U
    EZh                  	   @   s  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
mZ d dlmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d dlmZmZ d d	l m!Z! ed
ddZ"ej#e
j$e
j%e
j&e
j'e
j(e
j)e
j*e
j+f Z,G dd de-Z.ee ej/ee  ddddZ0e!ej/ej1e!e2ej3e4 f  ddddZ5ejejdddZ6G dd dZ7G dd dZ8G dd dej9Z:G dd de-Z;G dd  d e j<d!Z=e=>ej= G d"d# d#e j<d!Z?e?>ej? G d$d% d%e?Z@G d&d' d'e j<d!ZAeA>ejA G d(d) d)e j<d!ZBeB>ejB dEe2ejCe=d*d+d,ZDe2ej/e= d-d.d/ZEdFe2ejCe=d*d0d1ZFdGe2ejCeBd*d2d3ZGdHe2ejCeBd*d4d5ZHdIe2ejCeAd*d6d7ZIdJe2ejCeAd*d8d9ZJG d:d; d;ZKG d<d= d=ZLG d>d? d?ZMG d@dA dAZNe4dBdCdDZOdS )K    N)utils)x509)hashesserialization)dsaeced448ed25519rsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                       s&   e Zd Zeedd fddZ  ZS )AttributeNotFoundN)msgoidreturnc                    s   t  | || _d S N)super__init__r   )selfr   r   	__class__ ]/home/aprabhat/apps/x.techxrdev.in/venv/lib/python3.8/site-packages/cryptography/x509/base.pyr   6   s    zAttributeNotFound.__init__)__name__
__module____qualname__strr   r   __classcell__r"   r"   r    r#   r   5   s   r   )	extension
extensionsr   c                 C   s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r)   r*   er"   r"   r#   _reject_duplicate_extension;   s    r-   )r   
attributesr   c                 C   s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r+   )r   r.   Zattr_oid_r"   r"   r#   _reject_duplicate_attributeE   s    r0   timer   c                 C   s:   | j dk	r2|  }|r|nt }| jdd| S | S dS )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r3   	utcoffsetdatetime	timedeltareplace)r2   offsetr"   r"   r#   _convert_to_naive_utc_timeQ   s
    
r9   c                   @   sx   e Zd ZejjfeeeddddZ	e
edddZe
eddd	Zedd
dZeedddZedddZdS )	AttributeN)r   value_typer   c                 C   s   || _ || _|| _d S r   )_oid_valuer<   )r   r   r;   r<   r"   r"   r#   r   `   s    zAttribute.__init__r   c                 C   s   | j S r   )r=   r   r"   r"   r#   r   j   s    zAttribute.oidc                 C   s   | j S r   )r>   r@   r"   r"   r#   r;   n   s    zAttribute.valuec                 C   s   d| j  d| jdS )Nz<Attribute(oid=z, value=)>)r   r;   r@   r"   r"   r#   __repr__r   s    zAttribute.__repr__otherr   c                 C   s2   t |tstS | j|jko0| j|jko0| j|jkS r   )
isinstancer:   NotImplementedr   r;   r<   r   rD   r"   r"   r#   __eq__u   s    


zAttribute.__eq__c                 C   s   t | j| j| jfS r   )hashr   r;   r<   r@   r"   r"   r#   __hash__   s    zAttribute.__hash__)r$   r%   r&   r   Z
UTF8Stringr;   r   bytesintr   propertyr   r'   rB   objectboolrH   rJ   r"   r"   r"   r#   r:   _   s   

r:   c                   @   sN   e Zd Zeje ddddZed\ZZ	Z
edddZeed	d
dZdS )
AttributesN)r.   r   c                 C   s   t || _d S r   )list_attributes)r   r.   r"   r"   r#   r      s    zAttributes.__init__rR   r?   c                 C   s   d| j  dS )Nz<Attributes(rA   )rR   r@   r"   r"   r#   rB      s    zAttributes.__repr__r   r   c                 C   s2   | D ]}|j |kr|  S qtd| d|d S )NzNo z attribute was found)r   r   )r   r   attrr"   r"   r#   get_attribute_for_oid   s    

