
    ,d]              	      ^   d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlm	Z
 d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d d	l m!Z!m"Z" d d
l#m$Z$  ej        ddd          Z%ej&        ej'        ej(        ej)        ej*        ej+        ej,        ej-        ej.        f         Z/ G d de0          Z1dGdZ2dHdZ3dIdZ4 G d d          Z5 G d  d!          Z6 G d" d#ej7                  Z8 G d$ d%e0          Z9 G d& d'ej:        (          Z;e;<                    e
j;                    G d) d*ej:        (          Z=e=<                    e
j=                    G d+ d,e=          Z> G d- d.ej:        (          Z?e?<                    e
j?                    G d/ d0ej:        (          Z@e@<                    e
j@                   	 dJdKd5ZAdLd7ZB	 dJdKd8ZC	 dJdMd9ZD	 dJdMd:ZE	 dJdNd;ZF	 dJdNd<ZG G d= d>          ZH G d? d@          ZI G dA dB          ZJ G dC dD          ZKdOdFZLdS )P    )annotationsN)utils)x509)hashesserialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                        e Zd Zd fdZ xZS )	AttributeNotFoundmsgstroidr   returnNonec                X    t                                          |           || _        d S N)super__init__r   )selfr   r   	__class__s      6lib/python3.11/site-packages/cryptography/x509/base.pyr%   zAttributeNotFound.__init__8   s&        )r   r   r   r   r    r!   __name__
__module____qualname__r%   __classcell__r'   s   @r(   r   r   7   s=                 r)   r   	extensionExtension[ExtensionType]
extensions%typing.List[Extension[ExtensionType]]r    r!   c                N    |D ]!}|j         | j         k    rt          d          "d S )Nz$This extension has already been set.)r   
ValueError)r0   r2   es      r(   _reject_duplicate_extensionr7   =   sD    
  E E5IM!!CDDD "E Er)   r   r   
attributesHtyping.List[typing.Tuple[ObjectIdentifier, bytes, typing.Optional[int]]]c                B    |D ]\  }}}|| k    rt          d          d S )Nz$This attribute has already been set.)r5   )r   r8   attr_oid_s       r(   _reject_duplicate_attributer=   G   sD     % E E!Qs??CDDD E Er)   timedatetime.datetimec                    | j         D|                                 }|r|nt          j                    }|                     d          |z
  S | S )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)rA   	utcoffsetdatetime	timedeltareplace)r>   offsets     r(   _convert_to_naive_utc_timerG   S   sP     {!!!;x'9';';||4|((611r)   c                  v    e Zd Zej        j        fdd	Zedd
            Zedd            ZddZ	ddZ
ddZdS )	Attributer   r   valuebytes_typeintr    r!   c                0    || _         || _        || _        d S r#   )_oid_valuerL   )r&   r   rJ   rL   s       r(   r%   zAttribute.__init__b   s     	


r)   c                    | j         S r#   )rO   r&   s    r(   r   zAttribute.oidl   s
    yr)   c                    | j         S r#   )rP   rR   s    r(   rJ   zAttribute.valuep   s
    {r)   r   c                (    d| j          d| j        dS )Nz<Attribute(oid=z, value=)>)r   rJ   rR   s    r(   __repr__zAttribute.__repr__t   s    CCC4:CCCCr)   otherobjectboolc                    t          |t                    st          S | j        |j        k    o| j        |j        k    o| j        |j        k    S r#   )
isinstancerI   NotImplementedr   rJ   rL   r&   rW   s     r(   __eq__zAttribute.__eq__w   sO    %++ 	"!! H	! *
ek)*
ek)	
r)   c                D    t          | j        | j        | j        f          S r#   )hashr   rJ   rL   rR   s    r(   __hash__zAttribute.__hash__   s    TXtz4:6777r)   N)r   r   rJ   rK   rL   rM   r    r!   r    r   r    rK   r    r   rW   rX   r    rY   r    rM   )r+   r,   r-   r   
UTF8StringrJ   r%   propertyr   rV   r^   ra    r)   r(   rI   rI   a   s        
 )/	        X    XD D D D
 
 
 
