a
    ϏPfE                  	   @  s  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z d dlmZmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZm Z  d d	l!m"Z"m#Z# d d
l$m%Z% edddZ&ej'ej(ej)ej*ej+ej,ej-ej.ej/f Z0G dd de1Z2ddddddZ3ddddddZ4dddddZ5G dd dZ6G d d! d!Z7G d"d# d#ej8Z9G d$d% d%e1Z:G d&d' d'ej;d(Z<e<=ej< G d)d* d*ej;d(Z>e>=ej> G d+d, d,e>Z?G d-d. d.ej;d(Z@e@=ej@ G d/d0 d0ej;d(ZAeA=ejA ejBZBejCZCejDZDejEZEejFZFejGZGejHZHG d1d2 d2ZIG d3d4 d4ZJG d5d6 d6ZKG d7d8 d8ZLd9d:d;d<ZMdS )=    )annotationsN)utils)x509)hashesserialization)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes)	Extension
ExtensionsExtensionType_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                      s&   e Zd Zdddd fddZ  ZS )AttributeNotFoundstrr   None)msgoidreturnc                   s   t  | || _d S N)super__init__r   )selfr   r   	__class__ W/var/www/html/python-backend/venv/lib/python3.9/site-packages/cryptography/x509/base.pyr"   9   s    zAttributeNotFound.__init____name__
__module____qualname__r"   __classcell__r&   r&   r$   r'   r   8   s   r   zExtension[ExtensionType]list[Extension[ExtensionType]]r   )	extension
extensionsr   c                 C  s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r.   r/   er&   r&   r'   _reject_duplicate_extension>   s    r2   r   0list[tuple[ObjectIdentifier, bytes, int | None]])r   
attributesr   c                 C  s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r0   )r   r4   Zattr_oid_r&   r&   r'   _reject_duplicate_attributeH   s    r6   datetime.datetimetimer   c                 C  s:   | j dur2|  }|r|nt }| jdd| S | S dS )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    Ntzinfo)r;   	utcoffsetdatetime	timedeltareplace)r9   offsetr&   r&   r'   _convert_to_naive_utc_timeR   s
    
rA   c                   @  sx   e Zd ZejjfdddddddZeddd	d
ZeddddZddddZ	dddddZ
ddddZdS )	Attributer   bytesintr   )r   value_typer   c                 C  s   || _ || _|| _d S r    )_oid_valuerF   )r#   r   rE   rF   r&   r&   r'   r"   a   s    zAttribute.__init__r   c                 C  s   | j S r    )rG   r#   r&   r&   r'   r   k   s    zAttribute.oidc                 C  s   | j S r    )rH   rJ   r&   r&   r'   rE   o   s    zAttribute.valuer   c                 C  s   d| j  d| jdS )Nz<Attribute(oid=z, value=)>)r   rE   rJ   r&   r&   r'   __repr__s   s    zAttribute.__repr__objectboolotherr   c                 C  s2   t |tstS | j|jko0| j|jko0| j|jkS r    )
isinstancerB   NotImplementedr   rE   rF   r#   rP   r&   r&   r'   __eq__v   s    


zAttribute.__eq__c                 C  s   t | j| j| jfS r    )hashr   rE   rF   rJ   r&   r&   r'   __hash__   s    zAttribute.__hash__N)r)   r*   r+   r   Z
UTF8StringrE   r"   propertyr   rL   rT   rV   r&   r&   r&   r'   rB   `   s   

rB   c                   @  sH   e Zd ZdddddZed\ZZZddd	d
ZdddddZ	dS )
Attributesztyping.Iterable[Attribute]r   )r4   r   c                 C  s   t || _d S r    )list_attributes)r#   r4   r&   r&   r'   r"      s    zAttributes.__init__rZ   r   rI   c                 C  s   d| j  dS )Nz<Attributes(rK   )rZ   rJ   r&   r&   r'   rL      s    zAttributes.__repr__r   rB   r   r   c                 C  s2   | D ]}|j |kr|  S qtd| d|d S )NzNo z attribute was found)r   r   )r#   r   attrr&   r&   r'   get_attribute_for_oid   s    

