관리-도구
편집 파일: base.cpython-39.pyc
a �a� � @ s� d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl m Z m Z d dl m Z mZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZm Z d dl m Z m Z d d l m!Z! e�d d d �Z"G d d � d e#�Z$ee ej%ee dd�dd�Z&e!ej%ej'e!e(f dd�dd�Z)ejejd�dd�Z*G dd� d�Z+G dd� d�Z,G dd � d ej-�Z.G d d � d e#�Z/G d d � d e j0d!�Z1e1�2ej1� G d"d#� d#e j0d!�Z3e3�2ej3� G d$d%� d%e3�Z4G d&d'� d'e j0d!�Z5e5�2ej5� G d(d)� d)e j0d!�Z6e6�2ej6� dBe(ej7e1d*�d+d,�Z8dCe(ej7e1d*�d-d.�Z9dDe(ej7e6d*�d/d0�Z:dEe(ej7e6d*�d1d2�Z;dFe(ej7e5d*�d3d4�Z<dGe(ej7e5d*�d5d6�Z=G d7d8� d8e>�Z?G d9d:� d:e>�Z@G d;d<� d<e>�ZAG d=d>� d>e>�ZBeCd?�d@dA�ZDdS )H� N)�utils)�x509)�hashes� serialization)�dsa�ec�ed25519�ed448�rsa�x25519�x448)� CERTIFICATE_PUBLIC_KEY_TYPES�PRIVATE_KEY_TYPES�PUBLIC_KEY_TYPES)� Extension� ExtensionType� Extensions�_make_sequence_methods)�Name� _ASN1Type)�ObjectIdentifieri� � c s& e Zd Zeedd�� fdd� Z� ZS )�AttributeNotFoundN)�msg�oid�returnc s t t| ��|� || _d S �N)�superr �__init__r )�selfr r �� __class__� �</usr/lib64/python3.9/site-packages/cryptography/x509/base.pyr * s zAttributeNotFound.__init__)�__name__� __module__� __qualname__�strr r � __classcell__r" r" r r# r ) s r )� extension� extensionsr c C s" |D ]}|j | j krtd��qd S )Nz$This extension has already been set.)r � ValueError)r) r* �er" r" r# �_reject_duplicate_extension/ s r- )r � attributesr c C s" |D ]\}}|| krt d��qd S )Nz$This attribute has already been set.)r+ )r r. Zattr_oid�_r" r" r# �_reject_duplicate_attribute9 s r0 ��timer c C s: | j dur2| �� }|r|nt�� }| jdd�| S | S dS )z�Normalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N)�tzinfo)r3 Z utcoffset�datetimeZ timedelta�replace)r2 �offsetr" r" r# �_convert_to_naive_utc_timeC s r7 c @ s� e Zd Zejjfeeedd�dd�Z e ed�dd��Z e ed�dd ��Zd d � Z e jed �d d�Ze jed �dd�Zed�dd�ZdS )� AttributeN)r �value�_typer c C s || _ || _|| _d S r )�_oid�_valuer: )r r r9 r: r" r" r# r R s zAttribute.__init__�r c C s | j S r )r; �r r" r" r# r \ s z Attribute.oidc C s | j S r )r< r> r" r" r# r9 ` s zAttribute.valuec C s d� | j| j�S )Nz <Attribute(oid={}, value={!r})>)�formatr r9 r> r" r" r# �__repr__d s zAttribute.__repr__��otherr c C s2 t |t�stS | j|jko0| j|jko0| j|jkS r )� isinstancer8 �NotImplementedr r9 r: �r rB r" r" r# �__eq__g s � �zAttribute.__eq__c C s | |k S r r" rE r" r" r# �__ne__q s zAttribute.__ne__c C s t | j| j| jf�S r )�hashr r9 r: r> r" r" r# �__hash__t s zAttribute.__hash__)r$ r% r& r Z UTF8Stringr9 r �bytes�intr �propertyr r@ �typing�Any�boolrF rG rI r" r" r" r# r8 Q s �� r8 c @ sH e Zd Zeje dd�dd�Zed�\ZZ Z dd� Z e ed�d d �Z dS ) � AttributesN)r. r c C s t |�| _d S r )�list� _attributes)r r. r" r" r# r y s zAttributes.__init__rR c C s d� | j�S )Nz<Attributes({})>)r? rR r> r" r" r# r@ � s zAttributes.__repr__�r r c C s0 | D ]}|j |kr| S qtd�|�|��d S )NzNo {} attribute was found)r r r? )r r �attrr" r" r# �get_attribute_for_oid� s z Attributes.get_attribute_for_oid)r$ r% r& rM �Iterabler8 r r �__len__�__iter__� __getitem__r@ r rU r" r" r" r# rP x s � rP c @ s e Zd ZdZdZdS )�Versionr � N)r$ r% r& Zv1�v3r" r" r" r# rZ � s rZ c s& e Zd Zeedd�� fdd� Z� ZS )�InvalidVersionN)r �parsed_versionr c s t t| ��|� || _d S r )r r] r r^ )r r r^ r r" r# r � s zInvalidVersion.