o jn @sddlmZddlZddlZddlZddlmZddlmZddl m Z ddl m Z ddlmZmZmZmZmZmZmZmZmZmZddlmZmZdd lmZmZmZdd l m!Z!m"Z"dd l#m$Z$ed d d Z%ej&e j'e j(e j)e j*e j+e j,e j-e j.fZ/Gddde0Z1d5ddZ2d6ddZ3d7d d!Z4Gd"d#d#Z5Gd$d%d%Z6Gd&d'd'ej7Z8Gd(d)d)e0Z9e j:Z:e j;Z;e jZ>e j?Z?e j@Z@e jAZAe jBZBe jCZCe jDZDGd*d+d+ZEGd,d-d-ZFGd.d/d/ZGGd0d1d1ZHd8d3d4ZIdS)9) annotationsN)Iterable)utils)x509)hashes) dsaeced448ed25519mldsamlkempaddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificatePublicKeyTypes) Extension ExtensionType_make_sequence_methods)Name _ASN1Type)ObjectIdentifiericeZdZd fdd ZZS) AttributeNotFoundmsgstroidrreturnNonect|||_dSN)super__init__r)selfrr __class__/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/cryptography/x509/base.pyr$8  zAttributeNotFound.__init__)rrrrrr __name__ __module__ __qualname__r$ __classcell__r(r(r&r)r7r extensionExtension[ExtensionType] extensionslist[Extension[ExtensionType]]rr cCs"|D] }|j|jkrtdqdS)Nz$This extension has already been set.)r ValueError)r1r3er(r(r)_reject_duplicate_extension=s  r7rr attributes0list[tuple[ObjectIdentifier, bytes, int | None]]cCs$|D] \}}}||krtdqdS)Nz$This attribute has already been set.)r5)rr8attr_oid_r(r(r)_reject_duplicate_attributeGs r<timedatetime.datetimecCs6|jdur|}|r |nt}|jdd|S|S)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N)tzinfo)r? utcoffsetdatetime timedeltareplace)r=offsetr(r(r)_convert_to_naive_utc_timeQs rEc@sXeZdZejjfdd d Zedd d Zedd dZdddZ dddZ dddZ dS) Attributerrvaluebytes_typeintrr cC||_||_||_dSr")_oid_valuerI)r%rrGrIr(r(r)r$` zAttribute.__init__cC|jSr")rLr%r(r(r)rjz Attribute.oidcCrOr")rMrPr(r(r)rGnrQzAttribute.valuercCsd|jd|jdS)Nz)rrGrPr(r(r)__repr__rzAttribute.__repr__otherobjectboolcCs2t|tstS|j|jko|j|jko|j|jkSr") isinstancerFNotImplementedrrGrI)r%rUr(r(r)__eq__us    zAttribute.__eq__cCst|j|j|jfSr")hashrrGrIrPr(r(r)__hash__szAttribute.__hash__N)rrrGrHrIrJrr )rr)rrHrr)rUrVrrWrrJ) r,r-r.r UTF8StringrGr$propertyrrSrZr\r(r(r(r)rF_s      rFc@s8eZdZdddZed\ZZZdd d ZdddZ dS) Attributesr8Iterable[Attribute]rr cCst||_dSr")list _attributes)r%r8r(r(r)r$szAttributes.__init__rdrcCsd|jdS)Nz d?Z dS)ICertificateBuilderr4rtN issuer_namerrrq public_key CertificatePublicKeyTypes | None serial_number int | Nonenot_valid_beforedatetime.datetime | Nonenot_valid_afterr3public_key_rsa_paddingtype[padding.PSS] | Nonerr c Cs<tj|_||_||_||_||_||_||_||_ ||_ dSr") rjrm_version _issuer_namers _public_key_serial_number_not_valid_before_not_valid_afterrt_public_key_rsa_padding) r%rrqrrrrr3rr(r(r)r$)s  zCertificateBuilder.__init__rurc CsHt|ts td|jdurtdt||j|j|j|j |j |j |j S)z3 Sets the CA's distinguished name. rvN%The issuer name may only be set once.) rXrrxrr5rrsrrrrrtrryr(r(r)r>s  zCertificateBuilder.issuer_namec CsHt|ts td|jdurtdt|j||j|j|j |j |j |j S)z: Sets the requestor's distinguished name. rvNrw) rXrrxrsr5rrrrrrrtrryr(r(r)rqQs  zCertificateBuilder.subject_name)rkeyrrcCst|tjtjtjtjt j t j t j t jtjtjtjtjf s!td|dur8|tjur.tdt|tjs8td|jdurAtdt|j|j||j|j|j |j!