From 22dc77e1e3478f430cc6f07560652bb6a5fab3a3 Mon Sep 17 00:00:00 2001
From: Eric Berggren <eric_berggren@apple.com>
Date: Thu, 16 Jul 2026 14:24:21 -0700
Subject: [PATCH] CMS.isValidAttachedSignature() not using
 additionalIntermediateCertificates arg

Motivation:

CMS.isValidAttachedSignature() accepts additionalIntermediateCertificates[] but doesn't pass it along to .isValidSignature(), causing verification of messages with an attached signature to fail if it contains intermediate cert(s).

Modifications:

* Pass additionalIntermediateCertificates[] arg in CMS.isValidAttachedSignature() onto .isValidSignature()
* Added CMSTests.testCanProvideIntermediatesDuringAttachedVerification() test case (demonstrating the fix)

Result:

CMS messages with attached signatures containing intermediate certs will now pass verification via CMS.isValidAttachedSignature()
---
 .../CMSOperations.swift                       |  1 +
 Tests/X509Tests/CMSTests.swift                | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/Sources/X509/CryptographicMessageSyntax/CMSOperations.swift b/Sources/X509/CryptographicMessageSyntax/CMSOperations.swift
index cc49e35a..e96032ef 100644
--- a/Sources/X509/CryptographicMessageSyntax/CMSOperations.swift
+++ b/Sources/X509/CryptographicMessageSyntax/CMSOperations.swift
@@ -232,6 +232,7 @@ public enum CMS: Sendable {
             return try await isValidSignature(
                 dataBytes: attachedData.bytes,
                 signatureBytes: signatureBytes,
+                additionalIntermediateCertificates: additionalIntermediateCertificates,
                 trustRoots: trustRoots,
                 diagnosticCallback: diagnosticCallback,
                 microsoftCompatible: microsoftCompatible,
diff --git a/Tests/X509Tests/CMSTests.swift b/Tests/X509Tests/CMSTests.swift
index 7a3c40a2..36154e83 100644
--- a/Tests/X509Tests/CMSTests.swift
+++ b/Tests/X509Tests/CMSTests.swift
@@ -1039,6 +1039,26 @@ final class CMSTests: XCTestCase {
         XCTAssertValidSignature(isValidSignature)
     }
 
+    func testCanProvideIntermediatesDuringAttachedVerification() async throws {
+        let data: [UInt8] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
+
+        let signature = try CMS.sign(
+            data,
+            signatureAlgorithm: .ecdsaWithSHA256,
+            certificate: Self.leaf2Cert,
+            privateKey: Self.leaf2Key,
+            detached: false
+        )
+        let isValidSignature = await CMS.isValidAttachedSignature(
+            signatureBytes: signature,
+            additionalIntermediateCertificates: [Self.intermediateCert],
+            trustRoots: CertificateStore([Self.rootCert])
+        ) {
+            Self.defaultPolicies
+        }
+        XCTAssertValidSignature(isValidSignature)
+    }
+
     func testCanProvideIntermediatesInSigningProcess() async throws {
         let data: [UInt8] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]