Module envelope 

Operations on signed CoRIM envelopes (#6.18(COSE_Sign1) carrying a tagged-unsigned-corim-map payload).

Two public entry points:

• detach_payload splits a bundled signed CoRIM into its CoRIM document and a detached COSE_Sign1 (nil-payload) signature.
• verify_corim_signature cryptographically verifies a detached signature against a document, using the issuer X.509 certificate carried in the envelope’s x5chain / x5bag protected header (RFC 9360).

Design rationale

Parsing and encoding both delegate to the corim crate’s decode_signed_corim / encode_signed_corim entry points – the same code path that the upstream igvm crate uses for its CoRIM support. This keeps a single source of truth for signed-CoRIM envelope handling in the workspace and ensures that any envelope we accept also satisfies draft-ietf-rats-corim section 4.2 (protected header must include corim-meta or cwt-claims).

Cryptographic verification is performed via the workspace crypto crate’s RSA-PSS primitives; only PS384 is currently supported (see verify_corim_signature for details).

Structs

DetachedCorim

Output of detach_payload: the CoRIM document plus a detached COSE_Sign1 envelope (payload field set to nil).

Functions

detach_payload

Split a bundled (payload-embedded) COSE_Sign1 into its CoRIM document payload and a detached COSE_Sign1 signature.

verify_corim_signature

Cryptographically verify a detached COSE_Sign1 CoRIM signature against the document it endorses.