U vù¾fÙã @sŠddlmZddlZddlZddlZddlZddlZddlmZddl m Zddlm Z mZddlmZmZmZmZmZmZmZmZddlmZmZmZddlmZmZmZm Z dd l!m"Z"m#Z#dd l$m%Z%e ddd¡Z&ej'e j(e j)e j*e j+e j,e j-e j.e j/fZ0Gd d„de1ƒZ2ddddœdd„Z3ddddœdd„Z4dddœdd„Z5Gdd„dƒZ6Gd d!„d!ƒZ7Gd"d#„d#ej8ƒZ9Gd$d%„d%e1ƒZ:Gd&d'„d'ej;d(Ze> =ej>¡Gd+d,„d,e>ƒZ?Gd-d.„d.ej;d(Z@e@ =ej@¡Gd/d0„d0ej;d(ZAeA =ejA¡ejBZBejCZCejDZDejEZEejFZFejGZGejHZHGd1d2„d2ƒZIGd3d4„d4ƒZJGd5d6„d6ƒZKGd7d8„d8ƒZLd9d:œd;d<„ZMdS)=é)ÚannotationsN)Úutils)Úx509)ÚhashesÚ serialization)ÚdsaÚecÚed448Úed25519ÚpaddingÚrsaÚx448Úx25519)Ú CertificateIssuerPrivateKeyTypesÚCertificateIssuerPublicKeyTypesÚCertificatePublicKeyTypes)Ú ExtensionÚ ExtensionsÚ ExtensionTypeÚ_make_sequence_methods)ÚNameÚ _ASN1Type)ÚObjectIdentifierižécs&eZdZddddœ‡fdd„Z‡ZS)ÚAttributeNotFoundÚstrrÚNone)ÚmsgÚoidÚreturncstƒ |¡||_dS©N)ÚsuperÚ__init__r)Úselfrr©Ú __class__©úI/opt/alt/python38/lib64/python3.8/site-packages/cryptography/x509/base.pyr"9szAttributeNotFound.__init__©Ú__name__Ú __module__Ú__qualname__r"Ú __classcell__r&r&r$r'r8srzExtension[ExtensionType]úlist[Extension[ExtensionType]]r)Ú extensionÚ extensionsrcCs"|D]}|j|jkrtdƒ‚qdS)Nz$This extension has already been set.)rÚ ValueError)r.r/Úer&r&r'Ú_reject_duplicate_extension>sr2rú0list[tuple[ObjectIdentifier, bytes, int | None]])rÚ attributesrcCs$|D]\}}}||krtdƒ‚qdS)Nz$This attribute has already been set.)r0)rr4Zattr_oidÚ_r&r&r'Ú_reject_duplicate_attributeHsr6údatetime.datetime©ÚtimercCs:|jdk r2| ¡}|r|nt ¡}|jdd|S|SdS)z’Normalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N©Útzinfo)r;Ú utcoffsetÚdatetimeÚ timedeltaÚreplace)r9Úoffsetr&r&r'Ú_convert_to_naive_utc_timeRs rAc@sxeZdZejjfdddddœdd„Zeddœd d „ƒZeddœdd„ƒZd dœdd„Z dddœdd„Z ddœdd„ZdS)Ú AttributerÚbytesÚintr)rÚvalueÚ_typercCs||_||_||_dSr )Ú_oidÚ_valuerF)r#rrErFr&r&r'r"aszAttribute.__init__©rcCs|jSr )rG©r#r&r&r'rksz Attribute.oidcCs|jSr )rHrJr&r&r'rEoszAttribute.valuercCsd|j›d|j›dS)Nz)rrErJr&r&r'Ú__repr__sszAttribute.__repr__ÚobjectÚbool©ÚotherrcCs2t|tƒstS|j|jko0|j|jko0|j|jkSr )Ú isinstancerBÚNotImplementedrrErF©r#rPr&r&r'Ú__eq__vs ÿ ýzAttribute.__eq__cCst|j|j|jfƒSr )ÚhashrrErFrJr&r&r'Ú__hash__€szAttribute.__hash__N)r)r*r+rZ UTF8StringrEr"ÚpropertyrrLrTrVr&r&r&r'rB`sü rBc@sHeZdZdddœdd„Zedƒ\ZZZddœd d „Zddd œdd„Z dS)Ú Attributesztyping.Iterable[Attribute]r)r4rcCst|ƒ|_dSr )ÚlistÚ_attributes)r#r4r&r&r'r"…szAttributes.