o
    e]                  	   @  s  d dl mZ d dlZd dlZd dlZd dlZd dlmZ d dlm	Z
 d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d d	l m!Z!m"Z" d d
l#m$Z$ edddZ%ej&ej'ej(ej)ej*ej+ej,ej-ej.f Z/G dd de0Z1dRddZ2dSddZ3dTdd Z4G d!d" d"Z5G d#d$ d$Z6G d%d& d&ej7Z8G d'd( d(e0Z9G d)d* d*ej:d+Z;e;<e
j; G d,d- d-ej:d+Z=e=<e
j= G d.d/ d/e=Z>G d0d1 d1ej:d+Z?e?<e
j? G d2d3 d3ej:d+Z@e@<e
j@ 	dUdVd8d9ZAdWd;d<ZB	dUdVd=d>ZC	dUdXd?d@ZD	dUdXdAdBZE	dUdYdCdDZF	dUdYdEdFZGG dGdH dHZHG dIdJ dJZIG dKdL dLZJG dMdN dNZKdZdPdQZLdS )[    )annotationsN)utils)x509)hashesserialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                         e Zd Zd	 fddZ  ZS )
AttributeNotFoundmsgstroidr   returnNonec                      t  | || _d S N)super__init__r   )selfr   r   	__class__ I/var/www/html/venv/lib/python3.10/site-packages/cryptography/x509/base.pyr$   8      
zAttributeNotFound.__init__)r   r   r   r   r   r    __name__
__module____qualname__r$   __classcell__r(   r(   r&   r)   r   7       r   	extensionExtension[ExtensionType]
extensions%typing.List[Extension[ExtensionType]]r   r    c                 C  s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r1   r3   er(   r(   r)   _reject_duplicate_extension=   s
   r7   r   r   
attributesHtyping.List[typing.Tuple[ObjectIdentifier, bytes, typing.Optional[int]]]c                 C  s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r5   )r   r8   attr_oid_r(   r(   r)   _reject_duplicate_attributeG   s
   r<   timedatetime.datetimec                 C  s6   | j dur|  }|r|nt }| jdd| S | S )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r?   	utcoffsetdatetime	timedeltareplace)r=   offsetr(   r(   r)   _convert_to_naive_utc_timeS   s
   
rE   c                   @  sX   e Zd Zejjfdd	d
ZedddZedddZdddZ	dddZ
dddZdS ) 	Attributer   r   valuebytes_typeintr   r    c                 C     || _ || _|| _d S r"   )_oid_valuerI   )r%   r   rG   rI   r(   r(   r)   r$   b      
zAttribute.__init__c                 C     | j S r"   )rL   r%   r(   r(   r)   r   l      zAttribute.oidc                 C  rO   r"   )rM   rP   r(   r(   r)   rG   p   rQ   zAttribute.valuer   c                 C  s   d| j  d| jdS )Nz<Attribute(oid=z, value=)>)r   rG   rP   r(   r(   r)   __repr__t      zAttribute.__repr__otherobjectboolc                 C  s2   t |tstS | j|jko| j|jko| j|jkS r"   )
isinstancerF   NotImplementedr   rG   rI   r%   rU   r(   r(   r)   __eq__w   s   


zAttribute.__eq__c                 C  s   t | j| j| jfS r"   )hashr   rG   rI   rP   r(   r(   r)   __hash__   s   zAttribute.__hash__N)r   r   rG   rH   rI   rJ   r   r    r   r   r   rH   r   r   rU   rV   r   rW   r   rJ   )r,   r-   r.   r   
UTF8StringrG   r$   propertyr   rS   r[   r]   r(   r(   r(   r)   rF   a   s    



rF   c                   @  s8   e Zd ZdddZed\ZZZdd	d
ZdddZ	dS )
Attributesr8   typing.Iterable[Attribute]r   r    c                 C  s   t || _d S r"   )list_attributes)r%   r8   r(   r(   r)   r$      s   zAttributes.__init__rh   r   c                 C  s   d| j  dS )Nz<Attributes(rR   )rh   rP   r(   r(   r)   rS      s   zAttributes.__repr__r   r   rF   c                 C  s.   | D ]}|j |kr|  S qtd| d|)NzNo z attribute was found)r   r   )r%   r   attrr(   r(   r)   get_attribute_for_oid   s
   
