File: //usr/local/CyberCP/lib/python3.10/site-packages/cryptography/x509/__pycache__/base.cpython-310.pyc
o
�hِ � @ sp d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z d dl m
Z
mZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dl m Z m Z m Z m Z d d l!m"Z"m#Z# d d
l$m%Z% e�d d d �Z&ej'e
j(e
j)e
j*e
j+e
j,e
j-e
j.e
j/f Z0G d
d� de1�Z2d?dd�Z3d@dd �Z4dAd d �Z5G d!d"� d"�Z6G d#d$� d$�Z7G d%d&� d&ej8�Z9G d'd(� d(e1�Z:G d)d*� d*ej;d+�Z<e<�=e j<� G d,d-� d-ej;d+�Z>e>�=e j>� G d.d/� d/e>�Z?G d0d1� d1ej;d+�Z@e@�=e j@� G d2d3� d3ej;d+�ZAeA�=e jA� e jBZBe jCZCe jDZDe jEZEe jFZFe jGZGe jHZHG d4d5� d5�ZIG d6d7� d7�ZJG d8d9� d9�ZKG d:d;� d;�ZLdBd=d>�ZMdS )C� )� annotationsN)�utils)�x509)�hashes�
serialization)�dsa�ec�ed448�ed25519�padding�rsa�x448�x25519)� CertificateIssuerPrivateKeyTypes� CertificateIssuerPublicKeyTypes�CertificatePublicKeyTypes)� Extension�
Extensions�
ExtensionType�_make_sequence_methods)�Name� _ASN1Type)�ObjectIdentifieri� � c � e Zd Zd � fdd� Z� ZS )
�AttributeNotFound�msg�str�oidr �return�Nonec � t � �|� || _d S �N)�super�__init__r )�selfr r �� __class__� �I/usr/local/CyberCP/lib/python3.10/site-packages/cryptography/x509/base.pyr$ 9 �
zAttributeNotFound.__init__)r r r r r r ��__name__�
__module__� __qualname__r$ �
__classcell__r( r( r& r) r 8 � r � extension�Extension[ExtensionType]�
extensions� list[Extension[ExtensionType]]r r c C s" |D ] }|j | j krtd��qd S )Nz$This extension has already been set.)r �
ValueError)r1 r3 �er( r( r) �_reject_duplicate_extension> s
��r7 r r �
attributes�0list[tuple[ObjectIdentifier, bytes, int | None]]c C s$ |D ]
\}}}|| krt d��qd S )Nz$This attribute has already been set.)r5 )r r8 �attr_oid�_r( r( r) �_reject_duplicate_attributeH s
��r< �time�datetime.datetimec C s6 | j dur| �� }|r
|nt�� }| jdd�| S | S )z�Normalizes a datetime to a naive datetime in UTC.
time -- datetime to normalize. Assumed to be in UTC if not timezone
aware.
