jE @dZddlZddlZddlZddlmZddlmZmZm Z m Z m Z m Z ddl mZmZmZmZddlmZddlmZmZddlmZdd lmZdd lmZmZmZmZm Z dd l!m"Z"dd l#m$Z$dd l%m&Z&gdZ'ej(e)Z*Gdde+Z,Gdde,Z-Gdde,Z.dZ/Gdde0Z1Gdde+Z2de eej3de4fdZ5de eej3de4fdZ6de eej3de4fdZ7dej8d ej9fd!Z: d>dej8d ej;fd#Zffd%Z?d&e ej@ejAfdej8d eBfd'ZCGd(d)e$ZDGd*d+eDZEd,ed e4fd-ZFdej8d.e4d ejGfd/ZHed01Gd2d3ZId4ejJfd5ZKd6ZLd7ejMd ejNfd8ZOd7ejMd eIfd9ZPe"jQfd:ed;eeRd`_. N) dataclass)IOIterableListOptionalTupleUnion)algoscmstspx509)SignedDigestAlgorithm)hashes serialization)padding) RSAPublicKey)load_cert_from_pemderload_certs_from_pemderload_certs_from_pemder_dataload_private_key_from_pemder!load_private_key_from_pemder_data)misc)FormFillingError)get_pyca_cryptography_hash)CMSExtractionErrorCMSStructuralErrorMultivaluedAttributeErrorNonexistentAttributeErrorSignedDataCerts SigningErrorUnacceptableSignerErrorValueErrorWithMessageas_signing_certificateas_signing_certificate_v2byte_range_digestcheck_ess_certidextract_certificate_infoextract_signer_infofind_cms_attributefind_cms_attribute_iterfind_unique_cms_attributeget_cms_hash_algo_for_mechanismrrrrrmatch_issuer_serialoptimal_pss_paramssimple_cms_attributec"eZdZdZfdZxZS)r"z Value error with a failure message attribute that can be conveniently extracted, instead of having to rely on extracting exception args generically. crt||_t|dSN)strfailure_messagesuper__init__)selfr4 __class__s c/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/sign/general.pyr6zValueErrorWithMessage.__init__Gs1"?33 ))))))__name__ __module__ __qualname____doc__r6 __classcell__)r8s@r9r"r"@sB *********r:r"ceZdZdZdS)rz!Structural error in a CMS object.Nr;r<r=r>r:r9rrLs++++r:rceZdZdS)rNr;r<r=rBr:r9rrPDr:rcVtjtj||fdS)a Convenience method to quickly construct a CMS attribute object with one value. :param attr_type: The attribute type, as a string or OID. :param value: The value. :return: A :class:`.cms.CMSAttribute` object. )typevalues)r CMSAttributeCMSAttributeType) attr_typevalues r9r/r/Ts1  %i00UHEE  r:ceZdZdS)rNrDrBr:r9rrerEr:rceZdZdS)rNrDrBr:r9rrirEr:rattrsnamectjdttt ||}|r|St d|d)a .. deprecated:: 0.35.0 Find and return CMS attribute values of a given type. :param attrs: The :class:`.cms.CMSAttributes` object. :param name: The attribute type as a string (as defined in ``asn1crypto``). :return: The values associated with the requested type, if present. :raise NonexistentAttributeError: Raised when no such type entry could be found in the :class:`.cms.CMSAttributes` object. z/Deprecated in favour of find_cms_attribute_iterUnable to locate attribute .)warningswarnDeprecationWarninglistr*r)rOrP found_valuess r9r)r)msa" M9 /t<<==LO'(Md(M(M(MNNNr:c#ZK|r$|D]#}|dj|kr|dEd{V"dSdS)a .. versionadded:: 0.35.0 Find and return CMS attribute values of a given type in a generator. .. note:: This function will return an empty generator rather than throwing :class:`.NonexistentAttributeError`. :param attrs: The :class:`.cms.CMSAttributes` object. :param name: The attribute type as a string (as defined in ``asn1crypto``). :return: The values associated with the requested type, if present. rGrHN)native)rOrPattrs r9r*r*sb& * * *DF|"d**>)))))))** * *r:ct||} t|}n!