kj UddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddlm Z ddlm Z m Z mZejdk\rddlmZn,ejd krej$d ZdLd ZnddlmZdd lmZmZdd lmZmZmZmZmZddlmZddlm Z!ddlm"Z#ddlm$Z%ddlm&Z'ddlm(Z)ddlm*Z+gdZ,eejZej\ej^ej`ejbfZ2eejfejhejjejlejnfZ8ee2e8fZ9ee:e de:ffZ;e'jxZ=de>d<e'j~Z@de>d<dZAe'jZCde>d<e'jZEde>d<e'jZGde>d<e'jZIde>d<Gdd eJZKe e#eKZLe)eKZMdMdNd!ZNdOd"ZOdPd#ZPdQd$ZQdRd%ZRGd&d'ZSGd(d)ZTGd*d+ZUed,dSd-ZVed.dTd/ZWejGd0d1ZYed2Gd3d4ZZGd5d6Z[Gd7d8Z\Gd9d:Z]Gd;dZ_dUd?Z`dVd@ZadWdAZb dX dYdBZcGdCdDZddZdEZe dM d[dFZfd\dGZgegZhej"egeid2ejdHId]dJZkekZlej"ekeid2ejdKIy)^) annotationsN) b16encode)Sequence)partial)AnyCallableUnion) ) deprecated)r Tc dS)Nc|SN)fs W/home/ubuntu/.cache/pipx/cdb5059130eadca/lib/python3.12/site-packages/OpenSSL/crypto.pyzdeprecated..sr)msgkwargss rr r sr)utilsx509)dsaeced448ed25519rsa)StrOrBytesPath) byte_string)exception_from_error_queue)ffi)lib) make_assert) path_bytes) FILETYPE_ASN1 FILETYPE_PEM FILETYPE_TEXTTYPE_DSATYPE_RSAX509ErrorPKeyX509NameX509Req X509StoreX509StoreContextX509StoreContextErrorX509StoreFlagsdump_certificatedump_certificate_requestdump_privatekeydump_publickeyget_elliptic_curveget_elliptic_curvesload_certificateload_certificate_requestload_privatekeyload_publickey.intr(r'ir+r*TYPE_DHTYPE_ECceZdZdZy)r-z7 An error occurred in an `OpenSSL.crypto` API. N)__name__ __module__ __qualname____doc__rrrr-r-rsrr-cT|8tjtj}tj}n;t j d|}tj |t|}|fdd}t|tjk7t j||}|S)z Allocate a new OpenSSL memory BIO. Arrange for the garbage collector to clean it up automatically. :param buffer: None or some bytes to use to put into the BIO so that they can be read out. char[]c,tj|Sr)_libBIO_free)biorefs rfreez_new_mem_buf..frees==% %r)rLrrMrreturnr) rJBIO_new BIO_s_memrK_ffinewBIO_new_mem_buflen_openssl_assertNULLgc)bufferrLrNdatas r _new_mem_bufr[|s~ll4>>+,}}xx&)""4V5'+ &C499$% ''#t C Jrctjd}tj||}tj|d|ddS)zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**rN)rRrSrJBIO_get_mem_datarY)rL result_buffer buffer_lengths r_bio_to_stringr`s?HHX&M))#}=M ;;}Q' 7 ::rct|ts tdt|tj k7t j||}|dk(r tdy)a The the time value of an ASN1 time object. @param boundary: An ASN1_TIME pointer (or an object safely castable to that type) which will have its value set. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. zwhen must be a byte stringrzInvalid stringN) isinstancebytes TypeErrorrVrRrWrJASN1_TIME_set_string ValueError)boundarywhen set_results r_set_asn1_timerjsW dE "455H )***8T:JQ)**rctj}t|tjk7tj |tj }t|||S)a Behaves like _set_asn1_time but returns a new ASN1_TIME object. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. )rJ ASN1_TIME_newrVrRrWrXASN1_TIME_freerj)rhrets r_new_asn1_timerosH    CC499$% ''#t** +C3 JrcJtjd|}tj|dk(rytj|tj k(r(tj tj|Stjd}tj||t|dtjk7tjd|d}tj|}tj |}tj|d|S)a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. z ASN1_STRING*rNzASN1_GENERALIZEDTIME**) rRcastrJASN1_STRING_lengthASN1_STRING_typeV_ASN1_GENERALIZEDTIMEstringASN1_STRING_get0_datarSASN1_TIME_to_generalizedtimerVrWASN1_GENERALIZEDTIME_free) timestampstring_timestampgeneralized_timestamp string_data string_results r_get_asn1_timer~syy; /0A5 ./43N3NN{{4556FGHH $)A B )))5JK-a0DII=>99^5J15MN001AB  K0  &&' >!-6C;;t%9#%MN Nrc t|tjtjtj tj tjtjtjtjtjtjf s t!dddlm}m}m}m}t|tjtj tjtjtjfr4t-t.|j1|j2|j4S|j7|j2|j8|}t;t.|S)z Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer)Encoding NoEncryption PrivateFormat PublicFormat)rbr DSAPrivateKey DSAPublicKeyrEllipticCurvePrivateKeyEllipticCurvePublicKeyrEd25519PrivateKeyEd25519PublicKeyrEd448PrivateKeyEd448PublicKeyr RSAPrivateKey RSAPublicKeyrdrrrrrr>r' public_bytesDERSubjectPublicKeyInfo private_bytesPKCS8r=)cls crypto_keyrrrrrs rfrom_cryptography_keyzPKey.from_cryptography_keys( !!  **))))((%%$$!!    23 3      ))(($$    "''LL,"C"C ** m11<>C#=#6 6rc t|ts tdt|ts td|tk(r|dkr t dt j }tj|t j}t j|t jt j}t j|||tj}t|dk(t j |j"|}t|dk(d|_y|t$k(r t j&}t|tjk7tj|t j(}t j*||tjdtjtjtj}t|dk(tt j,|dk(tt j.