§
    ¥”jœ‡  ã                   óô  — d dl Z d dlZd dlmZ d dlmZ d dlmZmZmZm	Z	 d dl
mZmZ d dlmZmZ d dlmZ d dlmZmZ d d	lmZmZmZmZmZ d d
lmZmZmZmZm Z m!Z! d dl"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z, d dl-m.Z. ddl/m0Z0m1Z1 ddl2m3Z3 ddl4m5Z5m6Z6m7Z7 ddl8m9Z9 g d¢Z: e j;        e<¦  «        Z=deej>                 fd„Z?dee         fd„Z@dej>        deAfd„ZB G d„ d¦  «        ZC edddg¦  «        ZD	 dedeeD         fd „ZEd!eCfd"„ZFd#eCd$e.d%eGfd&„ZHd'„ ZI	 	 	 	 	 	 	 d3d#eCd)ee,         d*ee,         d+ee,         d,ee         d-ee3         d.eGd/ee9         de6fd0„ZJ	 	 	 d4d#eCd1ee,         d,ee         d.eGde5f
d2„ZKdS )5é    N)Ú
namedtuple)Údatetime)ÚDictÚListÚOptionalÚUnion)ÚcmsÚx509)ÚgenericÚmisc)Úpdf_name)ÚPdfFileReaderÚprocess_data_at_eof)ÚDEFAULT_DIFF_POLICYÚ
DiffPolicyÚ
DiffResultÚModificationLevelÚSuspiciousModification)ÚFieldMDPSpecÚMDPPermÚSeedLockDocumentÚSigSeedSubFilterÚSigSeedValFlagsÚSigSeedValueSpec)ÚMultivaluedAttributeErrorÚNonexistentAttributeErrorÚSignedDataCertsÚUnacceptableSignerErrorÚbyte_range_digestÚextract_signer_info)Úgeneric_cms)ÚValidationContext)ÚValidationPathé   )ÚSignatureValidationErrorÚSigSeedValueValidationError)ÚKeyUsageConstraints)ÚDocumentTimestampStatusÚPdfSignatureStatusÚSignatureCoverageLevel)ÚCMSAlgorithmUsagePolicy)Ú
DocMDPInfoÚEmbeddedPdfSignatureÚasync_validate_pdf_signatureÚasync_validate_pdf_timestampÚextract_contentsÚread_certification_dataÚreport_seed_value_validationÚreturnc                 óŽ   — 	 | d         }n# t           $ r Y d S w xY w|D ]&}|                     ¦   «         }|d         |k    r|c S Œ'd S )Nz
/Referencez/TransformMethod)ÚKeyErrorÚ
get_object)Úsignature_objÚmethodÚsig_refsÚrefs       ús/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/sign/validation/pdf_embedded.pyÚ_extract_reference_dictr<   @   sw   € ðØ  Ô.ˆˆøÝð ð ð Øˆtˆtðøøøàð ð ˆØ�nŠnÑÔˆØÐ!Ô" fÒ,Ð,ØˆJˆJˆJð -àˆ4s   ‚ ‹
˜c                 óÒ   — t          | d¦  «        }|€d S 	 |d                              d¦  «        }t          |¦  «        S # t          t          f$ r}t          d¦  «        |‚d }~ww xY w)Nú/DocMDPú/TransformParamsú/Pz#Failed to read document permissions)r<   Úraw_getr   Ú
ValueErrorr5   r%   )r7   r:   Ú	raw_permsÚes       r;   Ú_extract_docmdp_for_sigrE   N   sƒ   € Ý
! -°Ñ
;Ô
;€CØ
€{ØˆtðØÐ*Ô+×3Ò3°DÑ9Ô9ˆ	Ý�yÑ!Ô!Ð!øÝ�Ð!ð ð ð Ý&Ø1ñ
ô 
àð	øøøøðøøøs   –)A  Á A&ÁA!Á!A&Ú
sig_objectc                 ó  — 	 |                       dt          j        j        ¬¦  «        }n"# t          $ r t          j        d¦  «        ‚w xY wt          |t          j        t          j	        f¦  «        st          j        d¦  «        ‚|j
        S )zã
    Internal function to extract the (DER-encoded) signature bytes from a PDF
    signature dictionary.

