o
    e]                  	   @  s  d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlm	Z
 d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d d	l m!Z!m"Z" d d
l#m$Z$ edddZ%ej&ej'ej(ej)ej*ej+ej,ej-ej.f Z/G dd de0Z1dRddZ2dSddZ3dTdd Z4G d!d" d"Z5G d#d$ d$Z6G d%d& d&ej7Z8G d'd( d(e0Z9G d)d* d*ej:d+Z;e;<e
j; G d,d- d-ej:d+Z=e=<e
j= G d.d/ d/e=Z>G d0d1 d1ej:d+Z?e?<e
j? G d2d3 d3ej:d+Z@e@<e
j@ 	dUdVd8d9ZAdWd;d<ZB	dUdVd=d>ZC	dUdXd?d@ZD	dUdXdAdBZE	dUdYdCdDZF	dUdYdEdFZGG dGdH dHZHG dIdJ dJZIG dKdL dLZJG dMdN dNZKdZdPdQZLdS )[    )annotationsN)utils)x509)hashesserialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                         e Zd Zd	 fddZ  ZS )
AttributeNotFoundmsgstroidr   returnNonec                      t  | || _d S N)super__init__r   )selfr   r   	__class__ FD:\Projects\ConvertPro\env\Lib\site-packages\cryptography/x509/base.pyr$   8      
zAttributeNotFound.__init__)r   r   r   r   r   r    __name__
__module____qualname__r$   __classcell__r(   r(   r&   r)   r   7       r   	extensionExtension[ExtensionType]
extensions%typing.List[Extension[ExtensionType]]r   r    c                 C  s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r1   r3   er(   r(   r)   _reject_duplicate_extension=   s
   r7   r   r   
attributesHtyping.List[typing.Tuple[ObjectIdentifier, bytes, typing.Optional[int]]]c                 C  s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r5   )r   r8   Zattr_oid_r(   r(   r)   _reject_duplicate_attributeG   s
   r;   timedatetime.datetimec                 C  s6   | j dur|  }|r|nt }| jdd| S | S )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r>   	utcoffsetdatetime	timedeltareplace)r<   offsetr(   r(   r)   _convert_to_naive_utc_timeS   s
   
rD   c                   @  sX   e Zd Zejjfdd	d
ZedddZedddZdddZ	dddZ
dddZdS ) 	Attributer   r   valuebytes_typeintr   r    c                 C     || _ || _|| _d S r"   )_oid_valuerH   )r%   r   rF   rH   r(   r(   r)   r$   b      
zAttribute.__init__c                 C     | j S r"   )rK   r%   r(   r(   r)   r   l      zAttribute.oidc                 C  rN   r"   )rL   rO   r(   r(   r)   rF   p   rP   zAttribute.valuer   c                 C  s   d| j  d| jdS )Nz<Attribute(oid=z, value=)>)r   rF   rO   r(   r(   r)   __repr__t      zAttribute.__repr__otherobjectboolc                 C  s2   t |tstS | j|jko| j|jko| j|jkS r"   )
isinstancerE   NotImplementedr   rF   rH   r%   rT   r(   r(   r)   __eq__w   s   


zAttribute.__eq__c                 C  s   t | j| j| jfS r"   )hashr   rF   rH   rO   r(   r(   r)   __hash__   s   zAttribute.__hash__N)r   r   rF   rG   rH   rI   r   r    r   r   r   rG   r   r   rT   rU   r   rV   r   rI   )r,   r-   r.   r   Z
UTF8StringrF   r$   propertyr   rR   rZ   r\   r(   r(   r(   r)   rE   a   s    



rE   c                   @  s8   e Zd ZdddZed\ZZZdd	d
ZdddZ	dS )
Attributesr8   typing.Iterable[Attribute]r   r    c                 C  s   t || _d S r"   )list_attributes)r%   r8   r(   r(   r)   r$      s   zAttributes.__init__rf   r   c                 C  s   d| j  dS )Nz<Attributes(rQ   )rf   rO   r(   r(   r)   rR      s   zAttributes.__repr__r   r   rE   c                 C  s.   | D ]}|j |kr|  S qtd| d|)NzNo z attribute was found)r   r   )r%   r   attrr(   r(   r)   get_attribute_for_oid   s
   