z Attributes.get_attribute_for_oidN)r8   rf   r   r    r`   )r   r   r   rF   )
r,   r-   r.   r$   r   __len____iter____getitem__rS   rj   r(   r(   r(   r)   re      s
    

re   c                   @  s   e Zd ZdZdZdS )Versionr      N)r,   r-   r.   v1v3r(   r(   r(   r)   rn      s    rn   c                      r   )
InvalidVersionr   r   parsed_versionrJ   r   r    c                   r!   r"   )r#   r$   rs   )r%   r   rs   r&   r(   r)   r$      r*   zInvalidVersion.__init__)r   r   rs   rJ   r   r    r+   r(   r(   r&   r)   rr      r0   rr   c                   @  sp  e Zd Zejd<ddZeejd=dd	Zeejd>ddZejd?ddZ	eejd@ddZ
eejd@ddZeejdAddZeejdAddZeejdBddZeejdCddZeejdDd!d"ZeejdEd$d%ZeejdFd&d'ZeejdFd(d)ZeejdFd*d+ZejdGd/d0Zejd=d1d2ZejdHd5d6ZejdId9d:Zd;S )JCertificate	algorithmhashes.HashAlgorithmr   rH   c                 C     dS z4
        Returns bytes using digest passed.
        Nr(   r%   ru   r(   r(   r)   fingerprint       zCertificate.fingerprintrJ   c                 C  rw   )z3
        Returns certificate serial number
        Nr(   rP   r(   r(   r)   serial_number   r{   zCertificate.serial_numberrn   c                 C  rw   )z1
        Returns the certificate version
        Nr(   rP   r(   r(   r)   version   r{   zCertificate.versionr   c                 C  rw   z(
        Returns the public key
        Nr(   rP   r(   r(   r)   
public_key   r{   zCertificate.public_keyr>   c                 C  rw   )z?
        Not before time (represented as UTC datetime)
        Nr(   rP   r(   r(   r)   not_valid_before   r{   zCertificate.not_valid_beforec                 C  rw   )z>
        Not after time (represented as UTC datetime)
        Nr(   rP   r(   r(   r)   not_valid_after   r{   zCertificate.not_valid_afterr   c                 C  rw   )z1
        Returns the issuer name object.
        Nr(   rP   r(   r(   r)   issuer   r{   zCertificate.issuerc                 C  rw   z2
        Returns the subject name object.
        Nr(   rP   r(   r(   r)   subject   r{   zCertificate.subject%typing.Optional[hashes.HashAlgorithm]c                 C  rw   zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr(   rP   r(   r(   r)   signature_hash_algorithm   r{   z$Certificate.signature_hash_algorithmr   c                 C  rw   zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr(   rP   r(   r(   r)   signature_algorithm_oid   r{   z#Certificate.signature_algorithm_oid;typing.Union[None, padding.PSS, padding.PKCS1v15, ec.ECDSA]c                 C  rw   )z=
        Returns the signature algorithm parameters.
        Nr(   rP   r(   r(   r)   signature_algorithm_parameters   r{   z*Certificate.signature_algorithm_parametersr   c                 C  rw   )z/
        Returns an Extensions object.
        Nr(   rP   r(   r(   r)   r3      r{   zCertificate.extensionsc                 C  rw   z.
        Returns the signature bytes.
        Nr(   rP   r(   r(   r)   	signature   r{   zCertificate.signaturec                 C  rw   )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr(   rP   r(   r(   r)   tbs_certificate_bytes  r{   z!Certificate.tbs_certificate_bytesc                 C  rw   )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr(   rP   r(   r(   r)   tbs_precertificate_bytes
  r{   z$Certificate.tbs_precertificate_bytesrU   rV   rW   c                 C  rw   z"
        Checks equality.
        Nr(   rZ   r(   r(   r)   r[     r{   zCertificate.__eq__c                 C  rw   z"
        Computes a hash.
        Nr(   rP   r(   r(   r)   r]     r{   zCertificate.__hash__encodingserialization.Encodingc                 C  rw   )zB
        Serializes the certificate to PEM or DER format.
        Nr(   r%   r   r(   r(   r)   public_bytes  r{   zCertificate.public_bytesr   r    c                 C  rw   )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr(   )r%   r   r(   r(   r)   verify_directly_issued_by$  r{   z%Certificate.verify_directly_issued_byNru   rv   r   rH   rb   )r   rn   r   r   r   r>   r   r   r   r   r^   )r   r   r   r   r_   ra   r   r   r   rH   )r   rt   r   r    )r,   r-   r.   abcabstractmethodrz   rd   r|   r}   r   r   r   r   r   r   r   r   r3   r   r   r   r[   r]   r   r   r(   r(   r(   r)   rt      sh    rt   )	metaclassc                   @  sH   e Zd ZeejdddZeejdddZeejdd	d
ZdS )RevokedCertificater   rJ   c                 C  rw   )zG
        Returns the serial number of the revoked certificate.
        Nr(   rP   r(   r(   r)   r|   2  r{   z RevokedCertificate.serial_numberr>   c                 C  rw   )zH
        Returns the date of when this certificate was revoked.
        Nr(   rP   r(   r(   r)   revocation_date9  r{   z"RevokedCertificate.revocation_dater   c                 C  rw   )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr(   rP   r(   r(   r)   r3   @  r{   zRevokedCertificate.extensionsNrb   r   r   )	r,   r-   r.   rd   r   r   r|   r   r3   r(   r(   r(   r)   r   1  s    r   c                   @  s@   e Zd ZdddZedd
dZedddZedddZdS )_RawRevokedCertificater|   rJ   r   r>   r3   r   c                 C  rK   r"   _serial_number_revocation_date_extensionsr%   r|   r   r3   r(   r(   r)   r$   M  rN   z_RawRevokedCertificate.__init__r   c                 C  rO   r"   )r   rP   r(   r(   r)   r|   W  rQ   z$_RawRevokedCertificate.serial_numberc                 C  rO   r"   )r   rP   r(   r(   r)   r   [  rQ   z&_RawRevokedCertificate.revocation_datec                 C  rO   r"   )r   rP   r(   r(   r)   r3   _  rQ   z!_RawRevokedCertificate.extensionsN)r|   rJ   r   r>   r3   r   rb   r   r   )r,   r-   r.   r$   rd   r|   r   r3   r(   r(   r(   r)   r   L  s    

