j`ddlZddlZddlmZddlmZddlmZmZddl m Z ddl m Z ddl mZddlmZdd lmZmZdd lmZdd lmZdd lmZdd lmZddlmZddlmZddl m!Z!m"Z"ddl#m$Z$ddl%m&Z&ddl'm(Z(m)Z)ddl*m+Z+gdZ,ddl-m.Z.ddl/m0Z0ej1e2Z3eGddZ4dZ5GddZ6 d'd!e+d"e"fd#Z7d d$d dd ej8d$fd!e+d"e"d%e9fd&Z:dS)(N) dataclass)field)IterableOptional)crl)ocsp)x509) Certificate)genericmisc)pdf_name)IncrementalPdfFileWriter) get_and_apply) PdfHandler)BasePdfFileWriter)extract_tst_data_iter)CertificateValidatorValidationContext)ValidationPath)extract_certificate_info)NoDSSFoundErrorValidationInfoReadingError)EmbeddedPdfSignature)VRIDocumentSecurityStoreasync_add_validation_infocollect_validation_infoenumerate_ocsp_certs)SerialisedCredential) PdfFileReaderceZdZUdZeeZeed< eeZeed< eeZ eed< de j fdZ dS) raA VRI dictionary as defined in PAdES / ISO 32000-2. These dictionaries collect data that may be relevant for the validation of a specific signature. .. note:: The data are stored as PDF indirect objects, not asn1crypto values. In particular, values are tied to a specific PDF handler. )default_factorycertsocspscrlsreturncxtjtdtdi}|jr)tj|j|td<|jr)tj|j|td<tj|j|td<|S)zT :return: A PDF dictionary representing this VRI entry. z/Type/VRIz/OCSPz/CRLz/Cert)r DictionaryObjectr r' ArrayObjectr(r&)selfvris j/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/sign/validation/dss.py as_pdf_objectzVRI.as_pdf_objectBs &(9(98F;K;K'LMM : E%,%8%D%DC!! " 9 C$+$7 $B$BC  !!(!4TZ!@!@HW   N) __name__ __module__ __qualname____doc__ data_fieldsetr&__annotations__r'r(r r,r1r2r0rr'sC000E3000C000E3000 3///D#/// w7      r2rc#K|dj}|dkr6|d}|djdkr|dj}|dEd{VdSdSdS) zJ Essentially nabbed from _extract_ocsp_certs in ValidationContext response_status successfulresponse_bytes response_typebasic_ocsp_responseresponser&N)nativeparsed) ocsp_responsestatusr>rAs r0r r Ps~ , - 4F &'78 / * 15J J J%j18H( ( ( ( ( ( ( ( ( (  J Jr2c leZdZdZ ddeefdZedZdZ dZ dZ d Z e d ejfd Zd d d d dZdZd eejfdZd efdZeded dfdZeddddddddeded dfdZedddddddddd dededeedefdZdS) rz, Representation of a DSS in Python. Nwritercv||ni|_||ni|_||ng|_||ng|_||_||nt j|_i}|jD] }|j } ||| <!||_ i} |jD] } | j } | | | <!| |_ d|_ dS)NF) vri_entriesr&r'r(rGr r,backing_pdf_object get_objectdata _ocsps_seen _crls_seen _modified) r.rGr&r'r(rIrJ ocsps_seenocsp_ref ocsp_bytes crls_seencrl_ref crl_bytess r0__init__zDocumentSecurityStore.__init__bs+6*A;;r#/UUR #/UUR  ,DD"  "-  )++     . .H!,,..3J%-Jz " "% y + +G**,,1I#*Ii #r2c|jSN)rOr.s r0modifiedzDocumentSecurityStore.modifieds ~r2cv|js/d|_|j#|j|jdSdSdS)NT)rOrJrGupdate_containerrYs r0_mark_modifiedz$DocumentSecurityStore._mark_modifiedsN~ F!DN&2 ,,T-DEEEEE F F22r2c#0K|D]}|} ||V"#t$rb|jt j|}||||<|||VYwxYwdS)N stream_data)dumpKeyErrorrG add_objectr StreamObjectr]append)r.objsseendestobj obj_bytesrefs r0_cms_objects_to_streamsz-DocumentSecurityStore._cms_objects_to_streamss  C I 9o%%%%   k,,(Y???##%%%"%Y C       s 'A)BBc<fd}fd|DS)Nc3@KD]}t|Ed{VdSrX)r )respr's r0 extra_certszADocumentSecurityStore._embed_certs_from_ocsp..extra_certssC 6 6/5555555555 6 6r2c:g|]}|Sr: _embed_cert).0cert_r.s r0 z@DocumentSecurityStore._embed_certs_from_ocsp..s'CCCE  ''CCCr2r:)r.r'rps`` r0_embed_certs_from_ocspz,DocumentSecurityStore._embed_certs_from_ocsps@ 6 6 6 6 6DCCC[[]]CCCCr2c<|jtd |j|jS#t$rYnwxYw|jt j|}| ||j|j<|S)N"This DSS does not support updates.r_) rG TypeErrorr& issuer_serialrbrcr rdrar])r.certrks r0rsz!DocumentSecurityStore._embed_certs ; @AA A :d01 1    D k$$  TYY[[ 9 9 9   ), 4%& s * 77r)ctj|}t d|zS)a Hash the contents of a signature object to get the corresponding VRI identifier. This is internal API. :param contents: Signature contents. :return: A name object to put into the DSS. /)hashlibsha1digesthexupperr )contentsidents r0sig_content_identifierz,DocumentSecurityStore.sig_content_identifiersI