z Attributes.get_attribute_for_oidN)r8   rd   r   r    r_   )r   r   r   rE   )
r,   r-   r.   r$   r   __len____iter____getitem__rR   rh   r(   r(   r(   r)   rc      s
    

rc   c                   @  s   e Zd ZdZdZdS )Versionr      N)r,   r-   r.   v1v3r(   r(   r(   r)   rl      s    rl   c                      r   )
InvalidVersionr   r   parsed_versionrI   r   r    c                   r!   r"   )r#   r$   rq   )r%   r   rq   r&   r(   r)   r$      r*   zInvalidVersion.__init__)r   r   rq   rI   r   r    r+   r(   r(   r&   r)   rp      r0   rp   c                   @  sp  e Zd Zejd<ddZeejd=dd	Zeejd>ddZejd?ddZ	eejd@ddZ
eejd@ddZeejdAddZeejdAddZeejdBddZeejdCddZeejdDd!d"ZeejdEd$d%ZeejdFd&d'ZeejdFd(d)ZeejdFd*d+ZejdGd/d0Zejd=d1d2ZejdHd5d6ZejdId9d:Zd;S )JCertificate	algorithmhashes.HashAlgorithmr   rG   c                 C     dS z4
        Returns bytes using digest passed.
        Nr(   r%   rs   r(   r(   r)   fingerprint       zCertificate.fingerprintrI   c                 C  ru   )z3
        Returns certificate serial number
        Nr(   rO   r(   r(   r)   serial_number   ry   zCertificate.serial_numberrl   c                 C  ru   )z1
        Returns the certificate version
        Nr(   rO   r(   r(   r)   version   ry   zCertificate.versionr   c                 C  ru   z(
        Returns the public key
        Nr(   rO   r(   r(   r)   
public_key   ry   zCertificate.public_keyr=   c                 C  ru   )z?
        Not before time (represented as UTC datetime)
        Nr(   rO   r(   r(   r)   not_valid_before   ry   zCertificate.not_valid_beforec                 C  ru   )z>
        Not after time (represented as UTC datetime)
        Nr(   rO   r(   r(   r)   not_valid_after   ry   zCertificate.not_valid_afterr   c                 C  ru   )z1
        Returns the issuer name object.
        Nr(   rO   r(   r(   r)   issuer   ry   zCertificate.issuerc                 C  ru   z2
        Returns the subject name object.
        Nr(   rO   r(   r(   r)   subject   ry   zCertificate.subject%typing.Optional[hashes.HashAlgorithm]c                 C  ru   zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr(   rO   r(   r(   r)   signature_hash_algorithm   ry   z$Certificate.signature_hash_algorithmr   c                 C  ru   zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr(   rO   r(   r(   r)   signature_algorithm_oid   ry   z#Certificate.signature_algorithm_oid;typing.Union[None, padding.PSS, padding.PKCS1v15, ec.ECDSA]c                 C  ru   )z=
        Returns the signature algorithm parameters.
        Nr(   rO   r(   r(   r)   signature_algorithm_parameters   ry   z*Certificate.signature_algorithm_parametersr   c                 C  ru   )z/
        Returns an Extensions object.
        Nr(   rO   r(   r(   r)   r3      ry   zCertificate.extensionsc                 C  ru   z.
        Returns the signature bytes.
        Nr(   rO   r(   r(   r)   	signature   ry   zCertificate.signaturec                 C  ru   )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr(   rO   r(   r(   r)   tbs_certificate_bytes  ry   z!Certificate.tbs_certificate_bytesc                 C  ru   )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr(   rO   r(   r(   r)   tbs_precertificate_bytes
  ry   z$Certificate.tbs_precertificate_bytesrT   rU   rV   c                 C  ru   z"
        Checks equality.
        Nr(   rY   r(   r(   r)   rZ     ry   zCertificate.__eq__c                 C  ru   z"
        Computes a hash.
        Nr(   rO   r(   r(   r)   r\     ry   zCertificate.__hash__encodingserialization.Encodingc                 C  ru   )zB
        Serializes the certificate to PEM or DER format.
        Nr(   r%   r   r(   r(   r)   public_bytes  ry   zCertificate.public_bytesr   r    c                 C  ru   )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr(   )r%   r   r(   r(   r)   verify_directly_issued_by$  ry   z%Certificate.verify_directly_issued_byNrs   rt   r   rG   ra   )r   rl   r   r   r   r=   r   r   r   r   r]   )r   r   r   r   r^   r`   r   r   r   rG   )r   rr   r   r    )r,   r-   r.   abcabstractmethodrx   rb   rz   r{   r}   r~   r   r   r   r   r   r   r3   r   r   r   rZ   r\   r   r   r(   r(   r(   r)   rr      sh    rr   )	metaclassc                   @  sH   e Zd ZeejdddZeejdddZeejdd	d
ZdS )RevokedCertificater   rI   c                 C  ru   )zG
        Returns the serial number of the revoked certificate.
        Nr(   rO   r(   r(   r)   rz   2  ry   z RevokedCertificate.serial_numberr=   c                 C  ru   )zH
        Returns the date of when this certificate was revoked.
        Nr(   rO   r(   r(   r)   revocation_date9  ry   z"RevokedCertificate.revocation_dater   c                 C  ru   )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr(   rO   r(   r(   r)   r3   @  ry   zRevokedCertificate.extensionsNra   r   r   )	r,   r-   r.   rb   r   r   rz   r   r3   r(   r(   r(   r)   r   1  s    r   c                   @  s@   e Zd ZdddZedd
dZedddZedddZdS )_RawRevokedCertificaterz   rI   r   r=   r3   r   c                 C  rJ   r"   _serial_number_revocation_date_extensionsr%   rz   r   r3   r(   r(   r)   r$   M  rM   z_RawRevokedCertificate.__init__r   c                 C  rN   r"   )r   rO   r(   r(   r)   rz   W  rP   z$_RawRevokedCertificate.serial_numberc                 C  rN   r"   )r   rO   r(   r(   r)   r   [  rP   z&_RawRevokedCertificate.revocation_datec                 C  rN   r"   )r   rO   r(   r(   r)   r3   _  rP   z!_RawRevokedCertificate.extensionsN)rz   rI   r   r=   r3   r   ra   r   r   )r,   r-   r.   r$   rb   rz   r   r3   r(   r(   r(   r)   r   L  s    