r   c                   @  sL  e Zd Zejd?ddZejd@d	d
ZejdAddZeejdBddZ	eejdCddZ
eejdDddZeejdEddZeejdFddZeejdGd d!ZeejdHd"d#ZeejdHd$d%ZejdId)d*ZejdJd+d,ZejdKd/d0ZejdLd3d0ZejdMd6d0ZejdNd8d9ZejdOd<d=Zd>S )PCertificateRevocationListr   r   r   rH   c                 C  rw   )z:
        Serializes the CRL to PEM or DER format.
        Nr(   r   r(   r(   r)   r   e  r{   z&CertificateRevocationList.public_bytesru   rv   c                 C  rw   rx   r(   ry   r(   r(   r)   rz   k  r{   z%CertificateRevocationList.fingerprintr|   rJ   #typing.Optional[RevokedCertificate]c                 C  rw   )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr(   )r%   r|   r(   r(   r)   (get_revoked_certificate_by_serial_numberq  r{   zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr   c                 C  rw   r   r(   rP   r(   r(   r)   r   z  r{   z2CertificateRevocationList.signature_hash_algorithmr   c                 C  rw   r   r(   rP   r(   r(   r)   r     r{   z1CertificateRevocationList.signature_algorithm_oidr   c                 C  rw   )zC
        Returns the X509Name with the issuer of this CRL.
        Nr(   rP   r(   r(   r)   r     r{   z CertificateRevocationList.issuer"typing.Optional[datetime.datetime]c                 C  rw   )z?
        Returns the date of next update for this CRL.
        Nr(   rP   r(   r(   r)   next_update  r{   z%CertificateRevocationList.next_updater>   c                 C  rw   )z?
        Returns the date of last update for this CRL.
        Nr(   rP   r(   r(   r)   last_update  r{   z%CertificateRevocationList.last_updater   c                 C  rw   )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr(   rP   r(   r(   r)   r3     r{   z$CertificateRevocationList.extensionsc                 C  rw   r   r(   rP   r(   r(   r)   r     r{   z#CertificateRevocationList.signaturec                 C  rw   )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr(   rP   r(   r(   r)   tbs_certlist_bytes  r{   z,CertificateRevocationList.tbs_certlist_bytesrU   rV   rW   c                 C  rw   r   r(   rZ   r(   r(   r)   r[     r{   z CertificateRevocationList.__eq__c                 C  rw   )z<
        Number of revoked certificates in the CRL.
        Nr(   rP   r(   r(   r)   rk     r{   z!CertificateRevocationList.__len__idxr   c                 C     d S r"   r(   r%   r   r(   r(   r)   rm        z%CertificateRevocationList.__getitem__slicetyping.List[RevokedCertificate]c                 C  r   r"   r(   r   r(   r(   r)   rm     r   typing.Union[int, slice]Atyping.Union[RevokedCertificate, typing.List[RevokedCertificate]]c                 C  rw   )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr(   r   r(   r(   r)   rm     r{   #typing.Iterator[RevokedCertificate]c                 C  rw   )z8
        Iterator over the revoked certificates
        Nr(   rP   r(   r(   r)   rl     r{   z"CertificateRevocationList.__iter__r   r   c                 C  rw   )zQ
        Verifies signature of revocation list against given public key.
        Nr(   )r%   r   r(   r(   r)   is_signature_valid  r{   z,CertificateRevocationList.is_signature_validNr   r   )r|   rJ   r   r   r   r^   r   )r   r   r   r   r_   ra   rb   )r   rJ   r   r   )r   r   r   r   )r   r   r   r   )r   r   )r   r   r   rW   )r,   r-   r.   r   r   r   rz   r   rd   r   r   r   r   r   r3   r   r   r[   rk   typingoverloadrm   rl   r   r(   r(   r(   r)   r   d  sZ    r   c                   @  s   e Zd Zejd+ddZejd,dd	Zejd-ddZeejd.ddZ	eejd/ddZ