z Attributes.get_attribute_for_oidN)
r)   r*   r+   r"   r   __len____iter____getitem__rL   r]   r&   r&   r&   r'   rX      s   rX   c                   @  s   e Zd ZdZdZdS )Versionr      N)r)   r*   r+   Zv1v3r&   r&   r&   r'   ra      s   ra   c                      s&   e Zd Zdddd fddZ  ZS )InvalidVersionr   rD   r   )r   parsed_versionr   c                   s   t  | || _d S r    )r!   r"   re   )r#   r   re   r$   r&   r'   r"      s    zInvalidVersion.__init__r(   r&   r&   r$   r'   rd      s   rd   c                   @  s  e Zd ZejdddddZeejdddd	Zeejd
dddZejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejddddZeejddddZeejdddd Zeejd!dd"d#Zeejd$dd%d&Zeejd'dd(d)Zeejddd*d+Zeejddd,d-Zeejddd.d/Zejd0d1d2d3d4Zejddd5d6Zejd7dd8d9d:Zejd d;d<d=d>Zd?S )@Certificatehashes.HashAlgorithmrC   	algorithmr   c                 C  s   dS z4
        Returns bytes using digest passed.
        Nr&   r#   ri   r&   r&   r'   fingerprint   s    zCertificate.fingerprintrD   rI   c                 C  s   dS )z3
        Returns certificate serial number
        Nr&   rJ   r&   r&   r'   serial_number   s    zCertificate.serial_numberra   c                 C  s   dS )z1
        Returns the certificate version
        Nr&   rJ   r&   r&   r'   version   s    zCertificate.versionr   c                 C  s   dS z(
        Returns the public key
        Nr&   rJ   r&   r&   r'   
public_key   s    zCertificate.public_keyr7   c                 C  s   dS )z?
        Not before time (represented as UTC datetime)
        Nr&   rJ   r&   r&   r'   not_valid_before   s    zCertificate.not_valid_beforec                 C  s   dS )zK
        Not before time (represented as a non-naive UTC datetime)
        Nr&   rJ   r&   r&   r'   not_valid_before_utc   s    z Certificate.not_valid_before_utcc                 C  s   dS )z>
        Not after time (represented as UTC datetime)
        Nr&   rJ   r&   r&   r'   not_valid_after   s    zCertificate.not_valid_afterc                 C  s   dS )zJ
        Not after time (represented as a non-naive UTC datetime)
        Nr&   rJ   r&   r&   r'   not_valid_after_utc   s    zCertificate.not_valid_after_utcr   c                 C  s   dS )z1
        Returns the issuer name object.
        Nr&   rJ   r&   r&   r'   issuer   s    zCertificate.issuerc                 C  s   dS z2
        Returns the subject name object.
        Nr&   rJ   r&   r&   r'   subject   s    zCertificate.subjecthashes.HashAlgorithm | Nonec                 C  s   dS zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr&   rJ   r&   r&   r'   signature_hash_algorithm   s    z$Certificate.signature_hash_algorithmr   c                 C  s   dS zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr&   rJ   r&   r&   r'   signature_algorithm_oid   s    z#Certificate.signature_algorithm_oid0None | padding.PSS | padding.PKCS1v15 | ec.ECDSAc                 C  s   dS z=
        Returns the signature algorithm parameters.
        Nr&   rJ   r&   r&   r'   signature_algorithm_parameters   s    z*Certificate.signature_algorithm_parametersr   c                 C  s   dS )z/
        Returns an Extensions object.
        Nr&   rJ   r&   r&   r'   r/     s    zCertificate.extensionsc                 C  s   dS z.
        Returns the signature bytes.
        Nr&   rJ   r&   r&   r'   	signature	  s    zCertificate.signaturec                 C  s   dS )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr&   rJ   r&   r&   r'   tbs_certificate_bytes  s    z!Certificate.tbs_certificate_bytesc                 C  s   dS )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr&   rJ   r&   r&   r'   tbs_precertificate_bytes  s    z$Certificate.tbs_precertificate_bytesrM   rN   rO   c                 C  s   dS z"
        Checks equality.
        Nr&   rS   r&   r&   r'   rT     s    zCertificate.__eq__c                 C  s   dS z"
        Computes a hash.
        Nr&   rJ   r&   r&   r'   rV   %  s    zCertificate.__hash__serialization.Encodingencodingr   c                 C  s   dS )zB
        Serializes the certificate to PEM or DER format.
        Nr&   r#   r   r&   r&   r'   public_bytes+  s    zCertificate.public_bytesr   )ru   r   c                 C  s   dS )z
        This method verifies that certificate issuer name matches the
        issuer subject name and that the certificate is signed by the
        issuer's private key. No other validation is performed.