__init__rZrrIcCsd|j›dS)Nzœd?d@„ƒZdAS)BÚCertificateúhashes.HashAlgorithmrC©Ú algorithmrcCsdS©z4 Returns bytes using digest passed. Nr&©r#rjr&r&r'Úfingerprint¤szCertificate.fingerprintrDrIcCsdS)z3 Returns certificate serial number Nr&rJr&r&r'Ú serial_numberªszCertificate.serial_numberracCsdS)z1 Returns the certificate version Nr&rJr&r&r'Úversion±szCertificate.versionrcCsdS©z( Returns the public key Nr&rJr&r&r'Ú public_key¸szCertificate.public_keyrcCsdS)zA Returns the ObjectIdentifier of the public key. Nr&rJr&r&r'Úpublic_key_algorithm_oid¾sz$Certificate.public_key_algorithm_oidr7cCsdS)z? Not before time (represented as UTC datetime) Nr&rJr&r&r'Únot_valid_beforeÅszCertificate.not_valid_beforecCsdS)zK Not before time (represented as a non-naive UTC datetime) Nr&rJr&r&r'Únot_valid_before_utcÌsz Certificate.not_valid_before_utccCsdS)z> Not after time (represented as UTC datetime) Nr&rJr&r&r'Únot_valid_afterÓszCertificate.not_valid_aftercCsdS)zJ Not after time (represented as a non-naive UTC datetime) Nr&rJr&r&r'Únot_valid_after_utcÚszCertificate.not_valid_after_utcrcCsdS)z1 Returns the issuer name object. Nr&rJr&r&r'ÚissuerászCertificate.issuercCsdS©z2 Returns the subject name object. Nr&rJr&r&r'ÚsubjectèszCertificate.subjectúhashes.HashAlgorithm | NonecCsdS©zt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr&rJr&r&r'Úsignature_hash_algorithmïsz$Certificate.signature_hash_algorithmcCsdS©zJ Returns the ObjectIdentifier of the signature algorithm. Nr&rJr&r&r'Úsignature_algorithm_oidùsz#Certificate.signature_algorithm_oidú0None | padding.PSS | padding.PKCS1v15 | ec.ECDSAcCsdS©z= Returns the signature algorithm parameters. Nr&rJr&r&r'Úsignature_algorithm_parameterssz*Certificate.signature_algorithm_parametersrcCsdS)z/ Returns an Extensions object. Nr&rJr&r&r'r/ szCertificate.extensionscCsdS©z. Returns the signature bytes. Nr&rJr&r&r'Ú signatureszCertificate.signaturecCsdS)zR Returns the tbsCertificate payload bytes as defined in RFC 5280. Nr&rJr&r&r'Útbs_certificate_bytessz!Certificate.tbs_certificate_bytescCsdS)zh Returns the tbsCertificate payload bytes with the SCT list extension stripped. Nr&rJr&r&r'Útbs_precertificate_bytessz$Certificate.tbs_precertificate_bytesrMrNrOcCsdS©z" Checks equality. Nr&rSr&r&r'rT&szCertificate.__eq__cCsdS©z" Computes a hash. Nr&rJr&r&r'rV,szCertificate.