8 8 8 8 8 8r)   rI   c                  D    e Zd ZddZ ed          \  ZZZddZddZ	dS )
Attributesr8   typing.Iterable[Attribute]r    r!   c                .    t          |          | _        d S r#   )list_attributes)r&   r8   s     r(   r%   zAttributes.__init__   s      
++r)   ro   r   c                    d| j          dS )Nz<Attributes(rU   )ro   rR   s    r(   rV   zAttributes.__repr__   s    2d.2222r)   r   r   rI   c                R    | D ]}|j         |k    r|c S t          d| d|          )NzNo z attribute was found)r   r   )r&   r   attrs      r(   get_attribute_for_oidz Attributes.get_attribute_for_oid   sH     	 	Dx3    ?c ? ? ?EEEr)   N)r8   rl   r    r!   rd   )r   r   r    rI   )
r+   r,   r-   r%   r   __len____iter____getitem__rV   rs   ri   r)   r(   rk   rk      so        , , , , &<%;M%J%J"GX{3 3 3 3F F F F F Fr)   rk   c                      e Zd ZdZdZdS )Versionr      N)r+   r,   r-   v1v3ri   r)   r(   rx   rx      s        	
B	
BBBr)   rx   c                        e Zd Zd fdZ xZS )	InvalidVersionr   r   parsed_versionrM   r    r!   c                X    t                                          |           || _        d S r#   )r$   r%   r~   )r&   r   r~   r'   s      r(   r%   zInvalidVersion.__init__   s)    ,r)   )r   r   r~   rM   r    r!   r*   r/   s   @r(   r}   r}      s=        - - - - - - - - - -r)   r}   c                  d   e Zd Zej        d)d            Zeej        d*d                        Zeej        d+d	                        Zej        d,d            Z	eej        d-d                        Z
eej        d-d                        Zeej        d.d                        Zeej        d.d                        Zeej        d/d                        Zeej        d0d                        Zeej        d1d                        Zeej        d2d                        Zeej        d3d                        Zeej        d3d                        Zeej        d3d                        Zej        d4d             Zej        d*d!            Zej        d5d$            Zej        d6d'            Zd(S )7Certificate	algorithmhashes.HashAlgorithmr    rK   c                    dS z4
        Returns bytes using digest passed.
        Nri   r&   r   s     r(   fingerprintzCertificate.fingerprint         r)   rM   c                    dS )z3
        Returns certificate serial number
        Nri   rR   s    r(   serial_numberzCertificate.serial_number   r   r)   rx   c                    dS )z1
        Returns the certificate version
        Nri   rR   s    r(   versionzCertificate.version   r   r)   r   c                    dS z(
        Returns the public key
        Nri   rR   s    r(   
public_keyzCertificate.public_key   r   r)   r?   c                    dS )z?
        Not before time (represented as UTC datetime)
        Nri   rR   s    r(   not_valid_beforezCertificate.not_valid_before   r   r)   c                    dS )z>
        Not after time (represented as UTC datetime)
        Nri   rR   s    r(   not_valid_afterzCertificate.not_valid_after   r   r)   r   c                    dS )z1
        Returns the issuer name object.
        Nri   rR   s    r(   issuerzCertificate.issuer   r   r)   c                    dS z2
        Returns the subject name object.
        Nri   rR   s    r(   subjectzCertificate.subject   r   r)   %typing.Optional[hashes.HashAlgorithm]c                    dS zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nri   rR   s    r(   signature_hash_algorithmz$Certificate.signature_hash_algorithm   r   r)   r   c                    dS zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nri   rR   s    r(   signature_algorithm_oidz#Certificate.signature_algorithm_oid   r   r)   ;typing.Union[None, padding.PSS, padding.PKCS1v15, ec.ECDSA]c                    dS )z=
        Returns the signature algorithm parameters.
        Nri   rR   s    r(   signature_algorithm_parametersz*Certificate.signature_algorithm_parameters   r   r)   r   c                    dS )z/
        Returns an Extensions object.
        Nri   rR   s    r(   r2   zCertificate.extensions   r   r)   c                    dS z.
        Returns the signature bytes.
        Nri   rR   s    r(   	signaturezCertificate.signature   r   r)   c                    dS )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nri   rR   s    r(   tbs_certificate_bytesz!Certificate.tbs_certificate_bytes  r   r)   c                    dS )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nri   rR   s    r(   tbs_precertificate_bytesz$Certificate.tbs_precertificate_bytes
  r   r)   rW   rX   rY   c                    dS z"
        Checks equality.
        Nri   r]   s     r(   r^   zCertificate.__eq__  r   r)   c                    dS z"
        Computes a hash.
        Nri   rR   s    r(   ra   zCertificate.__hash__  r   r)   encodingserialization.Encodingc                    dS )zB
        Serializes the certificate to PEM or DER format.
        Nri   r&   r   s     r(   public_byteszCertificate.public_bytes  r   r)   r   r!   c                    dS )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nri   )r&   r   s     r(   verify_directly_issued_byz%Certificate.verify_directly_issued_by$  r   r)   Nr   r   r    rK   rf   )r    rx   r    r   r    r?   r    r   r    r   rb   )r    r   r    r   rc   re   r   r   r    rK   )r   r   r    r!   )r+   r,   r-   abcabstractmethodr   rh   r   r   r   r   r   r   r   r   r   r   r2   r   r   r   r^   ra   r   r   ri   r)   r(   r   r      s@          
     X
     X
 	   