eejd0ddZeejd1ddZeejd2ddZejd3dd Zeejd4d!d"Zeejd4d#d$Zeejd5d%d&Zejd6d(d)Zd*S )7CertificateSigningRequestrU   rV   r   rW   c                 C  rw   r   r(   rZ   r(   r(   r)   r[     r{   z CertificateSigningRequest.__eq__rJ   c                 C  rw   r   r(   rP   r(   r(   r)   r]     r{   z"CertificateSigningRequest.__hash__r   c                 C  rw   r~   r(   rP   r(   r(   r)   r     r{   z$CertificateSigningRequest.public_keyr   c                 C  rw   r   r(   rP   r(   r(   r)   r     r{   z!CertificateSigningRequest.subjectr   c                 C  rw   r   r(   rP   r(   r(   r)   r     r{   z2CertificateSigningRequest.signature_hash_algorithmr   c                 C  rw   r   r(   rP   r(   r(   r)   r     r{   z1CertificateSigningRequest.signature_algorithm_oidr   c                 C  rw   )z@
        Returns the extensions in the signing request.
        Nr(   rP   r(   r(   r)   r3     r{   z$CertificateSigningRequest.extensionsre   c                 C  rw   )z/
        Returns an Attributes object.
        Nr(   rP   r(   r(   r)   r8     r{   z$CertificateSigningRequest.attributesr   r   rH   c                 C  rw   )z;
        Encodes the request to PEM or DER format.
        Nr(   r   r(   r(   r)   r     r{   z&CertificateSigningRequest.public_bytesc                 C  rw   r   r(   rP   r(   r(   r)   r   "  r{   z#CertificateSigningRequest.signaturec                 C  rw   )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr(   rP   r(   r(   r)   tbs_certrequest_bytes)  r{   z/CertificateSigningRequest.tbs_certrequest_bytesc                 C  rw   )z8
        Verifies signature of signing request.
        Nr(   rP   r(   r(   r)   r   1  r{   z,CertificateSigningRequest.is_signature_validr   c                 C  rw   )z:
        Get the attribute value for a given OID.
        Nr(   )r%   r   r(   r(   r)   rj   8  r{   z/CertificateSigningRequest.get_attribute_for_oidNra   rb   r   r   r   r^   r   )r   re   r   r_   )r   rW   )r   r   r   rH   )r,   r-   r.   r   r   r[   r]   r   rd   r   r   r   r3   r8   r   r   r   r   rj   r(   r(   r(   r)   r     sF    r   datarH   backend
typing.Anyc                 C  
   t | S r"   )	rust_x509load_pem_x509_certificater   r   r(   r(   r)   r   D     
r   typing.List[Certificate]c                 C  r   r"   )r   load_pem_x509_certificates)r   r(   r(   r)   r   J  s   
r   c                 C  r   r"   )r   load_der_x509_certificater   r(   r(   r)   r   O  r   r   c                 C  r   r"   )r   load_pem_x509_csrr   r(   r(   r)   r   V  r   r   c                 C  r   r"   )r   load_der_x509_csrr   r(   r(   r)   r   ]  r   r   c                 C  r   r"   )r   load_pem_x509_crlr   r(   r(   r)   r   d  r   r   c                 C  r   r"   )r   load_der_x509_crlr   r(   r(   r)   r   k  r   r   c                   @  sP   e Zd Zdg g fd'dd	Zd(ddZd)ddZddd*ddZ	d+d,d%d&ZdS )- CertificateSigningRequestBuilderNsubject_nametyping.Optional[Name]r3   r4   r8   r9   c                 C  s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   rh   )r%   r   r3   r8   r(   r(   r)   r$   r  s   
z)CertificateSigningRequestBuilder.__init__namer   r   c                 C  s4   t |ts	td| jdurtdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rX   r   	TypeErrorr   r5   r   r   rh   r%   r   r(   r(   r)   r     s   