r   c                   @  sL  e Zd Zejd?ddZejd@d	d
ZejdAddZeejdBddZ	eejdCddZ
eejdDddZeejdEddZeejdFddZeejdGd d!ZeejdHd"d#ZeejdHd$d%ZejdId)d*ZejdJd+d,ZejdKd/d0ZejdLd3d0ZejdMd6d0ZejdNd8d9ZejdOd<d=Zd>S )PCertificateRevocationListr   r   r   rG   c                 C  ru   )z:
        Serializes the CRL to PEM or DER format.
        Nr(   r   r(   r(   r)   r   e  ry   z&CertificateRevocationList.public_bytesrs   rt   c                 C  ru   rv   r(   rw   r(   r(   r)   rx   k  ry   z%CertificateRevocationList.fingerprintrz   rI   #typing.Optional[RevokedCertificate]c                 C  ru   )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr(   )r%   rz   r(   r(   r)   (get_revoked_certificate_by_serial_numberq  ry   zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr   c                 C  ru   r   r(   rO   r(   r(   r)   r   z  ry   z2CertificateRevocationList.signature_hash_algorithmr   c                 C  ru   r   r(   rO   r(   r(   r)   r     ry   z1CertificateRevocationList.signature_algorithm_oidr   c                 C  ru   )zC
        Returns the X509Name with the issuer of this CRL.
        Nr(   rO   r(   r(   r)   r     ry   z CertificateRevocationList.issuer"typing.Optional[datetime.datetime]c                 C  ru   )z?
        Returns the date of next update for this CRL.
        Nr(   rO   r(   r(   r)   next_update  ry   z%CertificateRevocationList.next_updater=   c                 C  ru   )z?
        Returns the date of last update for this CRL.
        Nr(   rO   r(   r(   r)   last_update  ry   z%CertificateRevocationList.last_updater   c                 C  ru   )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr(   rO   r(   r(   r)   r3     ry   z$CertificateRevocationList.extensionsc                 C  ru   r   r(   rO   r(   r(   r)   r     ry   z#CertificateRevocationList.signaturec                 C  ru   )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr(   rO   r(   r(   r)   tbs_certlist_bytes  ry   z,CertificateRevocationList.tbs_certlist_bytesrT   rU   rV   c                 C  ru   r   r(   rY   r(   r(   r)   rZ     ry   z CertificateRevocationList.__eq__c                 C  ru   )z<
        Number of revoked certificates in the CRL.
        Nr(   rO   r(   r(   r)   ri     ry   z!CertificateRevocationList.__len__idxr   c                 C     d S r"   r(   r%   r   r(   r(   r)   rk        z%CertificateRevocationList.__getitem__slicetyping.List[RevokedCertificate]c                 C  r   r"   r(   r   r(   r(   r)   rk     r   typing.Union[int, slice]Atyping.Union[RevokedCertificate, typing.List[RevokedCertificate]]c                 C  ru   )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr(   r   r(   r(   r)   rk     ry   #typing.Iterator[RevokedCertificate]c                 C  ru   )z8
        Iterator over the revoked certificates
        Nr(   rO   r(   r(   r)   rj     ry   z"CertificateRevocationList.__iter__r}   r   c                 C  ru   )zQ
        Verifies signature of revocation list against given public key.
        Nr(   )r%   r}   r(   r(   r)   is_signature_valid  ry   z,CertificateRevocationList.is_signature_validNr   r   )rz   rI   r   r   r   r]   r   )r   r   r   r   r^   r`   ra   )r   rI   r   r   )r   r   r   r   )r   r   r   r   )r   r   )r}   r   r   rV   )r,   r-   r.   r   r   r   rx   r   rb   r   r   r   r   r   r3   r   r   rZ   ri   typingoverloadrk   rj   r   r(   r(   r(   r)   r   d  sZ    r   c                   @  s   e Zd Zejd+ddZejd,dd	Zejd-ddZeejd.ddZ	eejd/ddZ