z Attributes.get_attribute_for_oid)r$   r%   r&   typingIterabler:   r   r   __len____iter____getitem__r'   rB   r   rU   r"   r"   r"   r#   rP      s   rP   c                   @   s   e Zd ZdZdZdS )Versionr      N)r$   r%   r&   Zv1v3r"   r"   r"   r#   r[      s   r[   c                       s&   e Zd Zeedd fddZ  ZS )InvalidVersionN)r   parsed_versionr   c                    s   t  | || _d S r   )r   r   r_   )r   r   r_   r    r"   r#   r      s    zInvalidVersion.__init__)r$   r%   r&   r'   rL   r   r(   r"   r"   r    r#   r^      s   r^   c                   @   s  e Zd ZejejedddZe	eje
dddZe	ejedddZejedd	d
Ze	ejejdddZe	ejejdddZe	ejedddZe	ejedddZe	ejejej dddZe	ejedddZe	ejedddZe	ejedddZe	ejedddZe	ejedddZeje e!dd d!Z"eje
dd"d#Z#eje$j%ed$d%d&Z&ejd d'd(d)d*Z'd'S )+Certificate	algorithmr   c                 C   s   dS z4
        Returns bytes using digest passed.
        Nr"   r   rb   r"   r"   r#   fingerprint   s    zCertificate.fingerprintr?   c                 C   s   dS )z3
        Returns certificate serial number
        Nr"   r@   r"   r"   r#   serial_number   s    zCertificate.serial_numberc                 C   s   dS )z1
        Returns the certificate version
        Nr"   r@   r"   r"   r#   version   s    zCertificate.versionc                 C   s   dS z(
        Returns the public key
        Nr"   r@   r"   r"   r#   
public_key   s    zCertificate.public_keyc                 C   s   dS )z?
        Not before time (represented as UTC datetime)
        Nr"   r@   r"   r"   r#   not_valid_before   s    zCertificate.not_valid_beforec                 C   s   dS )z>
        Not after time (represented as UTC datetime)
        Nr"   r@   r"   r"   r#   not_valid_after   s    zCertificate.not_valid_afterc                 C   s   dS )z1
        Returns the issuer name object.
        Nr"   r@   r"   r"   r#   issuer   s    zCertificate.issuerc                 C   s   dS z2
        Returns the subject name object.
        Nr"   r@   r"   r"   r#   subject   s    zCertificate.subjectc                 C   s   dS zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr"   r@   r"   r"   r#   signature_hash_algorithm   s    z$Certificate.signature_hash_algorithmc                 C   s   dS zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr"   r@   r"   r"   r#   signature_algorithm_oid   s    z#Certificate.signature_algorithm_oidc                 C   s   dS )z/
        Returns an Extensions object.
        Nr"   r@   r"   r"   r#   r*      s    zCertificate.extensionsc                 C   s   dS z.
        Returns the signature bytes.
        Nr"   r@   r"   r"   r#   	signature   s    zCertificate.signaturec                 C   s   dS )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr"   r@   r"   r"   r#   tbs_certificate_bytes   s    z!Certificate.tbs_certificate_bytesc                 C   s   dS )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr"   r@   r"   r"   r#   tbs_precertificate_bytes   s    z$Certificate.tbs_precertificate_bytesrC   c                 C   s   dS z"
        Checks equality.
        Nr"   rG   r"   r"   r#   rH     s    zCertificate.__eq__c                 C   s   dS z"
        Computes a hash.
        Nr"   r@   r"   r"   r#   rJ     s    zCertificate.__hash__encodingr   c                 C   s   dS )zB
        Serializes the certificate to PEM or DER format.
        Nr"   r   rz   r"   r"   r#   public_bytes  s    zCertificate.public_bytesN)rl   r   c                 C   s   dS )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr"   )r   rl   r"   r"   r#   verify_directly_issued_by  s    z%Certificate.verify_directly_issued_by)(r$   r%   r&   abcabstractmethodr   HashAlgorithmrK   re   rM   rL   rf   r[   rg   r   ri   r5   rj   rk   r   rl   rn   rV   Optionalrp   r   rr   r   r*   rt   ru   rv   rN   rO   rH   rJ   r   Encodingr|   r}   r"   r"   r"   r#   r`      sb   
r`   )	metaclassc                   @   sV   e Zd ZeejedddZeejejdddZ	eeje
dddZdS )	RevokedCertificater?   c                 C   s   dS )zG
