java用bc做sm2的P7签名

1. 首先，需要导入Bouncy Castle库。可以在Maven中添加以下依赖项：

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.68</version>
</dependency>

2. 生成SM2密钥对：

Security.addProvider(new BouncyCastleProvider());
KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", "BC");
ECGenParameterSpec ecsp = new ECGenParameterSpec("sm2p256v1");
kpg.initialize(ecsp);
KeyPair keyPair = kpg.generateKeyPair();

3. 使用私钥进行签名：

byte[] data = "hello world".getBytes("UTF-8");
Signature signature = Signature.getInstance("SM3withSM2", "BC");
signature.initSign(keyPair.getPrivate(), new SecureRandom());
signature.update(data);
byte[] sigBytes = signature.sign();

其中，"hello world" 是待签名的数据，SM3withSM2 是签名算法，keyPair.getPrivate() 是私钥。

4. 将签名结果转换成P7格式：

CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
ContentSigner shaSigner = new JcaContentSignerBuilder("SM3withSM2")
        .setProvider("BC")
        .build(keyPair.getPrivate());

JcaSignerInfoGeneratorBuilder builder = new JcaSignerInfoGeneratorBuilder(
        new JcaDigestCalculatorProviderBuilder().setProvider("BC").build());
builder.setDirectSignature(true);

gen.addSignerInfoGenerator(builder.build(shaSigner, new X509CertificateHolder[]{new X509CertificateHolder(cert.getEncoded())}));
gen.addCertificates(new JcaCertStore(Arrays.asList(cert)));

CMSTypedData cmsData = new CMSProcessableByteArray(sigBytes);
CMSSignedData signedData = gen.generate(cmsData, true);
byte[] p7Bytes = signedData.getEncoded();

其中，cert 是证书，可以使用以下代码加载：

CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
InputStream certStream = new FileInputStream("path/to/cert.pem");
X509Certificate cert = (X509Certificate) cf.generateCertificate(certStream);

最终生成的 p7Bytes 就是P7格式的签名结果。