verify_pkcs7_signature(9)

💖 verify_pkcs7_signature(9) 💖

okay so bestie, welcome to the Kernel API Manual — this is <pink>verify_pkcs7_signature</pink>, and she is literally the bouncer at the club door of your system data. like, she checks the PKCS#7 signature and is like "hmm, are you on the list tho?" and you better hope your trusted keys say yes 😭✨

---

🌸 NAME 🌸

verify_pkcs7_signature — verify a PKCS#7-based signature on system data. that's it, that's the vibe check 🫶

---

✨ SYNOPSIS ✨

int verify_pkcs7_signature (const void *data , size_t len , const void
*raw_pkcs7 , size_t pkcs7_len , struct key *trusted_keys , enum
key_being_used_for usage , int (*view_content)(void *ctx, const void
*data, size_t len, size_t asn1hdrlen) , void *ctx );

like, look at all those parameters. main character and her whole entourage 💅

---

🎀 ARGUMENTS 🎀

• data — the data getting verified, bestie. she's the moment. and it's NULL if you're expecting internal data instead, no cap 👑
• len — size of data. gotta know how much of the good stuff we're working with 📏
• raw_pkcs7 — the PKCS#7 message that is the signature. yes she's the signature herself, iconic behavior 💖
• pkcs7_len — the size of raw_pkcs7. measure twice, verify once ✨
• trusted_keys — the trusted keys to use, and listen: NULL means builtin trusted keys only, and (void *)1UL means all trusted keys. not me memorising that absolute cursed cast (void *)1UL 😭 it's giving "we ran out of normal values so we used a pointer-shaped number" fr fr
• usage — the use to which the key is being put. like, what's the key's job today, what's her role in the group chat 🔥
• view_content — a callback to gain access to content 🦋 it's declared as int (*view_content)(void *ctx, const void *data, size_t len, size_t asn1hdrlen) — so she takes ctx, data, len, and asn1hdrlen, and returns an int, periodt
• ctx — context for the callback. you know, the emotional support parameter every callback deserves 🫶

---

🌈 SEE ALSO 🌈

• Kernel file ./certs/system_keyring.c — go read the source, iykyk 📂
• restrict_link_by_builtin_trusted(9)
• restrict_link_by_digsig_builtin(9)
• restrict_link_by_builtin_and_secondary_trusted(9)
• restrict_link_by_digsig_builtin_and_secondary(9)
• add_to_secondary_keyring(9)
• restrict_link_by_builtin_secondary_and_machine(9)
• verify_pkcs7_message_sig(9)

the whole keyring friend group showed up to support her, we love to see it 💜🧚

---

real talk though, those names are long. like restrict_link_by_builtin_and_secondary_trusted is a whole sentence with no punctuation. respect for anyone typing that from memory, genuinely 💀

---

and that's the page!! brought to you by the fine folks at ./certs, dropping October 2026 — so mark your calendars bestie, this certification era is gonna slay 🎀⭐🔥 👑