eejd0ddZeejd1ddZeejd2ddZejd3dd Zeejd4d!d"Zeejd4d#d$Zeejd5d%d&Zejd6d(d)Zd*S )7CertificateSigningRequestrT   rU   r   rV   c                 C  ru   r   r(   rY   r(   r(   r)   rZ     ry   z CertificateSigningRequest.__eq__rI   c                 C  ru   r   r(   rO   r(   r(   r)   r\     ry   z"CertificateSigningRequest.__hash__r   c                 C  ru   r|   r(   rO   r(   r(   r)   r}     ry   z$CertificateSigningRequest.public_keyr   c                 C  ru   r   r(   rO   r(   r(   r)   r     ry   z!CertificateSigningRequest.subjectr   c                 C  ru   r   r(   rO   r(   r(   r)   r     ry   z2CertificateSigningRequest.signature_hash_algorithmr   c                 C  ru   r   r(   rO   r(   r(   r)   r     ry   z1CertificateSigningRequest.signature_algorithm_oidr   c                 C  ru   )z@
        Returns the extensions in the signing request.
        Nr(   rO   r(   r(   r)   r3     ry   z$CertificateSigningRequest.extensionsrc   c                 C  ru   )z/
        Returns an Attributes object.
        Nr(   rO   r(   r(   r)   r8     ry   z$CertificateSigningRequest.attributesr   r   rG   c                 C  ru   )z;
        Encodes the request to PEM or DER format.
        Nr(   r   r(   r(   r)   r     ry   z&CertificateSigningRequest.public_bytesc                 C  ru   r   r(   rO   r(   r(   r)   r   "  ry   z#CertificateSigningRequest.signaturec                 C  ru   )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr(   rO   r(   r(   r)   tbs_certrequest_bytes)  ry   z/CertificateSigningRequest.tbs_certrequest_bytesc                 C  ru   )z8
        Verifies signature of signing request.
        Nr(   rO   r(   r(   r)   r   1  ry   z,CertificateSigningRequest.is_signature_validr   c                 C  ru   )z:
        Get the attribute value for a given OID.
        Nr(   )r%   r   r(   r(   r)   rh   8  ry   z/CertificateSigningRequest.get_attribute_for_oidNr`   ra   r   r   r   r]   r   )r   rc   r   r^   )r   rV   )r   r   r   rG   )r,   r-   r.   r   r   rZ   r\   r}   rb   r   r   r   r3   r8   r   r   r   r   rh   r(   r(   r(   r)   r     sF    r   datarG   backend
typing.Anyc                 C  
   t | S r"   )	rust_x509load_pem_x509_certificater   r   r(   r(   r)   r   D     
r   typing.List[Certificate]c                 C  r   r"   )r   load_pem_x509_certificates)r   r(   r(   r)   r   J  s   
r   c                 C  r   r"   )r   load_der_x509_certificater   r(   r(   r)   r   O  r   r   c                 C  r   r"   )r   load_pem_x509_csrr   r(   r(   r)   r   V  r   r   c                 C  r   r"   )r   load_der_x509_csrr   r(   r(   r)   r   ]  r   r   c                 C  r   r"   )r   load_pem_x509_crlr   r(   r(   r)   r   d  r   r   c                 C  r   r"   )r   load_der_x509_crlr   r(   r(   r)   r   k  r   r   c                   @  sP   e Zd Zdg g fd'dd	Zd(ddZd)ddZddd*ddZ	d+d,d%d&ZdS )- CertificateSigningRequestBuilderNsubject_nametyping.Optional[Name]r3   r4   r8   r9   c                 C  s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   rf   )r%   r   r3   r8   r(   r(   r)   r$   r  s   
z)CertificateSigningRequestBuilder.__init__namer   r   c                 C  s4   t |ts	td| jdurtdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rW   r   	TypeErrorr   r5   r   r   rf   r%   r   r(   r(   r)   r     s   