     X
     X
     X
     X
     X     X
     X     X
     X
     X
     X 	   
 	   
 	   
 	     r)   r   )	metaclassc                      e Zd Zeej        d	d                        Zeej        d
d                        Zeej        dd                        ZdS )RevokedCertificater    rM   c                    dS )zG
        Returns the serial number of the revoked certificate.
        Nri   rR   s    r(   r   z RevokedCertificate.serial_number2  r   r)   r?   c                    dS )zH
        Returns the date of when this certificate was revoked.
        Nri   rR   s    r(   revocation_datez"RevokedCertificate.revocation_date9  r   r)   r   c                    dS )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nri   rR   s    r(   r2   zRevokedCertificate.extensions@  r   r)   Nrf   r   r   )	r+   r,   r-   rh   r   r   r   r   r2   ri   r)   r(   r   r   1  s            X
     X
     X  r)   r   c                  ^    e Zd ZddZedd	            Zedd
            Zedd            ZdS )_RawRevokedCertificater   rM   r   r?   r2   r   c                0    || _         || _        || _        d S r#   _serial_number_revocation_date_extensionsr&   r   r   r2   s       r(   r%   z_RawRevokedCertificate.__init__M  "     , /%r)   r    c                    | j         S r#   )r   rR   s    r(   r   z$_RawRevokedCertificate.serial_numberW  s    ""r)   c                    | j         S r#   )r   rR   s    r(   r   z&_RawRevokedCertificate.revocation_date[  s    $$r)   c                    | j         S r#   )r   rR   s    r(   r2   z!_RawRevokedCertificate.extensions_  s    r)   N)r   rM   r   r?   r2   r   rf   r   r   )r+   r,   r-   r%   rh   r   r   r2   ri   r)   r(   r   r   L  s        & & & & # # # X# % % % X%       X     r)   r   c                     e Zd Zej        d/d            Zej        d0d            Zej        d1d            Zeej        d2d                        Z	eej        d3d                        Z
eej        d4d                        Zeej        d5d                        Zeej        d6d                        Zeej        d7d                        Zeej        d8d                        Zeej        d8d                        Zej        d9d            Zej        d:d            Zej        d;d"            Zej        d<d%            Zej        d=d(            Zej        d>d*            Zej        d?d-            Zd.S )@CertificateRevocationListr   r   r    rK   c                    dS )z:
        Serializes the CRL to PEM or DER format.
        Nri   r   s     r(   r   z&CertificateRevocationList.public_bytese  r   r)   r   r   c                    dS r   ri   r   s     r(   r   z%CertificateRevocationList.fingerprintk  r   r)   r   rM   #typing.Optional[RevokedCertificate]c                    dS )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nri   )r&   r   s     r(   (get_revoked_certificate_by_serial_numberzBCertificateRevocationList.get_revoked_certificate_by_serial_numberq  r   r)   r   c                    dS r   ri   rR   s    r(   r   z2CertificateRevocationList.signature_hash_algorithmz  r   r)   r   c                    dS r   ri   rR   s    r(   r   z1CertificateRevocationList.signature_algorithm_oid  r   r)   r   c                    dS )zC
        Returns the X509Name with the issuer of this CRL.
        Nri   rR   s    r(   r   z CertificateRevocationList.issuer  r   r)   "typing.Optional[datetime.datetime]c                    dS )z?
        Returns the date of next update for this CRL.
        Nri   rR   s    r(   next_updatez%CertificateRevocationList.next_update  r   r)   r?   c                    dS )z?
        Returns the date of last update for this CRL.
        Nri   rR   s    r(   last_updatez%CertificateRevocationList.last_update  r   r)   r   c                    dS )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nri   rR   s    r(   r2   z$CertificateRevocationList.extensions  r   r)   c                    dS r   ri   rR   s    r(   r   z#CertificateRevocationList.signature  r   r)   c                    dS )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nri   rR   s    r(   tbs_certlist_bytesz,CertificateRevocationList.tbs_certlist_bytes  r   r)   rW   rX   rY   c                    dS r   ri   r]   s     r(   r^   z CertificateRevocationList.__eq__  r   r)   c                    dS )z<
        Number of revoked certificates in the CRL.
        Nri   rR   s    r(   rt   z!CertificateRevocationList.__len__  r   r)   idxr   c                    d S r#   ri   r&   r   s     r(   rv   z%CertificateRevocationList.__getitem__      r)   slicetyping.List[RevokedCertificate]c                    d S r#   ri   r   s     r(   rv   z%CertificateRevocationList.__getitem__  r   r)   typing.Union[int, slice]Atyping.Union[RevokedCertificate, typing.List[RevokedCertificate]]c                    dS )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nri   r   s     r(   rv   z%CertificateRevocationList.__getitem__  r   r)   #typing.Iterator[RevokedCertificate]c                    dS )z8
        Iterator over the revoked certificates
        Nri   rR   s    r(   ru   z"CertificateRevocationList.__iter__  r   r)   r   r   c                    dS )zQ
        Verifies signature of revocation list against given public key.
        Nri   )r&   r   s     r(   is_signature_validz,CertificateRevocationList.is_signature_valid  r   r)   Nr   r   )r   rM   r    r   r   rb   r   )r    r   r   r   rc   re   rf   )r   rM   r    r   )r   r   r    r   )r   r   r    r   )r    r   )r   r   r    rY   )r+   r,   r-   r   r   r   r   r   rh   r   r   r   r   r   r2   r   r   r^   rt   typingoverloadrv   ru   r   ri   r)   r(   r   r   d  s          
 	   
