Commit 494351373d for openssl.org

commit 494351373d029416cf778ead930098139e7c7f5c
Author: Dr. David von Oheimb <dev@ddvo.net>
Date:   Thu Oct 5 23:06:32 2023 +0200

    {CMS,PKCS7}_verify.pod: add hint how to override the default 'smime_sign' purpose

    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Thu Sep  3 09:26:55 2026
    Merged-from: https://github.com/openssl/openssl/pull/22285

diff --git a/doc/man3/CMS_verify.pod b/doc/man3/CMS_verify.pod
index 68783076a5..89f6f01311 100644
--- a/doc/man3/CMS_verify.pod
+++ b/doc/man3/CMS_verify.pod
@@ -90,10 +90,9 @@ If any signing certificate cannot be located the operation fails unless
 B<CMS_VERIFY_PARTIAL> is set, where one signing certificate can be sufficient.

 Each found signing certificate is chain verified
-using the trusted certificate store I<store> if supplied.
-The purpose required in this verification is I<smimesign>
-unless a different one (or B<X509_PURPOSE_DEFAULT_ANY>)
-has been set in I<store> using L<X509_STORE_set_purpose(3)>.
+using I<store> as the trusted certificate store if supplied,
+and by default requiring the I<smimesign> purpose.
+The default purpose may be overridden using L<X509_STORE_set_purpose(3)>.
 Any internal certificates in the message, which may have been added using
 L<CMS_add1_cert(3)>, are used as untrusted CAs.
 If CRL checking is enabled in I<store> and B<CMS_NOCRL> is not set,
diff --git a/doc/man3/PKCS7_verify.pod b/doc/man3/PKCS7_verify.pod
index 3dd30b63bf..78af1794cd 100644
--- a/doc/man3/PKCS7_verify.pod
+++ b/doc/man3/PKCS7_verify.pod
@@ -73,11 +73,11 @@ the I<certs> parameter (if it is not NULL). Then they are looked up in any
 certificates contained in the I<p7> structure unless B<PKCS7_NOINTERN> is set.
 If any signer's certificates cannot be located the operation fails.

-Each signer's certificate is chain verified
-using the trusted certificate store I<store> if supplied.
-The purpose required in this verification is I<smimesign>
-unless a different one (or B<X509_PURPOSE_DEFAULT_ANY>) has been set in
-I<store> using L<X509_STORE_set_purpose(3)> and unless B<PKCS7_NOCHAIN> is set.
+Each signer certificate is chain verified
+using I<store> as the trusted certificate store if supplied.
+Unless B<PKCS7_NOCHAIN> is set,
+the default purpose required in this verification is I<smimesign>.
+The default purpose may be overridden using L<X509_STORE_set_purpose(3)>.
 Any internal certificates in the message, which may have been added using
 L<PKCS7_add_certificate(3)>, are used as untrusted CAs unless B<PKCS7_NOCHAIN>
 is set.