__hash__úserialization.Encoding©ÚencodingrcCsdS)zB Serializes the certificate to PEM or DER format. Nr&©r#rŠr&r&r'Úpublic_bytes2szCertificate.public_bytesr)rwrcCsdS)zÕ This method verifies that certificate issuer name matches the issuer subject name and that the certificate is signed by the issuer's private key. No other validation is performed. Nr&)r#rwr&r&r'Úverify_directly_issued_by8sz%Certificate.verify_directly_issued_byN)r)r*r+ÚabcÚabstractmethodrmrWrnrorqrrrsrtrurvrwryr|r~rr/rƒr„r…rTrVrŒrr&r&r&r'rg£sxrg)Ú metaclassc@sleZdZeejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd „ƒƒZeejd dœdd„ƒƒZ d S)ÚRevokedCertificaterDrIcCsdS)zG Returns the serial number of the revoked certificate. Nr&rJr&r&r'rnFsz RevokedCertificate.serial_numberr7cCsdS)zH Returns the date of when this certificate was revoked. Nr&rJr&r&r'Úrevocation_dateMsz"RevokedCertificate.revocation_datecCsdS)zl Returns the date of when this certificate was revoked as a non-naive UTC datetime. Nr&rJr&r&r'Úrevocation_date_utcTsz&RevokedCertificate.revocation_date_utcrcCsdS)zW Returns an Extensions object containing a list of Revoked extensions. Nr&rJr&r&r'r/\szRevokedCertificate.extensionsN) r)r*r+rWrŽrrnr’r“r/r&r&r&r'r‘Esr‘c@sfeZdZddddœdd„Zeddœdd „ƒZeddœd d„ƒZeddœdd „ƒZeddœdd„ƒZdS)Ú_RawRevokedCertificaterDr7r©rnr’r/cCs||_||_||_dSr ©Ú_serial_numberÚ_revocation_dateÚ_extensions©r#rnr’r/r&r&r'r"isz_RawRevokedCertificate.__init__rIcCs|jSr )r—rJr&r&r'rnssz$_RawRevokedCertificate.serial_numbercCstjdtjdd|jS)NukProperties that return a naÃ¯ve datetime object have been deprecated. Please switch to revocation_date_utc.rb)Ú stacklevel)ÚwarningsÚwarnrZDeprecatedIn42r˜rJr&r&r'r’wsüz&_RawRevokedCertificate.revocation_datecCs|jjtjjdS)Nr:)r˜r?r=ÚtimezoneÚutcrJr&r&r'r“sz*_RawRevokedCertificate.revocation_date_utccCs|jSr )r™rJr&r&r'r/…sz!_RawRevokedCertificate.extensionsN) r)r*r+r"rWrnr’r“r/r&r&r&r'r”hs r”c@sìeZdZejdddœdd„ƒZejdddœdd „ƒZejd ddœd d„ƒZeejddœdd„ƒƒZ eejddœdd„ƒƒZ eejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZ eejddœdd „ƒƒZeejd!dœd"d#„ƒƒZeejd!dœd$d%„ƒƒZeejd&dœd'd(„ƒƒZeejddœd)d*„ƒƒZeejddœd+d,„ƒƒZejd-d.d/œd0d1„ƒZejd dœd2d3„ƒZejd d4d5œd6d7„ƒZejd8d9d5œd:d7„ƒZejd;ddœd?d@„ƒZejdAd.dBœdCdD„ƒZdES)FÚCertificateRevocationListrˆrCr‰cCsdS)z: Serializes the CRL to PEM or DER format. Nr&r‹r&r&r'rŒ‹sz&CertificateRevocationList.public_bytesrhricCsdSrkr&rlr&r&r'rm‘sz%CertificateRevocationList.fingerprintrDzRevokedCertificate | None)rnrcCsdS)zs Returns an instance of RevokedCertificate or None if the serial_number is not in the