        Nr&   )r#   ru   r&   r&   r'   verify_directly_issued_by1  s    z%Certificate.verify_directly_issued_byN)r)   r*   r+   abcabstractmethodrl   rW   rm   rn   rp   rq   rr   rs   rt   ru   rw   rz   r|   r   r/   r   r   r   rT   rV   r   r   r&   r&   r&   r'   rf      sr   rf   )	metaclassc                   @  sl   e Zd ZeejddddZeejddddZeejdddd	Zeejd
dddZ	dS )RevokedCertificaterD   rI   c                 C  s   dS )zG
        Returns the serial number of the revoked certificate.
        Nr&   rJ   r&   r&   r'   rm   ?  s    z RevokedCertificate.serial_numberr7   c                 C  s   dS )zH
        Returns the date of when this certificate was revoked.
        Nr&   rJ   r&   r&   r'   revocation_dateF  s    z"RevokedCertificate.revocation_datec                 C  s   dS )zl
        Returns the date of when this certificate was revoked as a non-naive
        UTC datetime.
        Nr&   rJ   r&   r&   r'   revocation_date_utcM  s    z&RevokedCertificate.revocation_date_utcr   c                 C  s   dS )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr&   rJ   r&   r&   r'   r/   U  s    zRevokedCertificate.extensionsN)
r)   r*   r+   rW   r   r   rm   r   r   r/   r&   r&   r&   r'   r   >  s   r   c                   @  sf   e Zd ZddddddZedddd	Zeddd
dZeddddZeddddZdS )_RawRevokedCertificaterD   r7   r   rm   r   r/   c                 C  s   || _ || _|| _d S r    _serial_number_revocation_date_extensionsr#   rm   r   r/   r&   r&   r'   r"   b  s    z_RawRevokedCertificate.__init__rI   c                 C  s   | j S r    )r   rJ   r&   r&   r'   rm   l  s    z$_RawRevokedCertificate.serial_numberc                 C  s   t jdtjdd | jS )Nuk   Properties that return a naïve datetime object have been deprecated. Please switch to revocation_date_utc.rb   )
stacklevel)warningswarnr   ZDeprecatedIn42r   rJ   r&   r&   r'   r   p  s    z&_RawRevokedCertificate.revocation_datec                 C  s   | j jtjjdS )Nr:   )r   r?   r=   timezoneutcrJ   r&   r&   r'   r   z  s    z*_RawRevokedCertificate.revocation_date_utcc                 C  s   | j S r    )r   rJ   r&   r&   r'   r/   ~  s    z!_RawRevokedCertificate.extensionsN)	r)   r*   r+   r"   rW   rm   r   r   r/   r&   r&   r&   r'   r   a  s   
	r   c                   @  s  e Zd ZejdddddZejddddd	Zejd
ddddZeejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejdddd Zeejd!dd"d#Zeejd!dd$d%Zeejd&dd'd(Zeejddd)d*Zeejddd+d,Zejd-d.d/d0d1Zejd
dd2d3Zejd
d4d5d6d7Zejd8d9d5d:d7Zejd;d<d5d=d7Zejd>dd?d@ZejdAd.dBdCdDZdES )FCertificateRevocationListr   rC   r   c                 C  s   dS )z:
        Serializes the CRL to PEM or DER format.
        Nr&   r   r&   r&   r'   r     s    z&CertificateRevocationList.public_bytesrg   rh   c                 C  s   dS rj   r&   rk   r&   r&   r'   rl     s    z%CertificateRevocationList.fingerprintrD   zRevokedCertificate | None)rm   r   c                 C  s   dS )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr&   )r#   rm   r&   r&   r'   (get_revoked_certificate_by_serial_number  s    zBCertificateRevocationList.get_revoked_certificate_by_serial_numberrx   rI   c                 C  s   dS ry   r&   rJ   r&   r&   r'   rz     s    z2CertificateRevocationList.signature_hash_algorithmr   c                 C  s   dS r{   r&   rJ   r&   r&   r'   r|     s    z1CertificateRevocationList.signature_algorithm_oidr}   c                 C  s   dS r~   r&   rJ   r&   r&   r'   r     s    z8CertificateRevocationList.signature_algorithm_parametersr   c                 C  s   dS )zC
        Returns the X509Name with the issuer of this CRL.
        Nr&   rJ   r&   r&   r'   ru     s    z CertificateRevocationList.issuerdatetime.datetime | Nonec                 C  s   dS )z?
        Returns the date of next update for this CRL.
        Nr&   rJ   r&   r&   r'   next_update  s    z%CertificateRevocationList.next_updatec                 C  s   dS )zc
        Returns the date of next update for this CRL as a non-naive UTC
        datetime.
        Nr&   rJ   r&   r&   r'   next_update_utc  s    z)CertificateRevocationList.next_update_utcr7   c                 C  s   dS )z?
        Returns the date of last update for this CRL.
        Nr&   rJ   r&   r&   r'   last_update  s    z%CertificateRevocationList.last_updatec                 C  s   dS )zc
        Returns the date of last update for this CRL as a non-naive UTC
        datetime.