X&&--//3355;;==e $$$r2r:r&r'r(cjtdt|}t|}t}t}fd|D}|r.t|jj}|r.t|jj}| t ||\t|||}j | j|<dSdS)a Register validation information for a set of signing certificates associated with a particular signature. :param identifier: Identifier of the signature object (see `sig_content_identifier`). If ``None``, only embed the data into the DSS without associating it with any VRI. :param certs: Certificates to add. :param ocsps: OCSP responses to add. :param crls: CRLs to add. Nryc:h|]}|Sr:rr)rtr|r.s r0 z5DocumentSecurityStore.register_vri..s'>>>T%%d++>>>r2r)rGrzlistr8rlrMr'rNr(updaterwrrcr1rIr]) r. identifierr&r'r( ocsp_refscrl_refs cert_refsr/s ` r0 register_vriz"DocumentSecurityStore.register_vris]" ; @AA AU DzzEE 55>>>>>>>  ,,4+TZI  ,,T4?DINNH T88??@@AAA  !IYXFFFC+/;+A+A!!##,,D Z (    ! ! ! ! ! " !r2c|j}tjt|j|d<|jrtj|j|d<|jr)tj|j|td<|j r)tj|j |td<|S)z Convert the :class:`.DocumentSecurityStore` object to a python dictionary. This method also handles DSS updates. :return: A PDF object representing this DSS. /Certsr+/OCSPs/CRLs) rJr r-rr&valuesrIr,r'r r()r.pdf_dicts r0r1z#DocumentSecurityStore.as_pdf_objects*$0dj6G6G6I6I1J1JKK   J&78HIIHV  : K+2+>tz+J+JHXh'' ( 9 I*1*=di*H*HHXg&& 'r2c#K|jD]3}|}tj|j}|V4dS)z Return a generator that parses and yields all certificates in the DSS. :return: A generator yielding :class:`.Certificate` objects. N)r&rrKr loadrL)r.cert_ref cert_streamr|s r0 load_certsz DocumentSecurityStore.load_certs s^ ))++  H080C0C0E0EK#K$455DJJJJ  r2ct|}|dg}t||z}t|dd}|jD]O}|}t j|j }| |P||d<t|dd}|j D]O} | } tj | j } | | P||d<tdd|i|S)a Construct a validation context from the data in this DSS. :param validation_context_kwargs: Extra kwargs to pass to the ``__init__`` function. :return: A validation context preloaded with information from this DSS. other_certsr'r:r()dictpoprrr'rK asn1_ocsp OCSPResponserrLrer(asn1_crlCertificateListr) r.validation_context_kwargsrpr&r'rQ ocsp_streamror(rT crl_streamrs r0as_validation_contextz+DocumentSecurityStore.as_validation_contextsO%))B$C$C!/33M2FF T__&&''+5.227B??@@   H080C0C0E0EK)..{/?@@D LL    -2!'*-11&"==>>y  G/6/A/A/C/CJ*// @@C KK    ,0!&) PPUP6OPPPr2handlercj |jd}n!#t$r}t|d}~wwxYwi}t|dtg}|D]9}|}t j|j}|||j <:t|dtg} g} | D]O} | } tj | j} | | Pt|dtg}g}|D]O}|}tj|j}| |P t|d}n#t$rd}YnwxYwt!|t"r|}nd}|||| |||}|S) a Read a DSS record from a file and add the data to a validation context. :param handler: PDF handler from which to read the DSS. :return: A DocumentSecurityStore object describing the current state of the DSS. /DSSNr)defaultrrr+)rGr&r'rIr(rJ)rootrbrrrrKr rrLr{rrrerrr isinstancer)clsrdss_dicter cert_ref_listrrr|rr'rQrrorr(rTrrrIrGdsss r0read_dsszDocumentSecurityStore.read_dss5s +|F+HH + + +!## * + %h$KKK % 5 5H080C0C0E0EK + 01A B BD,4Id( ) )!(HdBGGG !  H080C0C0E0EK)..{/?@@D LL     7D"EEE  G/6/A/A/C/CJ*// @@C KK     x/00KK   KKK  g0 1 1 FFF c#'     s"  .). E66 FFTr&r'r(pathsvalidation_context embed_rootspdf_outrc" ||} d} n#t$rd} ||} YnwxYw|t|} nd} dtt jffd } fd} fd}| | | | | | }| r@| |}||j td <| | S) aD Add or update a DSS, and optionally associate the new information with a VRI entry tied to a signature object. You can either specify the CMS objects to include directly, or pass them in as output from `pyhanko_certvalidator`. :param pdf_out: PDF writer to write to. :param sig_contents: Contents of the new signature (used to compute the VRI hash), as a hexadecimal string, including any padding. If ``None``, the information will not be added to any VRI dictionary. :param certs: Certificates to include in the VRI entry. :param ocsps: OCSP responses to include in the VRI entry. :param crls: CRLs to include in the VRI entry. :param paths: Validation paths that have been established, and need to be added to the DSS. :param validation_context: Validation