|j"|dk(d|_yt1d) a3 Generate a key pair of the given type, with the given number of bits. This generates a key "into" the this object. :param type: The key type. :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA` :param bits: The number of bits. :type bits: :py:data:`int` ``>= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerrzInvalid number of bitszNo such key typeTN)rbr?rdr+rfrJBN_newrRrXBN_free BN_set_wordRSA_F4RSA_newRSA_generate_key_exrWrVEVP_PKEY_assign_RSArr*DSA_newDSA_freeDSA_generate_parameters_exDSA_generate_keyEVP_PKEY_set1_DSAr-r)rtypebitsexponentrresultrress r generate_keyzPKey.generate_keySs $$56 6$$56 6 8 qy !9::{{}Hwwx6H   Xt{{ 3,,.C--c4499MF FaK (--djj#>F FaK ("!X ,,.C C499, -''#t}}-C11T499aDIItyyC C1H % D11#6!; < D224::sCqH I!*+ +rc|jr tdtj|j tj k7r tdtj |j}tj|tj}tj|}|dk(ryty)ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.rTN) rrdrJ EVP_PKEY_typer EVP_PKEY_RSAEVP_PKEY_get1_RSArrRrXRSA_free RSA_check_key_raise_current_error)rrrs rcheckz PKey.checks   -. .   diik *d.?.? ?EF F$$TZZ0ggc4==)##C( Q;rc@tj|jS)zT Returns the type of the key :return: The type of the key. )rJ EVP_PKEY_idrrs rrz PKey.types  ++rc@tj|jS)zh Returns the number of bits of the key :return: The number of bits of the key. )rJ EVP_PKEY_bitsrrs rrz PKey.bitss !!$**--rNr)rOr)rrrOr.)rr?rr?rOrrOboolrOr?)rCrDrErFrrrr classmethodrrrrrrrrr.r.sHLL" O.7777r6!p4,.rr.cveZdZdZdZd fd Zed dZed dZed dZ d dZ ddZ dd Z xZ S)_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` NcNt|trt| |StS)z Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. )rbrsuper__ne__NotImplemented)rother __class__s rrz_EllipticCurve.__ne__s$ e^ ,7>%( (rcjtjd}tjd|}j||t fd|DS)z Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. rzEC_builtin_curve[]c3VK|] }j|j"ywr)from_nidnid).0crr$s r z7_EllipticCurve._load_elliptic_curves..s D3<<QUU+Ds&))EC_get_builtin_curvesrRrWrSset)rr$ num_curvesbuiltin_curvess`` r_load_elliptic_curvesz$_EllipticCurve._load_elliptic_curvessO..tyy!< "6 C !!.*=D^DDDrc^|j|j||_|jS)a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. )_curvesr)rr$s r_get_elliptic_curvesz#_EllipticCurve._get_elliptic_curvess* ;; 33C8CK{{rc x|||tj|j|jdS)a Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. ascii)rRru OBJ_nid2sndecode)rr$rs rrz_EllipticCurve.from_nids03T[[)<=DDWMNNrc.||_||_||_y)a :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)rJ_nidr)rr$rrs rrz_EllipticCurve.__init__s   rc"d|jdS)Nzrrs r__repr__z_EllipticCurve.__repr__s Q''rc|jj|j}tj|tj S)z Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. )rJEC_KEY_new_by_curve_namerrRrX EC_KEY_free)rkeys r _to_EC_KEYz_EllipticCurve._to_EC_KEYs3ii00;wwsD,,--rrrrOr)r$rrOset[_EllipticCurve])r$rrr?rOr)r$rrr?rstrrOrrOrrOr)rCrDrErFrrrrrrrrr __classcell__rs@rrrscG EE"  OO "(.rrzSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.c4tjtS)a Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. )rrrJrrrr:r:s  . .t 44rzRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.c^tD]}|j|k(s|cStd|)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve name)r:rrf)rcurves rr9r90s7 %& :: L )4 00rcdeZdZdZd dZd fd Zd dZddZddZddZ ddZ dd Z dd Z xZ S)r/a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. ctj|j}tj|tj |_y)z Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)rJ X509_NAME_duprrRrXX509_NAME_freers rrzX509Name.__init__`s0!!$**-''$(;(;< rc |jdrt | ||St|tur#t dt|j ddtjt|}|tjk(r ttdttj|j D]}tj"|j |}tj$|}tj&|}||k(sStj(|j |}tj*|nt-|tr|j/d}tj0|j |tj2|t5|dd}|s tyy#t$r YtdwxYw) N_z$attribute name must be string, not 'z.200'No such attributeutf-8r) startswithr __setattr__rrrdrCrJ OBJ_txt2nid _byte_string NID_undefrr-AttributeErrorrangeX509_NAME_entry_countrX509_NAME_get_entryX509_NAME_ENTRY_get_object OBJ_obj2nidX509_NAME_delete_entryX509_NAME_ENTRY_freerbencodeX509_NAME_add_entry_by_NID MBSTRING_UTF8rU) rrvaluerientent_objent_nid add_resultrs rrzX509Name.