z-CertificateSigningRequestBuilder.subject_nameextvalr   criticalrW   c                 C  sD   t |ts	tdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rX   r   r   r   r   r7   r   r   r   rh   r%   r   r   r1   r(   r(   r)   add_extension  s   

z.CertificateSigningRequestBuilder.add_extension)_tagr   r   rG   rH   r   typing.Optional[_ASN1Type]c                C  s|   t |ts	tdt |tstd|durt |tstdt|| j |dur-|j}nd}t| j	| j
| j|||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rX   r   r   rH   r   r<   rh   rG   r   r   r   )r%   r   rG   r   tagr(   r(   r)   add_attribute  s   


z.CertificateSigningRequestBuilder.add_attributeprivate_keyr   ru   "typing.Optional[_AllowedHashTypes]r   r   r   c                 C  s    | j du r	tdt| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r5   r   create_x509_csrr%   r   ru   r   r(   r(   r)   sign  s   
	z%CertificateSigningRequestBuilder.sign)r   r   r3   r4   r8   r9   )r   r   r   r   )r   r   r   rW   r   r   )r   r   rG   rH   r   r   r   r   r"   )r   r   ru   r   r   r   r   r   )r,   r-   r.   r$   r   r   r   r   r(   r(   r(   r)   r   q  s    

