title: Verify a signature with bouncy castle
body: <p>I inherited some code using the deprecated bouncycastle API. Before updating it to the new API I wanted to write a test to verify that I didn't change its behaviour. However, I cannot work out the correct way to verify this signature that is generated.  The code to be changed is:</p>
  
  <pre><code>public static byte[] createSignedData(byte[] content, X509Certificate cert, PrivateKey key)
          throws NoSuchAlgorithmException, NoSuchProviderException, CMSException, IOException {
  
      // set up the generator
      CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
  
      gen.addSigner(key, cert, CMSSignedGenerator.DIGEST_SHA1);
  
      // create the signed-data object
      CMSProcessable data = new CMSProcessableByteArray(content);
      CMSSignedData signed = gen.generate(data, BC_PROVIDER);
  
      return signed.getEncoded();
  }
  </code></pre>
  
  <p>What is being returned from this code? A detached signature?
  I tried to verify the signature with a small piece of code like this, but it always returns false:</p>
  
  <pre><code>Signature signer = Signature.getInstance(
                                "SHA1withRSA", 
                                BouncyCastleProvider.PROVIDER_NAME);
  signer.initVerify(cert.getPublicKey());
  signer.update(data);
  return signer.verify(sig);
  </code></pre>