N��tzinfo)r@ � utcoffset�datetime� timedelta�replace)r= �offsetr( r( r) �_convert_to_naive_utc_timeR s
rF c @ sX e Zd Zejjfdd d
�Zedd d ��Zed d
d��Zd dd�Z d dd�Z
d dd�Z dS ) � Attributer r �value�bytes�_type�intr r c C � || _ || _|| _d S r" )�_oid�_valuerJ )r% r rH rJ r( r( r) r$ a �
zAttribute.__init__c C � | j S r" )rM �r% r( r( r) r k � z
Attribute.oidc C rP r" )rN rQ r( r( r) rH o rR zAttribute.valuer c C s d| j � d| j�d�S )Nz<Attribute(oid=z, value=�)>)r rH rQ r( r( r) �__repr__s � zAttribute.__repr__�other�object�boolc C s2 t |t�stS | j|jko| j|jko| j|jkS r" )�
isinstancerG �NotImplementedr rH rJ �r% rV r( r( r) �__eq__v s
�
�zAttribute.__eq__c C s t | j| j| jf�S r" )�hashr rH rJ rQ r( r( r) �__hash__� s zAttribute.__hash__N)r r rH rI rJ rK r r �r r �r rI �r r �rV rW r rX �r rK ) r, r- r. r �
UTF8StringrH r$ �propertyr rT r\ r^ r( r( r( r) rG ` s �
rG c @ s8 e Zd Zddd�Zed�\ZZZdd d
�Zddd�Z dS )�
Attributesr8 �typing.Iterable[Attribute]r r c C s t |�| _d S r" )�list� _attributes)r% r8 r( r( r) r$ � s zAttributes.__init__ri r c C s d| j � d�S )Nz <Attributes(rS )ri rQ r( r( r) rT � s zAttributes.__repr__r r rG c C s. | D ] }|j |kr
| S qtd|� d�|��)NzNo z attribute was found)r r )r% r �attrr( r( r) �get_attribute_for_oid� s
�z Attributes.get_attribute_for_oidN)r8 rg r r ra )r r r rG )
r, r- r. r$ r �__len__�__iter__� __getitem__rT rk r( r( r( r) rf � s
rf c @ s e Zd ZdZdZdS )�Versionr � N)r, r- r. �v1�v3r( r( r( r) ro � s ro c r )
�InvalidVersionr r �parsed_versionrK r r c r! r" )r# r$ rt )r% r rt r& r( r) r$ � r* zInvalidVersion.__init__)r r rt rK r r r+ r( r( r& r) rs � r0 rs c @ s� e Zd ZejdBdd��ZeejdCdd ���ZeejdDd d ���ZejdEdd��Z eejdFdd���Z
eejdGdd���Z eejdGdd���Z eejdGdd���Z
eejdGdd���ZeejdHd d ���ZeejdHd d ���ZeejdId"d#���ZeejdFd$d%���ZeejdJd'd(���ZeejdKd*d+���ZeejdLd,d-���ZeejdLd.d/���ZeejdLd0d1���ZejdMd5d6��ZejdCd7d8��ZejdNd;d<��ZejdOd?d@��ZdAS )P� Certificate� algorithm�hashes.HashAlgorithmr rI c C � dS �z4
Returns bytes using digest passed.
Nr( �r% rv r( r( r) � fingerprint� � zCertificate.fingerprintrK c C rx )z3
Returns certificate serial number
Nr( rQ r( r( r) �
serial_number� r| zCertificate.serial_numberro c C rx )z1
Returns the certificate version
Nr( rQ r( r( r) �version� r| zCertificate.versionr c C rx �z(
Returns the public key
Nr( rQ r( r( r) �
public_key� r| zCertificate.public_keyr c C rx )zA
Returns the ObjectIdentifier of the public key.
Nr( rQ r( r( r) �public_key_algorithm_oid� r| z$Certificate.public_key_algorithm_oidr> c C rx )z?
Not before time (represented as UTC datetime)
Nr( rQ r( r( r) �not_valid_before� r| z Certificate.not_valid_beforec C rx )zK
Not before time (represented as a non-naive UTC datetime)
Nr( rQ r( r( r) �not_valid_before_utc� r| z Certificate.not_valid_before_utcc C rx )z>
Not after time (represented as UTC datetime)
Nr( rQ r( r( r) �not_valid_after� r| zCertificate.not_valid_afterc C rx )zJ
Not after time (represented as a non-naive UTC datetime)
Nr( rQ r( r( r) �not_valid_after_utc� r| z Certificate.not_valid_after_utcr c C rx )z1
Returns the issuer name object.
Nr( rQ r( r( r) �issuer� r| zCertificate.issuerc C rx �z2
Returns the subject name object.