CRL. Nr&)r#rnr&r&r'Ú(get_revoked_certificate_by_serial_number—szBCertificateRevocationList.get_revoked_certificate_by_serial_numberrzrIcCsdSr{r&rJr&r&r'r| sz2CertificateRevocationList.signature_hash_algorithmrcCsdSr}r&rJr&r&r'r~ªsz1CertificateRevocationList.signature_algorithm_oidrcCsdSr€r&rJr&r&r'r±sz8CertificateRevocationList.signature_algorithm_parametersrcCsdS)zC Returns the X509Name with the issuer of this CRL. Nr&rJr&r&r'rwºsz CertificateRevocationList.issuerúdatetime.datetime | NonecCsdS)z? Returns the date of next update for this CRL. Nr&rJr&r&r'Únext_updateÁsz%CertificateRevocationList.next_updatecCsdS)zc Returns the date of next update for this CRL as a non-naive UTC datetime. Nr&rJr&r&r'Únext_update_utcÈsz)CertificateRevocationList.next_update_utcr7cCsdS)z? Returns the date of last update for this CRL. Nr&rJr&r&r'Úlast_updateÐsz%CertificateRevocationList.last_updatecCsdS)zc Returns the date of last update for this CRL as a non-naive UTC datetime. Nr&rJr&r&r'Úlast_update_utc×sz)CertificateRevocationList.last_update_utcrcCsdS)zS Returns an Extensions object containing a list of CRL extensions. Nr&rJr&r&r'r/ßsz$CertificateRevocationList.extensionscCsdSr‚r&rJr&r&r'rƒæsz#CertificateRevocationList.signaturecCsdS)zO Returns the tbsCertList payload bytes as defined in RFC 5280. Nr&rJr&r&r'Útbs_certlist_bytesísz,CertificateRevocationList.tbs_certlist_bytesrMrNrOcCsdSr†r&rSr&r&r'rTôsz CertificateRevocationList.__eq__cCsdS)z< Number of revoked certificates in the CRL. Nr&rJr&r&r'r^úsz!CertificateRevocationList.__len__r‘)ÚidxrcCsdSr r&©r#r¨r&r&r'r`sz%CertificateRevocationList.__getitem__Úsliceúlist[RevokedCertificate]cCsdSr r&r©r&r&r'r`szint | slicez-RevokedCertificate | list[RevokedCertificate]cCsdS)zS Returns a revoked certificate (or slice of revoked certificates). Nr&r©r&r&r'r`sz#typing.Iterator[RevokedCertificate]cCsdS)z8 Iterator over the revoked certificates Nr&rJr&r&r'r_sz"CertificateRevocationList.__iter__r)rqrcCsdS)zQ Verifies signature of revocation list against given public key. Nr&)r#rqr&r&r'Úis_signature_validsz,CertificateRevocationList.is_signature_validN)r)r*r+rŽrrŒrmr¡rWr|r~rrwr£r¤r¥r¦r/rƒr§rTr^ÚtypingÚoverloadr`r_r¬r&r&r&r'r Šsjr c@sNeZdZejdddœdd„ƒZejddœdd „ƒZejd dœdd„ƒZeejd dœdd„ƒƒZ eejddœdd„ƒƒZ eejddœdd„ƒƒZeejddœdd„ƒƒZeejddœdd„ƒƒZ eejddœdd„ƒƒZejdd d!œd"d#„ƒZeejd dœd$d%„ƒƒZeejd dœd&d'„ƒƒZeejddœd(d)„ƒƒZejdd d*œd+d,„ƒZd-S).ÚCertificateSigningRequestrMrNrOcCsdSr†r&rSr&r&r'rT!sz CertificateSigningRequest.__eq__rDrIcCsdSr‡r&rJr&r&r'rV'sz"CertificateSigningRequest.