 	        X     X
     X
     X
     X
     X
     X
     X
 	   
 	   
 _   _ _   _ 	    	   
 	     r)   r   c                  H   e Zd Zej        dd            Zej        dd            Zej        d d	            Zeej        d!d                        Z	eej        d"d                        Z
eej        d#d                        Zeej        d$d                        Zeej        d%d                        Zej        d&d            Zeej        d'd                        Zeej        d'd                        Zeej        d(d                        Zej        d)d            ZdS )*CertificateSigningRequestrW   rX   r    rY   c                    dS r   ri   r]   s     r(   r^   z CertificateSigningRequest.__eq__  r   r)   rM   c                    dS r   ri   rR   s    r(   ra   z"CertificateSigningRequest.__hash__  r   r)   r   c                    dS r   ri   rR   s    r(   r   z$CertificateSigningRequest.public_key  r   r)   r   c                    dS r   ri   rR   s    r(   r   z!CertificateSigningRequest.subject  r   r)   r   c                    dS r   ri   rR   s    r(   r   z2CertificateSigningRequest.signature_hash_algorithm  r   r)   r   c                    dS r   ri   rR   s    r(   r   z1CertificateSigningRequest.signature_algorithm_oid  r   r)   r   c                    dS )z@
        Returns the extensions in the signing request.
        Nri   rR   s    r(   r2   z$CertificateSigningRequest.extensions  r   r)   rk   c                    dS )z/
        Returns an Attributes object.
        Nri   rR   s    r(   r8   z$CertificateSigningRequest.attributes  r   r)   r   r   rK   c                    dS )z;
        Encodes the request to PEM or DER format.
        Nri   r   s     r(   r   z&CertificateSigningRequest.public_bytes  r   r)   c                    dS r   ri   rR   s    r(   r   z#CertificateSigningRequest.signature"  r   r)   c                    dS )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nri   rR   s    r(   tbs_certrequest_bytesz/CertificateSigningRequest.tbs_certrequest_bytes)  r   r)   c                    dS )z8
        Verifies signature of signing request.
        Nri   rR   s    r(   r   z,CertificateSigningRequest.is_signature_valid1  r   r)   r   c                    dS )z:
        Get the attribute value for a given OID.
        Nri   )r&   r   s     r(   rs   z/CertificateSigningRequest.get_attribute_for_oid8  r   r)   Nre   rf   r   r   r   rb   r   )r    rk   r   rc   )r    rY   )r   r   r    rK   )r+   r,   r-   r   r   r^   ra   r   rh   r   r   r   r2   r8   r   r   r  r   rs   ri   r)   r(   r   r     s6          
 	   