Nr( rQ r( r( r) �subject� r| zCertificate.subject�hashes.HashAlgorithm | Nonec C rx �zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr( rQ r( r( r) �signature_hash_algorithm� r| z$Certificate.signature_hash_algorithmc C rx �zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr( rQ r( r( r) �signature_algorithm_oid� r| z#Certificate.signature_algorithm_oid�0None | padding.PSS | padding.PKCS1v15 | ec.ECDSAc C rx �z=
Returns the signature algorithm parameters.
Nr( rQ r( r( r) � signature_algorithm_parameters r| z*Certificate.signature_algorithm_parametersr c C rx )z/
Returns an Extensions object.
Nr( rQ r( r( r) r3 r| zCertificate.extensionsc C rx �z.
Returns the signature bytes.
Nr( rQ r( r( r) � signature r| zCertificate.signaturec C rx )zR
Returns the tbsCertificate payload bytes as defined in RFC 5280.
Nr( rQ r( r( r) �tbs_certificate_bytes r| z!Certificate.tbs_certificate_bytesc C rx )zh
Returns the tbsCertificate payload bytes with the SCT list extension
stripped.
Nr( rQ r( r( r) �tbs_precertificate_bytes r| z$Certificate.tbs_precertificate_bytesrV rW rX c C rx �z"
Checks equality.
Nr( r[ r( r( r) r\ & r| zCertificate.__eq__c C rx �z"
Computes a hash.
Nr( rQ r( r( r) r^ , r| zCertificate.__hash__�encoding�serialization.Encodingc C rx )zB
Serializes the certificate to PEM or DER format.
Nr( �r% r� r( r( r) � public_bytes2 r| zCertificate.public_bytesr� r c C rx )z�
This method verifies that certificate issuer name matches the
issuer subject name and that the certificate is signed by the
issuer's private key. No other validation is performed.
Nr( )r% r� r( r( r) �verify_directly_issued_by8 r| z%Certificate.verify_directly_issued_byN�rv rw r rI rc )r ro �r r r_ �r r> �r r �r r� �r r� �r r r` rb �r� r� r rI )r� ru r r ) r, r- r. �abc�abstractmethodr{ re r} r~ r� r� r� r� r� r� r� r� r� r� r� r3 r� r� r� r\ r^ r� r� r( r( r( r) ru � sz ru )� metaclassc @ s\ e Zd Zeejddd���Zeejddd���Zeejddd ���Zeejdd d ���Z d
S )�RevokedCertificater rK c C rx )zG
Returns the serial number of the revoked certificate.
Nr( rQ r( r( r) r} F r| z RevokedCertificate.serial_numberr> c C rx )zH
Returns the date of when this certificate was revoked.
Nr( rQ r( r( r) �revocation_dateM r| z"RevokedCertificate.revocation_datec C rx )zl
Returns the date of when this certificate was revoked as a non-naive
UTC datetime.
Nr( rQ r( r( r) �revocation_date_utcT r| z&RevokedCertificate.revocation_date_utcr c C rx )zW
Returns an Extensions object containing a list of Revoked extensions.
