PORT_Assert(cmsg); PORT_Assert(cert);
NSS_CMSSignedData_CreateCertsOnly(NSSCMSMessage *cmsg, CERTCertificate *cert, PRBool include_chain){    NSSCMSSignedData *sigd;    void *mark;    PLArenaPool *poolp;    SECStatus rv;    PORT_Assert(cmsg);    PORT_Assert(cert);    if (!cmsg || !cert) {        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);        return NULL;    }    poolp = cmsg->poolp;    mark = PORT_ArenaMark(poolp);    sigd = NSS_CMSSignedData_Create(cmsg);    if (sigd == NULL)	goto loser;    /* no signerinfos, thus no digestAlgorithms */    /* but certs */    if (include_chain) {	rv = NSS_CMSSignedData_AddCertChain(sigd, cert);    } else {	rv = NSS_CMSSignedData_AddCertificate(sigd, cert);    }    if (rv != SECSuccess)	goto loser;    /* RFC2630 5.2 sez:     * In the degenerate case where there are no signers, the     * EncapsulatedContentInfo value being "signed" is irrelevant.  In this     * case, the content type within the EncapsulatedContentInfo value being     * "signed" should be id-data (as defined in section 4), and the content     * field of the EncapsulatedContentInfo value should be omitted.     */    rv = NSS_CMSContentInfo_SetContent_Data(cmsg, &(sigd->contentInfo), NULL, PR_TRUE);    if (rv != SECSuccess)	goto loser;    PORT_ArenaUnmark(poolp, mark);    return sigd;loser:    if (sigd)	NSS_CMSSignedData_Destroy(sigd);    PORT_ArenaRelease(poolp, mark);    return NULL;}