z-CertificateSigningRequestBuilder.subject_nameextvalr   criticalrV   c                 C  sD   t |ts	tdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rW   r   r   r   r   r7   r   r   r   rf   r%   r   r   r1   r(   r(   r)   add_extension  s   

z.CertificateSigningRequestBuilder.add_extension)_tagr   r   rF   rG   r   typing.Optional[_ASN1Type]c                C  s|   t |ts	tdt |tstd|durt |tstdt|| j |dur-|j}nd}t| j	| j
| j|||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rW   r   r   rG   r   r;   rf   rF   r   r   r   )r%   r   rF   r   tagr(   r(   r)   add_attribute  s   


z.CertificateSigningRequestBuilder.add_attributeprivate_keyr   rs   "typing.Optional[_AllowedHashTypes]r   r   r   c                 C  s    | j du r	tdt| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r5   r   Zcreate_x509_csrr%   r   rs   r   r(   r(   r)   sign  s   
	z%CertificateSigningRequestBuilder.sign)r   r   r3   r4   r8   r9   )r   r   r   r   )r   r   r   rV   r   r   )r   r   rF   rG   r   r   r   r   r"   )r   r   rs   r   r   r   r   r   )r,   r-   r.   r$   r   r   r   r   r(   r(   r(   r)   r   q  s    

$r   c                   @  s   e Zd ZU ded< ddddddg fd9ddZd:ddZd:ddZd;ddZd<dd Zd=d#d$Z	d=d%d&Z
d>d+d,Z	d?dd-d@d7d8ZdS )ACertificateBuilderr4   r   Nissuer_namer   r   r}   *typing.Optional[CertificatePublicKeyTypes]rz   typing.Optional[int]r~   r   r   r3   r   r    c                 C  s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r"   )
rl   ro   _version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r%   r   r   r}   rz   r~   r   r3   r(   r(   r)   r$     s   

zCertificateBuilder.__init__r   r   c                 C  sD   t |ts	td| jdurtdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rW   r   r   r   r5   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

zCertificateBuilder.issuer_namec                 C  sD   t |ts	td| jdurtdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rW   r   r   r   r5   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

zCertificateBuilder.subject_namekeyr   c              	   C  s`   t |tjtjtjtjt	j
tjtjfstd| jdur tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rW   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyr
   ZEd25519PublicKeyr	   ZEd448PublicKeyr   ZX25519PublicKeyr   ZX448PublicKeyr   r   r5   r   r   r   r   r   r   r   )r%   r   r(   r(   r)   r}     s2   
zCertificateBuilder.public_keynumberrI   c                 C  sh   t |ts	td| jdurtd|dkrtd| dkr$tdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rW   rI   r   r   r5   
bit_lengthr   r   r   r   r   r   r   r%   r   r(   r(   r)   rz   ,  s&   

z CertificateBuilder.serial_numberr<   r=   c                 C  sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jkr-tdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rW   r@   r   r   r5   rD   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r%   r<   r(   r(   r)   r~   G  s,   
z#CertificateBuilder.not_valid_beforec                 C  sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jk r-tdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rW   r@   r   r   r5   rD   r   r   r   r   r   r   r   r   r   r(   r(   r)   r   d  s.   


z"CertificateBuilder.not_valid_afterr   r   r   rV   c              	   C  sT   t |ts	tdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )rW   r   r   r   r   r7   r   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

z CertificateBuilder.add_extension)rsa_paddingr   r   rs   r   r   r   r   <typing.Optional[typing.Union[padding.PSS, padding.PKCS1v15]]rr   c                C  s   | j du r	td| jdu rtd| jdu rtd| jdu r$td| jdu r-td| jdu r6td|durQt|tj	tj
fsGtdt|tjsQtd	t| |||S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyzPadding must be PSS or PKCS1v15z&Padding is only supported for RSA keys)r   r5   r   r   r   r   r   rW   r   ZPSSZPKCS1v15r   r   ZRSAPrivateKeyr   Zcreate_x509_certificate)r%   r   rs   r   r   r(   r(   r)   r     s(   





zCertificateBuilder.sign)r   r   r   r   r}   r   rz   r   r~   r   r   r   r3   r4   r   r    )r   r   r   r   )r   r   r   r   )r   rI   r   r   )r<   r=   r   r   )r   r   r   rV   r   r   r"   )
r   r   rs   r   r   r   r   r   r   rr   )r,   r-   r.   __annotations__r$   r   r   r}   rz   r~   r   r   r   r(   r(   r(   r)   r     s*   
 



%


 r   c                   @  st   e Zd ZU ded< ded< dddg g fd+ddZd,ddZd-ddZd.ddZd/ddZd0d d!Z		d1d2d)d*Z
dS )3 CertificateRevocationListBuilderr4   r   r   _revoked_certificatesNr   r   r   r   r   r3   revoked_certificatesc                 C  s"   || _ || _|| _|| _|| _d S r"   )r   _last_update_next_updater   r   )r%   r   r   r   r3   r   r(   r(   r)   r$     s
   
z)CertificateRevocationListBuilder.__init__r   r   c                 C  s<   t |ts	td| jd urtdt|| j| j| j| j	S )Nr   r   )
rW   r   r   r   r5   r   r   r   r   r   )r%   r   r(   r(   r)   r     s   

z,CertificateRevocationListBuilder.issuer_namer=   c                 C  sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jkr-tdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rW   r@   r   r   r5   rD   r   r   r   r   r   r   )r%   r   r(   r(   r)   r     s(   
z,CertificateRevocationListBuilder.last_updatec                 C  sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jk r-tdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)rW   r@   r   r   r5   rD   r   r   r   r   r   r   )r%   r   r(   r(   r)   r     s(   
z,CertificateRevocationListBuilder.next_updater   r   r   rV   c                 C  sL   t |ts	tdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rW   r   r   r   r   r7   r   r   r   r   r   r   r   r(   r(   r)   r     s   

z.CertificateRevocationListBuilder.add_extensionrevoked_certificater   c                 C  s2   t |ts	tdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rW   r   r   r   r   r   r   r   r   )r%   r   r(   r(   r)   add_revoked_certificate(  s   

z8CertificateRevocationListBuilder.add_revoked_certificater   r   rs   r   r   r   r   c                 C  sD   | j d u r	td| jd u rtd| jd u rtdt| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r5   r   r   r   Zcreate_x509_crlr   r(   r(   r)   r   9  s   


z%CertificateRevocationListBuilder.sign)
r   r   r   r   r   r   r3   r4   r   r   )r   r   r   r   )r   r=   r   r   )r   r=   r   r   )r   r   r   rV   r   r   )r   r   r   r   r"   )r   r   rs   r   r   r   r   r   )r,   r-   r.   r   r$   r   r   r   r   r  r   r(   r(   r(   r)   r     s    
 




r   c                   @  sH   e Zd Zddg fddd	ZdddZd ddZd!ddZd"d#ddZdS )$RevokedCertificateBuilderNrz   r   r   r   r3   r4   c                 C  rJ   r"   r   r   r(   r(   r)   r$   L  rM   z"RevokedCertificateBuilder.__init__r   rI   r   c                 C  sX   t |ts	td| jd urtd|dkrtd| dkr$tdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	rW   rI   r   r   r5   r   r  r   r   r   r(   r(   r)   rz   V  s   


z'RevokedCertificateBuilder.serial_numberr<   r=   c                 C  sN   t |tjs
td| jd urtdt|}|tk rtdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rW   r@   r   r   r5   rD   r   r  r   r   r   r(   r(   r)   r   h  s   

z)RevokedCertificateBuilder.revocation_dater   r   r   rV   c                 C  sD   t |ts	tdt|j||}t|| j t| j| j	| j|g S )Nr   )
rW   r   r   r   r   r7   r   r  r   r   r   r(   r(   r)   r   x  s   

z'RevokedCertificateBuilder.add_extensionr   r   r   c                 C  s:   | j d u r	td| jd u rtdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r5   r   r   r   r   )r%   r   r(   r(   r)   build  s   

zRevokedCertificateBuilder.build)rz   r   r   r   r3   r4   )r   rI   r   r  )r<   r=   r   r  )r   r   r   rV   r   r  r"   )r   r   r   r   )r,   r-   r.   r$   rz   r   r   r  r(   r(   r(   r)   r  K  s    



r  rI   c                   C  s   t tddd? S )N   bigr   )rI   
from_bytesosurandomr(   r(   r(   r)   random_serial_number  rS   r	  )r1   r2   r3   r4   r   r    )r   r   r8   r9   r   r    )r<   r=   r   r=   r"   )r   rG   r   r   r   rr   )r   rG   r   r   )r   rG   r   r   r   r   )r   rG   r   r   r   r   ra   )M
__future__r   r   r@   r  r   Zcryptographyr   Z"cryptography.hazmat.bindings._rustr   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r   r   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   r   r   Zcryptography.x509.extensionsr   r   r   r   Zcryptography.x509.namer   r   Zcryptography.x509.oidr   r   UnionSHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypes	Exceptionr   r7   r;   rD   rE   rc   Enumrl   rp   ABCMetarr   registerr   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r	  r(   r(   r(   r)   <module>   s~   (




$ |]
\ x I