    :param sig_object:
        A signature dictionary.
    :return:
        The extracted contents as a byte string.
    z	/Contents)Údecryptz+Could not read /Contents entry in signaturez/Contents must be string-like)rA   r   ÚEncryptedObjAccessÚRAWr5   r   ÚPdfReadErrorÚ
isinstanceÚTextStringObjectÚByteStringObjectÚoriginal_bytes)rF   Úcms_contents     r;   r0   r0   [   s¤   € ðOØ ×(Ò(Ø¥Ô!;Ô!?ð )ñ 
ô 
ˆˆøõ ð Oð Oð OÝÔÐ MÑNÔNÐNðOøøøõ Ø•gÔ.µÔ0HÐIñô ð Aõ ÔÐ ?Ñ@Ô@Ð@ØÔ%Ð%s	   ‚&) ©Ac                   óJ  — e Zd ZU dZej        ed<   	 ej        ed<   	 ej        ed<   	 de	dej        de
fd„Zdefd	„Zedeej                 fd
„¦   «         Zedeej                 fd„¦   «         Zedej        fd„¦   «         Zedej        fd„¦   «         Zed„ ¦   «         Zedee         fd„¦   «         Zdd„Zdefd„Zedee         fd„¦   «         Z edee!         fd„¦   «         Z"edee#         fd„¦   «         Z$ddee
         de%fd„Z&de'fd„Z(d„ Z)de*de+e,e-f         fd„Z.dS )r-   zA
    Class modelling a signature embedded in a PDF document.
    Ú	sig_fieldrF   Úsigned_dataÚreaderÚfq_namec                 óB  — || _         t          |t          j        ¦  «        r|                     ¦   «         }|| _        |                     d¦  «        }|                     ¦   «         x| _        }t          |t          j        ¦  «        sJ ‚	 |                     d¦  «        | _	        n"# t          $ r t          j        d¦  «        ‚w xY wt          |¦  «        x| _        }t          j                             |¦  «        }|d         }|| _        t'          |¦  «        | _        d | _        | j        d         }	|	d         j                             ¦   «         | _        |d         }
|
d         j        }|d	k    r| j        | _        n1|d
k    r+|
d         j        d         }|d         d         j        | _        | j         j                             |j        ¦  «        | _        d | _        i | _         d | _!        d | _"        dx| _#        | _$        d | _%        d | _&        d| _'        || _(        d S )Nz/Vz
/ByteRangez,Could not read /ByteRange entry in signatureÚcontentÚdigest_algorithmÚ	algorithmÚencap_content_infoÚcontent_typeÚdataÚtst_infoÚmessage_imprintÚhash_algorithmF))rT   rL   r   ÚIndirectObjectr6   rR   rA   rF   ÚDictionaryObjectÚ
byte_ranger5   r   rK   r0   Úpkcs7_contentr	   ÚContentInfoÚloadrS   r    Úsigner_infoÚ_sd_cert_infoÚnativeÚlowerÚmd_algorithmÚexternal_md_algorithmÚparsedÚxrefsÚget_last_changeÚ	referenceÚsigned_revisionÚcoverageÚexternal_digestsÚ_docmdpÚ	_fieldmdpÚ_docmdp_queriedÚ_fieldmdp_queriedÚtst_signature_digestÚdiff_resultÚ_integrity_checkedrU   )ÚselfrT   rR   rU   Úsig_object_refrF   rP   ÚmessagerS   Údigest_algoÚecir[   Úmis                r;   Ú__init__zEmbeddedPdfSignature.__init__‹   s0  € ð ˆŒÝ�i¥Ô!7Ñ8Ô8ð 	/Ø!×,Ò,Ñ.Ô.ˆIØ"ˆŒØ"×*Ò*¨4Ñ0Ô0ˆØ'5×'@Ò'@Ñ'BÔ'BÐBˆŒ˜*Ý˜*¥gÔ&>Ñ?Ô?Ð?Ð?Ð?ð	Ø(×0Ò0°Ñ>Ô>ˆDŒOˆOøÝð 	ð 	ð 	ÝÔ#Ø>ñô ð ð	øøøõ ,<¸JÑ+GÔ+GÐGˆÔ˜[å”/×&Ò& {Ñ3Ô3ˆØ˜iÔ(ˆØ+6ˆÔå.¨{Ñ;Ô;ˆÔØ8<ˆÔð Ô&Ð'9Ô:ˆØ'¨Ô4Ô;×AÒAÑCÔCˆÔØÐ.Ô/ˆØ˜>Ô*Ô1ˆØ˜6Ò!Ð!à)-Ô):ˆDÔ&Ð&Ø˜ZÒ'Ð'ð �Y”Ô&Ð'8Ô9ˆBØ)+Ð,<Ô)=Øô*äð Ô&ð  $œ{Ô0×@Ò@ØÔ$ñ 
ô  
ˆÔð ˆŒØ24ˆÔØ*.ˆŒØ15ˆŒØ8=Ð=ˆÔ˜tÔ5Ø59ˆÔ!àˆÔØ"'ˆÔØˆŒˆˆs   Â
B% Â%Cr3   c                 óZ   — | j         €t          j        | j        ¦  «        | _         | j         S ©N)rg   r!   Úextract_certs_for_validationrS   ©rz   s    r;   Ú_init_cert_infoz$EmbeddedPdfSignature._init_cert_infoÖ   s1   € ØÔÐ%Ý!,Ô!IØÔ ñ"ô "ˆDÔð Ô!Ð!ó    c                 óN   — t          |                      ¦   «         j        ¦  «        S )z2
        Embedded attribute certificates.
        )Úlistr…   Úattribute_certsr„   s    r;   Úembedded_attr_certsz(EmbeddedPdfSignature.embedded_attr_certsÝ   s!   € õ
 �D×(Ò(Ñ*Ô*Ô:Ñ;Ô;Ð;r†   c                 óN   — t          |                      ¦   «         j        ¦  «        S )zQ
        Embedded X.509 certificates, excluding than that of the signer.
        )rˆ   r…   Úother_certsr„   s    r;   Úother_embedded_certsz)EmbeddedPdfSignature.other_embedded_certsä   s!   € õ
 �D×(Ò(Ñ*Ô*Ô6Ñ7Ô7Ð7r†   c                 ó4   — |                       ¦   «         j        S )z,
        Certificate of the signer.
        )r…   Úsigner_certr„   s    r;   r�   z EmbeddedPdfSignature.signer_certë   s   € ð
 ×#Ò#Ñ%Ô%Ô1Ð1r†   c                 óR   — | j                              dt          d¦  «        ¦  «        S )a  
        Returns the type of the embedded signature object.
        For ordinary signatures, this will be ``/Sig``.
        In the case of a document timestamp, ``/DocTimeStamp`` is returned.

