feat: cms package

[JeyJeyGao]

Migrated to: notaryproject/tspclient-go#17

added CMS package

Depends on #176

Signed-off-by: Junjie Gao [email protected]

[codecov-commenter]

Codecov Report

Attention: 18 lines in your changes are missing coverage. Please review.

Comparison is base (d9131c7) 89.32% compared to head (4c97c11) 90.66%.

Files	Patch %	Lines
internal/crypto/cms/signed.go	94.37%	6 Missing and 3 partials ⚠️
internal/crypto/cms/encoding/ber/ber.go	96.38%	4 Missing and 2 partials ⚠️
internal/crypto/hashutil/hash.go	57.14%	2 Missing and 1 partial ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #181      +/-   ##
==========================================
+ Coverage   89.32%   90.66%   +1.34%     
==========================================
  Files          21       31      +10     
  Lines        1724     2165     +441     
==========================================
+ Hits         1540     1963     +423     
- Misses        149      161      +12     
- Partials       35       41       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Two-Hearts]

My first round of review. PTAL @JeyJeyGao

[Two-Hearts]

second round of review with a question:
In RFC 5652 section 5.3, it says ...version is the syntax version number. If the SignerIdentifier is the CHOICE issuerAndSerialNumber, then the version MUST be 1..., since we only support issuerAndSerialNumber, where are we enforcing the version number check?

[Two-Hearts]

LGTM

[JeyJeyGao]

The unit tests for this PR will be added later, following a few rounds of review.

Unit test has added.

[Two-Hearts]

LGTM

[Two-Hearts]

And as we discussed, we will have another CMS API func (*parsedSignedData) VerifySigner(signerInfo, certifcate) which verifies a specific signer in a Signed-data against user passed in signing certificate (the certificate MUST match signerInfo's sid). This logic is required by Timestamp RFC 3161. @JeyJeyGao

[JeyJeyGao]

And as we discussed, we will have another CMS API func (*parsedSignedData) VerifySigner(signerInfo, certifcate) which verifies a specific signer in a Signed-data against user passed in signing certificate (the certificate MUST match signerInfo's sid). This logic is required by Timestamp RFC 3161. @JeyJeyGao

added func (d *ParsedSignedData) VerifySigner(signerInfo *SignerInfo, signingCertificate *x509.Certificate, opts x509.VerifyOptions) (*x509.Certificate, error) {