 	   
     X
     X     X
     X
     X
 	   
     X
     X     X
 	     r)   r   datarK   backend
typing.Anyc                *    t          j        |           S r#   )	rust_x509load_pem_x509_certificater  r  s     r(   r  r  D       .t444r)   typing.List[Certificate]c                *    t          j        |           S r#   )r  load_pem_x509_certificates)r  s    r(   r  r  J  s    /555r)   c                *    t          j        |           S r#   )r  load_der_x509_certificater  s     r(   r  r  O  r  r)   c                *    t          j        |           S r#   )r  load_pem_x509_csrr  s     r(   r  r  V       &t,,,r)   c                *    t          j        |           S r#   )r  load_der_x509_csrr  s     r(   r  r  ]  r  r)   c                *    t          j        |           S r#   )r  load_pem_x509_crlr  s     r(   r  r  d  r  r)   c                *    t          j        |           S r#   )r  load_der_x509_crlr  s     r(   r  r  k  r  r)   c                  H    e Zd Zdg g fd"dZd#dZd$dZddd%dZ	 d&d'd!ZdS )( CertificateSigningRequestBuilderNsubject_nametyping.Optional[Name]r2   r3   r8   r9   c                0    || _         || _        || _        dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   ro   )r&   r  r2   r8   s       r(   r%   z)CertificateSigningRequestBuilder.__init__r  s"     *%%r)   namer   r    c                    t          |t                    st          d          | j        t	          d          t          || j        | j                  S )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)r[   r   	TypeErrorr"  r5   r  r   ro   r&   r#  s     r(   r  z-CertificateSigningRequestBuilder.subject_name  s\     $%% 	;9:::)EFFF/$"D$4
 
 	
r)   extvalr   criticalrY   c                    t          |t                    st          d          t          |j        ||          }t          || j                   t          | j        | j        |gz   | j	                  S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
r[   r   r'  r   r   r7   r   r  r"  ro   r&   r)  r*  r0   s       r(   add_extensionz.CertificateSigningRequestBuilder.add_extension  sw     &-00 	B@AAAfj(F;;	#It/?@@@/	{*
 
 	
r)   )_tagr   r   rJ   rK   r/  typing.Optional[_ASN1Type]c               n   t          |t                    st          d          t          |t                    st          d          |$t          |t                    st          d          t          || j                   ||j        }nd}t          | j	        | j
        | j        |||fgz             S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)r[   r   r'  rK   r   r=   ro   rJ   r  r"  r   )r&   r   rJ   r/  tags        r(   add_attributez.CertificateSigningRequestBuilder.add_attribute  s     #/00 	?=>>>%'' 	31222JtY$?$?3444#C)9:::*CCC/eS 122
 
 	
r)   private_keyr   r   "typing.Optional[_AllowedHashTypes]r  r	  r   c                Z    | j         t          d          t          j        | ||          S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r"  r5   r  create_x509_csrr&   r4  r   r  s       r(   signz%CertificateSigningRequestBuilder.sign  s1     %NOOO({IFFFr)   )r  r   r2   r3   r8   r9   )r#  r   r    r  )r)  r   r*  rY   r    r  )r   r   rJ   rK   r/  r0  r    r  r#   )r4  r   r   r5  r  r	  r    r   )r+   r,   r-   r%   r  r.  r3  r9  ri   r)   r(   r  r  q  s         /3<> & & & & &

 

 

 


 
 
 
. ,0
 
 
 
 
 
H #	G G G G G G Gr)   r  c                  |    e Zd ZU ded<   ddddddg fd0dZd1dZd1dZd2dZd3dZd4dZ	d4dZ
d5d$Z	 d6dd%d7d/ZdS )8CertificateBuilderr3   r   Nissuer_namer   r  r   *typing.Optional[CertificatePublicKeyTypes]r   typing.Optional[int]r   r   r   r2   r    r!   c                    t           j        | _        || _        || _        || _        || _        || _        || _        || _	        d S r#   )
rx   r{   _version_issuer_namer"  _public_keyr   _not_valid_before_not_valid_afterr   )r&   r<  r  r   r   r   r   r2   s           r(   r%   zCertificateBuilder.__init__  sK      
')%+!1 /%r)   r#  r   c           	         t          |t                    st          d          | j        t	          d          t          || j        | j        | j        | j	        | j
        | j                  S )z3
        Sets the CA's distinguished name.
        r%  N%The issuer name may only be set once.)r[   r   r'  rA  r5   r;  r"  rB  r   rC  rD  r   r(  s     r(   r<  zCertificateBuilder.issuer_name  sv     $%% 	;9:::(DEEE!"!
 
