# `Cmsex.Attribute`
[🔗](https://github.com/openspb/cmsex/blob/v0.1.0/lib/cmsex/attribute.ex#L1)

A signed or unsigned attribute of a signer (RFC 5652, 5.3): a type and its
values.

`type` is a name of `Cmsex.OID`, such as `:signing_time`, or the OID as a
tuple when the library does not know it. Each value is one encoded
AttributeValue: as received, in an attribute read from a message, or in
DER, in one built here.

The constructors build the attributes a signer may add; `new/2` builds
any other one from its encoded values. The content-type and
message-digest attributes are always written by `Cmsex.sign/3` itself.

    iex> attr = Cmsex.Attribute.signing_time(~U[2026-10-23 12:00:00Z])
    iex> attr.type
    :signing_time
    iex> attr.values
    [<<0x17, 13, "261023120000Z">>]

# `t`

```elixir
@type t() :: %Cmsex.Attribute{type: atom() | tuple(), values: [binary()]}
```

# `content_hint`

```elixir
@spec content_hint(atom() | tuple(), String.t() | nil) :: %Cmsex.Attribute{
  type: :content_hint,
  values: [binary(), ...]
}
```

The content-hints attribute (RFC 2634, 2.9): the type of the innermost
content, when the signed content is itself a CMS message, and an
optional description.

# `content_type`

```elixir
@spec content_type(atom() | tuple()) :: %Cmsex.Attribute{
  type: :content_type,
  values: [binary(), ...]
}
```

The content-type attribute (RFC 5652, 11.1). `Cmsex.sign/3` writes it
itself; this is for code that builds a SignerInfo some other way.

# `new`

```elixir
@spec new(atom() | tuple(), [binary(), ...]) :: t()
```

An attribute of `type`, a name of `Cmsex.OID` or an OID tuple, with
`values`, each the encoding of one AttributeValue.

    iex> Cmsex.Attribute.new({1, 2, 3, 4}, [<<0x0C, 2, "hi">>])
    %Cmsex.Attribute{type: {1, 2, 3, 4}, values: [<<0x0C, 2, "hi">>]}

# `signing_certificate_v2`

```elixir
@spec signing_certificate_v2(binary(), keyword()) :: %Cmsex.Attribute{
  type: :signing_certificate_v2,
  values: [binary(), ...]
}
```

The signing-certificate-v2 attribute (RFC 5035), which binds the signature
to the certificate of the signer, `certificate` in DER: an ESSCertIDv2
with its hash and, unless `issuer_serial: false`, its issuer and serial
number.

Options: `:hash`, `:sha256` (the default, which the encoding leaves out),
`:sha224`, `:sha384` or `:sha512`; `:issuer_serial` (true).

`Cmsex.verify/2` checks it, and the older signing-certificate attribute
(RFC 2634, 5.4), against the certificate that verified the signature.

# `signing_time`

```elixir
@spec signing_time(DateTime.t()) :: %Cmsex.Attribute{
  type: :signing_time,
  values: [binary(), ...]
}
```

The signing-time attribute (RFC 5652, 11.3), to the second: UTCTime from
1950 to 2049, GeneralizedTime outside that range.

---

*Consult [api-reference.md](api-reference.md) for complete listing*