        :return:
            A PDF name object describing the type of signature.
        z/Typeú/Sig)rF   Úgetr   r„   s    r;   Úsig_object_typez$EmbeddedPdfSignature.sig_object_typeò   s$   € ð Œ×"Ò" 7­H°VÑ,<Ô,<Ñ=Ô=Ð=r†   c                 ó   — | j         S )zC
        :return:
            Name of the signature field.
        )rU   r„   s    r;   Ú
field_namezEmbeddedPdfSignature.field_nameþ   s   € ð Œ|Ðr†   c                 óº   — t          j        | j        ¦  «        }|�|S 	 | j        d         }t	          j        || j        j        ¬¦  «        S # t          $ r Y dS w xY w)zÜ
        :return:
            The signing time as reported by the signer, if embedded in the
            signature's signed attributes or provided as part of the signature
            object in the PDF document.
        Nz/M)Ústrict)	r!   Úextract_self_reported_tsrf   rF   r   Úparse_pdf_daterT   r—   r5   )rz   ÚtsÚst_as_pdf_dates      r;   Úself_reported_timestampz,EmbeddedPdfSignature.self_reported_timestamp  sz   € õ Ô1°$Ô2BÑCÔCˆØˆ>ØˆIð	Ø!œ_¨TÔ2ˆNÝÔ)Ø t¤{Ô'9ðñ ô ð øõ ð 	ð 	ð 	Ø�4�4ð	øøøs   Ÿ,A Á
AÁANFc                 óà   — |                       ¦   «          |                      ¦   «          |                      ¦   «         | _        |pt          }|s|                      |¦  «        | _        d| _        dS )a«  
        Compute the various integrity indicators of this signature.

        :param diff_policy:
            Policy to evaluate potential incremental updates that were appended
            to the signed revision of the document.
            Defaults to
            :const:`~pyhanko.sign.diff_analysis.DEFAULT_DIFF_POLICY`.
        :param skip_diff:
            If ``True``, skip the difference analysis step entirely.
        TN)Ú_enforce_hybrid_xref_policyÚcompute_digestÚevaluate_signature_coveragerq   r   Úevaluate_modificationsrx   ry   )rz   Údiff_policyÚ	skip_diffs      r;   Úcompute_integrity_infoz+EmbeddedPdfSignature.compute_integrity_info  su   € ð 	×(Ò(Ñ*Ô*Ð*Ø×ÒÑÔÐð ×8Ò8Ñ:Ô:ˆŒØ!Ð8Õ%8ˆØð 	HØ#×:Ò:¸;ÑGÔGˆDÔà"&ˆÔÐÐr†   c                 óL  — | j         st          d¦  «        ‚| j        }| j        }| j        }d}|�Nt          |t          ¦  «        r|j        nt          j	        }|t          j	        k    p|duo|j
        |j
        k     }n |t          j        k    r|t          j        k    }|||dœ}|S )a  
        Compile the integrity information for this signature into a dictionary
        that can later be passed to :class:`.PdfSignatureStatus` as kwargs.

        This method is only available after calling
        :meth:`.EmbeddedPdfSignature.compute_integrity_info`.
        zGCall compute_integrity_info() before invokingsummarise_integrity_info()N)rq   Ú	docmdp_okrx   )ry   r%   Údocmdp_levelrx   rq   rL   r   Úmodification_levelr   ÚOTHERÚvaluer*   ÚENTIRE_REVISIONÚENTIRE_FILE)rz   Údocmdprx   rq   r¦   Ú	mod_levelÚstatus_kwargss          r;   Úsummarise_integrity_infoz-EmbeddedPdfSignature.summarise_integrity_info2  sæ   € ð Ô&ð 	Ý*ð-ñô ð ð
 Ô"ˆØÔ&ˆØ”=ˆØˆ	ð Ð"õ ˜k­:Ñ6Ô6ð-�Ô.Ð.å&Ô,ð ð Õ.Ô4Ò4ð KØ $Ð&ÐI¨9¬?¸V¼\Ò+IðˆIˆIð Õ/Ô?Ò?Ð?ð
 !Õ$:Ô$FÒFˆIð !Ø"Ø&ð
ð 
ˆð
 Ðr†   c                 ój   — 	 | j         d         }n# t          $ r Y d S w xY wt          j        |¦  «        S )Nz/SV)rR   r5   r   Úfrom_pdf_object)rz   Úsig_sv_dicts     r;   Úseed_value_specz$EmbeddedPdfSignature.seed_value_spec_  sH   € ð	Øœ.¨Ô/ˆKˆKøÝð 	ð 	ð 	Ø�4�4ð	øøøåÔ/°Ñ<Ô<Ð<s   ‚ �
�c                 óÔ   — | j         r| j        S t          | j        ¬¦  «        }|€4	 | j        d         }t          |d         ¦  «        }n# t          $ r Y nw xY w|| _        d| _         |S )av  
        :return:
            The document modification policy required by this signature or
            its Lock dictionary.

            .. warning::
                This does not take into account the DocMDP requirements of
                earlier signatures (if present).

                The specification forbids signing with a more lenient DocMDP
                than the one currently in force, so this should not happen
                in a compliant document.
                That being said, any potential violations will still invalidate
                the earlier signature with the stricter DocMDP policy.

        )r7   Nz/Lockr@   T)ru   rs   rE   rF   rR   r   r5   )rz   r­   Ú	lock_dicts      r;   r§   z!EmbeddedPdfSignature.docmdp_levelg  s†   € ð$ Ôð 	 Ø”<ÐÝ(°t´ÐGÑGÔGˆàˆ>ðØ œN¨7Ô3�	Ý  ¨4¤Ñ1Ô1��øÝð ð ð Ø�ðøøøàˆŒØ#ˆÔØˆs   §"A
 Á