        Nr&   rJ   r&   r&   r'   last_update_utc  s    z)CertificateRevocationList.last_update_utcr   c                 C  s   dS )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr&   rJ   r&   r&   r'   r/     s    z$CertificateRevocationList.extensionsc                 C  s   dS r   r&   rJ   r&   r&   r'   r     s    z#CertificateRevocationList.signaturec                 C  s   dS )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr&   rJ   r&   r&   r'   tbs_certlist_bytes  s    z,CertificateRevocationList.tbs_certlist_bytesrM   rN   rO   c                 C  s   dS r   r&   rS   r&   r&   r'   rT     s    z CertificateRevocationList.__eq__c                 C  s   dS )z<
        Number of revoked certificates in the CRL.
        Nr&   rJ   r&   r&   r'   r^     s    z!CertificateRevocationList.__len__r   )idxr   c                 C  s   d S r    r&   r#   r   r&   r&   r'   r`     s    z%CertificateRevocationList.__getitem__slicelist[RevokedCertificate]c                 C  s   d S r    r&   r   r&   r&   r'   r`     s    zint | slicez-RevokedCertificate | list[RevokedCertificate]c                 C  s   dS )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr&   r   r&   r&   r'   r`     s    z#typing.Iterator[RevokedCertificate]c                 C  s   dS )z8
        Iterator over the revoked certificates
        Nr&   rJ   r&   r&   r'   r_   	  s    z"CertificateRevocationList.__iter__r   )rp   r   c                 C  s   dS )zQ
        Verifies signature of revocation list against given public key.
        Nr&   )r#   rp   r&   r&   r'   is_signature_valid  s    z,CertificateRevocationList.is_signature_validN)r)   r*   r+   r   r   r   rl   r   rW   rz   r|   r   ru   r   r   r   r   r/   r   r   rT   r^   typingoverloadr`   r_   r   r&   r&   r&   r'   r     sj   r   c                   @  sN  e Zd ZejdddddZejdddd	Zejd
dddZeejddddZ	eejddddZ
eejddddZeejddddZeejddddZeejddddZejdd d!d"d#Zeejd dd$d%Zeejd dd&d'Zeejddd(d)Zejdd d*d+d,Zd-S ).CertificateSigningRequestrM   rN   rO   c                 C  s   dS r   r&   rS   r&   r&   r'   rT     s    z CertificateSigningRequest.__eq__rD   rI   c                 C  s   dS r   r&   rJ   r&   r&   r'   rV   "  s    z"CertificateSigningRequest.__hash__r   c                 C  s   dS ro   r&   rJ   r&   r&   r'   rp   (  s    z$CertificateSigningRequest.public_keyr   c                 C  s   dS rv   r&   rJ   r&   r&   r'   rw   .  s    z!CertificateSigningRequest.subjectrx   c                 C  s   dS ry   r&   rJ   r&   r&   r'   rz   5  s    z2CertificateSigningRequest.signature_hash_algorithmr   c                 C  s   dS r{   r&   rJ   r&   r&   r'   r|   ?  s    z1CertificateSigningRequest.signature_algorithm_oidr}   c                 C  s   dS r~   r&   rJ   r&   r&   r'   r   F  s    z8CertificateSigningRequest.signature_algorithm_parametersr   c                 C  s   dS )z@
        Returns the extensions in the signing request.
        Nr&   rJ   r&   r&   r'   r/   O  s    z$CertificateSigningRequest.extensionsrX   c                 C  s   dS )z/
        Returns an Attributes object.
        Nr&   rJ   r&   r&   r'   r4   V  s    z$CertificateSigningRequest.attributesr   rC   r   c                 C  s   dS )z;
        Encodes the request to PEM or DER format.
        Nr&   r   r&   r&   r'   r   ]  s    z&CertificateSigningRequest.public_bytesc                 C  s   dS r   r&   rJ   r&   r&   r'   r   c  s    z#CertificateSigningRequest.signaturec                 C  s   dS )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr&   rJ   r&   r&   r'   tbs_certrequest_bytesj  s    z/CertificateSigningRequest.tbs_certrequest_bytesc                 C  s   dS )z8
        Verifies signature of signing request.
        Nr&   rJ   r&   r&   r'   r   r  s    z,CertificateSigningRequest.is_signature_validr[   c                 C  s   dS )z:
        Get the attribute value for a given OID.
        Nr&   )r#   r   r&   r&   r'   r]   y  s    z/CertificateSigningRequest.get_attribute_for_oidN)r)   r*   r+   r   r   rT   rV   rp   rW   rw   rz   r|   r   r/   r4   r   r   r   r   r]   r&   r&   r&   r'   r     sJ   r   c                   @  s   e Zd Zdg g fddddddZdd d	d
dZddd dddZdddddd dddZd!dddddddddd ZdS )" CertificateSigningRequestBuilderNName | Noner-   r3   )subject_namer/   r4   c                 C  s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   rZ   )r#   r   r/   r4   r&   r&   r'   r"     s    	z)CertificateSigningRequestBuilder.__init__r   namer   c                 C  s4   t |tstd| jdur$tdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rQ   r   	TypeErrorr   r0   r   r   rZ   r#   r   r&   r&   r'   r     s    