#t$rtd|dwxYw t|t d|d#t$r|cYSwxYw)a  Find and return a unique CMS attribute value of a given type. :param attrs: The :class:`.cms.CMSAttributes` object. :param name: The attribute type as a string (as defined in ``asn1crypto``). :return: The value associated with the requested type, if present. :raise NonexistentAttributeError: Raised when no such type entry could be found in the :class:`.cms.CMSAttributes` object. :raise MultivaluedAttributeError: Raised when the attribute's cardinality is not 1. rRrSzExpected single-valued z attribute, but found multiple)r*next StopIterationrr)rOrPgenresults r9r+r+s& "% . .COc OOO'(Md(M(M(MNNNO S ' Jd J J J     s"A"A&& A54A5certreturnc tjdtjtj|tjd|j ig|ddddgiS)a Format an ASN.1 ``SigningCertificate`` object, where the certificate is identified by its SHA-1 digest. :param cert: An X.509 certificate. :return: A :class:`tsp.SigningCertificate` object referring to the original certificate. certsdirectory_nametbs_certificate serial_numberissuerrg) cert_hash issuer_serial) r SigningCertificate ESSCertIDhashlibsha1dumpdigestr GeneralNameri)ras r9r#r#s  !  %,\$))++%>%>%E%E%G%G!% 0%5t{$C!"!"' .22C-D /. * *     r:sha256c nt|}tj|}|||}t jdt jd|i|tj d|j ig|ddddgiS)a Format an ASN.1 ``SigningCertificateV2`` value, where the certificate is identified by the hash algorithm specified. :param cert: An X.509 certificate. :param hash_algo: Hash algorithm to use to digest the certificate. Default is SHA-256. :return: A :class:`tsp.SigningCertificateV2` object referring to the original certificate. rd algorithmrerfrgrh)hash_algorithmrjrk) rrHashupdaterpfinalizer SigningCertificateV2 ESSCertIDv2r rrri)ra hash_algo hash_specmd digest_values r9r$r$s$+955I Y  BIIdiikk;;==L  # +6 *B%1!% 0%5t{$C!"!"' .22C-D /. * *     r:certidc~t|tjrd}n|ddj}t |}t j|}||| }|dj}||krdS|d}| pt||S)a Match an ``ESSCertID`` value against a certificate. :param cert: The certificate to match against. :param certid: The ``ESSCertID`` value. :return: ``True`` if the ``ESSCertID`` matches the certificate, ``False`` otherwise. rorvrurjFrk) isinstancer rmrZrrrwrxrpryr-)rarr|r}r~rexpected_digest_valueexpected_issuer_serials r9r&r&s&#-((A +,[9@ *955I Y  BIIdiikk;;==L";/6,,,u/5o/F% % )<**r:rc|dd}|d}t|tjr3t|dks|djdkrdS|dj} ||jkp ||jk}n#t$rd}YnwxYw|o |d|kS)a~ Match the issuer and serial number of an X.509 certificate against some expected identifier. :param expected_issuer_serial: A certificate identifier, either :class:`cms.IssuerAndSerialNumber` or :class:`tsp.IssuerSerial`. :param cert: An :class:`x509.Certificate`. :return: ``True`` if there's a match, ``False`` otherwise. rfrgrirreF) rr GeneralNameslenrPchosenrpri ValueError)rra serial_asn1expected_issuer issuer_matchs r9r-r-6s&()/:K,X6O /4#4554  A % %q!&*:::5)!,3  " "dk&6&6&8&8 8 .$+-     O/@KOs%:B B/.B/ceZdZdZdS)r z1 Error encountered while signing a file. NrArBr:r9r r jsr:r ceZdZdZdS)r!z= Error raised when a signer was judged unacceptable. NrArBr:r9r!r!ps Dr:r!mechc>|j}|dkrdS|dkrdS|jS)a% Internal function that takes a :class:`.SignedDigestAlgorithm` instance and returns the name of the digest algorithm that has to be used to compute the ``messageDigest`` attribute. :param mech: A signature mechanism. :return: A digest algorithm name. ed25519sha512ed448shake256)signature_algor|)rsig_algos r9r,r,xs4"H9x W  z~r:digest_algorithmc |}tj|j}t |t stdt|t|}tj ||}tj tjd|itjdtjd|id|dS)a" Figure out the optimal RSASSA-PSS parameters for a given certificate. The subject's public key must be an RSA key. :param cert: An RSA X.509 certificate. :param digest_algorithm: The digest algorithm to use. :return: RSASSA-PSS