AÁAc                 óú   — | j         r| j        S t          | j        d¦  «        }d| _         |€dS 	 t	          j        |d         ¦  «        }n)# t          t          f$ r}t          d¦  «        |‚d}~ww xY w|| _        |S )z¨
        :return:
            Read the field locking policy of this signature, if applicable.
            See also :class:`~.pyhanko.sign.fields.FieldMDPSpec`.
        z	/FieldMDPTNr?   z!Failed to read /FieldMDP settings)	rv   rt   r<   rF   r   r²   rB   r5   r%   )rz   Úref_dictÚsprD   s       r;   ÚfieldmdpzEmbeddedPdfSignature.fieldmdp‡  s¢   € ð Ô!ð 	"Ø”>Ð!Ý*¨4¬?¸KÑHÔHˆØ!%ˆÔØÐØ�4ð	ÝÔ-¨hÐ7IÔ.JÑKÔKˆBˆBøÝ�HÐ%ð 	ð 	ð 	Ý*Ø3ñô àðøøøøð	øøøð ˆŒØˆ	s   °A ÁA1ÁA,Á,A1Ú	hash_algoc                 ó°   — |p| j         }	 | j        |         S # t          $ r Y nw xY wt          | j        j        | j        |¬¦  «        \  }}|| j        |<   |S )z™
        Compute the ``/ByteRange`` digest of this signature.
        The result will be cached.

        :return:
            The digest value.
        )rb   rj   )rk   rr   r5   r   rT   Ústreamrb   )rz   r»   rX   Ú_Údigests        r;   rŸ   z#EmbeddedPdfSignature.compute_digestž  s…   € ð %ÐB¨Ô(BÐð	ØÔ(Ð)9Ô:Ð:øÝð 	ð 	ð 	ØˆDð	øøøõ &ØŒKÔØ”Ø)ð
ñ 
ô 
‰	ˆˆ6ð
 39ˆÔÐ.Ñ/Øˆs   ‹ ˜
%¤%c                 ó:  — | j         j        }| j         j        }t          | j        ¦  «        dk    s| j        d         dk    rt
          j        S | j        \  }}}}|                     dt          j	        ¦  «         t          | j
        ¦  «        dz  dz   }||z   |z   }|                     ¦   «         |k    }	|	rt
          j        S |||z   k    }
|
st
          j        S |                     |¦  «         | j        }	 t          |¦  «        }|                     |¦  «        }||k    rt
          j        S n!# t"          j        $ r t
          j        cY S w xY wt'          |dz   ¦  «        D ]0}|                     |¦  «        }|j        |k    rt
          j        c S Œ1t
          j        S )z˜
        Internal method used to evaluate the coverage level of a signature.

        :return:
            The coverage level of the signature.
        é   r   é   r$   )rT   rm   r½   Úlenrb   r*   ÚUNCLEARÚseekÚosÚSEEK_ENDrc   Útellr¬   rp   r   Úget_startxref_for_revisionÚCONTIGUOUS_BLOCK_FROM_STARTr   rK   ÚrangeÚget_xref_container_infoÚend_locationr«   )rz   Ú
xref_cacher½   r¾   Úlen1Ústart2Úlen2Úembedded_sig_contentÚsigned_zone_lenÚfile_coveredÚ
contiguousÚ
signed_revÚ	startxrefÚexpectedÚrevisionÚ	xref_metas                   r;   r    z0EmbeddedPdfSignature.evaluate_signature_coverageµ  sÐ  € ð ”[Ô&ˆ
ð ”Ô#ˆõ ˆtŒÑÔ 1Ò$Ð$¨¬¸Ô(:¸aÒ(?Ð(?Ý)Ô1Ð1à $¤Ñˆˆ4�˜ð 	�Š�A•r”{Ñ#Ô#Ð#õ  # 4Ô#5Ñ6Ô6¸Ñ:¸QÑ>ÐØ ™+Ð(<Ñ<ˆØ—{’{‘}”}¨Ò7ˆØð 	6Ý)Ô5Ð5ð ˜tÐ&:Ñ:Ò:ˆ
Øð 	2Ý)Ô1Ð1ð 	�Š�OÑ$Ô$Ð$ØÔ)ˆ
ð	FÝ+¨FÑ3Ô3ˆIØ!×<Ò<¸ZÑHÔHˆHØ˜HÒ$Ð$Ý-ÔIÐIð %øåÔ ð 	Fð 	Fð 	FÝ)ÔEÐEÐEÐEð	Føøøõ
 ˜j¨1™nÑ-Ô-ð 	Jð 	JˆHØ"×:Ò:¸8ÑDÔDˆIØÔ%¨Ò7Ð7Ý-ÔIÐIÐIÐIð 8õ &Ô5Ð5s   Ã65D- Ä-EÅ
Ec                 ó\   — | j         }|j        r|j        j        rt	          d¦  «        ‚d S d S )NzJSettings do not permit validation of signatures in hybrid-reference files.)rT   r—   rm   Úhybrid_xrefs_presentr%   )rz   rT   s     r;   rž   z0EmbeddedPdfSignature._enforce_hybrid_xref_policyý  sJ   € Ø”ˆØŒ=ð 	˜Vœ\Ô>ð 	Ý*ð*ñô ð ð	ð 	ð 	ð 	r†   r¢   c                 ó  — | j         t          j        k     rt          d¦  «        S | j         t          j        k    r&t          t          j        t          ¦   «         ¦  «        S | 	                    | j
        | j        | j        | j        ¬¦  «        S )zY
        Internal method used to evaluate the modification level of a signature.
        z$Nonstandard signature coverage level)Úfield_mdp_specÚdoc_mdp)rq   r*   r«   r   r¬   r   r   ÚNONEÚsetÚreview_filerT   rp   rº   r§   )rz   r¢   s     r;   r¡   z+EmbeddedPdfSignature.evaluate_modifications  sˆ   € ð Œ=Õ1ÔAÒAÐAÝ)Ø6ñô ð ð Œ]Õ4Ô@Ò@Ð@ÝÕ/Ô4µc±e´eÑ<Ô<Ð<à×&Ò&ØŒKØÔ Øœ=ØÔ%ð	 'ñ 
ô 
ð 	
r†   )NFr‚   )/Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   ra   Ú__annotations__r	   Ú
SignedDatar   Ústrr€   r   r…   Úpropertyr   ÚAttributeCertificateV2rŠ   r
   ÚCertificater�   r�   Ú
NameObjectr“   r•   r   r   rœ   r¤   Údictr°   r   r´   r   r§   r   rº   ÚbytesrŸ   r*   r    rž   r   r   r   r   r¡   © r†   r;   r-   r-   w   sð  € € € € € € ðð ð Ô'Ð'Ð'Ñ'ðð Ô(Ð(Ð(Ñ(ðð ”ÐÐÑððIàðIð Ô+ðIð ð	Ið Ið Ið IðV" ð "ð "ð "ð "ð ð< T¨#Ô*DÔ%Eð <ð <ð <ñ „Xð<ð ð8 d¨4Ô+;Ô&<ð 8ð 8ð 8ñ „Xð8ð ð2˜TÔ-ð 2ð 2ð 2ñ „Xð2ð ð	> Ô!3ð 	>ð 	>ð 	>ñ „Xð	>ð ðð ñ „Xðð ð¨°(Ô);ð ð ð ñ „Xðð&'ð 'ð 'ð 'ð0+¨$ð +ð +ð +ð +ðZ ð= Ð*:Ô!;ð =ð =ð =ñ „Xð=ð ð˜h wÔ/ð ð ð ñ „Xðð> ð˜( <Ô0ð ð ð ñ „Xðð,ð ¨°¬ð Àð ð ð ð ð.F6Ð-Cð F6ð F6ð F6ð F6ðPð ð ð
Ø%ð
à	ˆzÐ1Ð1Ô	2ð
ð 
ð 
ð 
ð 
ð 
r†   r-   r,   Ú
permissionÚ
author_sigrT   c                 óŒ   — 	 | j         d         d         }n# t          $ r Y dS w xY wt          |¦  «        }t          ||¦  «        S )zî
    Read the certification information for a PDF document, if present.

