rdar://161919434 Upstream pkg-signer* support

In order to make `pkg-signer*` work, we needed to make some changes to `swift-certificates` exposing certain entities publicly and adding trusted timestamp support to CMS.

Author: emaloney

Sources/X509/CryptographicMessageSyntax/CMSSignerInfo.swift

@@ -137,7 +137,7 @@ struct CMSSignerInfo: DERImplicitlyTaggable, BERImplicitlyTaggable, Hashable, Se
                 node in
                 return try DER.set(
                     of: CMSAttribute.self,
-                    identifier: .init(tagWithNumber: 0, tagClass: .contextSpecific),
+                    identifier: .init(tagWithNumber: 1, tagClass: .contextSpecific),
                     rootNode: node
                 )
             }
@@ -192,7 +192,7 @@ struct CMSSignerInfo: DERImplicitlyTaggable, BERImplicitlyTaggable, Hashable, Se
                 node in
                 return try BER.set(
                     of: CMSAttribute.self,
-                    identifier: .init(tagWithNumber: 0, tagClass: .contextSpecific),
+                    identifier: .init(tagWithNumber: 1, tagClass: .contextSpecific),
                     rootNode: node
                 )
             }

Tests/X509Tests/CMSSignerInfoUnsignedAttributesRoundTripTest.swift

@@ -0,0 +1,59 @@
+//===----------------------------------------------------------------------===//
+//
+// This source file is part of the SwiftCertificates open source project
+//
+// Copyright (c) 2026 Apple Inc. and the SwiftCertificates project authors
+// Licensed under Apache License v2.0
+//
+// See LICENSE.txt for license information
+// See CONTRIBUTORS.txt for the list of SwiftCertificates project authors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+//===----------------------------------------------------------------------===//
+
+import XCTest
+import SwiftASN1
+@testable @_spi(CMS) import X509
+
+final class CMSSignerInfoUnsignedAttributesRoundTripTest: XCTestCase
+{
+    private func assertRoundTrips<ASN1Object: DERParseable & DERSerializable & Equatable>(_ value: ASN1Object)
+        throws
+    {
+        var serializer = DER.Serializer()
+        try serializer.serialize(value)
+        let parsed = try ASN1Object(derEncoded: serializer.serializedBytes)
+        XCTAssertEqual(parsed, value)
+    }
+
+    func testCMSSignerInfoWithUnsignedAttrsRoundTrips()
+        throws
+    {
+        // A SignerInfo carrying unsignedAttrs must survive a serialize/parse round trip.
+        // This exercises the `[1] IMPLICIT` unsignedAttrs path.
+        let unsignedAttr = CMSAttribute(
+            attrType: .contentType,
+            attrValues: [try ASN1Any(erasing: ASN1OctetString(contentBytes: [0xDE, 0xAD, 0xBE, 0xEF]))]
+        )
+        try assertRoundTrips(
+            CMSSignerInfo(
+                version: .v1,
+                signerIdentifier: .issuerAndSerialNumber(
+                    .init(
+                        issuer: .init {
+                            CountryName("US")
+                            OrganizationName("Apple Inc.")
+                            CommonName("Apple Public EV Server ECC CA 1 - G1")
+                        },
+                        serialNumber: .init(bytes: [20, 30, 40, 50])
+                    )
+                ),
+                digestAlgorithm: .sha256WithRSAEncryptionUsingNil,
+                signatureAlgorithm: .ecdsaWithSHA256,
+                signature: .init(contentBytes: [100, 110, 120, 130, 140]),
+                unsignedAttrs: [unsignedAttr]
+            )
+        )
+    }
+}