Nr( rQ r( r( r) r3 \ r| z RevokedCertificate.extensionsNrc r� r� )
r, r- r. re r� r� r} r� r� r3 r( r( r( r) r� E s r� c @ sN e Zd Zddd�Zedd
d ��Zedd d
��Zeddd��Zeddd��ZdS )�_RawRevokedCertificater} rK r� r> r3 r c C rL r" ��_serial_number�_revocation_date� _extensions�r% r} r� r3 r( r( r) r$ i rO z _RawRevokedCertificate.__init__r c C rP r" )r� rQ r( r( r) r} s rR z$_RawRevokedCertificate.serial_numberc C s t jdtjdd� | jS )Nuk Properties that return a naïve datetime object have been deprecated. Please switch to revocation_date_utc.rp )�
stacklevel)�warnings�warnr �DeprecatedIn42r� rQ r( r( r) r� w s �z&_RawRevokedCertificate.revocation_datec C s | j jtjjd�S )Nr? )r� rD rB �timezone�utcrQ r( r( r) r� � s z*_RawRevokedCertificate.revocation_date_utcc C rP r" )r� rQ r( r( r) r3 � rR z!_RawRevokedCertificate.extensionsN)r} rK r� r> r3 r rc r� r� ) r, r- r. r$ re r} r� r� r3 r( r( r( r) r� h s
r� c @ s� e Zd ZejdFdd��ZejdGd d
��ZejdHdd��ZeejdIdd���Z eejdJdd���Z
eejdKdd���Z eejdLdd���Z eejdMd d ���Z
eejdMd d ���ZeejdNd"d#���ZeejdNd$d%���ZeejdOd'd(���ZeejdPd)d*���ZeejdPd+d,���ZejdQd0d1��ZejdRd2d3��ZejdSd6d7��ZejdTd:d7��ZejdUd=d7��ZejdVd?d@��ZejdWdCdD��ZdES )X�CertificateRevocationListr� r� r rI c C rx )z:
Serializes the CRL to PEM or DER format.
Nr( r� r( r( r) r� � r| z&CertificateRevocationList.public_bytesrv rw c C rx ry r( rz r( r( r) r{ � r| z%CertificateRevocationList.fingerprintr} rK �RevokedCertificate | Nonec C rx )zs
Returns an instance of RevokedCertificate or None if the serial_number
is not in the CRL.
Nr( )r% r} r( r( r) �(get_revoked_certificate_by_serial_number� r| zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr� c C rx r� r( rQ r( r( r) r� � r| z2CertificateRevocationList.signature_hash_algorithmr c C rx r� r( rQ r( r( r) r� � r| z1CertificateRevocationList.signature_algorithm_oidr� c C rx r� r( rQ r( r( r) r� � r| z8CertificateRevocationList.signature_algorithm_parametersr c C rx )zC
Returns the X509Name with the issuer of this CRL.
Nr( rQ r( r( r) r� � r| z CertificateRevocationList.issuer�datetime.datetime | Nonec C rx )z?
Returns the date of next update for this CRL.
Nr( rQ r( r( r) � next_update� r| z%CertificateRevocationList.next_updatec C rx )zc
Returns the date of next update for this CRL as a non-naive UTC
datetime.
Nr( rQ r( r( r) �next_update_utc� r| z)CertificateRevocationList.next_update_utcr> c C rx )z?
Returns the date of last update for this CRL.
Nr( rQ r( r( r) � last_update� r| z%CertificateRevocationList.last_updatec C rx )zc
Returns the date of last update for this CRL as a non-naive UTC
datetime.
Nr( rQ r( r( r) �last_update_utc� r| z)CertificateRevocationList.last_update_utcr c C rx )zS
Returns an Extensions object containing a list of CRL extensions.
Nr( rQ r( r( r) r3 � r| z$CertificateRevocationList.extensionsc C rx r� r( rQ r( r( r) r� � r| z#CertificateRevocationList.signaturec C rx )zO
Returns the tbsCertList payload bytes as defined in RFC 5280.
Nr( rQ r( r( r) �tbs_certlist_bytes� r| z,CertificateRevocationList.tbs_certlist_bytesrV rW rX c C rx r� r( r[ r( r( r) r\ � r| z CertificateRevocationList.__eq__c C rx )z<
Number of revoked certificates in the CRL.
Nr( rQ r( r( r) rl � r| z!CertificateRevocationList.__len__�idxr� c C � d S r" r( �r% r� r( r( r) rn � z%CertificateRevocationList.__getitem__�slice�list[RevokedCertificate]c C r� r" r( r� r( r( r) rn r� � int | slice�-RevokedCertificate | list[RevokedCertificate]c C rx )zS
Returns a revoked certificate (or slice of revoked certificates).