    :param reader:
        Reader representing the input document.
    :return:
        A :class:`.DocMDPInfo` object containing the relevant data, or ``None``.
    ú/Permsr>   N)Úrootr5   rE   r,   )rT   Úcertification_sigÚperms      r;   r1   r1   "  s_   € ðØ"œK¨Ô1°)Ô<ÐÐøÝð ð ð Øˆtˆtðøøøõ #Ð#4Ñ5Ô5€DÝ�dÐ-Ñ.Ô.Ð.s   ‚ –
$£$Úemb_sigc                 ó:  — | j         }|€d S | j        }|j        �?	 |j                             ||¦  «         n"# t          $ r}t          |¦  «        |‚d }~ww xY w|s|j        rt          d¦  «        ‚| j        }|j        �Ó|j         	                    ¦   «         }	 | j
        j        d         }|                     d¦  «        }	|	|j        k    }
n$# t          t          j        t"          f$ r d}
Y nw xY w||
k    r+d„ }t          d ||¦  «        › d ||
¦  «        › d�¦  «        ‚|r/|j        j        }| j        }||k    rt          d	|› d
|› d�¦  «        ‚|j        }|sd S |d         }t+          |¦  «        }|t,          j        z  rR|j        �K|j        st3          d¦  «        ‚|j        d         }|�&||k    r t          d|j        ›d
|j        ›d�¦  «        ‚|t,          j        z  r!|j        �t:                               d¦  «         |t,          j        z  r|j         �t3          d¦  «        ‚|t,          j!        z  rv|j"        �o| j        }|j"        tF          j$        k    r|tJ          j&        k    rt          d¦  «        ‚|j"        tF          j'        k    r|tJ          j&        k    rt          d¦  «        ‚| j(        }|t,          j)        z  r¥|j*        �ž	 tW          j,        |d         d¦  «         d}n# tZ          t\          f$ r d}Y nw xY w|j*        |k    r#t          d|j*        rdnd›d|rdnd›d�¦  «        ‚|j*        r1|t*          j/        k    r!t          dt*          j/        j        z  ¦  «        ‚|t,          j0        z  r;|j1        �4| j2         3                    ¦   «         }||j1        vrt          d|z  ¦  «        ‚|t,          j4        z  rT|j5        pg }| p|dgk    }| 6                    d¦  «        }|r|�t          d ¦  «        ‚|s||vrt          d!|›d"�¦  «        ‚d S d S d S )#NznThe seed value dictionary requires a trusted timestamp, but none was found, or the timestamp did not validate.rô   r>   Fc                 ó   — | rdndS )Nza certificationzan approvalrð   )Úcertifys    r;   Ú_typez'_validate_sv_constraints.<locals>._typeS  s   € Ø,3ÐFÐ(Ð(¸ÐFr†   zPThe seed value dictionary's /MDP entry specifies that this field should contain z signature, but z appears to have been used.zaThe seed value dictionary specified that this certification signature should use the MDP policy 'z', but 'z' was used in the signature.ú
/SubFilterzPThe signature encodings mandated by the seed value dictionary are not supported.r   z.The seed value dictionary mandates subfilter 'zˆThe signature's seed value dictionary specifies the /AppearanceFilter entry as mandatory, but this constraint is impossible to validate.z�pyHanko does not support legal attestations, but the seed value dictionary mandates that they be restricted to a specific subset.z<Document must be locked, but some changes are still allowed.zGDocument must not be locked, but the DocMDP level is set to NO_CHANGES.Úsigned_attrsÚadobe_revocation_info_archivalTz2The seed value dict mandates that revocation info Ú znot zbe added, but it was zfound in the signature.zdThe seed value dict mandates that Adobe-style revocation info be added; this requires subfilter '%s'zKThe selected message digest %s is not allowed by the seed value dictionary.ú.z/Reasonz@The seed value dictionary prohibits giving a reason for signing.zThe reason for signing "z/" is not accepted by the seed value dictionary.)7r´   r�   ÚcertÚsatisfied_byr   r&   Útimestamp_requiredrF   Úseed_signature_typeÚcertification_signaturerT   rõ   Úget_value_as_referenceÚcontainer_refr5   r   ÚIndirectObjectExpectedÚAttributeErrorÚmdp_permr§   Úflagsr   r   Ú	SUBFILTERÚ
subfiltersÚNotImplementedErrorrª   ÚAPPEARANCE_FILTERÚ
appearanceÚloggerÚwarningÚLEGAL_ATTESTATIONÚlegal_attestationsÚLOCK_DOCUMENTÚlock_documentr   ÚLOCKr   Ú
NO_CHANGESÚDO_NOT_LOCKrf   ÚADD_REV_INFOÚadd_rev_infor!   Úfind_unique_cms_attributer   r   ÚADOBE_PKCS7_DETACHEDÚDIGEST_METHODÚdigest_methodsrj   ri   ÚREASONSÚreasonsr’   )rø   Úvalidation_pathÚtimestamp_foundÚsv_specÚsigning_certrD   Úsig_objÚ
sv_certifyÚpermsÚcert_sig_refÚwas_certifiedrü   Úsv_mdp_permrß   r  Úselected_sf_strÚselected_sfÚmandated_sfrf   Úrevinfo_foundÚselected_mdr"  Ú	must_omitÚreason_givens                           r;   Ú_validate_sv_constraintsr4  4  sÉ  € ð Ô%€GØ€ØˆØÔ&€LØ„|Ðð	8ØŒL×%Ò% l°OÑDÔDÐDÐDøÝ&ð 	8ð 	8ð 	8Ý-¨aÑ0Ô0°aÐ7øøøøð	8øøøð ð 
˜wÔ9ð 
Ý)ðAñ
ô 
ð 	
ð
 Ô €GàÔ"Ð.ØÔ0×HÒHÑJÔJˆ
ð	"Ø.5¬nÔ.AÀ(Ô.KˆEØ ×7Ò7¸	ÑBÔBˆLØ(¨GÔ,AÒAˆMˆMøÝ�'Ô8½.ÐIð 	"ð 	"ð 	"Ø!ˆMˆMˆMð	"øøøà˜Ò&Ð&ðGð Gð Gõ .ð-Ø-2¨U°:Ñ->Ô->ð-ð -à"' %¨Ñ"6Ô"6ð-ð -ð -ñô ð ð ð 		Ø!Ô5Ô>ˆKØÔ*ˆGØ˜gÒ%Ð%Ý1ð-à#ð-ð -à-4ð-ð -ð -ñô ð ð ŒM€EØð Øˆà˜lÔ+€OÝ" ?Ñ3Ô3€KØ•Ô)Ñ)ð ¨wÔ/AÐ/MàÔ!ð 	Ý%ð0ñô ð ð
 )0Ô(:¸1Ô(=ˆØÐ" {°kÒ'AÐ'AÝ-Ð-ð Ô$Ð$Ð$ kÔ&7Ð&7Ð&7ð9ñô ð ð 	•Ô1Ñ1ð
à
Ô
Ð
(Ý�Šð)ñ	
ô 	
ð 	
ð 	•Ô1Ñ1ð
à
Ô
$Ð
0Ý!ðPñ
ô 
ð 	
ð 	•Ô-Ñ-ðà
Ô
Ð
+ØÔ&ˆàÔ!Õ%5Ô%:Ò:Ð:Ø�7Ô-Ò-Ð-å-ØNñô ð ð Ô!Õ%5Ô%AÒAÐAØ�7Ô-Ò-Ð-å-ðñô ð ð Ô%€Kà•Ô,Ñ,ðà
Ô
Ð
*ð	"ÝÔ1Ø˜NÔ+Ð-Mñô ð ð !ˆMˆMøÝ)Õ+DÐEð 	"ð 	"ð 	"Ø!ˆMˆMˆMð	"øøøð Ô =Ò0Ð0Ý-Ð-ð "Ô.Ð:�B�B°FÐ:Ð:Ø'Ð3�B�B¨VÐ3Ð3ð	ñô ð ð Ô ð	àÕ/ÔDÒDÐDå-ð>å#Ô8Ô>ñ@ñô ð ð 	•Ô-Ñ-ðà
Ô
 Ð
,ØÔ*×0Ò0Ñ2Ô2ˆØ˜gÔ4Ð4Ð4Ý-ð)Ø+6ñ7ñô ð ð
 �Ô&Ñ&ð ð ”/Ð' RˆØ�KÐ3 7¨s¨eÒ#3ˆ	Ø—{’{ 9Ñ-Ô-ˆØð 	˜Ð1Ý-ðñô ð ð ð 	˜\°Ð8Ð8Ý-Ð-à,8¨L¨Lð;ñô ð ðð ð	ð 	Ð8Ð8s9   ›7 ·
AÁAÁAÂ2C ÃC-Ã,C-ËK+ Ë+LÌ LÚembedded_sigr#  r$  c                 ó°   — 	 t          | ||¬¦  «         d}n5# t          $ r(}t                               d|¬¦  «         |}Y d}~nd}~ww xY w| j        du|dœS )aŽ  
    Internal API function to enforce seed value constraints (if present)
    and report on the result(s).

