
    DIeJ#                     P   d Z ddlZddlZddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
mZmZmZmZ 	 ddlmZmZ dd	lmZmZmZ dd
lmZ n# e$ r  G d de          ZY nw xY wddlmZ ddlmZ ddlmZm Z  ddl!m"Z" ddl#m$Z$m%Z%  ee&          Z' G d d          Z( e(            Z)dS )z0Interface between conda-content-trust and conda.    N)	lru_cache)glob)	getLogger)makedirs)basenameexistsisdirjoin)verify_delegationverify_root)SignatureErrorload_metadata_from_filewrite_metadata_to_file)wrap_as_signablec                       e Zd ZdS )r   N)__name__
__module____qualname__     Blib/python3.11/site-packages/conda/trust/signature_verification.pyr   r      s        r   r      )context)join_url)	HTTPErrorInsecureRequestWarning)get_session   )INITIAL_TRUST_ROOTKEY_MGR_FILEc                       e Zd Ze ed          d                         Ze ed          d                         Ze ed          d                         Z	 ddZd Z	dS )	_SignatureVerificationN)maxsizec                    t           j        sdS t           j        st                              d           dS 	 dd l}n+# t          $ r t                              d           Y dS w xY wt          t           j                  s3t          	                    d           t          t           j                   | j        t                              d           dS | j        t                              d           dS dS )	NFz[metadata signature verification requested, but no metadata URL base has not been specified.r   zVmetadata signature verification requested, but `conda-content-trust` is not installed.z5creating directory for artifact verification metadatazDcould not find trusted_root data for metadata signature verificationz?could not find key_mgr data for metadata signature verificationT)r   extra_safety_checkssigning_metadata_url_baselogwarnconda_content_trustImportErrorr	   av_data_dirinfor   trusted_rootkey_mgr)selfr)   s     r   enabledz_SignatureVerification.enabled%   s$    * 	5 0 	HHC   5	&&&&& 	 	 	HH>   55	 W()) 	*HHLMMMW())) $HHV   5 <HHVWWW5 ts   = $A%$A%c                    t           }t          t          t          t          j        d                    d          D ]v}	 t          t          |                              d          d                    t          
                    d| d           t          |          } n8# t          $ r Y sw xY wt                              dt          j         d           d}|r|d	         d
         dz    d}t          t          j        |          }	 |                     t          j        |          }t!          ||           |}t#          ||           nq# t$          $ r6}|j        j        dk    rt                              |           d}Y d }~n6d }~wt,          $ r&}t                              |           d}Y d }~nd }~ww xY w||S )Nz[0-9]*.root.jsonT)reverse.r   zLoading root metadata from zNo root metadata in z. Using built-in root metadata.signedversionr   z
.root.jsoni  F)r   sortedr   r
   r   r+   intr   splitr'   r,   r   
ValueErrordebug_fetch_channel_signing_datar&   r   r   r   responsestatus_codeerror	Exception)r/   trustedpathmore_signaturesfname	untrustederrs          r   r-   z#_SignatureVerification.trusted_rootS   s    % g)+=>>??
 
 
 	 	DHTNN((--a0111
 >t>>>???1$77     II0w': 0 0 0    	6x(3a7CCCE+U33D6 <<5 	
 GY/// $&w5555  ( ( ( <+s22IIcNNN"' ( ( (		#"'('  	68 s6   5B%%
B21B20E 
G,FGF<<Gc                    d }t           }t          t          j        |          }	 |                     t          j        t                     }t          d|| j                   |}t          ||           nF# t          t          f$ r$}t                              |           Y d }~nd }~wt          $ r} d }~ww xY w|st          |          rt!          |          }|S )Nr.   )r    r
   r   r+   r;   r&   r   r-   r   ConnectionErrorr   r'   r(   r?   r>   r   r   )r/   r@   rC   rA   rD   rE   s         r   r.   z_SignatureVerification.key_mgr   s      G'//	2881 I
 iD4EFFF  G"7D1111  + 	 	 	HHSMMMMMMMM 	 	 		  	46$<< 	4-d33Gs#   ;A3 3B6B##B60B11B6c                 :   t          |          }t          j        st          j        dt
                     ddd}|r||d<   |r||d<   t          j        }	 dt          _        |                    t          ||          ||j	        d t          j
        t          j        f          }|                                 |t          _        n# |t          _        w xY w	 |                                S # t          j        j        $ r}	t!          d	| d
|           d }	~	ww xY w)Nignorez!gzip, deflate, compress, identityzapplication/json)zAccept-EncodingzContent-TypezIf-None-MatchzIf-Modified-SinceF)headersproxiesauthtimeoutzInvalid JSON returned from /)r   r   
ssl_verifywarningssimplefilterr   add_anaconda_tokengetr   rK   remote_connect_timeout_secsremote_read_timeout_secsraise_for_statusjsondecoderJSONDecodeErrorr9   )
r/   signing_data_urlfilenameetag	mod_stampsessionrJ   saved_token_settingresprE   s
             r   r;   z2_SignatureVerification._fetch_channel_signing_data   sY    .//! 	D!(,BCCC  C.
 
  	,'+GO$ 	5+4G'(%8	= */G&;;)84474  	 	D !!###)<G&&)<G&<<<<	99;;|+ 	 	 	K.>KKKK  	s%   A#C CC, ,D DDc                     | j         r||vrd S t          |          }||         |d<   	 t          d|| j                   d}n/# t          $ r" t
                              d|            d}Y nw xY w||d<   d S )N
signaturespkg_mgrz:(INFO: package metadata is signed by Anaconda and trusted)zinvalid signature for z1(WARNING: metadata signature verification failed)metadata_signature_status)r0   r   r   r.   r   r'   r(   )r/   r,   fnrb   envelopestatuss         r   __call__z_SignatureVerification.__call__   s    | 	r33F $D))!+B	Ri4<@@@
 RFF	  	I 	I 	IHH2b22333HFFF	I -3()))s   A )A.-A.)NN)
r   r   r   propertyr   r0   r-   r.   r;   rh   r   r   r   r"   r"   #   s        Yt) )  X)X Yt5 5  X5p Yt   X@ @D6 6 6 6p3 3 3 3 3r   r"   )*__doc__rW   rP   	functoolsr   r   loggingr   osr   os.pathr   r   r	   r
   "conda_content_trust.authenticationr   r   conda_content_trust.commonr   r   r   conda_content_trust.signingr   r*   r?   base.contextr   
common.urlr   gateways.connectionr   r   gateways.connection.sessionr   	constantsr   r    r   r'   r"   signature_verificationr   r   r   <module>rx      s   7 6                           1 1 1 1 1 1 1 1 1 1 1 1QQQQQQQQ         
 =<<<<<<             # " " " " " ! ! ! ! ! ! C C C C C C C C 5 5 5 5 5 5 7 7 7 7 7 7 7 7iS3 S3 S3 S3 S3 S3 S3 S3n 0/11   s   A	 	AA