Nr( r� r( r( r) rn r| �#typing.Iterator[RevokedCertificate]c C rx )z8
Iterator over the revoked certificates
Nr( rQ r( r( r) rm r| z"CertificateRevocationList.__iter__r� r c C rx )zQ
Verifies signature of revocation list against given public key.
Nr( )r% r� r( r( r) �is_signature_valid r| z,CertificateRevocationList.is_signature_validNr� r� )r} rK r r� r� r_ r� r� )r r� r� r� r` rb rc )r� rK r r� )r� r� r r� )r� r� r r� )r r� )r� r r rX )r, r- r. r� r� r� r{ r� re r� r� r� r� r� r� r� r� r3 r� r� r\ rl �typing�overloadrn rm r� r( r( r( r) r� � sl r� c @ s e Zd Zejd.dd��Zejd/dd ��Zejd0d d ��Zeejd1dd���Z eejd2dd���Z
eejd3dd���Z eejd4dd���Z eejd5dd���Z
eejd6d d ���Zejd7d"d#��Zeejd8d$d%���Zeejd8d&d'���Zeejd9d(d)���Zejd:d+d,��Zd-S );�CertificateSigningRequestrV rW r rX c C rx r� r( r[ r( r( r) r\ ! r| z CertificateSigningRequest.__eq__rK c C rx r� r( rQ r( r( r) r^ ' r| z"CertificateSigningRequest.__hash__r c C rx r r( rQ r( r( r) r� - r| z$CertificateSigningRequest.public_keyr c C rx r� r( rQ r( r( r) r� 3 r| z!CertificateSigningRequest.subjectr� c C rx r� r( rQ r( r( r) r� : r| z2CertificateSigningRequest.signature_hash_algorithmr c C rx r� r( rQ r( r( r) r� D r| z1CertificateSigningRequest.signature_algorithm_oidr� c C rx r� r( rQ r( r( r) r� K r| z8CertificateSigningRequest.signature_algorithm_parametersr c C rx )z@
Returns the extensions in the signing request.
Nr( rQ r( r( r) r3 T r| z$CertificateSigningRequest.extensionsrf c C rx )z/
Returns an Attributes object.
Nr( rQ r( r( r) r8 [ r| z$CertificateSigningRequest.attributesr� r� rI c C rx )z;
Encodes the request to PEM or DER format.
Nr( r� r( r( r) r� b r| z&CertificateSigningRequest.public_bytesc C rx r� r( rQ r( r( r) r� h r| z#CertificateSigningRequest.signaturec C rx )zd
Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
2986.
Nr( rQ r( r( r) �tbs_certrequest_byteso r| z/CertificateSigningRequest.tbs_certrequest_bytesc C rx )z8
Verifies signature of signing request.
Nr( rQ r( r( r) r� w r| z,CertificateSigningRequest.is_signature_validr c C rx )z:
Get the attribute value for a given OID.
Nr( )r% r r( r( r) rk ~ r| z/CertificateSigningRequest.get_attribute_for_oidNrb rc r� r� r� r_ r� r� )r rf r� r` )r rX )r r r rI )r, r- r. r� r� r\ r^ r� re r� r� r� r� r3 r8 r� r� r� r� rk r( r( r( r) r� sL r� c @ sV e Zd Zdg g fd*dd �Zd+d
d�Zd,dd�Zdd�d-d d �Z d.dd �d/d(d)�ZdS )0� CertificateSigningRequestBuilderN� subject_name� Name | Noner3 r4 r8 r9 c C s || _ || _|| _dS )zB
Creates an empty X.509 certificate request (v1).
N)�
_subject_namer� ri )r% r� r3 r8 r( r( r) r$ � s
z)CertificateSigningRequestBuilder.__init__�namer r c C s4 t |t�s td��| jdurtd��t|| j| j�S )zF
Sets the certificate requestor's distinguished name.