context from which to draw OCSP responses and CRLs. :param embed_roots: .. versionadded:: 0.9.0 Option that controls whether the root certificate of each validation path should be embedded into the DSS. The default is ``True``. .. note:: Trust roots are configured by the validator, so embedding them typically does nothing in a typical validation process. Therefore they can be safely omitted in most cases. Nonetheless, embedding the roots can be useful for documentation purposes. .. warning:: This only applies to paths, not the ``certs`` parameter. :return: a :class:`DocumentSecurityStore` object containing both the new and existing contents of the DSS (if any). FT)rGNr)c3~KpdEd{VpdD]*}t|}st||Ed{V+dSNr:)iternext)path path_partsr&rrs r0_certsz:DocumentSecurityStore.supply_dss_in_writer.._certss|{ " " " " " " "  & &!$ZZ "%$$$%%%%%%%%%  & &r2c3BKpdEd{VjEd{VdSdSr)r')r'rsr0_ocspsz:DocumentSecurityStore.supply_dss_in_writer.._ocspssR{ " " " " " " "!--3333333333.-r2c3BKpdEd{VjEd{VdSdSr)r()r(rsr0_crlsz9DocumentSecurityStore.supply_dss_in_writer.._crlssRzr ! ! ! ! ! ! !!--2222222222.-r2rr) rrrrrr r rr1rcrr update_root)rr sig_contentsr&r'r(rrrrcreatedrrrrrdss_refs `````` r0supply_dss_in_writerz*DocumentSecurityStore.supply_dss_in_writersst &,,w''CGG) & & &G#W%%%CCC &  #.EEJJJ &!12 & & & & & & & & 4 4 4 4 4 4  3 3 3 3 3 3  ffhhffhhUUWW    $$&&  "((22G-4GL&)) *    ! ! ! s  ;;F) r&r'r(rr force_writerfile_credentialstrictrrrc t|| } | j| | j| || ||||||| } |s| jr| dSdS)a Wrapper around :meth:`supply_dss_in_writer`. The result is applied to the output stream as an incremental update. :param output_stream: Output stream to write to. :param sig_contents: Contents of the new signature (used to compute the VRI hash), as a hexadecimal string, including any padding. If ``None``, the information will not be added to any VRI dictionary. :param certs: Certificates to include in the VRI entry. :param ocsps: OCSP responses to include in the VRI entry. :param crls: CRLs to include in the VRI entry. :param paths: Validation paths that have been established, and need to be added to the DSS. :param force_write: Force a write even if the DSS doesn't have any new content. :param validation_context: Validation context from which to draw OCSP responses and CRLs. :param embed_roots: .. versionadded:: 0.9.0 Option that controls whether the root certificate of each validation path should be embedded into the DSS. The default is ``True``. .. note:: Trust roots are configured by the validator, so embedding them typically does nothing in a typical validation process. Therefore they can be safely omitted in most cases. Nonetheless, embedding the roots can be useful for documentation purposes. .. warning:: This only applies to paths, not the ``certs`` parameter. :param file_credential: .. versionadded:: 0.13.0 Serialised file credential, to update encrypted files. :param strict: If ``True``, enforce strict validation of the input stream. Default is ``True``. )rNr)rsecurity_handler authenticaterrZwrite_in_place)r output_streamrr&r'r(rrrrrrrrs r0add_dsszDocumentSecurityStore.add_dsss@+=HHH  # /O4O  $ 1 1/ B B B&&  1#'     %#, %  " " $ $ $ $ $ % %r2)NNNNN) r3r4r5r6rrrVpropertyrZr]rlrwrs staticmethodr NameObjectrrr1rr r rrr classmethodrrboolrr"rr:r2r0rr]sj   *+    DXFFF   DDD  %G,> % % %\ %13"2/"/"/"/"/"b* HT%56    Q QQQQ@;z;.E;;;[;z   fff"ff !fff[fP  ! :>M%M%M%M%M%""67M%M%M%M%[M%M%M%r2rF embedded_sigrcKjj}|jstdgfd}||jd{V|s/dD],}t |j|D]}||d{V-S)a Query revocation info for a PDF signature using a validation context, and store the results in a validation context. This works by validating the signer's certificate against the provided validation context, which causes revocation info to be cached for later