__init__)r$ r% r& r' rK r r( r" r" r r# r] � s r] c @ sx e Zd Zejejed�dd��Zej e d�dd��Z ej e d�dd��Z ejed�d d ��Zej ejd�d d ��Zej ejd�d d��Zej ed�dd��Zej ed�dd��Zej ejej d�dd��Zej ed�dd��Zej ed�dd��Z ej ed�dd��Z ej ed�dd ��Z eje e d �d d ��Z!eje e d �d d!��Z"eje d�d"d#��Z#eje$j%ed$�d%d&��Z&d'S )(� Certificate�� algorithmr c C s dS �z4 Returns bytes using digest passed. Nr" �r ra r" r" r# � fingerprint� s zCertificate.fingerprintr= c C s dS )z3 Returns certificate serial number Nr" r> r" r" r# � serial_number� s zCertificate.serial_numberc C s dS )z1 Returns the certificate version Nr" r> r" r" r# �version� s zCertificate.versionc C s dS �z( Returns the public key Nr" r> r" r" r# � public_key� s zCertificate.public_keyc C s dS )z? Not before time (represented as UTC datetime) Nr" r> r" r" r# �not_valid_before� s z Certificate.not_valid_beforec C s dS )z> Not after time (represented as UTC datetime) Nr" r> r" r" r# �not_valid_after� s zCertificate.not_valid_afterc C s dS )z1 Returns the issuer name object. Nr" r> r" r" r# �issuer� s zCertificate.issuerc C s dS �z2 Returns the subject name object. Nr" r> r" r" r# �subject� s zCertificate.subjectc C s dS �zt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr" r> r" r" r# �signature_hash_algorithm� s z$Certificate.signature_hash_algorithmc C s dS �zJ Returns the ObjectIdentifier of the signature algorithm. Nr" r> r" r" r# �signature_algorithm_oid� s z#Certificate.signature_algorithm_oidc C s dS )z/ Returns an Extensions object. Nr" r> r" r" r# r* � s zCertificate.extensionsc C s dS �z. Returns the signature bytes. Nr" r> r" r" r# � signature� s zCertificate.signaturec C s dS )zR Returns the tbsCertificate payload bytes as defined in RFC 5280. Nr" r> r" r" r# �tbs_certificate_bytes� s z!Certificate.tbs_certificate_bytesrA c C s dS �z" Checks equality. Nr" rE r" r" r# rF � s zCertificate.__eq__c C s dS �z# Checks not equal. Nr" rE r" r" r# rG � s zCertificate.__ne__c C s dS �z" Computes a hash. Nr" r> r" r" r# rI � s zCertificate.__hash__��encodingr c C s dS )zB Serializes the certificate to PEM or DER format. Nr" �r ry r" r" r# � public_bytes� s zCertificate.public_bytesN)'r$ r% r& �abc�abstractmethodr � HashAlgorithmrJ rd �abstractpropertyrK re rZ rf r rh r4 ri rj r rk rm rM �Optionalro r rq r r* rs rt �objectrO rF rG rI r �Encodingr{ r" r" r" r# r_ � sF �r_ )� metaclassc @ sJ e Zd Zejed�dd��Zejejd�dd��Zeje d�dd��Z dS ) �RevokedCertificater= c C s dS )zG Returns the serial number of the revoked certificate. Nr" r> r" r" r# re s z RevokedCertificate.serial_numberc C s dS )zH Returns the date of when this certificate was revoked. Nr" r> r" r" r# �revocation_date s z"RevokedCertificate.revocation_datec C s dS )zW Returns an Extensions object containing a list of Revoked extensions. Nr" r> r" r" r# r* s z RevokedCertificate.extensionsN) r$ r% r& r| r rK re r4 r� r r* r" r" r" r# r� s r� c @ sX e Zd Zeejed�dd�Zeed�dd��Zeejd�dd��Z eed�d d ��Z d S ) �_RawRevokedCertificate�re r� r* c C s || _ || _|| _d S r ��_serial_number�_revocation_date� _extensions�r re r� r* r" r" r# r s z _RawRevokedCertificate.__init__r= c C s | j S r )r� r> r" r" r# re ) s z$_RawRevokedCertificate.serial_numberc C s | j S r )r� r> r" r" r# r� - s z&_RawRevokedCertificate.revocation_datec C s | j S r )r� r> r" r" r# r* 1 s z!