__setattr__js ??3 7&tU3 3 :S K((.a1  |D12 $..  $&!!45 5t11$**=> A**4::q9C55c:G&&w/Gg~11$**a@))#.  eS !LL)E44 JJT//E B  ")  !45 5 s F<< GGctjt|}|tjk(r t t dtj|j|d}|dk(rytj|j|}tj|}tjd}tj||}t|dk\ tj|d|ddj!d}tj"|d|S#t $r Yt dwxYw#tj"|dwxYw)a  Find attribute. An X509Name object has the following attributes: countryName (alias C), stateOrProvince (alias ST), locality (alias L), organization (alias O), organizationalUnit (alias OU), commonName (alias CN) and more... rrNunsigned char**rr)rJrrrrr-rX509_NAME_get_index_by_NIDrr X509_NAME_ENTRY_get_datarRrSASN1_STRING_to_UTF8rVrYr OPENSSL_free) rrr entry_indexentryrZr^ data_lengthrs r __getattr__zX509Name.__getattr__s2|D12 $..  $&!!45 555djj#rJ " (([A,,U3!23 ..}dC  q() 0[[q!1;?BIIF   mA. / -  !45 5 *   mA. /s D#+D<# D98D9<Ect|tstStj|j |j dk(SNrrbr/rrJ X509_NAME_cmprrrs r__eq__zX509Name.__eq__s2%*! !!!$**ekk:a??rct|tstStj|j |j dkSr9r:r<s r__lt__zX509Name.__lt__s2%*! !!!$**ekk:Q>>rc tjdd}tj|j|t |}t |tjk7djtj|jdS)z6 String representation of an X509Name rHizr) rRrSrJX509_NAME_onelinerrUrVrWformatrur)rr^ format_results rrzX509Name.__repr__sq3/ .. JJ s='9   23'.. KK & - -g 6  rc@tj|jS)a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` )rJX509_NAME_hashrrs rhashz X509Name.hashs""4::..rctjd}tj|j|}t |dk\tj |d|dd}tj|d|S)z Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` r/rN)rRrSrJ i2d_X509_NAMErrVrYr3)rr^ encode_resultr}s rrz X509Name.dersi!23 **4::}E  *+ M!$4mDQG  -*+rcg}ttj|jD]}tj|j|}tj |}tj |}tj|}tj|}tjtj|tj|dd}|jtj||f|S)z Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)rrJrrr r!r1r"rrRrYrvrrrru) rrr)r*fnamefvalrrr(s rget_componentszX509Name.get_componentsst11$**=> 6A**4::q9C33C8E005D""5)C??3'DKK**40$2I2I$2OE MM4;;t,e4 5 6  rr)rrr(rrOr)rrrO str | NonerrrrOrc)rOzlist[tuple[bytes, bytes]])rCrDrErFrrr7r=r?rrFrrMr r s@rr/r/Fs80=%#N&P@ ?   / rr/zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.creZdZdZd dZddZe ddZddZddZ ddZ ddZ dd Z dd Z dd Zy )r0z An X.509 certificate signing requests. .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. ctj}tj|tj|_|j dyr9)rJ X509_REQ_newrRrX X509_REQ_free_req set_version)rreqs rrzX509Req.__init__s6!GGC!3!34  rc>ddlm}tt|}||S)z Export as a ``cryptography`` certificate signing request. :rtype: ``cryptography.x509.CertificateSigningRequest`` .. versionadded:: 17.1.0 r)load_der_x509_csr)cryptography.x509rX"_dump_certificate_request_internalr')rrXrs rto_cryptographyzX509Req.to_cryptographys 80E %%rct|tjs tdddlm}|j |j}tt|S)a Construct based on a ``cryptography`` *crypto_req*. :param crypto_req: A ``cryptography`` X.509 certificate signing request :type crypto_req: ``cryptography.x509.CertificateSigningRequest`` :rtype: X509Req .. versionadded:: 17.1.0 z%Must be a certificate signing requestrr) rbrCertificateSigningRequestrdrrrr"_load_certificate_request_internalr')r crypto_reqrrs rfrom_cryptographyzX509Req.from_cryptography)sD*d&D&DECD DI%%hll31-EErcttj|j|j}t |dk(y)z Set the public key of the certificate signing request. :param pkey: The public key to use. :type pkey: :py:class:`PKey` :return: ``None`` rN)rJX509_REQ_set_pubkeyrTrrVrrris r set_pubkeyzX509Req.set_pubkey?s*--diiD  a(rc@tjt}tj|j|_t |j tjk7tj|j tj|_d|_ |S)z Get the public key of the certificate signing request. :return: The public key. :rtype: :py:class:`PKey` T) r.__new__rJX509_REQ_get_pubkeyrTrrVrRrWrXrrrs r get_pubkeyzX509Req.get_pubkeyKsf||D!