$r   c                   @  s   e Zd ZU ded< ddddddg fd9ddZd:ddZd:ddZd;ddZd<dd Zd=d#d$Z	d=d%d&Z
d>d+d,Z	d?dd-d@d7d8ZdS )ACertificateBuilderr4   r   Nissuer_namer   r   r   *typing.Optional[CertificatePublicKeyTypes]r|   typing.Optional[int]r   r   r   r3   r   r    c                 C  s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r"   )
rn   rq   _version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r%   r   r   r   r|   r   r   r3   r(   r(   r)   r$     s   

zCertificateBuilder.__init__r   r   c                 C  sD   t |ts	td| jdurtdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rX   r   r   r   r5   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

zCertificateBuilder.issuer_namec                 C  sD   t |ts	td| jdurtdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rX   r   r   r   r5   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

zCertificateBuilder.subject_namekeyr   c              	   C  s`   t |tjtjtjtjt	j
tjtjfstd| jdur tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rX   r   DSAPublicKeyr   RSAPublicKeyr   EllipticCurvePublicKeyr
   Ed25519PublicKeyr	   Ed448PublicKeyr   X25519PublicKeyr   X448PublicKeyr   r   r5   r   r   r   r   r   r   r   )r%   r   r(   r(   r)   r     s2   
zCertificateBuilder.public_keynumberrJ   c                 C  sh   t |ts	td| jdurtd|dkrtd| dkr$tdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rX   rJ   r   r   r5   
bit_lengthr   r   r   r   r   r   r   r%   r   r(   r(   r)   r|   ,  s&   

z CertificateBuilder.serial_numberr=   r>   c                 C  sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jkr-tdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rX   rA   r   r   r5   rE   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r%   r=   r(   r(   r)   r   G  s,   
z#CertificateBuilder.not_valid_beforec                 C  sz   t |tjs
td| jdurtdt|}|tk rtd| jdur-|| jk r-tdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rX   rA   r   r   r5   rE   r   r   r   r   r   r   r   r   r   r(   r(   r)   r   d  s.   


z"CertificateBuilder.not_valid_afterr   r   r   rW   c              	   C  sT   t |ts	tdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )rX   r   r   r   r   r7   r   r   r   r   r   r   r   r   r   r(   r(   r)   r     s   

z CertificateBuilder.add_extension)rsa_paddingr   r   ru   r   r   r   r   <typing.Optional[typing.Union[padding.PSS, padding.PKCS1v15]]rt   c                C  s   | j du r	td| jdu rtd| jdu rtd| jdu r$td| jdu r-td| jdu r6td|durQt|tj	tj
fsGtdt|tjsQtd	t| |||S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyzPadding must be PSS or PKCS1v15z&Padding is only supported for RSA keys)r   r5   r   r   r   r   r   rX   r   PSSPKCS1v15r   r   RSAPrivateKeyr   create_x509_certificate)r%   r   ru   r   r   r(   r(   r)   r     s(   





zCertificateBuilder.sign)r   r   r   r   r   r   r|   r   r   r   r   r   r3   r4   r   r    )r   r   r   r   )r   r   r   r   )r   rJ   r   r   )r=   r>   r   r   )r   r   r   rW   r   r   r"   )
r   r   ru   r   r   r   r   r  r   rt   )r,   r-   r.   __annotations__r$   r   r   r   r|   r   r   r   r   r(   r(   r(   r)   r     s*   
 



%


 r   c                   @  st   e Zd ZU ded< ded< dddg g fd+ddZd,ddZd-ddZd.ddZd/ddZd0d d!Z		d1d2d)d*Z
dS )3 CertificateRevocationListBuilderr4   r   r   _revoked_certificatesNr   r   r   r   r   r3   revoked_certificatesc                 C  s"   || _ || _|| _|| _|| _d S r"   )r   _last_update_next_updater   r  )r%   r   r   r   r3   r	  r(   r(   r)   r$     s
   
z)CertificateRevocationListBuilder.__init__r   r   c                 C  s<   t |ts	td| jd urtdt|| j| j| j| j	S )Nr   r   )
rX   r   r   r   r5   r  r
  r  r   r  )r%   r   r(   r(   r)   r     s   