|S)zT Sets the requestor's public key (as found in the signing request). zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, MLDSA44PublicKey, MLDSA65PublicKey, MLDSA87PublicKey, MLKEM768PublicKey, MLKEM1024PublicKey, X25519PublicKey or X448PublicKey.Nz2rsa_padding must be the PSS class, not an instancez2rsa_padding is only supported with RSA public keysz$The public key may only be set once.)"rXr DSAPublicKeyr RSAPublicKeyrEllipticCurvePublicKeyr Ed25519PublicKeyr Ed448PublicKeyr MLDSA44PublicKeyMLDSA65PublicKeyMLDSA87PublicKeyr MLKEM768PublicKeyMLKEM1024PublicKeyrX25519PublicKeyr X448PublicKeyrxr rrr5rrrsrrrrt)r%rrr(r(r)rdsP    zCertificateBuilder.public_keynumberrJc Cslt|ts td|jdurtd|dkrtd|dkr$tdt|j|j|j ||j |j |j |j S)z5 Sets the certificate serial number. 'Serial number must be of integral type.N'The serial number may only be set once.rz%The serial number should be positive.3The serial number should not be more than 159 bits.)rXrJrxrr5 bit_lengthrrrsrrrrtrr%rr(r(r)rs(   z CertificateBuilder.serial_numberr=r>c Cs~t|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j |j |j |j ||j|j |jS)z7 Sets the certificate activation time. Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rXrArxrr5rE_EARLIEST_UTC_TIMErrrrsrrrtrr%r=r(r(r)rs.  z#CertificateBuilder.not_valid_beforec Cs~t|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j |j |j |j |j||j |jS)z7 Sets the certificate expiration time. rNz)The not valid after may only be set once.ztd|durYt|t j t j fsOtd t|t j sYtd |durgt|tjsgtd t|||||S) zC Signs the certificate using the CA's private key. N&A certificate must have a subject name&A certificate must have an issuer name'A certificate must have a serial number/A certificate must have a not valid before time.A certificate must have a not valid after time$A certificate must have a public keyz$Need private key to sign certificaterrr)rsr5rrrrrrxrXr rrrrrrrcreate_x509_certificaterr(r(r)r s>        zCertificateBuilder.signcCs|jdur td|jdurtd|jdurtd|jdur$td|jdur-td|jdur6tdtj|dddddS) z@ Creates an unsigned certificate, per RFC 9925. Nrrrrrr)rhash_algorithmrr) rsr5rrrrrrrrPr(r(r)create_unsignedAs&      z"CertificateBuilder.create_unsigned)rrrrqrrrrrrrrrrr3r4rrrr )rurrr)rrrrrr)rrJrr)r=r>rr)rzrr{rWrrr") rrrrrrrrrrrr)rr)r,r-r.__annotations__r$rrqrrrrr~rrr(r(r(r)r&s2    7   5rc@s|eZdZUded<ded<dddggfd0d dZd1ddZd2ddZd3ddZd4ddZd5d d!Z d6ddd"d7d.d/Z dS)8 CertificateRevocationListBuilderr4rtlist[RevokedCertificate]_revoked_certificatesNrrr last_updater next_updater3revoked_certificatescCs"||_||_||_||_||_dSr")r _last_update _next_updatertr)r%rrrr3rr(r(r)r$ds  z)CertificateRevocationListBuilder.