�Expecting x509.Name object.N�&The subject name may only be set once.)rY r � TypeErrorr� r5 r� r� ri �r% r� r( r( r) r� � s
�z-CertificateSigningRequestBuilder.subject_name�extvalr �criticalrX c C sF t |t�s td��t|j||�}t|| j� t| jg | j�|�| j �S )zE
Adds an X.509 extension to the certificate request.
�"extension must be an ExtensionType)
rY r r� r r r7 r� r� r� ri �r% r� r� r1 r( r( r) �
add_extension� s
�z.CertificateSigningRequestBuilder.add_extension)�_tagr r rH rI r� �_ASN1Type | Nonec C s~ t |t�s td��t |t�std��|dur t |t�s td��t|| j� |dur-|j}nd}t| j | j
g | j�|||f��S )zK
Adds an X.509 attribute with an OID and associated value.
z oid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type) rY r r� rI r r< ri rH r� r� r� )r% r rH r� �tagr( r( r) �
add_attribute� s
�z.CertificateSigningRequestBuilder.add_attribute�� rsa_padding� private_keyr rv �_AllowedHashTypes | None�backend�
typing.Anyr� �%padding.PSS | padding.PKCS1v15 | Noner� c C sX | j du r td��|dur$t|tjtjf�std��t|tj�s$td��t �
| |||�S )zF
Signs the request using the requestor's private key.
Nz/A CertificateSigningRequest must have a subject� Padding must be PSS or PKCS1v15�&Padding is only supported for RSA keys) r� r5 rY r �PSS�PKCS1v15r� r �
RSAPrivateKey� rust_x509�create_x509_csr�r% r� rv r� r� r( r( r) �sign� s
�z%CertificateSigningRequestBuilder.sign)r� r� r3 r4 r8 r9 )r� r r r� )r� r r� rX r r� )r r rH rI r� r� r r� r" )
r� r rv r� r� r� r� r� r r� )r, r- r. r$ r� r� r� r� r( r( r( r) r� � s �
�$��r� c @ s� e Zd ZU ded< ddddddg fd9dd�Zd:dd�Zd:dd�Zd;dd �Zd<d d �Zd=d#d$�Z d=d%d&�Z
d>d+d,�Z d?dd-�d@d7d8�Z dS )A�CertificateBuilderr4 r� N� issuer_namer� r� r� � CertificatePublicKeyTypes | Noner} �
int | Noner� r� r� r3 r r c C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S r" )
ro rr �_version� _issuer_namer� � _public_keyr� �_not_valid_before�_not_valid_afterr� )r% r� r� r� r} r� r� r3 r( r( r) r$ � s
zCertificateBuilder.__init__r� r c C sD t |t�s td��| jdurtd��t|| j| j| j| j | j
| j �S )z3
Sets the CA's distinguished name.
r� N�%The issuer name may only be set once.) rY r r� r� r5 r� r� r� r� r� r� r� r� r( r( r) r� s
�z CertificateBuilder.issuer_namec C sD t |t�s td��| jdurtd��t| j|| j| j| j | j
| j �S )z:
Sets the requestor's distinguished name.
r� Nr� ) rY r r� r� r5 r� r� r� r� r� r� r� r� r( r( r) r� " s
�z CertificateBuilder.subject_name�keyr c C s` t |tjtjtjtjt j
t j t
jf�std��| jdur td��t| j| j|| j| j| j| j�S )zT
Sets the requestor's public key (as found in the signing request).
z�Expecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rY r � DSAPublicKeyr � RSAPublicKeyr �EllipticCurvePublicKeyr
�Ed25519PublicKeyr �Ed448PublicKeyr �X25519PublicKeyr
�
X448PublicKeyr� r� r5 r� r� r� r� r� r� r� )r% r� r( r( r) r� 4 s2 �� �
�z CertificateBuilder.public_key�numberrK c C sh t |t�s td��| jdurtd��|dkrtd��|�� dkr$td��t| j| j| j || j
| j | j �S )z5
Sets the certificate serial number.