_RawRevokedCertificate.extensionsN) r$ r% r& rK r4 r r rL re r� r* r" r" r" r# r� s � r� c @ s� e Zd Zejejed�dd��Zeje j ed�dd��Z eje e je d�dd ��Zeje je j d �d d ��Zejed �d d��Zejed �dd��Zeje jej d �dd��Zejejd �dd��Zejed �dd��Zejed �dd��Z ejed �dd��Z eje e d�d d ��Z eje e d�d d ��Z!eje d �d d!��Z"e j#e ed"�d#d$��Z$e j#e%e j&e d"�d%d$��Z$eje j'e e%f e j'ee j&e f d"�d&d$��Z$eje j(e d �d'd(��Z)eje*e d)�d*d+��Z+d,S )-�CertificateRevocationListrx c C s dS )z: Serializes the CRL to PEM or DER format. Nr" rz r" r" r# r{ 7 s z&CertificateRevocationList.public_bytesr` c C s dS rb r" rc r" r" r# rd = s z%CertificateRevocationList.fingerprint)re r c C s dS )zs Returns an instance of RevokedCertificate or None if the serial_number is not in the CRL. Nr" )r re r" r" r# �(get_revoked_certificate_by_serial_numberC s zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr= c C s dS rn r" r> r" r" r# ro L s z2CertificateRevocationList.signature_hash_algorithmc C s dS rp r" r> r" r" r# rq U s z1CertificateRevocationList.signature_algorithm_oidc C s dS )zC Returns the X509Name with the issuer of this CRL. Nr" r> r" r" r# rk [ s z CertificateRevocationList.issuerc C s dS )z? Returns the date of next update for this CRL. Nr" r> r" r" r# � next_updatea s z%CertificateRevocationList.next_updatec C s dS )z? Returns the date of last update for this CRL. Nr" r> r" r" r# � last_updateg s z%CertificateRevocationList.last_updatec C s dS )zS Returns an Extensions object containing a list of CRL extensions. Nr" r> r" r" r# r* m s z$CertificateRevocationList.extensionsc C s dS rr r" r> r" r" r# rs s s z#CertificateRevocationList.signaturec C s dS )zO Returns the tbsCertList payload bytes as defined in RFC 5280. Nr" r> r" r" r# �tbs_certlist_bytesy s z,CertificateRevocationList.tbs_certlist_bytesrA c C s dS ru r" rE r" r" r# rF s z CertificateRevocationList.__eq__c C s dS rv r" rE r" r" r# rG � s z CertificateRevocationList.__ne__c C s dS )z< Number of revoked certificates in the CRL. Nr" r> r" r" r# rW � s z!CertificateRevocationList.__len__)�idxr c C s d S r r" �r r� r" r" r# rY � s z%CertificateRevocationList.__getitem__c C s d S r r" r� r" r" r# rY � s c C s dS )zS Returns a revoked certificate (or slice of revoked certificates). Nr" r� r" r" r# rY � s c C s dS )z8 Iterator over the revoked certificates Nr" r> r" r" r# rX � s z"CertificateRevocationList.__iter__)rh r c C s dS )zQ Verifies signature of revocation list against given public key. Nr" )r rh r" r" r# �is_signature_valid� s z,CertificateRevocationList.is_signature_validN),r$ r% r& r| r} r r� rJ r{ r r~ rd rK rM r� r� r� r ro r rq r rk r4 r� r� r r* rs r� r� rO rF rG rW �overloadrY �slice�List�Union�IteratorrX r r� r" r" r" r# r� 6 sV � � �r� c @ s6 e Zd Zejeed�dd��Zejeed�dd��Zeje d�dd��Z eje d�d d ��Z ej ed�d d ��Zej ejej d�d d��Zej ed�dd��Zej ed�dd��Zej ed�dd��Zejej e d�dd��Z ej e d�dd��Z ej e d�dd��Z ej ed�d d ��Z!ejee d �d d ��Z"d!S )"�CertificateSigningRequestrA c C s dS ru r" rE r" r" r# rF � s z CertificateSigningRequest.__eq__c C s dS rv r" rE r" r" r# rG � s z CertificateSigningRequest.__ne__r= c C s dS rw r" r> r" r" r# rI � s z"CertificateSigningRequest.