        Returns the serial number of the revoked certificate.
        Nr"   r@   r"   r"   r#   rf   '  s    z RevokedCertificate.serial_numberc                 C   s   dS )zH
        Returns the date of when this certificate was revoked.
        Nr"   r@   r"   r"   r#   revocation_date.  s    z"RevokedCertificate.revocation_datec                 C   s   dS )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr"   r@   r"   r"   r#   r*   5  s    zRevokedCertificate.extensionsN)r$   r%   r&   rM   r~   r   rL   rf   r5   r   r   r*   r"   r"   r"   r#   r   &  s   r   c                   @   sX   e Zd ZeejedddZeedddZeejdddZ	eedd	d
Z
dS )_RawRevokedCertificaterf   r   r*   c                 C   s   || _ || _|| _d S r   _serial_number_revocation_date_extensionsr   rf   r   r*   r"   r"   r#   r   B  s    z_RawRevokedCertificate.__init__r?   c                 C   s   | j S r   )r   r@   r"   r"   r#   rf   L  s    z$_RawRevokedCertificate.serial_numberc                 C   s   | j S r   )r   r@   r"   r"   r#   r   P  s    z&_RawRevokedCertificate.revocation_datec                 C   s   | j S r   )r   r@   r"   r"   r#   r*   T  s    z!_RawRevokedCertificate.extensionsN)r$   r%   r&   rL   r5   r   r   rM   rf   r   r*   r"   r"   r"   r#   r   A  s   
r   c                   @   s  e Zd ZejejedddZeje	j
edddZejeeje ddd	Zeejeje	j
 d
ddZeejed
ddZeejed
ddZeejejej d
ddZeejejd
ddZeejed
ddZeejed
ddZeejed
ddZejeedddZ ejed
ddZ!ej"eed d!d"Z#ej"e$ej%e d d#d"Z#ejej&ee$f ej&eej%e f d d$d"Z#ejej'e d
d%d&Z(eje)ed'd(d)Z*d*S )+CertificateRevocationListry   c                 C   s   dS )z:
        Serializes the CRL to PEM or DER format.
        Nr"   r{   r"   r"   r#   r|   Z  s    z&CertificateRevocationList.public_bytesra   c                 C   s   dS rc   r"   rd   r"   r"   r#   re   `  s    z%CertificateRevocationList.fingerprint)rf   r   c                 C   s   dS )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr"   )r   rf   r"   r"   r#   (get_revoked_certificate_by_serial_numberf  s    zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr?   c                 C   s   dS ro   r"   r@   r"   r"   r#   rp   o  s    z2CertificateRevocationList.signature_hash_algorithmc                 C   s   dS rq   r"   r@   r"   r"   r#   rr   y  s    z1CertificateRevocationList.signature_algorithm_oidc                 C   s   dS )zC
        Returns the X509Name with the issuer of this CRL.
        Nr"   r@   r"   r"   r#   rl     s    z CertificateRevocationList.issuerc                 C   s   dS )z?
        Returns the date of next update for this CRL.
        Nr"   r@   r"   r"   r#   next_update  s    z%CertificateRevocationList.next_updatec                 C   s   dS )z?
        Returns the date of last update for this CRL.
        Nr"   r@   r"   r"   r#   last_update  s    z%CertificateRevocationList.last_updatec                 C   s   dS )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr"   r@   r"   r"   r#   r*     s    z$CertificateRevocationList.extensionsc                 C   s   dS rs   r"   r@   r"   r"   r#   rt     s    z#CertificateRevocationList.signaturec                 C   s   dS )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr"   r@   r"   r"   r#   tbs_certlist_bytes  s    z,CertificateRevocationList.tbs_certlist_bytesrC   c                 C   s   dS rw   r"   rG   r"   r"   r#   rH     s    z CertificateRevocationList.__eq__c                 C   s   dS )z<
        Number of revoked certificates in the CRL.
        Nr"   r@   r"   r"   r#   rX     s    z!CertificateRevocationList.__len__)idxr   c                 C   s   d S r   r"   r   r   r"   r"   r#   rZ     s    z%CertificateRevocationList.__getitem__c                 C   s   d S r   r"   r   r"   r"   r#   rZ     s    c                 C   s   dS )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr"   r   r"   r"   r#   rZ     s    c                 C   s   dS )z8
        Iterator over the revoked certificates