__hash__rcCsdSrpr&rJr&r&r'rq-sz$CertificateSigningRequest.public_keyrcCsdSrxr&rJr&r&r'ry3sz!CertificateSigningRequest.subjectrzcCsdSr{r&rJr&r&r'r|:sz2CertificateSigningRequest.signature_hash_algorithmrcCsdSr}r&rJr&r&r'r~Dsz1CertificateSigningRequest.signature_algorithm_oidrcCsdSr€r&rJr&r&r'rKsz8CertificateSigningRequest.signature_algorithm_parametersrcCsdS)z@ Returns the extensions in the signing request. Nr&rJr&r&r'r/Tsz$CertificateSigningRequest.extensionsrXcCsdS)z/ Returns an Attributes object. Nr&rJr&r&r'r4[sz$CertificateSigningRequest.attributesrˆrCr‰cCsdS)z; Encodes the request to PEM or DER format. Nr&r‹r&r&r'rŒbsz&CertificateSigningRequest.public_bytescCsdSr‚r&rJr&r&r'rƒhsz#CertificateSigningRequest.signaturecCsdS)zd Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC 2986. Nr&rJr&r&r'Útbs_certrequest_bytesosz/CertificateSigningRequest.tbs_certrequest_bytescCsdS)z8 Verifies signature of signing request. Nr&rJr&r&r'r¬wsz,CertificateSigningRequest.is_signature_validr[cCsdS)z: Get the attribute value for a given OID. Nr&)r#rr&r&r'r]~sz/CertificateSigningRequest.get_attribute_for_oidN)r)r*r+rŽrrTrVrqrWryr|r~rr/r4rŒrƒr°r¬r]r&r&r&r'r¯ sJr¯c@s€eZdZdggfddddœdd„Zddd œd d„Zdd ddœdd„Zddœdddddœdd„Zd!ddœddddddœdd „ZdS)"Ú CertificateSigningRequestBuilderNúName | Noner-r3)Úsubject_namer/r4cCs||_||_||_dS)zB Creates an empty X.509 certificate request (v1). N)Ú _subject_namer™rZ)r#r³r/r4r&r&r'r"–s z)CertificateSigningRequestBuilder.__init__r©ÚnamercCs4t|tƒstdƒ‚|jdk r$tdƒ‚t||j|jƒS)zF Sets the certificate requestor's distinguished name. úExpecting x509.Name object.Nú&The subject name may only be set once.)rQrÚ TypeErrorr´r0r±r™rZ©r#r¶r&r&r'r³£s ÿz-CertificateSigningRequestBuilder.subject_namerrN©ÚextvalÚcriticalrcCsDt|tƒstdƒ‚t|j||ƒ}t||jƒt|j|j|f•|j ƒS)zE Adds an X.509 extension to the certificate request. ú"extension must be an ExtensionType) rQrr¹rrr2r™r±r´rZ©r#r¼r½r.r&r&r'Ú add_extension¯s ýz.CertificateSigningRequestBuilder.add_extension)Ú_tagrrCz_ASN1Type | None)rrErÁrcCs|t|tƒstdƒ‚t|tƒs$tdƒ‚|dk r>t|tƒs>tdƒ‚t||jƒ|dk rZ|j}nd}t|j |j |j|||ff•ƒS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rQrr¹rCrr6rZrEr±r´r™)r#rrErÁÚtagr&r&r'Ú add_attributeÁs ýz.CertificateSigningRequestBuilder.add_attribute©Úrsa_paddingrú_AllowedHashTypes | Noneú typing.Anyú%padding.PSS | padding.PKCS1v15 | Noner¯©Úprivate_keyrjÚbackendrÅrcCsX|jdkrtdƒ‚|dk rHt|tjtjfƒs4tdƒ‚t|tjƒsHtdƒ‚t ||||¡S)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subjectúPadding must be PSS or PKCS1v15ú&Padding is only