--dii8  dii/0WWTZZ););<   rct|ts td|dk7r tdt j |j |}t|dk(y)z Set the version subfield (RFC 2986, section 4.1) of the certificate request. :param int version: The version number. :return: ``None`` zversion must be an intrz9Invalid version. The only valid version for X509Req is 0.rN)rbr?rdrfrJX509_REQ_set_versionrTrV)rversionris rrUzX509Req.set_versionYsU'3'45 5 a<K ..tyy'B  a(rc@tj|jS)z Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate request. :return: The value of the version subfield. :rtype: :py:class:`int` )rJX509_REQ_get_versionrTrs r get_versionzX509Req.get_versionjs((33rctjt}tj|j|_t |j tjk7||_ |S)a Return the subject of this certificate signing request. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate signing request. Modifying it will modify the underlying signing request, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate signing request. :rtype: :class:`X509Name` ) r/rgrJX509_REQ_get_subject_namerTrrVrRrW_ownerrs r get_subjectzX509Req.get_subjecttsM)33DII>  dii/0  rcJ|jr td|js tdtjt |}|t jk(r tdtj|j|j|}t|dkDy)aa Sign the certificate signing request with this key and digest type. :param pkey: The key pair to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use for the signature, e.g. :py:data:`"sha256"`. :type digest: :py:class:`str` :return: ``None`` zKey has only public partKey is uninitializedNo such digest methodrN) rrfrrJEVP_get_digestbynamerrRrW X509_REQ_signrTrrV)rrdigest digest_obj sign_results rsignz X509Req.signs   78 8  34 4..|F/CD  "45 5((DJJ K  a(rct|ts tdtj|j |j }|dkr t|S)a@ Verifies the signature on this certificate signing request. :param PKey key: A public key. :return: ``True`` if the signature is correct. :rtype: bool :raises OpenSSL.crypto.Error: If the signature is invalid or there is a problem verifying the signature. pkey must be a PKey instancer)rbr.rdrJX509_REQ_verifyrTrr)rrrs rverifyzX509Req.verifysF$%:; ;%%dii< Q; " rNr)rOx509.CertificateSigningRequest)r`rrOr0rr.rOrrOr.rlr?rOrrrOr/rr.ryrrOr)rr.rOr)rCrDrErFrr[rrarerirUrorsr|rrrrr0r0 s\  &F7F FF* ) )"4,)0rr0c eZdZdZd!dZed"dZd#dZed$dZd%dZ d&dZ d'dZ d(d Z d)d Z d*d Zd+d Zd&d Zd,dZd&dZd-dZd-dZd.dZd/dZd0dZ d1dZd2dZd0dZd2dZd3dZd4dZd5dZd6dZd5dZ d7dZ!d&dZ"y )8r,z An X.509 certificate. ctj}t|tjk7tj |tj |_t|_ t|_ yr) rJX509_newrVrRrWrX X509_free_x509r_issuer_invalidator_subject_invalidator)rrs rrz X509.__init__sJ}} )*WWT4>>2 #7#9 $8$:!rc|j|}tj|tj|_t |_t |_|Sr) rgrRrXrJrrrrr)rrcerts r_from_raw_x509_ptrzX509._from_raw_x509_ptrsA{{3WWT4>>2 #7#9 $8$:! rc>ddlm}tt|}||S)z Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r)load_der_x509_certificate)rYrr5r')rrrs rr[zX509.to_cryptographys @}d3(--rct|tjs tdddlm}|j |j}tt|S)z Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificaterr]) rbr Certificaterdrrrrr;r')r crypto_certrrs rrazX509.from_cryptographysD+t'7'7834 4I&&x||4 s33rct|ts tdtt j |j |dk(y)a  Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerrN)rbr?rdrVrJX509_set_versionr)rrls rrUzX509.set_versions8'3'89 9--djj'BaGHrc@tj|jS)z Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` )rJX509_get_versionrrs rrozX509.get_versions$$TZZ00rcBtjt}tj|j|_|j t jk(r tt j|j tj|_d|_ |S)z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` T) r.rgrJX509_get_pubkeyrrrRrWrrXrrrs rrizX509.get_pubkeysg||D!))$**5 :: " "WWTZZ););<   rct|ts tdtj|j |j }t|dk(y)z Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` r~rN)rbr.rdrJX509_set_pubkeyrrrVrds rrezX509.set_pubkeys@$%:; ;))$**djjA  a(rct|ts td|jr t d|j s t dt jt|}|tjk(r t dt j|j|j|}t|dkDy)a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` r~zKey only has public partrurvrN)rbr.rdrrfrrJrwrrRrW X509_signrrrV)rrryevp_mdr{s rr|z X509.sign$s$%:; ;   78 8  34 4**<+?