�'Serial number must be of integral type.N�'The serial number may only be set once.r z%The serial number should be positive.� �3The serial number should not be more than 159 bits.)
rY rK r� r� r5 �
bit_lengthr� r� r� r� r� r� r� �r% r r( r( r) r} Y s&
��z CertificateBuilder.serial_numberr= r> c C sz t |tj�s
td��| jdurtd��t|�}|tk r td��| jdur-|| jkr-td��t| j | j
| j | j || j| j
�S )z7
Sets the certificate activation time.
�Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rY rB r� r� r5 rF �_EARLIEST_UTC_TIMEr� r� r� r� r� r� r� �r% r= r( r( r) r� t s,
���z#CertificateBuilder.not_valid_beforec C sz t |tj�s
td��| jdurtd��t|�}|tk r td��| jdur-|| jk r-td��t| j | j
| j | j | j|| j
�S )z7
Sets the certificate expiration time.
r Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rY rB r� r� r5 rF r r� r� r� r� r� r� r� r
r( r( r) r� � s.
�
��z"CertificateBuilder.not_valid_afterr� r r� rX c C sV t |t�s td��t|j||�}t|| j� t| j| j | j
| j | j | j
g | j�|��S )z=
Adds an X.509 extension to the certificate.
r� )rY r r� r r r7 r� r� r� r� r� r� r� r� r� r( r( r) r� � s
�z CertificateBuilder.add_extensionr� r� r rv r� r� r� r� r� ru c C s� | j du r td��| jdu rtd��| jdu rtd��| jdu r$td��| jdu r-td��| jdu r6td��|durQt|tj tj
f�sGt d��t|t j
�sQt d ��t�| |||�S )
zC
Signs the certificate using the CA's private key.
Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyr� r� )r� r5 r� r� r� r� r� rY r r� r� r� r r� r� �create_x509_certificater� r( r( r) r� � s(
�zCertificateBuilder.sign)r� r� r� r� r� r� r} r� r� r� r� r� r3 r4 r r )r� r r r� )r� r r r� )r rK r r� )r= r> r r� )r� r r� rX r r� r" )
r� r rv r� r� r� r� r� r ru )
r, r- r. �__annotations__r$ r� r� r� r} r� r� r� r� r( r( r( r) r� � s*
�
%
��r� c @ sz e Zd ZU ded< ded< dddg g fd.d
d�Zd/dd�Zd0dd�Zd1dd�Zd2d d �Zd3d d!�Z d4dd"�d5d,d-�Z
dS )6� CertificateRevocationListBuilderr4 r� r� �_revoked_certificatesNr� r� r� r� r� r3 �revoked_certificatesc C s" || _ || _|| _|| _|| _d S r" )r� � _last_update� _next_updater� r )r% r� r� r� r3 r r( r( r) r$ � s
z)CertificateRevocationListBuilder.__init__r r c C s< t |t�s td��| jd urtd��t|| j| j| j| j �S )Nr� r� )
rY r r� r� r5 r
r r r� r )r% r� r( r( r) r� s
�z,CertificateRevocationListBuilder.issuer_namer> c C sr t |tj�s
td��| jd urtd��t|�}|tk r td��| jd ur-|| jkr-td��t| j || j| j
| j �S )Nr �!Last update may only be set once.�8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rY rB r� r r5 rF r r r
r� r� r )r% r� r( r( r) r� s(
���z,CertificateRevocationListBuilder.last_updatec C sr t |tj�s
td��| jd urtd��t|�}|tk r td��| jd ur-|| jk r-td��t| j | j|| j
| j �S )Nr r r z8The next update date must be after the last update date.) rY rB r� r r5 rF r r r
r� r� r )r% r� r( r( r) r� ( s(
���z,CertificateRevocationListBuilder.next_updater� r r� rX c C sN t |t�s td��t|j||�}t|| j� t| j| j | j
g | j�|�| j �S )zM
Adds an X.509 extension to the certificate revocation list.