        Nr"   r@   r"   r"   r#   rY     s    z"CertificateRevocationList.__iter__)ri   r   c                 C   s   dS )zQ
        Verifies signature of revocation list against given public key.
        Nr"   )r   ri   r"   r"   r#   is_signature_valid  s    z,CertificateRevocationList.is_signature_validN)+r$   r%   r&   r~   r   r   r   rK   r|   r   r   re   rL   rV   r   r   r   rM   rp   r   rr   r   rl   r5   r   r   r   r*   rt   r   rN   rO   rH   rX   overloadrZ   sliceListUnionIteratorrY   r   r   r"   r"   r"   r#   r   Y  sf   
r   c                   @   s@  e Zd ZejeedddZejedddZ	eje
dddZeejedd	d
Zeejejej dddZeejedddZeejedddZeejedddZejejedddZeejedddZeejedddZeejedddZ ejeedddZ!dS ) CertificateSigningRequestrC   c                 C   s   dS rw   r"   rG   r"   r"   r#   rH     s    z CertificateSigningRequest.__eq__r?   c                 C   s   dS rx   r"   r@   r"   r"   r#   rJ     s    z"CertificateSigningRequest.__hash__c                 C   s   dS rh   r"   r@   r"   r"   r#   ri     s    z$CertificateSigningRequest.public_keyc                 C   s   dS rm   r"   r@   r"   r"   r#   rn     s    z!CertificateSigningRequest.subjectc                 C   s   dS ro   r"   r@   r"   r"   r#   rp     s    z2CertificateSigningRequest.signature_hash_algorithmc                 C   s   dS rq   r"   r@   r"   r"   r#   rr     s    z1CertificateSigningRequest.signature_algorithm_oidc                 C   s   dS )z@
        Returns the extensions in the signing request.
        Nr"   r@   r"   r"   r#   r*     s    z$CertificateSigningRequest.extensionsc                 C   s   dS )z/
        Returns an Attributes object.
        Nr"   r@   r"   r"   r#   r.   
  s    z$CertificateSigningRequest.attributesry   c                 C   s   dS )z;
        Encodes the request to PEM or DER format.
        Nr"   r{   r"   r"   r#   r|     s    z&CertificateSigningRequest.public_bytesc                 C   s   dS rs   r"   r@   r"   r"   r#   rt     s    z#CertificateSigningRequest.signaturec                 C   s   dS )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr"   r@   r"   r"   r#   tbs_certrequest_bytes  s    z/CertificateSigningRequest.tbs_certrequest_bytesc                 C   s   dS )z8
        Verifies signature of signing request.
        Nr"   r@   r"   r"   r#   r   &  s    z,CertificateSigningRequest.is_signature_validrS   c                 C   s   dS )z:
        Get the attribute value for a given OID.
        Nr"   )r   r   r"   r"   r#   rU   -  s    z/CertificateSigningRequest.get_attribute_for_oidN)"r$   r%   r&   r~   r   rN   rO   rH   rL   rJ   r   ri   rM   r   rn   rV   r   r   r   rp   r   rr   r   r*   rP   r.   r   r   rK   r|   rt   r   r   rU   r"   r"   r"   r#   r     sF   
r   )databackendr   c                 C   s
   t | S r   )	rust_x509load_pem_x509_certificater   r   r"   r"   r#   r   9  s    r   )r   r   c                 C   s
   t | S r   )r   load_pem_x509_certificates)r   r"   r"   r#   r   ?  s    r   c                 C   s
   t | S r   )r   load_der_x509_certificater   r"   r"   r#   r   D  s    r   c                 C   s
   t | S r   )r   load_pem_x509_csrr   r"   r"   r#   r   K  s    r   c                 C   s
   t | S r   )r   load_der_x509_csrr   r"   r"   r#   r   R  s    r   c                 C   s
   t | S r   )r   load_pem_x509_crlr   r"   r"   r#   r   Y  s    r   c                 C   s
   t | S r   )r   load_der_x509_crlr   r"   r"   r#   r   `  s    r   c                	   @   s   e Zd Zdg g feje ejee  ejej	e
eeje f  dddZed dddZeed dd	d
Zdde
eeje d dddZdeeje ejedddZdS ) CertificateSigningRequestBuilderN)subject_namer*   r.   c                 C   s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   rR   )r   r   r*   r.   r"   r"   r#   r   g  s    z)CertificateSigningRequestBuilder.__init__namer   c                 C   s4   t |tstd| jdk	r$tdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rE   r   	TypeErrorr   r+   r   r   rR   r   r   r"   r"   r#   r   v  s    