 	
r)   c           	         t          |t                    st          d          | j        t	          d          t          | j        || j        | j        | j	        | j
        | j                  S )z:
        Sets the requestor's distinguished name.
        r%  Nr&  )r[   r   r'  r"  r5   r;  rA  rB  r   rC  rD  r   r(  s     r(   r  zCertificateBuilder.subject_name  sv     $%% 	;9:::)EFFF!"!
 
 	
r)   keyr   c           
     l   t          |t          j        t          j        t
          j        t          j        t          j
        t          j        t          j        f          st          d          | j        t#          d          t%          | j        | j        || j        | j        | j        | j                  S )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)r[   r   DSAPublicKeyr   RSAPublicKeyr	   EllipticCurvePublicKeyr   Ed25519PublicKeyr
   Ed448PublicKeyr   X25519PublicKeyr   X448PublicKeyr'  rB  r5   r;  rA  r"  r   rC  rD  r   )r&   rH  s     r(   r   zCertificateBuilder.public_key  s       )($&"
 
 	 !   'CDDD!"!
 
 	
r)   numberrM   c           	     T   t          |t                    st          d          | j        t	          d          |dk    rt	          d          |                                dk    rt	          d          t          | j        | j        | j	        || j
        | j        | j                  S )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)r[   rM   r'  r   r5   
bit_lengthr;  rA  r"  rB  rC  rD  r   r&   rQ  s     r(   r   z CertificateBuilder.serial_number,  s     &#&& 	GEFFF*FGGGQ;;DEEE #%%H   ""!
 
 	
r)   r>   r?   c           	     z   t          |t          j                  st          d          | j        t	          d          t          |          }|t          k     rt	          d          | j        || j        k    rt	          d          t          | j	        | j
        | j        | j        || j        | j                  S )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)r[   rC   r'  rC  r5   rG   _EARLIEST_UTC_TIMErD  r;  rA  r"  rB  r   r   r&   r>   s     r(   r   z#CertificateBuilder.not_valid_beforeG  s     $ 122 	:8999!-IJJJ)$//$$$$    ,8M1M1M   "!
 
 	
r)   c           	     z   t          |t          j                  st          d          | j        t	          d          t          |          }|t          k     rt	          d          | j        || j        k     rt	          d          t          | j	        | j
        | j        | j        | j        || j                  S )z7
        Sets the certificate expiration time.
        rZ  Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)r[   rC   r'  rD  r5   rG   r[  rC  r;  rA  r"  rB  r   r   r\  s     r(   r   z"CertificateBuilder.not_valid_afterd  s     $ 122 	:8999 ,HIII)$//$$$#  
 ".t---   ""
 
 	
r)   r)  r   r*  rY   c           
        t          |t                    st          d          t          |j        ||          }t          || j                   t          | j        | j	        | j
        | j        | j        | j        | j        |gz             S )z=
        Adds an X.509 extension to the certificate.
        r,  )r[   r   r'  r   r   r7   r   r;  rA  r"  rB  r   rC  rD  r-  s       r(   r.  z CertificateBuilder.add_extension  s     &-00 	B@AAAfj(F;;	#It/?@@@!"!	{*
 
 	
r)   )rsa_paddingr4  r   r   r5  r  r	  r_  <typing.Optional[typing.Union[padding.PSS, padding.PKCS1v15]]r   c                  | j         t          d          | j        t          d          | j        t          d          | j        t          d          | j        t          d          | j        t          d          |^t          |t          j	        t          j
        f          st          d          t          |t          j                  st          d	          t          j        | |||          S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyzPadding must be PSS or PKCS1v15z&Padding is only supported for RSA keys)r"  r5   rA  r   rC  rD  rB  r[   r   PSSPKCS1v15r'  r   RSAPrivateKeyr  create_x509_certificate)r&   r4  r   r  r_  s        r(   r9  zCertificateBuilder.sign  s	    %EFFF$EFFF&FGGG!)NOOO (MNNN#CDDD"kGK9I+JKK C ABBBk3+<== J HIII0+y+
 
 	
r)   )r<  r   r  r   r   r=  r   r>  r   r   r   r   r2   r3   r    r!   )r#  r   r    r;  )rH  r   r    r;  )rQ  rM   r    r;  )r>   r?   r    r;  )r)  r   r*  rY   r    r;  r#   )
r4  r   r   r5  r  r	  r_  r`  r    r   )r+   r,   r-   __annotations__r%   r<  r  r   r   r   r   r.  r9  ri   r)   r(   r;  r;    s        6666 .2.2AE.2?C>B<>& & & & &&
 