r� ) rY r r� r r r7 r� r
r� r r r r� r( r( r) r� @ s
�z.CertificateRevocationListBuilder.add_extension�revoked_certificater� c C s4 t |t�s td��t| j| j| j| jg | j�|��S )z8
Adds a revoked certificate to the CRL.
z)Must be an instance of RevokedCertificate) rY r� r� r
r� r r r� r )r% r r( r( r) �add_revoked_certificateS s
�z8CertificateRevocationListBuilder.add_revoked_certificater� r� r rv r� r� r� r� r� r� c C s| | j d u r td��| jd u rtd��| jd u rtd��|d ur6t|tjtjf�s,td��t|t j
�s6td��t � | |||�S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timer� r� )
r� r5 r r rY r r� r� r� r r� r� �create_x509_crlr� r( r( r) r� d s
�z%CertificateRevocationListBuilder.sign)
r� r� r� r� r� r� r3 r4 r r� )r� r r r
)r� r> r r
)r� r> r r
)r� r r� rX r r
)r r� r r
r" )
r� r rv r� r� r� r� r� r r� ) r, r- r. r r$ r� r� r� r� r r� r( r( r( r) r
� s$
�
��r
c @ sH e Zd Zddg fd dd �Zd d
d�Zd dd�Zd!dd�Zd"d#d d �ZdS )$�RevokedCertificateBuilderNr} r� r� r� r3 r4 c C rL r" r� r� r( r( r) r$ � rO z"RevokedCertificateBuilder.__init__r rK r c C sX t |t�s td��| jd urtd��|dkrtd��|�� dkr$td��t|| j| j�S )Nr r r z$The serial number should be positiver r ) rY rK r� r� r5 r r r� r� r r( r( r) r} � s
�
�z'RevokedCertificateBuilder.serial_numberr= r> c C sN t |tj�s
td��| jd urtd��t|�}|tk r td��t| j|| j �S )Nr z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rY rB r� r� r5 rF r r r� r� r
r( r( r) r� � s
�
�z)RevokedCertificateBuilder.revocation_dater� r r� rX c C sF t |t�s td��t|j||�}t|| j� t| j| j g | j�|��S )Nr� )
rY r r� r r r7 r� r r� r� r� r( r( r) r� � s
�z'RevokedCertificateBuilder.add_extensionr� r� r� c C s: | j d u r td��| jd u rtd��t| j | jt| j��S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r� r5 r� r� r r� )r% r� r( r( r) �build� s
��z RevokedCertificateBuilder.build)r} r� r� r� r3 r4 )r rK r r )r= r> r r )r� r r� rX r r r" )r� r� r r� )r, r- r. r$ r} r� r� r r( r( r( r) r � s �
r rK c C s t �t�d�d�d? S )N� �bigr )rK �
from_bytes�os�urandomr( r( r( r) �random_serial_number� rU r )r1 r2 r3 r4 r r )r r r8 r9 r r )r= r> r r> rc )N�
__future__r r� rB r r� r� � cryptographyr �"cryptography.hazmat.bindings._rustr r� � cryptography.hazmat.primitivesr r �)cryptography.hazmat.primitives.asymmetricr r r r
r r r
r �/cryptography.hazmat.primitives.asymmetric.typesr r r � cryptography.x509.extensionsr r r r �cryptography.x509.namer r �cryptography.x509.oidr r �Union�SHA224�SHA256�SHA384�SHA512�SHA3_224�SHA3_256�SHA3_384�SHA3_512�_AllowedHashTypes� Exceptionr r7 r< rF rG rf �Enumro rs �ABCMetaru �registerr� r� r� r� �load_pem_x509_certificate�load_der_x509_certificate�load_pem_x509_certificates�load_pem_x509_csr�load_der_x509_csr�load_pem_x509_crl�load_der_x509_crlr� r� r
r r r( r( r( r) �<module> sv (
��
$ " fe v I