  z-CertificateSigningRequestBuilder.subject_nameextvalcriticalr   c                 C   sD   t |tstdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rE   r   r   r   r   r-   r   r   r   rR   r   r   r   r)   r"   r"   r#   add_extension  s    

z.CertificateSigningRequestBuilder.add_extension)_tag)r   r;   r   r   c                C   s|   t |tstdt |ts$td|dk	r>t |ts>tdt|| j |dk	rZ|j}nd}t| j	| j
| j|||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rE   r   r   rK   r   r0   rR   r;   r   r   r   )r   r   r;   r   tagr"   r"   r#   add_attribute  s    


z.CertificateSigningRequestBuilder.add_attributeprivate_keyrb   r   r   c                 C   s    | j dkrtdt| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r+   r   Zcreate_x509_csrr   r   rb   r   r"   r"   r#   sign  s    	
z%CertificateSigningRequestBuilder.sign)N)r$   r%   r&   rV   r   r   r   r   r   Tupler   rK   rL   r   r   rO   r   r   r   r   _AllowedHashTypesAnyr   r   r"   r"   r"   r#   r   f  s:    $ r   c                
   @   s  e Zd ZU ejee  ed< ddddddg feje	 eje	 eje
 eje ejej ejej ejee  ddddZe	d dddZe	d dd	d
Ze
d dddZed dddZejd dddZejd dddZeed dddZdeeje ejedddZdS )CertificateBuilderr   N)issuer_namer   ri   rf   rj   rk   r*   r   c                 C   s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r   )
r[   r]   _version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r   r   r   ri   rf   rj   rk   r*   r"   r"   r#   r     s    
zCertificateBuilder.__init__r   c                 C   sD   t |tstd| jdk	r$tdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rE   r   r   r   r+   r   r   r   r   r   r   r   r   r"   r"   r#   r     s    

zCertificateBuilder.issuer_namec                 C   sD   t |tstd| jdk	r$tdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rE   r   r   r   r+   r   r   r   r   r   r   r   r   r"   r"   r#   r     s    

zCertificateBuilder.subject_name)keyr   c              	   C   s`   t |tjtjtjtjt	j
tjtjfs.td| jdk	r@tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rE   r   ZDSAPublicKeyr
   ZRSAPublicKeyr   ZEllipticCurvePublicKeyr	   ZEd25519PublicKeyr   ZEd448PublicKeyr   ZX25519PublicKeyr   ZX448PublicKeyr   r   r+   r   r   r   r   r   r   r   )r   r   r"   r"   r#   ri     s2    
zCertificateBuilder.public_keynumberr   c                 C   sh   t |tstd| jdk	r$td|dkr4td| dkrHtdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rE   rL   r   r   r+   
bit_lengthr   r   r   r   r   r   r   r   r   r"   r"   r#   rf   !  s&    

z CertificateBuilder.serial_numberr1   c                 C   sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jkrZtdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rE   r5   r   r   r+   r9   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r   r2   r"   r"   r#   rj   <  s,    
z#CertificateBuilder.not_valid_beforec                 C   sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jk rZtdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rE   r5   r   r   r+   r9   r   r   r   r   r   r   r   r   r   r"   r"   r#   rk   [  s2    
z"CertificateBuilder.not_valid_afterr   c              	   C   sT   t |tstdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )rE   r   r   r   r   r-   r   r   r   r   r   r   r   r   r   r"   r"   r#   r   {  s    

z CertificateBuilder.add_extensionr   c                 C   sz   | j dkrtd| jdkr$td| jdkr6td| jdkrHtd| jdkrZtd| jdkrltdt| ||S )zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key)	r   r+   r   r   r   r   r   r   Zcreate_x509_certificater   r"   r"   r#   r     s    	





zCertificateBuilder.sign)N)r$   r%   r&   rV   r   r   r   __annotations__r   r   r   rL   r5   r   r   r   ri   rf   rj   rk   rO   r   r   r   r   r`   r   r"   r"   r"   r#   r     sN   


