cms

type VerifyAttachedOptions struct {
	VerifyOptions
	// IgnoreValidity builds the certificate path by name and signature
	// alone, without applying validity windows. Apple device identities
	// chain through the Apple iPhone Device CA, which expired in 2014 and
	// still issues current leaves, so stock chain verification cannot
	// accept them. SHA-1 signatures are tolerated on this path because the
	// chain uses them.
	IgnoreValidity bool
	// Anchors are trust anchors matched by identity: the path is accepted
	// when it reaches a certificate issued (by name and signature) by one
	// of them, or one of them itself. They are the trust store for
	// IgnoreValidity, since a CertPool cannot be walked; when
	// IgnoreValidity is false they are added to Roots. Nil Anchors and nil
	// Roots skip chain verification, as in Verify.
	Anchors []*x509.Certificate
}

type VerifyOptions struct {
	// Roots, when set, requires the signer certificate to chain to one of
	// them (intermediates from the CMS structure are used). Nil skips chain
	// verification and only checks the signature itself.
	Roots *x509.CertPool
	// Now supplies the verification time; defaults to time.Now.
	Now func() time.Time
	// ClockSkew tolerates a signing time this far outside the signer
	// certificate's validity. Zero means no tolerance.
	ClockSkew time.Duration
}