@ TYY 45 5nnTZZVD  a(rctj|j}tjd}tj |tj tj |tj|d}|tjk(r tdtjtj|S)z Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **rzUndefined signature algorithm) rJX509_get0_tbs_sigalgrrRrSX509_ALGOR_get0rWr"rrfru OBJ_nid2ln)rsig_algalgrs rget_signature_algorithmzX509.get_signature_algorithm@s++DJJ7hh'( S$))TYY@s1v& $.. <= ={{4??3/00rctjt|}|tjk(r t dtj dtj}tj dd}t||d<tj|j|||}t|dk(djtj||dDcgc]}t|jc}Scc}w)a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` rvzunsigned char[]zunsigned int[]rr:)rJrwrrRrWrfrSEVP_MAX_MD_SIZErU X509_digestrrVjoinrYrupper)r digest_nameryr^ result_length digest_resultchs rryz X509.digestSs**< +DE TYY 45 5!2D4H4HI !115 }- a(( JJ }   *+yy++m]15EF " ##%    s Dc@tj|jS)z Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` )rJX509_subject_name_hashrrs rsubject_name_hashzX509.subject_name_hashrs**4::66rc`t|ts tdt|dd}|j d}t j d}tj||}t|t jk7tj|dt j}tj|dt|t jk7t j|tj}tj|j |}t|dk(y)z Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerNrzBIGNUM**rr)rbr?rdhexr%rRrSrJ BN_hex2bnrVrWBN_to_ASN1_INTEGERrrXASN1_INTEGER_freeX509_set_serialNumberr)rserial hex_serialhex_serial_bytes bignum_serialr asn1_serialris rset_serial_numberzX509.set_serial_number{s&#&78 8[_ %,,W5,  /?@$))+,--mA.> J  ]1%& tyy01ggk4+A+AB // KH  a(rctj|j}tj|tj } tj |} t j|}t|d}|tj|tj|S#tj|wxYw#tj|wxYw)zx Return the serial number of this certificate. :return: The serial number. :rtype: int ) rJX509_get_serialNumberrASN1_INTEGER_to_BNrRrW BN_bn2hexrur?r3r)rrrrhexstring_serialrs rget_serial_numberzX509.get_serial_numbers00< // TYYG  ( 6J .#';;z#: -r2!!*- LL '!!*- LL 's$C"B(=C(B??CCct|ts tdtj|j }tj ||y)z Adjust the time stamp on which the certificate stops being valid. :param int amount: The number of seconds by which to adjust the timestamp. :return: ``None`` amount must be an integerN)rbr?rdrJX509_getm_notAfterrX509_gmtime_adj)ramountnotAfters rgmtime_adj_notAfterzX509.gmtime_adj_notAfters>&#&78 8**4::6 Xv.rct|ts tdtj|j }tj ||y)z Adjust the timestamp on which the certificate starts being valid. :param amount: The number of seconds by which to adjust the timestamp. :return: ``None`` rN)rbr?rdrJX509_getm_notBeforerr)rr notBefores rgmtime_adj_notBeforezX509.gmtime_adj_notBefores>&#&78 8,,TZZ8  Y/rc:|j}| td|jd}tjj |d}tj j }tjj|jd}||kS)z Check whether the certificate has expired. :return: ``True`` if the certificate has expired, ``False`` otherwise. :rtype: bool NzUnable to determine notAfterrz %Y%m%d%H%M%SZ)tzinfo) get_notAfterrfrdatetimestrptimetimezoneutcnowreplace)r time_bytes time_string not_afterUTCutcnows r has_expiredzX509.has_expireds&&(  ;< < ''0 %%..{OL ##""&&s+3343@6!!rc8t||jSr)r~r)rwhichs r_get_boundary_timezX509._get_boundary_timeseDJJ/00rc@|jtjS)a  Get the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rrJrrs r get_notBeforezX509.get_notBefores&&t'?'?@@rc:t||j|Sr)rjr)rrrhs r_set_boundary_timezX509._set_boundary_timeseDJJ/66rcB|jtj|S)z Set the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )rrJrrrhs r set_notBeforezX509.set_notBefores&&t'?'?FFrc@|jtjS)a  Get the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rrJrrs rrzX509.get_notAfters&&t'>'>??rcB|jtj|S)z Set the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )rrJrrs r set_notAfterzX509.set_notAfters&&t'>'>EErctjt}||j|_t |jt j k7||_|Sr)r/rgrrrVrRrWrr)rrrs r _get_namezX509._get_namesE)4::&  dii/0  rct|ts td||j|j}t |dk(y)Nzname must be an X509Namer)rbr/rdrrrV)rrrris r _set_namezX509._set_names8$)67 74::tzz2  a(rcz|jtj}|jj ||S)a Return the issuer of this certificate. This creates a new :class:`X509Name` that wraps the underlying issuer name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this issuer. :return: The issuer of this certificate. :rtype: :class:`X509Name` )rrJX509_get_issuer_namerrrs r get_issuerzX509.get_issuer$s1~~d778   $$T* rcx|jtj||jj y)z Set the issuer of this certificate. :param issuer: The issuer. :type issuer: :py:class:`X509Name` :return: ``None`` N)rrJX509_set_issuer_namerr)rissuers r set_issuerzX509.set_issuer4s* t00&9   &&(rcz|jtj}|jj ||S)a Return the subject of this certificate. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate. :rtype: :class:`X509Name` )rrJX509_get_subject_namerrrs rrszX509.get_subject@s1~~d889 !!