%!  r   c                   @   s   e Zd ZU ejee  ed< eje ed< dddg g fej	e
 ej	ej ej	ej ejee  eje dddZe
d ddd	Zejd d
ddZejd dddZeed dddZed dddZdeej	e ejedddZdS ) CertificateRevocationListBuilderr   _revoked_certificatesN)r   r   r   r*   revoked_certificatesc                 C   s"   || _ || _|| _|| _|| _d S r   )r   _last_update_next_updater   r   )r   r   r   r   r*   r   r"   r"   r#   r     s
    z)CertificateRevocationListBuilder.__init__)r   r   c                 C   s<   t |tstd| jd k	r$tdt|| j| j| j| j	S )Nr   r   )
rE   r   r   r   r+   r   r   r   r   r   )r   r   r"   r"   r#   r     s    

z,CertificateRevocationListBuilder.issuer_name)r   r   c                 C   sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jkrZtdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rE   r5   r   r   r+   r9   r   r   r   r   r   r   )r   r   r"   r"   r#   r     s(    
z,CertificateRevocationListBuilder.last_update)r   r   c                 C   sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jk rZtdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)rE   r5   r   r   r+   r9   r   r   r   r   r   r   )r   r   r"   r"   r#   r     s(    
z,CertificateRevocationListBuilder.next_updater   c                 C   sL   t |tstdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rE   r   r   r   r   r-   r   r   r   r   r   r   r   r"   r"   r#   r      s    

z.CertificateRevocationListBuilder.add_extension)revoked_certificater   c                 C   s2   t |tstdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rE   r   r   r   r   r   r   r   r   )r   r   r"   r"   r#   add_revoked_certificate  s    

z8CertificateRevocationListBuilder.add_revoked_certificater   c                 C   sD   | j d krtd| jd kr$td| jd kr6tdt| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r+   r   r   r   Zcreate_x509_crlr   r"   r"   r#   r   $  s    


z%CertificateRevocationListBuilder.sign)N)r$   r%   r&   rV   r   r   r   r   r   r   r   r5   r   r   r   r   rO   r   r   r   r   r   r   r   r"   r"   r"   r#   r     sJ   


  r   c                   @   s   e Zd Zddg feje ejej ejee	  dddZ
ed dddZejd dd	d
Ze	ed dddZdejedddZdS )RevokedCertificateBuilderNr   c                 C   s   || _ || _|| _d S r   r   r   r"   r"   r#   r   7  s    z"RevokedCertificateBuilder.__init__r   c                 C   sX   t |tstd| jd k	r$td|dkr4td| dkrHtdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	rE   rL   r   r   r+   r   r   r   r   r   r"   r"   r#   rf   A  s    

  z'RevokedCertificateBuilder.serial_numberr1   c                 C   sN   t |tjstd| jd k	r&tdt|}|tk r>tdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rE   r5   r   r   r+   r9   r   r   r   r   r   r"   r"   r#   r   S  s    
  z)RevokedCertificateBuilder.revocation_dater   c                 C   sD   t |tstdt|j||}t|| j t| j| j	| j|g S )Nr   )
rE   r   r   r   r   r-   r   r   r   r   r   r"   r"   r#   r   c  s    

z'RevokedCertificateBuilder.add_extension)r   r   c                 C   s:   | j d krtd| jd kr$tdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r+   r   r   r   r   )r   r   r"   r"   r#   buildq  s    

zRevokedCertificateBuilder.build)N)r$   r%   r&   rV   r   rL   r5   r   r   r   r   rf   r   rO   r   r   r   r   r"   r"   r"   r#   r   6  s"   

 r   r?   c                   C   s   t tddd? S )N   bigr   )rL   
from_bytesosurandomr"   r"   r"   r#   random_serial_number  s    r   )N)N)N)N)N)N)Pr~   r5   r   rV   Zcryptographyr   Z"cryptography.hazmat.bindings._rustr   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   r	   r
   r   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   r   r   Zcryptography.x509.extensionsr   r   r   r   Zcryptography.x509.namer   r   Zcryptography.x509.oidr   r   r   SHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512r   	Exceptionr   r   r-   r   rK   r   rL   r0   r9   r:   rP   Enumr[   r^   ABCMetar`   registerr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r"   r"   r"   r#   <module>   s   $	$ |]            \ n I