retrieval. .. warning:: This function does *not* actually validate the signature, but merely checks the signer certificate's chain of trust. :param embedded_sig: Embedded PDF signature to operate on. :param validation_context: Validation context to use. :param skip_timestamp: If the signature has a time stamp token attached to it, also collect revocation information for the timestamp. :return: A list of validation paths. zfRevocation mode is set to soft-fail/tolerant mode; collected revocation information may be incomplete.cKt|}|j}|j}t||}|t d{V}|dS)N)intermediate_certsr) key_usage)r signer_certrrasync_validate_usager8re) signed_data cert_infor|r validatorrrrs r0_validate_signed_dataz6collect_validation_info.._validate_signed_dataTs,[99 $+ ( *1   33cee3DDDDDDDD Tr2N)FT)signed)revinfo_policyrevocation_checking_policy essentialloggerwarningrr signer_info)rrskip_timestamprevinfo_fetch_policyrrtst_signed_datars ` @r0rr-s: )D )  8   E        8 9 99999999 =# = =F#8($$$ = =,+O<<<<<<<<<< = Lr2Trc K|j} |r| jx} }tj|ntj|} t |||d{V} |r-|jd} nd} tj | } || _ t | | || |}|s|jr-|r| nZ| | nD|sB| jdtjt'|| j| tj|| S)aY .. versionadded: 0.9.0 Add validation info (CRLs, OCSP responses, extra certificates) for a signature to the DSS of a document in an incremental update. This is a wrapper around :func:`collect_validation_info`. :param embedded_sig: The signature for which the revocation information needs to be collected. :param validation_context: The validation context to use. :param skip_timestamp: If ``True``, do not attempt to validate the timestamp attached to the signature, if one is present. :param add_vri_entry: Add a ``/VRI`` entry for this signature to the document security store. Default is ``True``. :param output: Write the output to the specified output stream. If ``None``, write to a new :class:`.BytesIO` object. Default is ``None``. :param in_place: Sign the original input stream in-place. This parameter overrides ``output``. :param chunk_size: Chunk size parameter to use when copying output to a new stream (irrelevant if ``in_place`` is ``True``). :param force_write: Force a new revision to be written, even if not necessary (i.e. when all data in the validation context is already present in the DSS). :param embed_roots: Option that controls whether the root certificate of each validation path should be embedded into the DSS. The default is ``True``. .. note:: Trust roots are configured by the validator, so embedding them typically does nothing in a typical validation process. Therefore they can be safely omitted in most cases. Nonetheless, embedding the roots can be useful for documentation purposes. :return: The (file-like) output object to which the result was written. )rNascii)rrrr)readerstreamr !assert_writable_and_random_accessprepare_rw_output_streamr pkcs7_contentrencoder from_reader IO_CHUNK_SIZErrrZrwriteseek chunked_write bytearrayfinalise_output)rrr add_vri_entryin_placeoutputr chunk_sizerrworking_outputrrr resulting_dsss r0rrksp)/F ?"(-/ .v66666v>>)(      E#15577>>wGG  &26::G&G)>>- ?M Qm, Q  *  " " $ $ $ $ MM. ) ) ) ) Q  1 9Z00&-PPP   7 77r2)F);rlogging dataclassesrrr7typingrr asn1cryptorrrrr asn1crypto.x509r pyhanko.pdf_utilsr r pyhanko.pdf_utils.genericr $pyhanko.pdf_utils.incremental_writerrpyhanko.pdf_utils.miscrpyhanko.pdf_utils.rw_commonrpyhanko.pdf_utils.writerr#pyhanko.sign.validation.generic_cmsrpyhanko_certvalidatorrrpyhanko_certvalidator.pathrgeneralrerrorsrr pdf_embeddedr__all__pdf_utils.cryptr"pdf_utils.readerr# getLoggerr3rrr rrDEFAULT_CHUNK_SIZErrr:r2r0rs!!!!!!++++++%%%%%%%%&&&&&&((((((''''''++++++++......IIIIII000000222222666666EEEEEEIIIIIIII555555......????????......   433333------  8 $ $ %%%%%%% %P ) ) )M%M%M%M%M%M%M%M%f;;&;);;;;B  &c8c8&c8)c8c8c8c8c8c8c8r2