__hash__c C s dS rg r" r> r" r" r# rh � s z$CertificateSigningRequest.public_keyc C s dS rl r" r> r" r" r# rm � s z!CertificateSigningRequest.subjectc C s dS rn r" r> r" r" r# ro � s z2CertificateSigningRequest.signature_hash_algorithmc C s dS rp r" r> r" r" r# rq � s z1CertificateSigningRequest.signature_algorithm_oidc C s dS )z@ Returns the extensions in the signing request. Nr" r> r" r" r# r* � s z$CertificateSigningRequest.extensionsc C s dS )z/ Returns an Attributes object. Nr" r> r" r" r# r. � s z$CertificateSigningRequest.attributesrx c C s dS )z; Encodes the request to PEM or DER format. Nr" rz r" r" r# r{ � s z&CertificateSigningRequest.public_bytesc C s dS rr r" r> r" r" r# rs � s z#CertificateSigningRequest.signaturec C s dS )zd Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC 2986. Nr" r> r" r" r# �tbs_certrequest_bytes� s z/CertificateSigningRequest.tbs_certrequest_bytesc C s dS )z8 Verifies signature of signing request. Nr" r> r" r" r# r� � s z,CertificateSigningRequest.is_signature_validrS c C s dS )z: Get the attribute value for a given OID. Nr" )r r r" r" r# rU s z/CertificateSigningRequest.get_attribute_for_oidN)#r$ r% r& r| r} r� rO rF rG rK rI r rh r r rm rM r� r r~ ro r rq r r* rP r. r r� rJ r{ rs r� r� rU r" r" r" r# r� � s: �r� )�data�backendr c C s t �| �S r )� rust_x509�load_pem_x509_certificate�r� r� r" r" r# r� s r� c C s t �| �S r )r� �load_der_x509_certificater� r" r" r# r� s r� c C s t �| �S r )r� �load_pem_x509_csrr� r" r" r# r� s r� c C s t �| �S r )r� �load_der_x509_csrr� r" r" r# r� % s r� c C s t �| �S r )r� �load_pem_x509_crlr� r" r" r# r� , s r� c C s t �| �S r )r� �load_der_x509_crlr� r" r" r# r� 3 s r� c @ s� e Zd Zdg g feje ejee ejej e e f d�dd�Z ed d�dd�Z eed d�d d �Ze e d d �d d �Zdeejej ejed�dd�ZdS )� CertificateSigningRequestBuilderN)� subject_namer* r. c C s || _ || _|| _dS )zB Creates an empty X.509 certificate request (v1). N)� _subject_namer� rR )r r� r* r. r" r" r# r : s z)CertificateSigningRequestBuilder.__init__��namer c C s4 t |t�std��| jdur$td��t|| j| j�S )zF Sets the certificate requestor's distinguished name. �Expecting x509.Name object.N�&The subject name may only be set once.)rC r � TypeErrorr� r+ r� r� rR �r r� r" r" r# r� G s �z-CertificateSigningRequestBuilder.subject_name��extval�criticalr c C sD t |t�std��t|j||�}t|| j� t| j| j|g | j �S )zE Adds an X.509 extension to the certificate request. �"extension must be an ExtensionType) rC r r� r r r- r� r� r� rR �r r� r� r) r" r" r# � add_extensionS s �z.CertificateSigningRequestBuilder.add_extension)r r9 r c C sL t |t�std��t |t�s$td��t|| j� t| j| j| j||fg �S )zK Adds an X.509 attribute with an OID and associated value. z oid must be an ObjectIdentifierzvalue must be bytes) rC r r� rJ r0 rR r� r� r� )r r r9 r" r" r# � add_attributee s �z.CertificateSigningRequestBuilder.add_attribute�� private_keyra r� r c C s | j du rtd��t�| ||�S )zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subject)r� r+ r� Zcreate_x509_csr�r r� ra r� r" r" r# �signy s z%CertificateSigningRequestBuilder.sign)N)r$ r% r& rM r� r r� r r �Tupler rJ r r� rO r� r� r r r~ rN r� r� r" r" r" r# r� 9 s, � � � � � �r� c @ s e Zd ZU ejee ed< ddddddg feje eje eje eje eje j eje j ejee dd�dd�Z e d d�dd�Ze d d�d d �Ze d d �d d �Ze d d�dd�Ze j d d�dd�Ze j d d�dd�Zeed d�dd�Zd eejej ejed�dd�ZdS ) �CertificateBuilderr� N)� issuer_namer� rh re ri rj r* r c C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S r ) rZ r\ Z_version� _issuer_namer� � _public_keyr� �_not_valid_before�_not_valid_afterr� )r r� r� rh re ri rj r* r" r" r# r � s zCertificateBuilder.