%%d+ rcx|jtj||jj y)z Set the subject of this certificate. :param subject: The subject. :type subject: :py:class:`X509Name` :return: ``None`` N)rrJX509_set_subject_namerr)rsubjects r set_subjectzX509.set_subjectPs* t117; !!'')rc@tj|jS)z Get the number of extensions on this certificate. :return: The number of extensions. :rtype: :py:class:`int` .. versionadded:: 0.12 )rJX509_get_ext_countrrs rget_extension_countzX509.get_extension_count\s&&tzz22rNr)rrrOr,)rOx509.Certificate)rrrOr,rrrrrrO)rrrOrc)rr?rOr)rr?rOrr)rrrO bytes | None)rOr)rzCallable[..., Any]rhrcrOr)rhrcrOr)rrrOr/)rrrr/rOrr)rr/rOr)rr/rOr)#rCrDrErFrrrr[rarUrorirer|rryrrrrrrrrrrrrrrrrrsrrrrrr,r,s; .44& I1  ))81& >7)8(( / 0""1 A7'7/47 7 G @ F )  ) * 3rr,cfeZdZUdZej Zded<ejZ ded<ejZ ded<ejZ ded<ejZded<ej Zded<ej$Zded <ej(Zded <ej,Zded <ej0Zded <y )r4a  Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html r? CRL_CHECK CRL_CHECK_ALLIGNORE_CRITICAL X509_STRICTALLOW_PROXY_CERTS POLICY_CHECKEXPLICIT_POLICY INHIBIT_MAPCHECK_SS_SIGNATURE PARTIAL_CHAINN)rCrDrErFrJX509_V_FLAG_CRL_CHECKr__annotations__X509_V_FLAG_CRL_CHECK_ALLrX509_V_FLAG_IGNORE_CRITICALr X509_V_FLAG_X509_STRICTr X509_V_FLAG_ALLOW_PROXY_CERTSr X509_V_FLAG_POLICY_CHECKr X509_V_FLAG_EXPLICIT_POLICYr X509_V_FLAG_INHIBIT_MAPrX509_V_FLAG_CHECK_SS_SIGNATURErX509_V_FLAG_PARTIAL_CHAINrrrrr4r4hs//Is/77M37;;OS;33K3!??s?55L#5;;OS;33K3"AAA77M37rr4cNeZdZdZd dZd dZd dZd dZd dZ d ddZ y)r1a An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. c~tj}tj|tj|_yr)rJX509_STORE_newrRrXX509_STORE_free_storerstores rrzX509Store.__init__s(##%ggeT%9%9: rct|ts ttj|j |j }t|dk(y)a Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. rN)rbr,rdrJX509_STORE_add_certr rrV)rrrs radd_certzX509Store.add_certs< $%+ &&t{{DJJ?q!rct|tjrddlm}t |j |j}tj|tj}t|tjk7tj|tj}n tdttj |j"|dk7y)a Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. rr]z?CRL must be of type cryptography.x509.CertificateRevocationListN)rbrCertificateRevocationListrrr[rrrJd2i_X509_CRL_biorRrWrVrX X509_CRL_freerdX509_STORE_add_crlr )rcrlrrL openssl_crls radd_crlzX509Store.add_crls c499 : Ms// =>C//TYY?K K4994 5''+t'9'9:C>  // SAQFGrc\ttj|j|dk7y)a Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. rN)rVrJX509_STORE_set_flagsr )rflagss r set_flagszX509Store.set_flagss", 11$++uEJKrc:tj}tj|tj}tj |t j|jttj|j|dk7y)a Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. rN) rJX509_VERIFY_PARAM_newrRrXX509_VERIFY_PARAM_freeX509_VERIFY_PARAM_set_timecalendartimegm timetuplerVX509_STORE_set1_paramr )rvfy_timeparams rset_timezX509Store.set_timesm **,t::; '' 8??8#5#5#78  224;;F!KLrNc|tj}n t|}|tj}n t|}tj|j ||}|s t yy)a Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rRrW _path_bytesrJX509_STORE_load_locationsr r)rcafilecapath load_results rload_locationszX509Store.load_locationss`F >YYF (F >YYF (F44 KK  "rr)rr,rOr)r+zx509.CertificateRevocationListrOr)r0r?rOr)r:zdatetime.datetimerOrr)r@StrOrBytesPath | NonerArDrOr) rCrDrErFrr%r-r1r<rCrrrr1r1sI ;",H<L0M6)-1#%1#&1#  1#rr1c4eZdZdZ dfd ZxZS)r3z An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` c@t||||_||_yr)rrerrors certificate)rmessagerGrHrs rrzX509StoreContextError.__init__2s! ! &r)rIrrGz list[Any]rHr,rOr)rCrDrErFrr r s@rr3r3)s2''$-'<@' ''rr3cveZdZdZ d d dZe d dZed dZddZddZ ddZ dd Z y)r2a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` NcL||_||_|j||_yr)r _cert_build_certificate_stack_chain)rr"rHchains rrzX509StoreContext.__init__Js$    33E: rcdd}|t|dk(rtjStj}t |tjk7tj ||}|D]}t|ts tdt tj|jdkDtj||jdksmtj|jt|S)Ncttj|D]-}tj||}tj|/tj |yr)rrJ sk_X509_num sk_X509_valuer sk_X509_free)sr)xs rcleanupz:X509StoreContext._build_certificate_stack..cleanupXsQ4++A./ "&&q!,q! "   a rrz+One of the elements is not an X509 instance)rUrrOr)rUrRrWrJsk_X509_new_nullrVrXrbr,rd X509_up_refr sk_X509_pushrr) certificatesrWstackrs rrMz)X509StoreContext._build_certificate_stackTs !  