 
 
$
 
 
 
$#
 #
 #
 #
J
 
 
 
6
 
 
 
:
 
 
 
@
 
 
 
4 #	'
 '
 '
 '
 '
 '
 '
 '
 '
r)   r;  c                  l    e Zd ZU ded<   ded<   dddg g fd$dZd%dZd&dZd'dZd(dZd)dZ		 d*d+d#Z
dS ), CertificateRevocationListBuilderr3   r   r   _revoked_certificatesNr<  r   r   r   r   r2   revoked_certificatesc                L    || _         || _        || _        || _        || _        d S r#   )rA  _last_update_next_updater   ri  )r&   r<  r   r   r2   rj  s         r(   r%   z)CertificateRevocationListBuilder.__init__  s2     (''%%9"""r)   r   r    c                    t          |t                    st          d          | j        t	          d          t          || j        | j        | j        | j	                  S )Nr%  rF  )
r[   r   r'  rA  r5   rh  rl  rm  r   ri  )r&   r<  s     r(   r<  z,CertificateRevocationListBuilder.issuer_name  sj     +t,, 	;9:::(DEEE/&
 
 	
r)   r?   c                b   t          |t          j                  st          d          | j        t	          d          t          |          }|t          k     rt	          d          | j        || j        k    rt	          d          t          | j	        || j        | j
        | j                  S )NrZ  !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)r[   rC   r'  rl  r5   rG   r[  rm  rh  rA  r   ri  )r&   r   s     r(   r   z,CertificateRevocationListBuilder.last_update  s     +x'899 	:8999(@AAA0==+++M   ([4;L-L-LK   0&
 
 	
r)   c                b   t          |t          j                  st          d          | j        t	          d          t          |          }|t          k     rt	          d          | j        || j        k     rt	          d          t          | j	        | j        || j
        | j                  S )NrZ  rp  rq  z8The next update date must be after the last update date.)r[   rC   r'  rm  r5   rG   r[  rl  rh  rA  r   ri  )r&   r   s     r(   r   z,CertificateRevocationListBuilder.next_update  s     +x'899 	:8999(@AAA0==+++M   ([4;L-L-LJ   0&
 
 	
r)   r)  r   r*  rY   c                    t          |t                    st          d          t          |j        ||          }t          || j                   t          | j        | j	        | j
        | j        |gz   | j                  S )zM
        Adds an X.509 extension to the certificate revocation list.
        r,  )r[   r   r'  r   r   r7   r   rh  rA  rl  rm  ri  r-  s       r(   r.  z.CertificateRevocationListBuilder.add_extension  s     &-00 	B@AAAfj(F;;	#It/?@@@/	{*&
 
 	
r)   revoked_certificater   c                    t          |t                    st          d          t          | j        | j        | j        | j        | j        |gz             S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	r[   r   r'  rh  rA  rl  rm  r   ri  )r&   rt  s     r(   add_revoked_certificatez8CertificateRevocationListBuilder.add_revoked_certificate(  sa     -/ABB 	IGHHH/&*=)>>
 
 	
r)   r4  r   r   r5  r  r	  r   c                    | j         t          d          | j        t          d          | j        t          d          t	          j        | ||          S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)rA  r5   rl  rm  r  create_x509_crlr8  s       r(   r9  z%CertificateRevocationListBuilder.sign9  sa     $=>>>$ABBB$ABBB({IFFFr)   )
r<  r   r   r   r   r   r2   r3   rj  r   )r<  r   r    rh  )r   r?   r    rh  )r   r?   r    rh  )r)  r   r*  rY   r    rh  )rt  r   r    rh  r#   )r4  r   r   r5  r  r	  r    r   )r+   r,   r-   rf  r%   r<  r   r   r.  rv  r9  ri   r)   r(   rh  rh    s         6666:::: .2:>:><>@B: : : : :
 
 
 

 
 
 
0
 
 
 
0
 
 
 
&
 
 
 