parameters. z&Expected RSA key, but got key of type rumgf1)ru parameters)rvmask_gen_algorithm salt_length)lowerrload_der_public_key public_keyrprrr rGrrcalculate_max_pss_salt_lengthr RSASSAPSSParamsDigestAlgorithmMaskGenAlgorithm)rarkeyr~optimal_salt_lens r9r.r.s(--//  +DO,@,@,B,B C CC c< ( (QODIIOOPPP #$4 5 5Br Certificate__annotations__rr AttributeCertificateV2rBr:r9rrsg!!!!d&''''#45555r:rsidcjdkrfdSjdkr+jjtdfdSt )Nissuer_and_serial_numberc.tj|Sr2)r-r)crs r9z'_get_signer_predicate..s,SZ;;r:subject_key_identifierzThe signature in this SignedData value seems to be identified by a subject key identifier --- this is legal in CMS, but many PDF viewers and SDKs do not support this feature.c|jkSr2)key_identifier)rskis r9rz'_get_signer_predicate..s)S0r:)rPrrZloggerwarningNotImplementedError)rrs`@r9_get_signer_predicatersm x---;;;;; - - -j <   10000 r:ct|d}d}g}|D]%}||r|}||&|td||fS)Nrz,signer certificate not included in signature)rappendr)rd signer_info predicaterarrs r9_partition_certsrs| &k%&899I DK "" 9Q<< "DD   q ! ! ! ! | !OPPP  r: signed_datacV |d\}|S#t$rtdwxYw)a5 Extract the unique ``SignerInfo`` entry of a CMS signed data value, or throw a ``ValueError``. :param signed_data: A CMS ``SignedData`` value. :return: A CMS ``SignerInfo`` value. :raises ValueError: If the number of ``SignerInfo`` values is not exactly one. signer_infosz-signer_infos should contain exactly one entry)rr)rrs r9r(r(sI $^4     ;    s (c@g}g}|dD]\}|j}|jdkr||<|jdkr||]t |}t ||\}}t |||}|S)a Extract and classify embedded certificates found in the ``certificates`` field of the signed data value. :param signed_data: A CMS ``SignedData`` value. :return: A :class:`SignedDataCerts` object containing the embedded certificates. certificates certificate v2_attr_cert)rrr)runtagrPrr(rr) rrd attr_certsrrarrr cert_infos r9r'r's EJ  ($$x~~ 6] " " LL     V~ % %   d # # #%k22K/{CCK"I r:stream byte_range md_algorithmc.t|}tj|}d}t|}t j|D]7\}} ||t j|||| || z }8||fS)a  Internal API to compute byte range digests. Potentially dangerous if used without due caution. :param stream: Stream over which to compute the digest. Must support seeking and reading. :param byte_range: The byte range, as a list of (offset, length) pairs, flattened. :param md_algorithm: The message digest algorithm to use. :param chunk_size: The I/O chunk size to use. :return: A tuple of the total digested length, and the actual digest. r)max_read) rrrw bytearrayr pair_iterseekchunked_digestry) rrr chunk_sizemd_specr~ total_len chunk_buflo chunk_lens r9r%r%"s,)66G W  B I*%%I 33 I B IvrIFFFFY bkkmm ##r:)rs)Ur>rnloggingrT dataclassesrtypingrrrrrr asn1cryptor r r r asn1crypto.algosrcryptography.hazmat.primitivesrr)cryptography.hazmat.primitives.asymmetricr-cryptography.hazmat.primitives.asymmetric.rsar pyhanko.keysrrrrrpyhanko.pdf_utilsrpyhanko.pdf_utils.miscrpyhanko_certvalidator.utilr__all__ getLoggerr;rrr"rrr/KeyErrorrrrIr3r)r*r+rrlr#rzr$rmr{r&IssuerAndSerialNumber IssuerSerialboolr-r r!r,rr.rSignerIdentifierrr SignedData SignerInfor(r'DEFAULT_CHUNK_SIZEintbytesr%rBr:r9rs!!!!!!================,,,,,,,,,,,,222222@@@@@@@@======FFFFFF#"""""333333AAAAAA   <  8 $ $ * * * * *J * * *,,,,,.,,,     .   "                Ohx0@'ABO#OOOO:* HS-. /*7:****2 HS-. /7:D !1 c6L    H'/++  +++++\  $)#-*H$I@1!#";S=M"MN1  1 1111h#      l   *?C.&  &.1& &&&&R $* s3     $ S^     *#._B& #$#$ #$ #$#$  3: #$#$#$#$#$#$r: