o
    ÖèFhE�  ã                	   @  sp  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZm Z  d d	l!m"Z"m#Z# d d
l$m%Z% e ddd¡Z&ej'ej(ej)ej*ej+ej,ej-ej.ej/f Z0G dd„ de1ƒZ2d?dd„Z3d@dd„Z4dAdd „Z5G d!d"„ d"ƒZ6G d#d$„ d$ƒZ7G d%d&„ d&ej8ƒZ9G d'd(„ d(e1ƒZ:G d)d*„ d*ej;d+�Z<e< =ej<¡ G d,d-„ d-ej;d+�Z>e> =ej>¡ G d.d/„ d/e>ƒZ?G d0d1„ d1ej;d+�Z@e@ =ej@¡ G d2d3„ d3ej;d+�ZAeA =ejA¡ ejBZBejCZCejDZDejEZEejFZFejGZGejHZHG d4d5„ d5ƒZIG d6d7„ d7ƒZJG d8d9„ d9ƒZKG d:d;„ d;ƒZLdBd=d>„ZMdS )Cé    )ÚannotationsN)Úutils)Úx509)ÚhashesÚserialization)ÚdsaÚecÚed448Úed25519ÚpaddingÚrsaÚx448Úx25519)Ú CertificateIssuerPrivateKeyTypesÚCertificateIssuerPublicKeyTypesÚCertificatePublicKeyTypes)Ú	ExtensionÚ
ExtensionsÚExtensionTypeÚ_make_sequence_methods)ÚNameÚ	_ASN1Type)ÚObjectIdentifieriž  é   c                      ó   e Zd Zd	‡ fdd„Z‡  ZS )
ÚAttributeNotFoundÚmsgÚstrÚoidr   ÚreturnÚNonec                   ó   t ƒ  |¡ || _d S ©N)ÚsuperÚ__init__r   )Úselfr   r   ©Ú	__class__© úO/var/www/html/loop/nvenv/lib/python3.10/site-packages/cryptography/x509/base.pyr$   9   ó   
zAttributeNotFound.__init__)r   r   r   r   r   r    ©Ú__name__Ú
__module__Ú__qualname__r$   Ú__classcell__r(   r(   r&   r)   r   8   ó    r   Ú	extensionúExtension[ExtensionType]Ú
extensionsúlist[Extension[ExtensionType]]r   r    c                 C  s"   |D ]}|j | j krtdƒ‚qd S )Nz$This extension has already been set.)r   Ú
ValueError)r1   r3   Úer(   r(   r)   Ú_reject_duplicate_extension>   s
   ÿÿr7   r   r   Ú
attributesú0list[tuple[ObjectIdentifier, bytes, int | None]]c                 C  s$   |D ]\}}}|| krt dƒ‚qd S )Nz$This attribute has already been set.)r5   )r   r8   Úattr_oidÚ_r(   r(   r)   Ú_reject_duplicate_attributeH   s
   ÿÿr<   Útimeúdatetime.datetimec                 C  s6   | j dur|  ¡ }|r|nt ¡ }| jdd�| S | S )z’Normalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N©Útzinfo)r@   Ú	utcoffsetÚdatetimeÚ	timedeltaÚreplace)r=   Úoffsetr(   r(   r)   Ú_convert_to_naive_utc_timeR   s
   
rF   c                   @  sX   e Zd Zejjfdd	d
„Zeddd„ƒZeddd„ƒZddd„Z	ddd„Z
ddd„ZdS ) Ú	Attributer   r   ÚvalueÚbytesÚ_typeÚintr   r    c                 C  ó   || _ || _|| _d S r"   )Ú_oidÚ_valuerJ   )r%   r   rH   rJ   r(   r(   r)   r$   a   ó   
zAttribute.__init__c                 C  ó   | j S r"   )rM   ©r%   r(   r(   r)   r   k   ó   zAttribute.oidc                 C  rP   r"   )rN   rQ   r(   r(   r)   rH   o   rR   zAttribute.valuer   c                 C  s   d| j › d| j›d�S )Nz<Attribute(oid=z, value=ú)>)r   rH   rQ   r(   r(   r)   Ú__repr__s   ó   zAttribute.__repr__ÚotherÚobjectÚboolc                 C  s2   t |tƒstS | j|jko| j|jko| j|jkS r"   )Ú
isinstancerG   ÚNotImplementedr   rH   rJ   ©r%   rV   r(   r(   r)   Ú__eq__v   s   

ÿ
ýzAttribute.__eq__c                 C  s   t | j| j| jfƒS r"   )Úhashr   rH   rJ   rQ   r(   r(   r)   Ú__hash__€   s   zAttribute.__hash__N)r   r   rH   rI   rJ   rK   r   r    ©r   r   ©r   rI   ©r   r   ©rV   rW   r   rX   ©r   rK   )r,   r-   r.   r   Ú
UTF8StringrH   r$   Úpropertyr   rT   r\   r^   r(   r(   r(   r)   rG   `   s    ü



rG   c                   @  s8   e Zd Zddd„Zedƒ\ZZZdd	d
„Zddd„Z	dS )Ú
Attributesr8   útyping.Iterable[Attribute]r   r    c                 C  s   t |ƒ| _d S r"   )ÚlistÚ_attributes)r%   r8   r(   r(   r)   r$   …   s   zAttributes.__init__ri   r   c                 C  s   d| j › d�S )Nz<Attributes(rS   )ri   rQ   r(   r(   r)   rT   �   s   zAttributes.__repr__r   r   rG   c                 C  s.   | D ]}|j |kr|  S qtd|› d�|ƒ‚)NzNo z attribute was found)r   r   )r%   r   Úattrr(   r(   r)   Úget_attribute_for_oid�   s
   
ÿz Attributes.get_attribute_for_oidN)r8   rg   r   r    ra   )r   r   r   rG   )
r,   r-   r.   r$   r   Ú__len__Ú__iter__Ú__getitem__rT   rk   r(   r(   r(   r)   rf   „   s
    

rf   c                   @  s   e Zd ZdZdZdS )ÚVersionr   é   N)r,   r-   r.   Úv1Úv3r(   r(   r(   r)   ro   ˜   s    ro   c                      r   )
ÚInvalidVersionr   r   Úparsed_versionrK   r   r    c                   r!   r"   )r#   r$   rt   )r%   r   rt   r&   r(   r)   r$   ž   r*   zInvalidVersion.__init__)r   r   rt   rK   r   r    r+   r(   r(   r&   r)   rs   �   r0   rs   c                   @  s˜  e Zd Zejd@dd„ƒZeejdAdd	„ƒƒZeejdBdd„ƒƒZejdCdd„ƒZ	eejdDdd„ƒƒZ
eejdDdd„ƒƒZeejdDdd„ƒƒZeejdDdd„ƒƒZeejdEdd„ƒƒZeejdEdd„ƒƒZeejdFdd „ƒƒZeejdGd"d#„ƒƒZeejdHd%d&„ƒƒZeejdId(d)„ƒƒZeejdJd*d+„ƒƒZeejdJd,d-„ƒƒZeejdJd.d/„ƒƒZejdKd3d4„ƒZejdAd5d6„ƒZejdLd9d:„ƒZejdMd=d>„ƒZd?S )NÚCertificateÚ	algorithmúhashes.HashAlgorithmr   rI   c                 C  ó   dS ©z4
        Returns bytes using digest passed.
        Nr(   ©r%   rv   r(   r(   r)   Úfingerprint¤   ó    zCertificate.fingerprintrK   c                 C  rx   )z3
        Returns certificate serial number
        Nr(   rQ   r(   r(   r)   Úserial_numberª   r|   zCertificate.serial_numberro   c                 C  rx   )z1
        Returns the certificate version
        Nr(   rQ   r(   r(   r)   Úversion±   r|   zCertificate.versionr   c                 C  rx   ©z(
        Returns the public key
        Nr(   rQ   r(   r(   r)   Ú
public_key¸   r|   zCertificate.public_keyr>   c                 C  rx   )z?
        Not before time (represented as UTC datetime)
        Nr(   rQ   r(   r(   r)   Únot_valid_before¾   r|   zCertificate.not_valid_beforec                 C  rx   )zK
        Not before time (represented as a non-naive UTC datetime)
        Nr(   rQ   r(   r(   r)   Únot_valid_before_utcÅ   r|   z Certificate.not_valid_before_utcc                 C  rx   )z>
        Not after time (represented as UTC datetime)
        Nr(   rQ   r(   r(   r)   Únot_valid_afterÌ   r|   zCertificate.not_valid_afterc                 C  rx   )zJ
        Not after time (represented as a non-naive UTC datetime)
        Nr(   rQ   r(   r(   r)   Únot_valid_after_utcÓ   r|   zCertificate.not_valid_after_utcr   c                 C  rx   )z1
        Returns the issuer name object.
        Nr(   rQ   r(   r(   r)   ÚissuerÚ   r|   zCertificate.issuerc                 C  rx   ©z2
        Returns the subject name object.
        Nr(   rQ   r(   r(   r)   Úsubjectá   r|   zCertificate.subjectúhashes.HashAlgorithm | Nonec                 C  rx   ©zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr(   rQ   r(   r(   r)   Úsignature_hash_algorithmè   r|   z$Certificate.signature_hash_algorithmr   c                 C  rx   ©zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr(   rQ   r(   r(   r)   Úsignature_algorithm_oidò   r|   z#Certificate.signature_algorithm_oidú0None | padding.PSS | padding.PKCS1v15 | ec.ECDSAc                 C  rx   ©z=
        Returns the signature algorithm parameters.
        Nr(   rQ   r(   r(   r)   Úsignature_algorithm_parametersù   r|   z*Certificate.signature_algorithm_parametersr   c                 C  rx   )z/
        Returns an Extensions object.
        Nr(   rQ   r(   r(   r)   r3     r|   zCertificate.extensionsc                 C  rx   ©z.
        Returns the signature bytes.
        Nr(   rQ   r(   r(   r)   Ú	signature	  r|   zCertificate.signaturec                 C  rx   )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr(   rQ   r(   r(   r)   Útbs_certificate_bytes  r|   z!Certificate.tbs_certificate_bytesc                 C  rx   )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr(   rQ   r(   r(   r)   Útbs_precertificate_bytes  r|   z$Certificate.tbs_precertificate_bytesrV   rW   rX   c                 C  rx   ©z"
        Checks equality.
        Nr(   r[   r(   r(   r)   r\     r|   zCertificate.__eq__c                 C  rx   ©z"
        Computes a hash.
        Nr(   rQ   r(   r(   r)   r^   %  r|   zCertificate.__hash__Úencodingúserialization.Encodingc                 C  rx   )zB
        Serializes the certificate to PEM or DER format.
        Nr(   ©r%   r–   r(   r(   r)   Úpublic_bytes+  r|   zCertificate.public_bytesr…   r    c                 C  rx   )zÕ
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr(   )r%   r…   r(   r(   r)   Úverify_directly_issued_by1  r|   z%Certificate.verify_directly_issued_byN©rv   rw   r   rI   rc   )r   ro   ©r   r   ©r   r>   ©r   r   ©r   rˆ   r_   ©r   r�   ©r   r   r`   rb   ©r–   r—   r   rI   )r…   ru   r   r    )r,   r-   r.   ÚabcÚabstractmethodr{   re   r}   r~   r€   r�   r‚   rƒ   r„   r…   r‡   rŠ   rŒ   r�   r3   r‘   r’   r“   r\   r^   r™   rš   r(   r(   r(   r)   ru   £   st    ru   )Ú	metaclassc                   @  s\   e Zd Zeejddd„ƒƒZeejddd„ƒƒZeejddd	„ƒƒZeejddd„ƒƒZ	dS )ÚRevokedCertificater   rK   c                 C  rx   )zG
        Returns the serial number of the revoked certificate.
        Nr(   rQ   r(   r(   r)   r}   ?  r|   z RevokedCertificate.serial_numberr>   c                 C  rx   )zH
        Returns the date of when this certificate was revoked.
        Nr(   rQ   r(   r(   r)   Úrevocation_dateF  r|   z"RevokedCertificate.revocation_datec                 C  rx   )zl
        Returns the date of when this certificate was revoked as a non-naive
        UTC datetime.
        Nr(   rQ   r(   r(   r)   Úrevocation_date_utcM  r|   z&RevokedCertificate.revocation_date_utcr   c                 C  rx   )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr(   rQ   r(   r(   r)   r3   U  r|   zRevokedCertificate.extensionsNrc   r�   r¡   )
r,   r-   r.   re   r£   r¤   r}   r§   r¨   r3   r(   r(   r(   r)   r¦   >  s    r¦   c                   @  sN   e Zd Zddd„Zedd
d„ƒZeddd„ƒZeddd„ƒZeddd„ƒZdS )Ú_RawRevokedCertificater}   rK   r§   r>   r3   r   c                 C  rL   r"   ©Ú_serial_numberÚ_revocation_dateÚ_extensions©r%   r}   r§   r3   r(   r(   r)   r$   b  rO   z_RawRevokedCertificate.__init__r   c                 C  rP   r"   )r«   rQ   r(   r(   r)   r}   l  rR   z$_RawRevokedCertificate.serial_numberc                 C  s   t jdtjdd� | jS )Nuk   Properties that return a naÃ¯ve datetime object have been deprecated. Please switch to revocation_date_utc.rp   )Ú
stacklevel)ÚwarningsÚwarnr   ÚDeprecatedIn42r¬   rQ   r(   r(   r)   r§   p  s   üz&_RawRevokedCertificate.revocation_datec                 C  s   | j jtjjd�S )Nr?   )r¬   rD   rB   ÚtimezoneÚutcrQ   r(   r(   r)   r¨   z  s   z*_RawRevokedCertificate.revocation_date_utcc                 C  rP   r"   )r­   rQ   r(   r(   r)   r3   ~  rR   z!_RawRevokedCertificate.extensionsN)r}   rK   r§   r>   r3   r   rc   r�   r¡   )	r,   r-   r.   r$   re   r}   r§   r¨   r3   r(   r(   r(   r)   r©   a  s    

	r©   c                   @  sˆ  e Zd ZejdFdd„ƒZejdGd	d
„ƒZejdHdd„ƒZeejdIdd„ƒƒZ	eejdJdd„ƒƒZ
eejdKdd„ƒƒZeejdLdd„ƒƒZeejdMdd„ƒƒZeejdMdd „ƒƒZeejdNd"d#„ƒƒZeejdNd$d%„ƒƒZeejdOd'd(„ƒƒZeejdPd)d*„ƒƒZeejdPd+d,„ƒƒZejdQd0d1„ƒZejdRd2d3„ƒZejdSd6d7„ƒZejdTd:d7„ƒZejdUd=d7„ƒZejdVd?d@„ƒZejdWdCdD„ƒZdES )XÚCertificateRevocationListr–   r—   r   rI   c                 C  rx   )z:
        Serializes the CRL to PEM or DER format.
        Nr(   r˜   r(   r(   r)   r™   „  r|   z&CertificateRevocationList.public_bytesrv   rw   c                 C  rx   ry   r(   rz   r(   r(   r)   r{   Š  r|   z%CertificateRevocationList.fingerprintr}   rK   úRevokedCertificate | Nonec                 C  rx   )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr(   )r%   r}   r(   r(   r)   Ú(get_revoked_certificate_by_serial_number�  r|   zBCertificateRevocationList.get_revoked_certificate_by_serial_numberrˆ   c                 C  rx   r‰   r(   rQ   r(   r(   r)   rŠ   ™  r|   z2CertificateRevocationList.signature_hash_algorithmr   c                 C  rx   r‹   r(   rQ   r(   r(   r)   rŒ   £  r|   z1CertificateRevocationList.signature_algorithm_oidr�   c                 C  rx   rŽ   r(   rQ   r(   r(   r)   r�   ª  r|   z8CertificateRevocationList.signature_algorithm_parametersr   c                 C  rx   )zC
        Returns the X509Name with the issuer of this CRL.
        Nr(   rQ   r(   r(   r)   r…   ³  r|   z CertificateRevocationList.issuerúdatetime.datetime | Nonec                 C  rx   )z?
        Returns the date of next update for this CRL.
        Nr(   rQ   r(   r(   r)   Únext_updateº  r|   z%CertificateRevocationList.next_updatec                 C  rx   )zc
        Returns the date of next update for this CRL as a non-naive UTC
        datetime.
        Nr(   rQ   r(   r(   r)   Únext_update_utcÁ  r|   z)CertificateRevocationList.next_update_utcr>   c                 C  rx   )z?
        Returns the date of last update for this CRL.
        Nr(   rQ   r(   r(   r)   Úlast_updateÉ  r|   z%CertificateRevocationList.last_updatec                 C  rx   )zc
        Returns the date of last update for this CRL as a non-naive UTC
        datetime.
        Nr(   rQ   r(   r(   r)   Úlast_update_utcÐ  r|   z)CertificateRevocationList.last_update_utcr   c                 C  rx   )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr(   rQ   r(   r(   r)   r3   Ø  r|   z$CertificateRevocationList.extensionsc                 C  rx   r�   r(   rQ   r(   r(   r)   r‘   ß  r|   z#CertificateRevocationList.signaturec                 C  rx   )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr(   rQ   r(   r(   r)   Útbs_certlist_bytesæ  r|   z,CertificateRevocationList.tbs_certlist_bytesrV   rW   rX   c                 C  rx   r”   r(   r[   r(   r(   r)   r\   í  r|   z CertificateRevocationList.__eq__c                 C  rx   )z<
        Number of revoked certificates in the CRL.
        Nr(   rQ   r(   r(   r)   rl   ó  r|   z!CertificateRevocationList.__len__Úidxr¦   c                 C  ó   d S r"   r(   ©r%   r¾   r(   r(   r)   rn   ù  ó   z%CertificateRevocationList.__getitem__Úsliceúlist[RevokedCertificate]c                 C  r¿   r"   r(   rÀ   r(   r(   r)   rn   ý  rÁ   úint | sliceú-RevokedCertificate | list[RevokedCertificate]c                 C  rx   )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr(   rÀ   r(   r(   r)   rn     r|   ú#typing.Iterator[RevokedCertificate]c                 C  rx   )z8
        Iterator over the revoked certificates
        Nr(   rQ   r(   r(   r)   rm   	  r|   z"CertificateRevocationList.__iter__r€   r   c                 C  rx   )zQ
        Verifies signature of revocation list against given public key.
        Nr(   )r%   r€   r(   r(   r)   Úis_signature_valid  r|   z,CertificateRevocationList.is_signature_validNr¢   r›   )r}   rK   r   r¶   rŸ   r_   r    rž   )r   r¸   r�   r¡   r`   rb   rc   )r¾   rK   r   r¦   )r¾   rÂ   r   rÃ   )r¾   rÄ   r   rÅ   )r   rÆ   )r€   r   r   rX   )r,   r-   r.   r£   r¤   r™   r{   r·   re   rŠ   rŒ   r�   r…   r¹   rº   r»   r¼   r3   r‘   r½   r\   rl   ÚtypingÚoverloadrn   rm   rÇ   r(   r(   r(   r)   rµ   ƒ  sl    rµ   c                   @  s  e Zd Zejd.dd„ƒZejd/dd	„ƒZejd0dd„ƒZeejd1dd„ƒƒZ	eejd2dd„ƒƒZ
eejd3dd„ƒƒZeejd4dd„ƒƒZeejd5dd„ƒƒZeejd6dd„ƒƒZejd7d"d#„ƒZeejd8d$d%„ƒƒZeejd8d&d'„ƒƒZeejd9d(d)„ƒƒZejd:d+d,„ƒZd-S );ÚCertificateSigningRequestrV   rW   r   rX   c                 C  rx   r”   r(   r[   r(   r(   r)   r\     r|   z CertificateSigningRequest.__eq__rK   c                 C  rx   r•   r(   rQ   r(   r(   r)   r^   "  r|   z"CertificateSigningRequest.__hash__r   c                 C  rx   r   r(   rQ   r(   r(   r)   r€   (  r|   z$CertificateSigningRequest.public_keyr   c                 C  rx   r†   r(   rQ   r(   r(   r)   r‡   .  r|   z!CertificateSigningRequest.subjectrˆ   c                 C  rx   r‰   r(   rQ   r(   r(   r)   rŠ   5  r|   z2CertificateSigningRequest.signature_hash_algorithmr   c                 C  rx   r‹   r(   rQ   r(   r(   r)   rŒ   ?  r|   z1CertificateSigningRequest.signature_algorithm_oidr�   c                 C  rx   rŽ   r(   rQ   r(   r(   r)   r�   F  r|   z8CertificateSigningRequest.signature_algorithm_parametersr   c                 C  rx   )z@
        Returns the extensions in the signing request.
        Nr(   rQ   r(   r(   r)   r3   O  r|   z$CertificateSigningRequest.extensionsrf   c                 C  rx   )z/
        Returns an Attributes object.
        Nr(   rQ   r(   r(   r)   r8   V  r|   z$CertificateSigningRequest.attributesr–   r—   rI   c                 C  rx   )z;
        Encodes the request to PEM or DER format.
        Nr(   r˜   r(   r(   r)   r™   ]  r|   z&CertificateSigningRequest.public_bytesc                 C  rx   r�   r(   rQ   r(   r(   r)   r‘   c  r|   z#CertificateSigningRequest.signaturec                 C  rx   )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr(   rQ   r(   r(   r)   Útbs_certrequest_bytesj  r|   z/CertificateSigningRequest.tbs_certrequest_bytesc                 C  rx   )z8
        Verifies signature of signing request.
        Nr(   rQ   r(   r(   r)   rÇ   r  r|   z,CertificateSigningRequest.is_signature_validr   c                 C  rx   )z:
        Get the attribute value for a given OID.
        Nr(   )r%   r   r(   r(   r)   rk   y  r|   z/CertificateSigningRequest.get_attribute_for_oidNrb   rc   rœ   rž   rŸ   r_   r    r¡   )r   rf   r¢   r`   )r   rX   )r   r   r   rI   )r,   r-   r.   r£   r¤   r\   r^   r€   re   r‡   rŠ   rŒ   r�   r3   r8   r™   r‘   rË   rÇ   rk   r(   r(   r(   r)   rÊ     sL    rÊ   c                   @  sV   e Zd Zdg g fd*dd	„Zd+dd„Zd,dd„Zddœd-dd„Z	d.ddœd/d(d)„ZdS )0Ú CertificateSigningRequestBuilderNÚsubject_nameúName | Noner3   r4   r8   r9   c                 C  s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)Ú_subject_namer­   ri   )r%   rÍ   r3   r8   r(   r(   r)   r$   ‘  s   	
z)CertificateSigningRequestBuilder.__init__Únamer   r   c                 C  s4   t |tƒs	tdƒ‚| jdurtdƒ‚t|| j| jƒS )zF
        Sets the certificate requestor's distinguished name.
        úExpecting x509.Name object.Nú&The subject name may only be set once.)rY   r   Ú	TypeErrorrÏ   r5   rÌ   r­   ri   ©r%   rÐ   r(   r(   r)   rÍ   ž  s   


ÿz-CertificateSigningRequestBuilder.subject_nameÚextvalr   ÚcriticalrX   c                 C  sF   t |tƒs	tdƒ‚t|j||ƒ}t|| jƒ t| jg | j¢|‘| j	ƒS )zE
        Adds an X.509 extension to the certificate request.
        ú"extension must be an ExtensionType)
rY   r   rÓ   r   r   r7   r­   rÌ   rÏ   ri   ©r%   rÕ   rÖ   r1   r(   r(   r)   Úadd_extensionª  s   
ýz.CertificateSigningRequestBuilder.add_extension)Ú_tagr   r   rH   rI   rÚ   ú_ASN1Type | Nonec                C  s~   t |tƒs	tdƒ‚t |tƒstdƒ‚|durt |tƒstdƒ‚t|| jƒ |dur-|j}nd}t| j	| j
g | j¢|||f‘ƒS )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rY   r   rÓ   rI   r   r<   ri   rH   rÌ   rÏ   r­   )r%   r   rH   rÚ   Útagr(   r(   r)   Úadd_attribute¼  s   


ýz.CertificateSigningRequestBuilder.add_attribute©Úrsa_paddingÚprivate_keyr   rv   ú_AllowedHashTypes | NoneÚbackendú
typing.Anyrß   ú%padding.PSS | padding.PKCS1v15 | NonerÊ   c                C  sX   | j du r	tdƒ‚|dur$t|tjtjfƒstdƒ‚t|tjƒs$tdƒ‚t	 
| |||¡S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subjectúPadding must be PSS or PKCS1v15ú&Padding is only supported for RSA keys)rÏ   r5   rY   r   ÚPSSÚPKCS1v15rÓ   r   ÚRSAPrivateKeyÚ	rust_x509Úcreate_x509_csr©r%   rà   rv   râ   rß   r(   r(   r)   ÚsignÜ  s   
ÿz%CertificateSigningRequestBuilder.sign)rÍ   rÎ   r3   r4   r8   r9   )rÐ   r   r   rÌ   )rÕ   r   rÖ   rX   r   rÌ   )r   r   rH   rI   rÚ   rÛ   r   rÌ   r"   )
rà   r   rv   rá   râ   rã   rß   rä   r   rÊ   )r,   r-   r.   r$   rÍ   rÙ   rÝ   rí   r(   r(   r(   r)   rÌ   �  s    ü

û$üúrÌ   c                   @  sŠ   e Zd ZU ded< ddddddg fd9dd„Zd:dd„Zd:dd„Zd;dd„Zd<dd „Zd=d#d$„Z	d=d%d&„Z
d>d+d,„Z	d?dd-œd@d7d8„ZdS )AÚCertificateBuilderr4   r­   NÚissuer_namerÎ   rÍ   r€   ú CertificatePublicKeyTypes | Noner}   ú
int | Noner�   r¸   rƒ   r3   r   r    c                 C  s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r"   )
ro   rr   Ú_versionÚ_issuer_namerÏ   Ú_public_keyr«   Ú_not_valid_beforeÚ_not_valid_afterr­   )r%   rï   rÍ   r€   r}   r�   rƒ   r3   r(   r(   r)   r$   ø  s   

zCertificateBuilder.__init__rÐ   r   c                 C  sD   t |tƒs	tdƒ‚| jdurtdƒ‚t|| j| j| j| j	| j
| jƒS )z3
        Sets the CA's distinguished name.
        rÑ   Nú%The issuer name may only be set once.)rY   r   rÓ   ró   r5   rî   rÏ   rô   r«   rõ   rö   r­   rÔ   r(   r(   r)   rï     s   

ùzCertificateBuilder.issuer_namec                 C  sD   t |tƒs	tdƒ‚| jdurtdƒ‚t| j|| j| j| j	| j
| jƒS )z:
        Sets the requestor's distinguished name.
        rÑ   NrÒ   )rY   r   rÓ   rÏ   r5   rî   ró   rô   r«   rõ   rö   r­   rÔ   r(   r(   r)   rÍ     s   

ùzCertificateBuilder.subject_nameÚkeyr   c              	   C  s`   t |tjtjtjtjt	j
tjtjfƒstdƒ‚| jdur tdƒ‚t| j| j|| j| j| j| jƒS )zT
        Sets the requestor's public key (as found in the signing request).
        z‰Expecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rY   r   ÚDSAPublicKeyr   ÚRSAPublicKeyr   ÚEllipticCurvePublicKeyr
   ÚEd25519PublicKeyr	   ÚEd448PublicKeyr   ÚX25519PublicKeyr   ÚX448PublicKeyrÓ   rô   r5   rî   ró   rÏ   r«   rõ   rö   r­   )r%   rø   r(   r(   r)   r€   /  s2   ùþÿ
ùzCertificateBuilder.public_keyÚnumberrK   c                 C  sh   t |tƒs	tdƒ‚| jdurtdƒ‚|dkrtdƒ‚| ¡ dkr$tdƒ‚t| j| j| j	|| j
| j| jƒS )z5
        Sets the certificate serial number.
        ú'Serial number must be of integral type.Nú'The serial number may only be set once.r   z%The serial number should be positive.é    ú3The serial number should not be more than 159 bits.)rY   rK   rÓ   r«   r5   Ú
bit_lengthrî   ró   rÏ   rô   rõ   rö   r­   ©r%   r   r(   r(   r)   r}   T  s&   

ÿùz CertificateBuilder.serial_numberr=   r>   c                 C  sz   t |tjƒs
tdƒ‚| jdurtdƒ‚t|ƒ}|tk rtdƒ‚| jdur-|| jkr-tdƒ‚t| j	| j
| j| j|| j| jƒS )z7
        Sets the certificate activation time.
        úExpecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rY   rB   rÓ   rõ   r5   rF   Ú_EARLIEST_UTC_TIMErö   rî   ró   rÏ   rô   r«   r­   ©r%   r=   r(   r(   r)   r�   o  s,   
ÿÿùz#CertificateBuilder.not_valid_beforec                 C  sz   t |tjƒs
tdƒ‚| jdurtdƒ‚t|ƒ}|tk rtdƒ‚| jdur-|| jk r-tdƒ‚t| j	| j
| j| j| j|| jƒS )z7
        Sets the certificate expiration time.
        r  Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rY   rB   rÓ   rö   r5   rF   r  rõ   rî   ró   rÏ   rô   r«   r­   r	  r(   r(   r)   rƒ   Œ  s.   
ÿ

ÿùz"CertificateBuilder.not_valid_afterrÕ   r   rÖ   rX   c              	   C  sV   t |tƒs	tdƒ‚t|j||ƒ}t|| jƒ t| j| j	| j
| j| j| jg | j¢|‘ƒS )z=
        Adds an X.509 extension to the certificate.
        r×   )rY   r   rÓ   r   r   r7   r­   rî   ró   rÏ   rô   r«   rõ   rö   rØ   r(   r(   r)   rÙ   ¬  s   
ùz CertificateBuilder.add_extensionrÞ   rà   r   rv   rá   râ   rã   rß   rä   ru   c                C  s²   | j du r	tdƒ‚| jdu rtdƒ‚| jdu rtdƒ‚| jdu r$tdƒ‚| jdu r-tdƒ‚| jdu r6tdƒ‚|durQt|tj	tj
fƒsGtdƒ‚t|tjƒsQtd	ƒ‚t | |||¡S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyrå   ræ   )rÏ   r5   ró   r«   rõ   rö   rô   rY   r   rç   rè   rÓ   r   ré   rê   Úcreate_x509_certificaterì   r(   r(   r)   rí   Â  s(   





ÿzCertificateBuilder.sign)rï   rÎ   rÍ   rÎ   r€   rð   r}   rñ   r�   r¸   rƒ   r¸   r3   r4   r   r    )rÐ   r   r   rî   )rø   r   r   rî   )r   rK   r   rî   )r=   r>   r   rî   )rÕ   r   rÖ   rX   r   rî   r"   )
rà   r   rv   rá   râ   rã   rß   rä   r   ru   )r,   r-   r.   Ú__annotations__r$   rï   rÍ   r€   r}   r�   rƒ   rÙ   rí   r(   r(   r(   r)   rî   õ  s*   
 ø



%


 üúrî   c                   @  sz   e Zd ZU ded< ded< dddg g fd.dd„Zd/dd„Zd0dd„Zd1dd„Zd2dd„Zd3d d!„Z		d4dd"œd5d,d-„Z
dS )6Ú CertificateRevocationListBuilderr4   r­   rÃ   Ú_revoked_certificatesNrï   rÎ   r»   r¸   r¹   r3   Úrevoked_certificatesc                 C  s"   || _ || _|| _|| _|| _d S r"   )ró   Ú_last_updateÚ_next_updater­   r  )r%   rï   r»   r¹   r3   r  r(   r(   r)   r$   î  s
   
z)CertificateRevocationListBuilder.__init__r   r   c                 C  s<   t |tƒs	tdƒ‚| jd urtdƒ‚t|| j| j| j| j	ƒS )NrÑ   r÷   )
rY   r   rÓ   ró   r5   r  r  r  r­   r  )r%   rï   r(   r(   r)   rï   ü  s   

ûz,CertificateRevocationListBuilder.issuer_namer>   c                 C  sr   t |tjƒs
tdƒ‚| jd urtdƒ‚t|ƒ}|tk rtdƒ‚| jd ur-|| jkr-tdƒ‚t| j	|| j| j
| jƒS )Nr  ú!Last update may only be set once.ú8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rY   rB   rÓ   r  r5   rF   r  r  r  ró   r­   r  )r%   r»   r(   r(   r)   r»     s(   
ÿÿûz,CertificateRevocationListBuilder.last_updatec                 C  sr   t |tjƒs
tdƒ‚| jd urtdƒ‚t|ƒ}|tk rtdƒ‚| jd ur-|| jk r-tdƒ‚t| j	| j|| j
| jƒS )Nr  r  r  z8The next update date must be after the last update date.)rY   rB   rÓ   r  r5   rF   r  r  r  ró   r­   r  )r%   r¹   r(   r(   r)   r¹   #  s(   
ÿÿûz,CertificateRevocationListBuilder.next_updaterÕ   r   rÖ   rX   c                 C  sN   t |tƒs	tdƒ‚t|j||ƒ}t|| jƒ t| j| j	| j
g | j¢|‘| jƒS )zM
        Adds an X.509 extension to the certificate revocation list.
        r×   )rY   r   rÓ   r   r   r7   r­   r  ró   r  r  r  rØ   r(   r(   r)   rÙ   ;  s   
ûz.CertificateRevocationListBuilder.add_extensionÚrevoked_certificater¦   c                 C  s4   t |tƒs	tdƒ‚t| j| j| j| jg | j¢|‘ƒS )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rY   r¦   rÓ   r  ró   r  r  r­   r  )r%   r  r(   r(   r)   Úadd_revoked_certificateN  s   
ûz8CertificateRevocationListBuilder.add_revoked_certificaterÞ   rà   r   rv   rá   râ   rã   rß   rä   rµ   c                C  s|   | j d u r	tdƒ‚| jd u rtdƒ‚| jd u rtdƒ‚|d ur6t|tjtjfƒs,tdƒ‚t|t	j
ƒs6tdƒ‚t | |||¡S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timerå   ræ   )ró   r5   r  r  rY   r   rç   rè   rÓ   r   ré   rê   Úcreate_x509_crlrì   r(   r(   r)   rí   _  s   


ÿz%CertificateRevocationListBuilder.sign)
rï   rÎ   r»   r¸   r¹   r¸   r3   r4   r  rÃ   )rï   r   r   r  )r»   r>   r   r  )r¹   r>   r   r  )rÕ   r   rÖ   rX   r   r  )r  r¦   r   r  r"   )
rà   r   rv   rá   râ   rã   rß   rä   r   rµ   )r,   r-   r.   r  r$   rï   r»   r¹   rÙ   r  rí   r(   r(   r(   r)   r  ê  s$   
 ú




üúr  c                   @  sH   e Zd Zddg fddd	„Zddd„Zd dd„Zd!dd„Zd"d#dd„ZdS )$ÚRevokedCertificateBuilderNr}   rñ   r§   r¸   r3   r4   c                 C  rL   r"   rª   r®   r(   r(   r)   r$   |  rO   z"RevokedCertificateBuilder.__init__r   rK   r   c                 C  sX   t |tƒs	tdƒ‚| jd urtdƒ‚|dkrtdƒ‚| ¡ dkr$tdƒ‚t|| j| jƒS )Nr  r  r   z$The serial number should be positiver  r  )	rY   rK   rÓ   r«   r5   r  r  r¬   r­   r  r(   r(   r)   r}   †  s   

ÿ
ÿz'RevokedCertificateBuilder.serial_numberr=   r>   c                 C  sN   t |tjƒs
tdƒ‚| jd urtdƒ‚t|ƒ}|tk rtdƒ‚t| j|| j	ƒS )Nr  z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rY   rB   rÓ   r¬   r5   rF   r  r  r«   r­   r	  r(   r(   r)   r§   ˜  s   
ÿ
ÿz)RevokedCertificateBuilder.revocation_daterÕ   r   rÖ   rX   c                 C  sF   t |tƒs	tdƒ‚t|j||ƒ}t|| jƒ t| j| j	g | j¢|‘ƒS )Nr×   )
rY   r   rÓ   r   r   r7   r­   r  r«   r¬   rØ   r(   r(   r)   rÙ   ¨  s   
ýz'RevokedCertificateBuilder.add_extensionrâ   rã   r¦   c                 C  s:   | j d u r	tdƒ‚| jd u rtdƒ‚t| j | jt| jƒƒS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r«   r5   r¬   r©   r   r­   )r%   râ   r(   r(   r)   Úbuild¶  s   

ÿýzRevokedCertificateBuilder.build)r}   rñ   r§   r¸   r3   r4   )r   rK   r   r  )r=   r>   r   r  )rÕ   r   rÖ   rX   r   r  r"   )râ   rã   r   r¦   )r,   r-   r.   r$   r}   r§   rÙ   r  r(   r(   r(   r)   r  {  s    ü



r  rK   c                   C  s   t  t d¡d¡d? S )Né   Úbigr   )rK   Ú
from_bytesÚosÚurandomr(   r(   r(   r)   Úrandom_serial_numberÄ  rU   r  )r1   r2   r3   r4   r   r    )r   r   r8   r9   r   r    )r=   r>   r   r>   rc   )NÚ
__future__r   r£   rB   r  rÈ   r°   Úcryptographyr   Ú"cryptography.hazmat.bindings._rustr   rê   Úcryptography.hazmat.primitivesr   r   Ú)cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r   r   r   Ú/cryptography.hazmat.primitives.asymmetric.typesr   r   r   Úcryptography.x509.extensionsr   r   r   r   Úcryptography.x509.namer   r   Úcryptography.x509.oidr   r  ÚUnionÚSHA224ÚSHA256ÚSHA384ÚSHA512ÚSHA3_224ÚSHA3_256ÚSHA3_384ÚSHA3_512Ú_AllowedHashTypesÚ	Exceptionr   r7   r<   rF   rG   rf   ÚEnumro   rs   ÚABCMetaru   Úregisterr¦   r©   rµ   rÊ   Úload_pem_x509_certificateÚload_der_x509_certificateÚload_pem_x509_certificatesÚload_pem_x509_csrÚload_der_x509_csrÚload_pem_x509_crlÚload_der_x509_crlrÌ   rî   r  r  r  r(   r(   r(   r)   Ú<module>   sv   (
ùÿ




$  " fe v I