__init__r� c C sD t |t�std��| jdur$td��t|| j| j| j| j | j | j �S )z3 Sets the CA's distinguished name. r� N�%The issuer name may only be set once.) rC r r� r� r+ r� r� r� r� r� r� r� r� r" r" r# r� � s �z CertificateBuilder.issuer_namec C sD t |t�std��| jdur$td��t| j|| j| j| j | j | j �S )z: Sets the requestor's distinguished name. r� Nr� ) rC r r� r� r+ r� r� r� r� r� r� r� r� r" r" r# r� � s �z CertificateBuilder.subject_name)�keyr c C s` t |tjtjtjtjt j t j t jf�s.td��| jdur@td��t| j| j|| j| j| j| j�S )zT Sets the requestor's public key (as found in the signing request). z�Expecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rC r Z DSAPublicKeyr Z RSAPublicKeyr ZEllipticCurvePublicKeyr ZEd25519PublicKeyr ZEd448PublicKeyr ZX25519PublicKeyr Z X448PublicKeyr� r� r+ r� r� r� r� r� r� r� )r r� r" r" r# rh � s2 �� � �z CertificateBuilder.public_key��numberr c C sh t |t�std��| jdur$td��|dkr4td��|�� dkrHtd��t| j| j| j || j | j | j �S )z5 Sets the certificate serial number. �'Serial number must be of integral type.N�'The serial number may only be set once.r z%The serial number should be positive.� �3The serial number should not be more than 159 bits.) rC rK r� r� r+ � bit_lengthr� r� r� r� r� r� r� �r r� r" r" r# re � s& ��z CertificateBuilder.serial_numberr1 c C sz t |tj�std��| jdur&td��t|�}|tk r>td��| jdurZ|| jkrZtd��t| j | j | j | j || j| j �S )z7 Sets the certificate activation time. �Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rC r4 r� r� r+ r7 �_EARLIEST_UTC_TIMEr� r� r� r� r� r� r� �r r2 r" r" r# ri s, ���z#CertificateBuilder.not_valid_beforec C sz t |tj�std��| jdur&td��t|�}|tk r>td��| jdurZ|| jk rZtd��t| j | j | j | j | j|| j �S )z7 Sets the certificate expiration time. r� Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rC r4 r� r� r+ r7 r� r� r� r� r� r� r� r� r� r" r" r# rj s2 �����z"CertificateBuilder.not_valid_afterr� c C sT t |t�std��t|j||�}t|| j� t| j| j | j | j | j | j | j|g �S )z= Adds an X.509 extension to the certificate. r� )rC r r� r r r- r� r� r� r� r� r� r� r� r� r" r" r# r� @ s �z CertificateBuilder.add_extensionr� c C sz | j du rtd��| jdu r$td��| jdu r6td��| jdu rHtd��| jdu rZtd��| jdu rltd��t�| ||�S )zC Signs the certificate using the CA's private key. Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key) r� r+ r� r� r� r� r� r� Zcreate_x509_certificater� r" r" r# r� V s zCertificateBuilder.sign)N) r$ r% r& rM r� r r �__annotations__r� r r rK r4 r r� r� rh re ri rj rO r� r r r~ rN r_ r� r" r" r" r# r� � sL � � � % � !� � �r� c @ s� e Zd ZU ejee ed< eje ed< dddg g fej e ej e j ej e j ejee eje d�dd�Z e d d�dd �Z e j d d �d d �Ze j d d �dd�Zeed d�dd�Zed d�dd�Zdeej ej ejed�dd�ZdS )� CertificateRevocationListBuilderr� �_revoked_certificatesN)r� r� r� r* �revoked_certificatesc C s" || _ || _|| _|| _|| _d S r )r� � _last_update� _next_updater� r� )r r� r� r� r* r� r" r" r# r x s z)CertificateRevocationListBuilder.