    :param embedded_sig:
        The embedded signature.
    :param validation_path:
        The validation path for the signer's certificate.
    :param timestamp_found:
        Flag indicating whether a valid timestamp was found or not.
    :return:
        A ``status_kwargs`` dict.
    )r$  NzError in seed value validation.)Úexc_info)Úhas_seed_valuesÚseed_value_constraint_error)r4  r&   r  r  r´   )r5  r#  r$  Úsv_errrD   s        r;   r2   r2   Þ  s’   € ð&Ý Ø˜/¸?ð	
ñ 	
ô 	
ð 	
ð ˆˆøÝ&ð ð ð Ý�ŠÐ8À1ˆÑEÔEÐEØˆˆˆˆˆˆøøøøðøøøð (Ô7¸tÐCØ'-ðð ð s   ‚ —
A	¡AÁA	c                 ó|   — 	 ddl m}  || ¦  «        |v }n# t          $ r d}Y nw xY w|st          || z  ¦  «        ‚d S )Nr   )r   F)Úpyhanko.sign.fieldsr   rB   r%   )Úsubfilter_strÚpermitted_subfiltersÚerr_msgr   Úsubfilter_oks        r;   Ú_validate_subfilterrA  ÿ  s   € ðØ8Ð8Ð8Ð8Ð8Ð8à'Ð'¨Ñ6Ô6Ð:NÐNˆˆøÝð ð ð Øˆˆˆðøøøð ð @Ý& w°Ñ'>Ñ?Ô?Ð?ð@ð @s   ‚ –%¤%FÚsigner_validation_contextÚts_validation_contextÚac_validation_contextr¢   Úkey_usage_settingsr£   Úalgorithm_policyc           	   ƒ   óâ  K  — | j         }| j        dk    rt          d¦  «        ‚|                     dd¦  «        }	t	          |	t
          j        t
          j        fd¦  «         |€|}|                      ||¬¦  «         |  	                    ¦   «         }
t          j        | j        || j        |¬¦  «        ƒ d{V —†}|
                     |¦  «         d|
vr| j        }|�||
d<   t!          j        |¦  «        }t          j        | j        |                      ¦   «         ||
||¬	¦  «        ƒ d{V —†}
|
                     d
d¦  «        }|duo|j        o|j        }t-          | |
d         |¦  «        }|
                     |¦  «         |�|j                             | j        ¦  «         |
                     t          j        | j        | j        || j        d         ¬¦  «        ƒ d{V —†¦  «         t!          di |
¤ŽS )a  
    .. versionadded:: 0.9.0

