catch you in the next group chat, bestie! 🌈👑