Re: [PATCH v3 0/5] pkcs7: better handling of signed attributes

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Feb 26, 2026 at 07:43:54AM -0500, James Bottomley wrote:
> > If this is for some out-of-tree module, we don't do that.
> > 
> > I'll also note that we should generally be aiming to simplify the
> > PKCS#7 signature verification code, not making it even more complex.
> 
> I'm fine with the general goal, but since the current code verifies the
> signature, pulls out the message hash and other attributes, compares
> the message against the MessageDigest one and then frees the whole
> structure it's a bit hard to see how the current goal can be achieved
> without extracting at least the first part of that ... but if you have
> a suggestion, I'm happy to implement.

Sure, just incorporate your auxiliary data into the actual message being
signed and verified.  Something like:
    
    program_len || program || hash*

Then there's no need for the complexity of signed attributes.

You could also just use a regular signature without all the pointless
complexity and bugs of PKCS#7.

- Eric