z-CertificateSigningRequestBuilder.subject_namer   rN   extvalcriticalr   c                 C  sF   t |tstdt|j||}t|| j t| jg | j|| j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rQ   r   r   r   r   r2   r   r   r   rZ   r#   r   r   r.   r&   r&   r'   add_extension  s    
z.CertificateSigningRequestBuilder.add_extension)_tagr   rC   z_ASN1Type | None)r   rE   r   r   c                C  s~   t |tstdt |ts$td|dur>t |ts>tdt|| j |durZ|j}nd}t| j	| j
g | j|||fS )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rQ   r   r   rC   r   r6   rZ   rE   r   r   r   )r#   r   rE   r   tagr&   r&   r'   add_attribute  s    


z.CertificateSigningRequestBuilder.add_attributersa_paddingr   _AllowedHashTypes | None
typing.Any%padding.PSS | padding.PKCS1v15 | Noner   private_keyri   backendr   r   c                C  sX   | j du rtd|durHt|tjtjfs4tdt|tjsHtdt	
| |||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subjectPadding must be PSS or PKCS1v15&Padding is only supported for RSA keys)r   r0   rQ   r   PSSPKCS1v15r   r   RSAPrivateKey	rust_x509Zcreate_x509_csrr#   r   ri   r   r   r&   r&   r'   sign  s    
z%CertificateSigningRequestBuilder.sign)N)r)   r*   r+   r"   r   r   r   r   r&   r&   r&   r'   r     s   $ r   c                
   @  s   e Zd ZU ded< ddddddg fddddddddd	d
dZdd dddZdd dddZdd dddZdd dddZdd dddZ	dd dddZ
d d!d d"d#d$Zd.dd%d&d'd(d)d*d+d,d-ZdS )/CertificateBuilderr-   r   Nr   z CertificatePublicKeyTypes | None
int | Noner   r   )issuer_namer   rp   rm   rq   rs   r/   r   c                 C  s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r    )
ra   rc   _version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r#   r   r   rp   rm   rq   rs   r/   r&   r&   r'   r"     s    
zCertificateBuilder.__init__r   r   c                 C  sD   t |tstd| jdur$tdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rQ   r   r   r   r0   r   r   r   r   r   r   r   r   r&   r&   r'   r     s    