    .. versionchanged: 0.11.0
        Added ``ac_validation_context`` param.


    Validate a PDF signature.

    :param embedded_sig:
        Embedded signature to evaluate.
    :param signer_validation_context:
        Validation context to use to validate the signature's chain of trust.
    :param ts_validation_context:
        Validation context to use to validate the timestamp's chain of trust
        (defaults to ``signer_validation_context``).
    :param ac_validation_context:
        Validation context to use to validate attribute certificates.
        If not supplied, no AC validation will be performed.

        .. note::
            :rfc:`5755` requires attribute authority trust roots to be specified
            explicitly; hence why there's no default.
    :param diff_policy:
        Policy to evaluate potential incremental updates that were appended
        to the signed revision of the document.
        Defaults to
        :const:`~pyhanko.sign.diff_analysis.DEFAULT_DIFF_POLICY`.
    :param key_usage_settings:
        A :class:`.KeyUsageConstraints` object specifying which key usages
        must or must not be present in the signer's certificate.
    :param skip_diff:
        If ``True``, skip the difference analysis step entirely.
    :param algorithm_policy:
        The algorithm usage policy for the signature validation.

        .. warning::
            This is distinct from the algorithm usage policy used for
            certificate validation, but the latter will be used as a fallback
            if this parameter is not specified.

            It is nonetheless recommended to align both policies unless
            there is a clear reason to do otherwise.
    :return:
        The status of the PDF signature in question.
    r‘   z"Signature object type must be /Sigrý   Nz4%s is not a recognized SubFilter type in signatures.©r¢   r£   )Ú
raw_digestrF  Úsigner_reported_dt)rI  Úvalidation_contextr¯   rE  rF  Útimestamp_validityr#  rþ   )Úsd_attr_certificatesr�   rK  Úsd_signed_attrsrð   )rF   r“   r%   r’   rA  r   r  ÚPADESr¤   r°   r!   Úcollect_timing_inforf   rŸ   Úupdaterœ   r)   Údefault_usage_constraintsÚcms_basic_validationrS   ÚvalidÚtrustedr2   Úcertificate_registryÚregister_multipler�   Úcollect_signer_attr_statusrŠ   r�   )r5  rB  rC  rD  r¢   rE  r£   rF  rF   r=  r¯   Úts_status_kwargsrJ  Útst_validityr$  Ú	sv_updates                   r;   r.   r.     s¬  è è € ðr Ô(€JØÔ# vÒ-Ð-Ý&Ð'KÑLÔLÐLð —N’N <°Ñ6Ô6€MÝØÝ	Ô	.Õ0@Ô0FÐGØ>ñô ð ð Ð$Ø 9Ðà×'Ò'Ø¨9ð (ñ ô ð ð !×9Ò9Ñ;Ô;€Må(Ô<ØÔ ØØÔ.Ø)ð	ñ ô ð ð ð ð ð ð Ðð ×ÒÐ)Ñ*Ô*Ð*Ø =Ð0Ð0à)ÔAÐØÐ)Ø2DˆMÐ.Ñ/å+ÔEØñô Ðõ &Ô:ØÔ Ø×.Ò.Ñ0Ô0Ø4Ø#Ø-Ø)ðñ ô ð ð ð ð ð ð €Mð !×$Ò$Ð%9¸4Ñ@Ô@€Là˜DÐ ÐP \Ô%7ÐP¸LÔ<Pð õ -Ø�mÐ$5Ô6¸ñô €Ið ×Ò˜Ñ#Ô#Ð#ØÐ(ØÔ2×DÒDØÔ-ñ	
ô 	
ð 	
ð ×ÒÝÔ4Ø!-Ô!AØ$Ô0Ø4Ø(Ô4°^ÔDð	
ñ 
ô 
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
ñô ð õ Ð.Ð. Ð.Ð.Ð.r†   rK  c              ƒ   ób  K  — | j         dk    rt          d¦  «        ‚| j                             dd¦  «        }t	          |t
          j        fd¦  «         |                      ||¬¦  «         t          j	        | j
        || j        ¦  «        ƒ d{V —†}| j        |d<   | j        |d<   t          d	i |¤ŽS )
a{  
    .. versionadded:: 0.9.0