__init__rrcCs<t|ts td|jdurtdt||j|j|j|j S)Nrvr) rXrrxrr5rrrrtr)r%rr(r(r)rrs  z,CertificateRevocationListBuilder.issuer_namer>cCsrt|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j ||j|j |j S)Nr!Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rXrArxrr5rErrrrrtr)r%rr(r(r)rs(  z,CertificateRevocationListBuilder.last_updatecCsrt|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j |j||j |j S)Nrrrz8The next update date must be after the last update date.) rXrArxrr5rErrrrrtr)r%rr(r(r)rs(  z,CertificateRevocationListBuilder.next_updaterzrr{rWcCsNt|ts tdt|j||}t||jt|j|j |j g|j||j S)zM Adds an X.509 extension to the certificate revocation list. r|) rXrrxrrr7rtrrrrrr}r(r(r)r~s   z.CertificateRevocationListBuilder.add_extensionrevoked_certificateRevokedCertificatecCs4t|ts tdt|j|j|j|jg|j|S)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rXrrxrrrrrtr)r%rr(r(r)add_revoked_certificates  z8CertificateRevocationListBuilder.add_revoked_certificaterrrrrrrrrrrCertificateRevocationListcCs|jdur td|jdurtd|jdurtd|dur6t|tjtjfs,tdt|t j s6td|durDt|t j sDtdt |||||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timerrr)rr5rrrXr rrrxrrrrrcreate_x509_crlrr(r(r)rs.     z%CertificateRevocationListBuilder.sign) rrrrrrrr3r4rr)rrrr)rr>rr)rr>rr)rzrr{rWrr)rrrrr") rrrrrrrrrrrr) r,r-r.rr$rrrr~rrr(r(r(r)r`s&      rc@sHeZdZddgfddd Zdd dZd ddZd!ddZd"d#ddZdS)$RevokedCertificateBuilderNrrrevocation_daterr3r4cCrKr")r_revocation_datert)r%rrr3r(r(r)r$rNz"RevokedCertificateBuilder.__init__rrJrcCsXt|ts td|jdurtd|dkrtd|dkr$tdt||j|jS)Nrrrz$The serial number should be positiverr) rXrJrxrr5rrrrtrr(r(r)rs    z'RevokedCertificateBuilder.serial_numberr=r>cCsNt|tjs td|jdurtdt|}|tkrtdt|j||j S)Nrz)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rXrArxrr5rErrrrtrr(r(r)rs   z)RevokedCertificateBuilder.revocation_daterzrr{rWcCsFt|ts tdt|j||}t||jt|j|j g|j|S)Nr|) rXrrxrrr7rtrrrr}r(r(r)r~)s   z'RevokedCertificateBuilder.add_extensionrrrcCs.|jdur td|jdurtdt|S)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rr5rrcreate_revoked_certificate)r%rr(r(r)build7s   zRevokedCertificateBuilder.build)rrrrr3r4)rrJrr)r=r>rr)rzrr{rWrrr")rrrr)r,r-r.r$rrr~rr(r(r(r)rs  rrJcCsttddd?S)Nbigr)rJ from_bytesosurandomr(r(r(r)random_serial_numberArTr)r1r2r3r4rr )rrr8r9rr )r=r>rr>r^)J __future__rrArtypingcollections.abcr cryptographyr"cryptography.hazmat.bindings._rustrrcryptography.hazmat.primitivesr)cryptography.hazmat.primitives.asymmetricrrr r r r r rrr/cryptography.hazmat.primitives.asymmetric.typesrrcryptography.x509.extensionsrrrcryptography.x509.namerrcryptography.x509.oidrrUnionSHA224SHA256SHA384SHA512SHA3_224SHA3_256SHA3_384SHA3_512_AllowedHashTypes Exceptionrr7r<rErFraEnumrjrnrrrrload_pem_x509_certificateload_der_x509_certificateload_pem_x509_certificatesload_pem_x509_csrload_der_x509_csrload_pem_x509_crlload_der_x509_crlrprrrrr(r(r(r)sh     0    $p<E