3|#4#999 %%'*+w'  'DdD) MNN D,,TZZ81< =   3q8tzz*$& ' rctjtjtj|j d}tj|tj ||g}tj|}tj|}tj|}t|||S)z Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. r) rRrurJX509_verify_cert_error_stringX509_STORE_CTX_get_errorrX509_STORE_CTX_get_error_depthX509_STORE_CTX_get_current_certX509_dupr,rr3) store_ctxrIrGrrLpycerts r_exception_from_contextz(X509StoreContext._exception_from_contextrs++  . .--i8   &/   ) )) 4  / / :  44Y? e$((/$Wff==rctj}t|tjk7tj |tj }tj||jj|jj|j}t|dk(tj|}|dkr|j||S)a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. rr)rJX509_STORE_CTX_newrVrRrWrXX509_STORE_CTX_freeX509_STORE_CTX_initr rLrrNX509_verify_certre)rrcrns r_verify_certificatez$X509StoreContext._verify_certificates++-  TYY./GGIt'?'?@ && t{{))4::+;+;T[[  q!##I. !8..y9 9rc||_y)z Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)r r!s r set_storezX509StoreContext.set_stores  rc$|jy)a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)rkrs rverify_certificatez#X509StoreContext.verify_certificates   "rc|j}tj|}t|tj k7g}t tj|D]Z}tj||}t|tj k7tj|}|j|\tj||S)aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 ) rkrJX509_STORE_CTX_get1_chainrVrRrWrrRrSr,rrrT)rrc cert_stackrr)rrds rget_verified_chainz#X509StoreContext.get_verified_chains,,. 33I>  dii/0t'' 34 "A%%j!4D DDII- .,,T2F MM& !  " *% rr)r"r1rHr,rOSequence[X509] | NonerOr)r[rtrOr)rcrrOr3r)r"r1rOrr)rOz list[X509]) rCrDrErFr staticmethodrMrerkrmrorsrrrr2r2:s &(, ;;;% ;  ;+ :>>20  #rr2ct|tr|jd}t|}|tk(rCt j |tjtjtj}n9|tk(r%t j|tj}n td|tjk(r ttj|S)a Load a certificate (X509) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param bytes buffer: The buffer the certificate is stored in :return: The X509 object r3type argument must be FILETYPE_PEM or FILETYPE_ASN1)rbrr%r[r(rJPEM_read_bio_X509rRrWr' d2i_X509_biorfrr,r)rrYrLrs rr;r;s&#w' v C |%%c499diiK    dii0NOO tyy  " "4 ((rc^t}|tk(r!tj||j}na|t k(r!tj ||j}n7|tk(r#tj||jdd}n tdt|dk(t|S)a Dump the certificate *cert* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXT) :param cert: The certificate to dump :return: The buffer with the dumped certificate in rCtype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTr) r[r(rJPEM_write_bio_X509rr' i2d_X509_bior) X509_print_exrfrVr`)rrrL result_codes rr5r5s .C |--c4::>  ''TZZ8  ((djj!Q?    K1$% # rct}|tk(rtj}n%|tk(rtj }n t d|||j}|dk7r tt|S)z Dump a public key to a buffer. :param type: The file type (one of :data:`FILETYPE_PEM` or :data:`FILETYPE_ASN1`). :param PKey pkey: The public key to dump :return: The buffer with the dumped key in it. :rtype: bytes rwr) r[r(rJPEM_write_bio_PUBKEYr'i2d_PUBKEY_biorfrrr`)rrrL write_biors rr8r8sf .C |--  '' NOOC,Ka # rc t}t|ts td|I| tdt j t |}|tjk(rtdtj}t||}|tk(rXt j||j|tjd|j|j}|j!n|t"k(r!t j$||j}n|t&k(rt j(|jtj*k7r tdtj,t j.|jtj0}t j2||d}n tdt5|dk7t7|S)a Dump the private key *pkey* into a buffer string encoded with the type *type*. Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it using *cipher* and *passphrase*. :param type: The file type (one of :const:`FILETYPE_PEM`, :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`) :param PKey pkey: The PKey to dump :param cipher: (optional) if encrypted PEM format, the cipher to use :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The buffer with the dumped key in :rtype: bytes zpkey must be a PKeyzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namerz-Only RSA keys are supported for FILETYPE_TEXTr{)r[rbr.rdrJEVP_get_cipherbynamerrRrWrf_PassphraseHelperr(PEM_write_bio_PrivateKeyrcallback callback_argsraise_if_problemr'i2d_PrivateKey_bior)rrrXrr RSA_printrVr`) rrcipher passphraserL cipher_objhelperrrs rr7r7*s* .C dD !-..   8 ..|F/CD  "23 3YY tZ 0F |33  JJ  II OO    !  --c4::>     DJJ '4+<+< <KL Lggd,,TZZ8$--HnnS#q1    K1$% # rcxeZdZ d ddZed dZed dZefd dZ d dZ y) rch|tk7r | td||_||_||_g|_y)Nz0only FILETYPE_PEM key format supports encryption)r(rf _passphrase _more_args _truncate _problems)rrr more_argstruncates rrz_PassphraseHelper.__init__ps@ < J$:B &#!*,rc|jtjSt|jtst |jr tj d|jStd)Npem_password_cb2Last argument must be a byte string or a callable.) rrRrWrbrccallabler_read_passphraserdrs rrz_PassphraseHelper.callbacks]    #99  ((% 0HT=M=M4N==!2D4I4IJ JD rc|jtjSt|jtst |jrtjSt d)Nr)rrRrWrbrcrrdrs rrz_PassphraseHelper.callback_argssO    #99  ((% 0HT=M=M4N99 D rc|jr' t||jjdy#|$rY#wxYwr9)r_exception_from_error_queuepop)r exceptionTypes rrz"_PassphraseHelper.raise_if_problemsF >> +M:..$$Q' ' !  s 5==c t|jr2|jr|j|||}n,|j|}n|jJ|j}t|ts t dt ||kDr|jr|d|}n t dtt |D] }|||dz||<t |S#t$r%}|jj|Yd}~yd}~wwxYw)NzBytes expectedz+passphrase returned by callback is too longrr) rrrrbrcrfrUrr Exceptionrr)rbufsizerwflaguserdatarr)es rrz"_PassphraseHelper._read_passphrases (()??!--dFHEF!--f5F''333))fe, !1226{T!>>#ET]F$E3v;' +AE*A +v;   NN ! !! $ sCC D!DDN)FF) rr?rPassphraseCallableT | NonerrrrrOrr)rztype[Exception]rOr) rrrr?rrrrrOr?) rCrDrErpropertyrrr-rrrrrrros   --/- -  -  - AF(!+.:= rrc4t|tr|jd}t|}|tk(rCt j |tjtjtj}n9|tk(r%t j|tj}n td|tjk(r ttjt}tj|t j |_d|_|S)a< Load a public key from a buffer. :param type: The file type (one of :data:`FILETYPE_PEM`, :data:`FILETYPE_ASN1`). :param buffer: The buffer the key is stored in. :type buffer: A Python string object, either unicode or bytestring. :return: The PKey object. :rtype: :class:`PKey` rrwT)rbrr%r[r(rJPEM_read_bio_PUBKEYrRrWr'd2i_PUBKEY_biorfrr.rgrXrrr)rrYrLevp_pkeyrs rr>r>s&#w' v C |++ DIItyy   &&sDII6NOO499 << D4#5#56DJD KrcNt|tr|jd}t|}t ||}|t k(rKt j|tj|j|j}|jn9|tk(r%t j|tj}n td|tjk(r t!t"j%t"}tj&|t j(|_|S)a Load a private key (PKey) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the key is stored in :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The PKey object rrw)rbrr%r[rr(rJPEM_read_bio_PrivateKeyrRrWrrrr'd2i_PrivateKey_biorfrr.rgrXrr)rrYrrLrrrs rr=r=s"&#w' v C tZ 0F |// FOOV-A-A  !  **3 :NOO499 << D4#5#56DJ Krc^t}|tk(r!tj||j}na|t k(r!tj ||j}n7|tk(r#tj||jdd}n tdt|dk7t|S)av Dump the certificate request *req* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param req: The certificate request to dump :return: The buffer with the dumped certificate request in .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. rr{) r[r(rJPEM_write_bio_X509_REQrTr'i2d_X509_REQ_bior)X509_REQ_print_exrfrVr`)rrVrLrs rr6r6s .C |11#sxx@  ++C:  ,,S#((AqA    K1$% # rr6rc$t|tr|jd}t|}|tk(rCt j |tjtjtj}n9|tk(r%t j|tj}n tdt|tjk7tjt}tj|t j |_|S)a Load a certificate request (X509Req) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the certificate request is stored in :return: The X509Req object .. deprecated:: 24.2.0 Use `cryptography.x509.load_der_x509_csr` or `cryptography.x509.load_pem_x509_csr` instead. rrw)rbrr%r[r(rJPEM_read_bio_X509_REQrRrWr'd2i_X509_REQ_biorfrVr0rgrXrSrT)rrYrLrVx509reqs rr<r<6s&#w' v C |((diiDIIN  ##C3NOOC499$%oog&G773 2 23GL Nrr<)rrrobjectrOzCallable[[_T], _T]r)rYrrOr)rLrrOrc)rgrrhrcrOr)rhrcrOr)ryrrOr)rOr)rrrOr)rr?rYrcrOr,)rr?rr,rOrc)rr?rr.rOrc)NN) rr?rr.rrNrrrOrc)rr?rY str | bytesrOr.)rr?rYrrrrOr.)rr?rVr0rOrc)rr?rYrcrOr0)m __future__rr6r functoolssysrbase64rcollections.abcrrrrr version_infowarningsr TypeVar_Ttyping_extensions cryptographyrr)cryptography.hazmat.primitives.asymmetricrrrrr OpenSSL._utilr r!rr"rr#rRr$rJr% _make_assertr&r>__all__rrrrr _PrivateKeyrrrrr _PublicKeyrrcPassphraseCallableTSSL_FILETYPE_PEMr(rSSL_FILETYPE_ASN1r'r)rr+ EVP_PKEY_DSAr* EVP_PKEY_DHr@ EVP_PKEY_ECrArr-rrVr[r`rjror~rr.rr:r9total_orderingr/r0r,r4r1r3r2r;r5r8r7rr>r=r6rZrCDeprecationWarningr<r_rrrrs" $ w#  B-$) 8         [* $%E8CJ#778)) c)++ s+ !!#!!!#!I :EBu%4;+2&:  ~.~.Bd.d.N  5  5 1 1$ D hh hVm3m3` 88.g#g#T'I'"[[|):88-1 B B B B+ B  BJKK\J.2& & &+& &R@&>"   # @&>"   # r