    Validate a PDF document timestamp.

    :param embedded_sig:
        Embedded signature to evaluate.
    :param validation_context:
        Validation context to use to validate the timestamp's chain of trust.
    :param diff_policy:
        Policy to evaluate potential incremental updates that were appended
        to the signed revision of the document.
        Defaults to
        :const:`~pyhanko.sign.diff_analysis.DEFAULT_DIFF_POLICY`.
    :param skip_diff:
        If ``True``, skip the difference analysis step entirely.
    :return:
        The status of the PDF timestamp in question.
    z/DocTimeStampz+Signature object type must be /DocTimeStamprý   Nz5%s is not a recognized SubFilter type for timestamps.rH  rq   rx   rð   )r“   r%   rF   r’   rA  r   ÚETSI_RFC3161r¤   r!   Úvalidate_tst_signed_datarS   rŸ   rq   rx   r(   )r5  rK  r¢   r£   r=  r¯   s         r;   r/   r/   ‡  sû   è è € ð4 Ô# Ò6Ð6Ý&Ø9ñ
ô 
ð 	
ð
 !Ô+×/Ò/°¸dÑCÔC€MÝØÝ	Ô	&Ð(Ø?ñô ð ð ×'Ò'Ø¨9ð (ñ ô ð õ &Ô>ØÔ ØØÔ#ñô ð ð ð ð ð ð €Mð !-Ô 5€M�*ÑØ#/Ô#;€M�-Ñ Ý"Ð3Ð3 ]Ð3Ð3Ð3r†   )NNNNNFN)NNF)LÚloggingrÆ   Úcollectionsr   r   Útypingr   r   r   r   Ú
asn1cryptor	   r
   Úpyhanko.pdf_utilsr   r   Úpyhanko.pdf_utils.genericr   Úpyhanko.pdf_utils.readerr   r   Úpyhanko.sign.diff_analysisr   r   r   r   r   r<  r   r   r   r   r   r   Úpyhanko.sign.generalr   r   r   r   r   r    Úpyhanko.sign.validationr!   Úpyhanko_certvalidatorr"   Úpyhanko_certvalidator.pathr#   Úerrorsr%   r&   Úsettingsr'   Ústatusr(   r)   r*   Úutilsr+   Ú__all__Ú	getLoggerrã   r  ra   r<   rE   rï   r0   r-   r,   r1   r4  Úboolr2   rA  r.   r/   rð   r†   r;   ú<module>rr     sß  ðØ €€€Ø 	€	€	€	Ø "Ð "Ð "Ð "Ð "Ð "Ø Ð Ð Ð Ð Ð Ø .Ð .Ð .Ð .Ð .Ð .Ð .Ð .Ð .Ð .Ð .Ð .à  Ð  Ð  Ð  Ð  Ð  Ð  Ð  Ø +Ð +Ð +Ð +Ð +Ð +Ð +Ð +Ø .Ð .Ð .Ð .Ð .Ð .Ø GÐ GÐ GÐ GÐ GÐ GÐ GÐ Gðð ð ð ð ð ð ð ð ð ð ð ð ð ðð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ðð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð 0Ð /Ð /Ð /Ð /Ð /Ø 3Ð 3Ð 3Ð 3Ð 3Ð 3Ø 5Ð 5Ð 5Ð 5Ð 5Ð 5ðð ð ð ð ð ð ð ð *Ð )Ð )Ð )Ð )Ð )ðð ð ð ð ð ð ð ð ð ð
 +Ð *Ð *Ð *Ð *Ð *ðð ð €ð 
ˆÔ	˜8Ñ	$Ô	$€ðàˆgÔ&Ô'ðð ð ð ð
¨h°wÔ.?ð 
ð 
ð 
ð 
ð& Ô!9ð &¸eð &ð &ð &ð &ð8a
ð a
ð a
ð a
ð a
ñ a
ô a
ð a
ðH ˆZ˜ |°\Ð&BÑCÔC€
ðð/ Mð /°h¸zÔ6Jð /ð /ð /ð /ð$gØ!ðgð gð gð gðTØ&ðà#ðð ðð ð ð ðB	@ð 	@ð 	@ð >BØ9=Ø9=Ø(,Ø8<ØØ:>ðy/ð y/Ø&ðy/à'Ð(9Ô:ðy/ð $Ð$5Ô6ðy/ð $Ð$5Ô6ð	y/ð
 ˜*Ô%ðy/ð !Ð!4Ô5ðy/ð ðy/ð Ð6Ô7ðy/ð ðy/ð y/ð y/ð y/ð| 7;Ø(,Øð	34ð 34Ø&ð34à Ð!2Ô3ð34ð ˜*Ô%ð34ð ð	34ð
 ð34ð 34ð 34ð 34ð 34ð 34r†   