supported for RSA keys)r´r0rQrÚPSSÚPKCS1v15r¹rÚ RSAPrivateKeyÚ rust_x509Zcreate_x509_csr©r#rÊrjrËrÅr&r&r'Úsignás ÿz%CertificateSigningRequestBuilder.sign)N)r)r*r+r"r³rÀrÃrÓr&r&r&r'r±•sü û$üúr±c @sÒeZdZUded<ddddddgfddddddddd œd d„Zddd œdd„Zddd œdd„Zdddœdd„Zdddœdd„Zdddœdd„Z dddœdd„Z d d!dd"œd#d$„Zd.dd%œd&d'd(d)d*d+œd,d-„ZdS)/ÚCertificateBuilderr-r™Nr²z CertificatePublicKeyTypes | Noneú int | Noner¢r)Úissuer_namer³rqrnrsrur/rcCs6tj|_||_||_||_||_||_||_||_ dSr ) rardÚ_versionÚ_issuer_namer´Ú_public_keyr—Ú_not_valid_beforeÚ_not_valid_afterr™)r#rÖr³rqrnrsrur/r&r&r'r"ýs zCertificateBuilder.__init__rrµcCsDt|tƒstdƒ‚|jdk r$tdƒ‚t||j|j|j|j |j |jƒS)z3 Sets the CA's distinguished name. r·Nú%The issuer name may only be set once.)rQrr¹rØr0rÔr´rÙr—rÚrÛr™rºr&r&r'rÖs ùzCertificateBuilder.issuer_namecCsDt|tƒstdƒ‚|jdk r$tdƒ‚t|j||j|j|j |j |jƒS)z: Sets the requestor's distinguished name. r·Nr¸)rQrr¹r´r0rÔrØrÙr—rÚrÛr™rºr&r&r'r³"s ùzCertificateBuilder.subject_namer)Úkeyrc Cs`t|tjtjtjtjt j tjt jfƒs.tdƒ‚|jdk r@tdƒ‚t|j|j||j|j|j|jƒS)zT Sets the requestor's public key (as found in the signing request). z‰Expecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rQrZDSAPublicKeyrZRSAPublicKeyrZEllipticCurvePublicKeyr ZEd25519PublicKeyr ZEd448PublicKeyrZX25519PublicKeyr Z X448PublicKeyr¹rÙr0rÔrØr´r—rÚrÛr™)r#rÝr&r&r'rq4s2ùþÿ ùzCertificateBuilder.public_keyrD©ÚnumberrcCsht|tƒstdƒ‚|jdk r$tdƒ‚|dkr4tdƒ‚| ¡dkrHtdƒ‚t|j|j|j ||j |j|jƒS)z5 Sets the certificate serial number. ú'Serial number must be of integral type.Nú'The serial number may only be set once.rz%The serial number should be positive.é ú3The serial number should not be more than 159 bits.) rQrDr¹r—r0Ú bit_lengthrÔrØr´rÙrÚrÛr™©r#rßr&r&r'rnYs& ÿùz CertificateBuilder.serial_numberr7r8cCszt|tjƒstdƒ‚|jdk r&tdƒ‚t|ƒ}|tkr>tdƒ‚|jdk rZ||jkrZtdƒ‚t|j |j |j|j||j|j ƒS)z7 Sets the certificate activation time. úExpecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rQr=r¹rÚr0rAÚ_EARLIEST_UTC_TIMErÛrÔrØr´rÙr—r™©r#r9r&r&r'rsts, ÿÿùz#CertificateBuilder.not_valid_beforecCszt|tjƒstdƒ‚|jdk r&tdƒ‚t|ƒ}|tkr>tdƒ‚|jdk rZ||jkrZtdƒ‚t|j |j |j|j|j||j ƒS)z7 Sets the certificate expiration time. ræNz)The not valid after may only be set once.ztdƒ‚|jdk rZ||jkrZtdƒ‚t|j ||j|j |jƒS)Nræú!Last update may only be set once.