z,CertificateRevocationListBuilder.issuer_namer>   c                 C  sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jkr-tdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rX   rA   r   r
  r5   rE   r   r  r  r   r   r  )r%   r   r(   r(   r)   r     s(   
z,CertificateRevocationListBuilder.last_updatec                 C  sr   t |tjs
td| jd urtdt|}|tk rtd| jd ur-|| jk r-tdt| j	| j|| j
| jS )Nr   r  r  z8The next update date must be after the last update date.)rX   rA   r   r  r5   rE   r   r
  r  r   r   r  )r%   r   r(   r(   r)   r     s(   
z,CertificateRevocationListBuilder.next_updater   r   r   rW   c                 C  sL   t |ts	tdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rX   r   r   r   r   r7   r   r  r   r
  r  r  r   r(   r(   r)   r     s   

z.CertificateRevocationListBuilder.add_extensionrevoked_certificater   c                 C  s2   t |ts	tdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rX   r   r   r  r   r
  r  r   r  )r%   r  r(   r(   r)   add_revoked_certificate(  s   

z8CertificateRevocationListBuilder.add_revoked_certificater   r   ru   r   r   r   r   c                 C  sD   | j d u r	td| jd u rtd| jd u rtdt| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r5   r
  r  r   create_x509_crlr   r(   r(   r)   r   9  s   


z%CertificateRevocationListBuilder.sign)
r   r   r   r   r   r   r3   r4   r	  r   )r   r   r   r  )r   r>   r   r  )r   r>   r   r  )r   r   r   rW   r   r  )r  r   r   r  r"   )r   r   ru   r   r   r   r   r   )r,   r-   r.   r  r$   r   r   r   r   r  r   r(   r(   r(   r)   r    s    
 




r  c                   @  sH   e Zd Zddg fddd	ZdddZd ddZd!ddZd"d#ddZdS )$RevokedCertificateBuilderNr|   r   r   r   r3   r4   c                 C  rK   r"   r   r   r(   r(   r)   r$   L  rN   z"RevokedCertificateBuilder.__init__r   rJ   r   c                 C  sX   t |ts	td| jd urtd|dkrtd| dkr$tdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	rX   rJ   r   r   r5   r   r  r   r   r   r(   r(   r)   r|   V  s   


z'RevokedCertificateBuilder.serial_numberr=   r>   c                 C  sN   t |tjs
td| jd urtdt|}|tk rtdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rX   rA   r   r   r5   rE   r   r  r   r   r   r(   r(   r)   r   h  s   

z)RevokedCertificateBuilder.revocation_dater   r   r   rW   c                 C  sD   t |ts	tdt|j||}t|| j t| j| j	| j|g S )Nr   )
rX   r   r   r   r   r7   r   r  r   r   r   r(   r(   r)   r   x  s   

z'RevokedCertificateBuilder.add_extensionr   r   r   c                 C  s:   | j d u r	td| jd u rtdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r5   r   r   r   r   )r%   r   r(   r(   r)   build  s   

zRevokedCertificateBuilder.build)r|   r   r   r   r3   r4   )r   rJ   r   r  )r=   r>   r   r  )r   r   r   rW   r   r  r"   )r   r   r   r   )r,   r-   r.   r$   r|   r   r   r  r(   r(   r(   r)   r  K  s    



r  rJ   c                   C  s   t tddd? S )N   bigr   )rJ   
from_bytesosurandomr(   r(   r(   r)   random_serial_number  rT   r  )r1   r2   r3   r4   r   r    )r   r   r8   r9   r   r    )r=   r>   r   r>   r"   )r   rH   r   r   r   rt   )r   rH   r   r   )r   rH   r   r   r   r   )r   rH   r   r   r   r   rb   )M
__future__r   r   rA   r  r   cryptographyr   "cryptography.hazmat.bindings._rustr   r   cryptography.hazmat.primitivesr   r   )cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r   r   r   /cryptography.hazmat.primitives.asymmetric.typesr   r   r   cryptography.x509.extensionsr   r   r   r   cryptography.x509.namer   r   cryptography.x509.oidr   r   UnionSHA224SHA256SHA384SHA512SHA3_224SHA3_256SHA3_384SHA3_512_AllowedHashTypes	Exceptionr   r7   r<   rE   rF   re   Enumrn   rr   ABCMetart   registerr   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r(   r(   r(   r)   <module>   s~   (




$ |]
\ x I