* #	G G G G G G Gr)   rh  c                  @    e Zd Zddg fddZddZddZddZdddZdS )RevokedCertificateBuilderNr   r>  r   r   r2   r3   c                0    || _         || _        || _        d S r#   r   r   s       r(   r%   z"RevokedCertificateBuilder.__init__L  r   r)   rQ  rM   r    c                $   t          |t                    st          d          | j        t	          d          |dk    rt	          d          |                                dk    rt	          d          t          || j        | j                  S )NrS  rT  r   z$The serial number should be positiverU  rV  )	r[   rM   r'  r   r5   rW  rz  r   r   rX  s     r(   r   z'RevokedCertificateBuilder.serial_numberV  s    &#&& 	GEFFF*FGGGQ;;CDDD #%%H   )D)4+;
 
 	
r)   r>   r?   c                   t          |t          j                  st          d          | j        t	          d          t          |          }|t          k     rt	          d          t          | j        || j	                  S )NrZ  z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
r[   rC   r'  r   r5   rG   r[  rz  r   r   r\  s     r(   r   z)RevokedCertificateBuilder.revocation_dateh  s     $ 122 	:8999 ,HIII)$//$$$L   )t'7
 
 	
r)   r)  r   r*  rY   c                    t          |t                    st          d          t          |j        ||          }t          || j                   t          | j        | j	        | j        |gz             S )Nr,  )
r[   r   r'  r   r   r7   r   rz  r   r   r-  s       r(   r.  z'RevokedCertificateBuilder.add_extensionx  sw     &-00 	B@AAAfj(F;;	#It/?@@@(!	{*
 
 	
r)   r  r	  r   c                    | j         t          d          | j        t          d          t          | j         | j        t	          | j                            S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r5   r   r   r   r   )r&   r  s     r(   buildzRevokedCertificateBuilder.build  sf    &NOOO (C   &!t'((
 
 	
r)   )r   r>  r   r   r2   r3   )rQ  rM   r    rz  )r>   r?   r    rz  )r)  r   r*  rY   r    rz  r#   )r  r	  r    r   )r+   r,   r-   r%   r   r   r.  r  ri   r)   r(   rz  rz  K  s         /3>B<>	& & & & &
 
 
 
$
 
 
 
 
 
 
 

 
 
 
 
 
 
r)   rz  rM   c                 b    t                               t          j        d          d          dz	  S )N   bigr   )rM   
from_bytesosurandomri   r)   r(   random_serial_numberr    s#    >>"*R..%00A55r)   )r0   r1   r2   r3   r    r!   )r   r   r8   r9   r    r!   )r>   r?   r    r?   r#   )r  rK   r  r	  r    r   )r  rK   r    r  )r  rK   r  r	  r    r   )r  rK   r  r	  r    r   rf   )M
__future__r   r   rC   r  r   cryptographyr   "cryptography.hazmat.bindings._rustr   r  cryptography.hazmat.primitivesr   r   )cryptography.hazmat.primitives.asymmetricr   r	   r
   r   r   r   r   r   /cryptography.hazmat.primitives.asymmetric.typesr   r   r   cryptography.x509.extensionsr   r   r   r   cryptography.x509.namer   r   cryptography.x509.oidr   r[  UnionSHA224SHA256SHA384SHA512SHA3_224SHA3_256SHA3_384SHA3_512_AllowedHashTypes	Exceptionr   r7   r=   rG   rI   rk   Enumrx   r}   ABCMetar   registerr   r   r   r   r  r  r  r  r  r  r  r  r;  rh  rz  r  ri   r)   r(   <module>r     s  
 # " " " " " 



  				        @ @ @ @ @ @ @ @ @ @ @ @ @ @	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	         
            3 2 2 2 2 2 2 2 2 2 2 2 2 2&X&tQ22  L
M
M
M
M
O
O
O
O	     	   E E E E	E 	E 	E 	E   !8 !8 !8 !8 !8 !8 !8 !8HF F F F F F F F(    ej   
- - - - -Y - - -F F F F FCK F F F FT   Y* + + +    3;    0   I8 9 9 9         /      0y y y y y#+ y y y yx  " "9#F G G GY Y Y Y Y#+ Y Y Y Yz  " "9#F G G G
 (,5 5 5 5 56 6 6 6 (,5 5 5 5 5 (,- - - - - (,- - - - - (,- - - - - (,- - - - -YG YG YG YG YG YG YG YGxt
 t
 t
 t
 t
 t
 t
 t
nDG DG DG DG DG DG DG DGNF
 F
 F
 F
 F
 F
 F
 F
R6 6 6 6 6 6r)   