ú8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rQr=r¹rír0rArçrîrêrØr™rë)r#r¥r&r&r'r¥s( ÿÿûz,CertificateRevocationListBuilder.last_update)r£rcCsrt|tjƒstdƒ‚|jdk r&tdƒ‚t|ƒ}|tkr>tdƒ‚|jdk rZ||jkrZtdƒ‚t|j |j||j |jƒS)Nrærïrðz8The next update date must be after the last update date.)rQr=r¹rîr0rArçrírêrØr™rë)r#r£r&r&r'r£(s( ÿÿûz,CertificateRevocationListBuilder.next_updaterrNr»cCsLt|tƒstdƒ‚t|j||ƒ}t||jƒt|j|j |j |j|f•|jƒS)zM Adds an X.509 extension to the certificate revocation list. r¾)rQrr¹rrr2r™rêrØrírîrër¿r&r&r'rÀ@s ûz.CertificateRevocationListBuilder.add_extensionr‘)Úrevoked_certificatercCs2t|tƒstdƒ‚t|j|j|j|j|j|f•ƒS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rQr‘r¹rêrØrírîr™rë)r#rñr&r&r'Úadd_revoked_certificateSs ûz8CertificateRevocationListBuilder.add_revoked_certificaterÄrrÆrÇrÈr rÉcCs||jdkrtdƒ‚|jdkr$tdƒ‚|jdkr6tdƒ‚|dk rlt|tjtjfƒsXtdƒ‚t|t j ƒsltdƒ‚t ||||¡S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timerÌrÍ) rØr0rírîrQrrÎrÏr¹rrÐrÑZcreate_x509_crlrÒr&r&r'rÓds" ÿz%CertificateRevocationListBuilder.sign)N)r)r*r+rér"rÖr¥r£rÀròrÓr&r&r&r'rêïs" úüúrêc@sjeZdZddgfddddœdd„Zddd œd d„Zddd œdd„Zddddœdd„Zddddœdd„ZdS)ÚRevokedCertificateBuilderNrÕr¢r-r•cCs||_||_||_dSr r–ršr&r&r'r"sz"RevokedCertificateBuilder.__init__rDrÞcCsXt|tƒstdƒ‚|jdk r$tdƒ‚|dkr4tdƒ‚| ¡dkrHtdƒ‚t||j|jƒS)Nràrárz$The serial number should be positiverârã) rQrDr¹r—r0rärór˜r™rår&r&r'rn‹s ÿÿz'RevokedCertificateBuilder.serial_numberr7r8cCsNt|tjƒstdƒ‚|jdk r&tdƒ‚t|ƒ}|tkr>tdƒ‚t|j||j ƒS)Nræz)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rQr=r¹r˜r0rArçrór—r™rèr&r&r'r’s ÿÿz)RevokedCertificateBuilder.revocation_daterrNr»cCsDt|tƒstdƒ‚t|j||ƒ}t||jƒt|j|j |j|f•ƒS)Nr¾) rQrr¹rrr2r™rór—r˜r¿r&r&r'rÀs ýz'RevokedCertificateBuilder.add_extensionrÇr‘)rËrcCs:|jdkrtdƒ‚|jdkr$tdƒ‚t|j|jt|jƒƒS)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r—r0r˜r”rr™)r#rËr&r&r'Úbuild»s ÿýzRevokedCertificateBuilder.build)N)r)r*r+r"rnr’rÀrôr&r&r&r'ró€sü rórDrIcCst t d¡d¡d?S)NéÚbigr)rDÚ from_bytesÚosÚurandomr&r&r&r'Úrandom_serial_numberÉsrú)NÚ __future__rrŽr=rørrœZcryptographyrZ"cryptography.hazmat.bindings._rustrrÑZcryptography.hazmat.primitivesrrZ)cryptography.hazmat.primitives.asymmetricrrr r rrr rZ/cryptography.hazmat.primitives.asymmetric.typesrrrZcryptography.x509.extensionsrrrrZcryptography.x509.namerrZcryptography.x509.oidrrçÚUnionÚSHA224ÚSHA256ÚSHA384ÚSHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypesÚ Exceptionrr2r6rArBrXÚEnumrareÚABCMetargÚregisterr‘r”r r¯Zload_pem_x509_certificateZload_der_x509_certificateZload_pem_x509_certificatesZload_pem_x509_csrZload_der_x509_csrZload_pem_x509_crlZload_der_x509_crlr±rÔrêrórúr&r&r&r'Úst( ùÿ $ "fevI