__init__)r� r c C s< t |t�std��| jd ur$td��t|| j| j| j| j �S )Nr� r� ) rC r r� r� r+ r� r� r� r� r� )r r� r" r" r# r� � s �z,CertificateRevocationListBuilder.issuer_name)r� r c C sr t |tj�std��| jd ur&td��t|�}|tk r>td��| jd urZ|| jkrZtd��t| j || j| j | j �S )Nr� �!Last update may only be set once.�8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rC r4 r� r� r+ r7 r� r� r� r� r� r� )r r� r" r" r# r� � s( ���z,CertificateRevocationListBuilder.last_update)r� r c C sr t |tj�std��| jd ur&td��t|�}|tk r>td��| jd urZ|| jk rZtd��t| j | j|| j | j �S )Nr� r� r� z8The next update date must be after the last update date.) rC r4 r� r� r+ r7 r� r� r� r� r� r� )r r� r" r" r# r� � s( ���z,CertificateRevocationListBuilder.next_updater� c C sL t |t�std��t|j||�}t|| j� t| j| j | j | j|g | j �S )zM Adds an X.509 extension to the certificate revocation list. r� ) rC r r� r r r- r� r� r� r� r� r� r� r" r" r# r� � s �z.CertificateRevocationListBuilder.add_extension)�revoked_certificater c C s2 t |t�std��t| j| j| j| j| j|g �S )z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rC r� r� r� r� r� r� r� r� )r r� r" r" r# �add_revoked_certificate� s �z8CertificateRevocationListBuilder.add_revoked_certificater� c C sD | j d u rtd��| jd u r$td��| jd u r6td��t�| ||�S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r� r+ r� r� r� Zcreate_x509_crlr� r" r" r# r� � s z%CertificateRevocationListBuilder.sign)N)r$ r% r& rM r� r r r� r� r� r r4 r r� r� r� rO r� r� r r r~ rN r� r� r" r" r" r# r� t sH � � � � � � � � �r� c @ s� e Zd Zddg feje ejej ejee d�dd�Z ed d�dd�Z ejd d�d d �Z e e d d �d d �Zdejed�dd�ZdS )�RevokedCertificateBuilderNr� c C s || _ || _|| _d S r r� r� r" r" r# r � s z"RevokedCertificateBuilder.__init__r� c C sX t |t�std��| jd ur$td��|dkr4td��|�� dkrHtd��t|| j| j�S )Nr� r� r z$The serial number should be positiver� r� ) rC rK r� r� r+ r� r� r� r� r� r" r" r# re s � �z'RevokedCertificateBuilder.serial_numberr1 c C sN t |tj�std��| jd ur&td��t|�}|tk r>td��t| j|| j �S )Nr� z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rC r4 r� r� r+ r7 r� r� r� r� r� r" r" r# r� s � �z)RevokedCertificateBuilder.revocation_dater� c C sD t |t�std��t|j||�}t|| j� t| j| j | j|g �S )Nr� ) rC r r� r r r- r� r� r� r� r� r" r" r# r� ( s �z'RevokedCertificateBuilder.add_extension)r� r c C s: | j d u rtd��| jd u r$td��t| j | jt| j��S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r� r+ r� r� r r� )r r� r" r" r# �build6 s ��z RevokedCertificateBuilder.build)N)r$ r% r& rM r� rK r4 r� r r r re r� rO r� rN r� r� r" r" r" r# r� � s � � � � r� r= c C s t �t�d�d�d? S )N� Zbigr )rK � from_bytes�os�urandomr" r" r" r# �random_serial_numberD s r� )N)N)N)N)N)N)Er| r4 r� rM Z cryptographyr Z"cryptography.hazmat.bindings._rustr r� Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr r r r r r r Z/cryptography.hazmat.primitives.asymmetric.typesr r r Z cryptography.x509.extensionsr r r r Zcryptography.x509.namer r Zcryptography.x509.oidr r� � Exceptionr r� r- r� rJ r0 r7 r8 rP �EnumrZ r] �ABCMetar_ �registerr� r� r� r� rN r� r� r� r� r� r� r� r� r� r� r� rK r� r" r" r" r# �<module> s� $ � � 'l x [ �� �� �� �� �� �� N n I