zCertificateBuilder.issuer_namec                 C  sD   t |tstd| jdur$tdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rQ   r   r   r   r0   r   r   r   r   r   r   r   r   r&   r&   r'   r     s    

zCertificateBuilder.subject_namer   )keyr   c              	   C  s`   t |tjtjtjtjt	j
tjtjfs.td| jdur@tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rQ   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyr
   ZEd25519PublicKeyr	   ZEd448PublicKeyr   ZX25519PublicKeyr   ZX448PublicKeyr   r   r0   r   r   r   r   r   r   r   )r#   r   r&   r&   r'   rp   /  s2    
zCertificateBuilder.public_keyrD   numberr   c                 C  sh   t |tstd| jdur$td|dkr4td| dkrHtdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rQ   rD   r   r   r0   
bit_lengthr   r   r   r   r   r   r   r#   r   r&   r&   r'   rm   T  s&    

z CertificateBuilder.serial_numberr7   r8   c                 C  sz   t |tjstd| jdur&tdt|}|tk r>td| jdurZ|| jkrZtdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rQ   r=   r   r   r0   rA   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r#   r9   r&   r&   r'   rq   o  s,    
z#CertificateBuilder.not_valid_beforec                 C  sz   t |tjstd| jdur&tdt|}|tk r>td| jdurZ|| jk rZtdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rQ   r=   r   r   r0   rA   r   r   r   r   r   r   r   r   r   r&   r&   r'   rs     s2    
z"CertificateBuilder.not_valid_afterr   rN   r   c              	   C  sV   t |tstdt|j||}t|| j t| j| j	| j
| j| j| jg | j|S )z=
        Adds an X.509 extension to the certificate.
        r   )rQ   r   r   r   r   r2   r   r   r   r   r   r   r   r   r   r&   r&   r'   r     s    
z CertificateBuilder.add_extensionr   r   r   r   r   rf   r   c                C  s   | j du rtd| jdu r$td| jdu r6td| jdu rHtd| jdu rZtd| jdu rltd|durt|tj	tj
fstdt|tjstd	t| |||S )
zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyr   r   )r   r0   r   r   r   r   r   rQ   r   r   r   r   r   r   r   Zcreate_x509_certificater   r&   r&   r'   r     s(    





zCertificateBuilder.sign)N)r)   r*   r+   __annotations__r"   r   r   rp   rm   rq   rs   r   r   r&   r&   r&   r'   r     s(   
%  r   c                   @  s   e Zd ZU ded< ded< dddg g fddddddd	d
Zdd dddZdd dddZdd dddZddd dddZdd dddZ	d(ddd d!d"d#d$d%d&d'Z
dS )) CertificateRevocationListBuilderr-   r   r   _revoked_certificatesNr   r   )r   r   r   r/   revoked_certificatesc                 C  s"   || _ || _|| _|| _|| _d S r    )r   _last_update_next_updater   r   )r#   r   r   r   r/   r   r&   r&   r'   r"     s
    z)CertificateRevocationListBuilder.__init__r   )r   r   c                 C  s<   t |tstd| jd ur$tdt|| j| j| j| j	S )Nr   r   )
rQ   r   r   r   r0   r   r   r   r   r   )r#   r   r&   r&   r'   r     s    

z,CertificateRevocationListBuilder.issuer_namer7   )r   r   c                 C  sr   t |tjstd| jd ur&tdt|}|tk r>td| jd urZ|| jkrZtdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rQ   r=   r   r   r0   rA   r   r   r   r   r   r   )r#   r   r&   r&   r'   r     s(    
z,CertificateRevocationListBuilder.last_update)r   r   c                 C  sr   t |tjstd| jd ur&tdt|}|tk r>td| jd urZ|| jk rZtdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)rQ   r=   r   r   r0   rA   r   r   r   r   r   r   )r#   r   r&   r&   r'   r   #  s(    
z,CertificateRevocationListBuilder.next_updater   rN   r   c                 C  sN   t |tstdt|j||}t|| j t| j| j	| j
g | j|| jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rQ   r   r   r   r   r2   r   r   r   r   r   r   r   r&   r&   r'   r   ;  s    
z.CertificateRevocationListBuilder.add_extensionr   )revoked_certificater   c                 C  s4   t |tstdt| j| j| j| jg | j|S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rQ   r   r   r   r   r   r   r   r   )r#   r   r&   r&   r'   add_revoked_certificateN  s    
z8CertificateRevocationListBuilder.add_revoked_certificater   r   r   r   r   r   r   c                C  s|   | j d u rtd| jd u r$td| jd u r6td|d urlt|tjtjfsXtdt|t	j
sltdt| |||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timer   r   )r   r0   r   r   rQ   r   r   r   r   r   r   r   Zcreate_x509_crlr   r&   r&   r'   r   _  s    


z%CertificateRevocationListBuilder.sign)N)r)   r*   r+   r   r"   r   r   r   r   r   r   r&   r&   r&   r'   r     s"   
 r   c                   @  sj   e Zd Zddg fddddddZdd d	d
dZdd dddZddd dddZddddddZdS )RevokedCertificateBuilderNr   r   r-   r   c                 C  s   || _ || _|| _d S r    r   r   r&   r&   r'   r"   |  s    z"RevokedCertificateBuilder.__init__rD   r   c                 C  sX   t |tstd| jd ur$td|dkr4td| dkrHtdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	rQ   rD   r   r   r0   r   r   r   r   r   r&   r&   r'   rm     s    


z'RevokedCertificateBuilder.serial_numberr7   r8   c                 C  sN   t |tjstd| jd ur&tdt|}|tk r>tdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rQ   r=   r   r   r0   rA   r   r   r   r   r   r&   r&   r'   r     s    

z)RevokedCertificateBuilder.revocation_dater   rN   r   c                 C  sF   t |tstdt|j||}t|| j t| j| j	g | j|S )Nr   )
rQ   r   r   r   r   r2   r   r   r   r   r   r&   r&   r'   r     s    
z'RevokedCertificateBuilder.add_extensionr   r   )r   r   c                 C  s:   | j d u rtd| jd u r$tdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r0   r   r   r   r   )r#   r   r&   r&   r'   build  s    

zRevokedCertificateBuilder.build)N)r)   r*   r+   r"   rm   r   r   r   r&   r&   r&   r'   r   {  s   
r   rD   rI   c                   C  s   t tddd? S )N   bigr   )rD   
from_bytesosurandomr&   r&   r&   r'   random_serial_number  s    r   )N
__future__r   r   r=   r   r   r   Zcryptographyr   Z"cryptography.hazmat.bindings._rustr   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r	   r
   r   r   r   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   r   r   Zcryptography.x509.extensionsr   r   r   r   Zcryptography.x509.namer   r   Zcryptography.x509.oidr   r   UnionSHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypes	Exceptionr   r2   r6   rA   rB   rX   Enumra   rd   ABCMetarf   registerr   r   r   r   Zload_pem_x509_certificateZload_der_x509_certificateZload_pem_x509_certificatesZload_pem_x509_csrZload_der_x509_csrZload_pem_x509_crlZload_der_x509_crlr   r   r   r   r   r&   r&   r&   r'   <module>   st   (


$  " fe v I