j3 ddlZddlZddlmZddlmZddlmZmZmZm Z m Z m Z m Z ddl mZddlmZddlmZddlmZdd lmZdd lmZmZmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%dd l&m'Z'gdZ(ej)e*Z+eddddddej,dZ-dZ.dZ/edej0ej1Z2GddeZ3GddZ4dedede'fdZ5dS) N)replace)datetime) FrozenSetIterableListOptionalSetTupleUnion)x509)qualified_asn1)AdESIndeterminate)SignatureValidationError)QualificationRequirements)QcPrivateKeyManagementTypeQualificationResultQualifiedStatus) CA_QC_URIQTST_URIBaseServiceInformation QcCertType QualificationQualifiedServiceInformation Qualifier TSPRegistry)TrustedServiceType)ValidationPath)QualificationAssessorQualificationPolicyErrorenforce_requirementsiEurope/Brussels)tzinfoz0.4.0.1456.1.1z0.4.0.1456.1.2F qualifiedqc_typeqc_key_securityceZdZdZdS)rz4Error triggered by a qualification policy violation.N)__name__ __module__ __qualname____doc__w/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/sign/validation/qualified/assess.pyrr6s>>Dr/rceZdZdZdefdZedejde fdZ ede de fd Z edejd e d e efd Zed e d eefdZ ddedeedefdZdS)rzk Assesses the qualification status of certificates against a particular :class:`.TSPRegistry`. tsp_registryc||_dSN) _registry)selfr2s r0__init__zQualificationAssessor.__init__Bs %r/certreturnc~tj|}d}d}tj}|D]k}|dj}|dkrd}|dkrd}!|dkrD|d}t |dkrt d t|d j}lt|||r|r tj n tj S) NF statement_id qc_complianceTqc_sscdr'statement_infor"zonly support exactly 1 qc_typerr%) r get_qc_statementsrQC_ESIGNnativelenNotImplementedErrorrrQSCDUNKNOWN)r8qcsr& key_securer' statementst_typeqc_typess r0_process_qc_statementsz,QualificationAssessor._process_qc_statementsEs.t44  % 9 9I/6G/)) I%%! I%%=F$>x==A%% ..NOOO$Xa[%7888"+8*///7     r/sdputative_statusct|j}|r.|j|vr%td|jddSdS)NzFound matching SDI z1 on path; skipping because QC type does not matchFT) additional_info_certificate_typer'loggerinfo service_name)rLrMsd_declared_types r0_check_cd_applicablez*QualificationAssessor._check_cd_applicablehs]>   7?O O O KK;bo;;;   5tr/ prelim_statusqualificationsct}|D]7}|j|s||j8t |t|Sr4)set criteria_listmatchesupdate qualifiersr _final_status frozenset)r8rUrVapplicable_qualifiers qualifications r0_apply_sd_qualificationsz.QualificationAssessor._apply_sd_qualificationsus{ 14+ C CM .66t<<  ! ( ()A B B B B$22 9%:;;   r/r_cJtj|vstj|vrd}ntj|vrd}n|j}tj|vr t j}n=tj|vr t j }n"tj |vr t j }n|j }|s tj}nttj|vstj|vr tj}nKtj|vr tj}n0tj|vstj|vr tj}n|j}t/|||S)NFTr%)r NOT_QUALIFIED LEGAL_PERSON QC_STATEMENTr&FOR_WSArQC_WEBFOR_ESIGr@ FOR_ESEALQC_ESEALr'rrENO_SSCDNO_QSCDQSCD_MANAGED_ON_BEHALFQSCD_DELEGATED WITH_SSCD WITH_QSCDrDr(r)rUr_ is_qualifiedr'key_mgmts r0r]z#QualificationAssessor._final_statussA  #'< < <%)>>> LL  #'< < <LL(2L   5 5 5 'GG  #8 8 8 )GG  $9 9 9 )GG#+G 519HH  !6 6 6 $99919HH  -1F F F1@HH  #8 8 8"&;;;16HH$4H"$    r/Npathmomentc |j}t|tjst dt |}|}|p&tj tj d}|tkra|r_d|D}t|vr0t|d|jjs t"jn|j}nt&|vrt|d}g}|j||D]Z} t ||| j} t | j| r|| | f[t7d|D} t9|d kr)t;|d d |d d  St9| d krrd d |D} t> d|j!j"d| t;|d d |d d  S| st;tFd Sd d|D} t> d|j!j"d| d| dt;tFd S)a Evaluate the qualified status of a certificate (given a specific validation path). :param path: Validation path to scrutinise. :param moment: Evaluate the status against the service definitions valid at the time specified. If ``None``, take the latest available service definitions. :return: A :class:`.QualificationResult` instance. z4Only public-key certs are in scope for qualificationr#)tzch|] }|j Sr.)user_domain_policy_id).0qs r0 zDQualificationAssessor.check_entity_cert_qualified..sJJJq12JJJr/T)r&r()r&c3 K|] \}}|V dSr4r.)ry_sts r0 zDQualificationAssessor.check_entity_cert_qualified..s&;;51bB;;;;;;r/r"r)service_definition, c34K|]\}}|jjVdSr4 base_inforRryrLr}s r0rzDQualificationAssessor.check_entity_cert_qualified..<%%.3b! )%%%%%%r/zQualification algorithm for zU reached a consistent conclusion, but through several different service definitions: Nc34K|]\}}|jjVdSr4rrs r0rzDQualificationAssessor.check_entity_cert_qualified..rr/z$ reached contradictory conclusions: z5. Several service definitions were found applicable: z4. This certificate will not be considered qualified.)$leaf isinstancer CertificaterCrrKqualified_policiesrnowzoneinfoZoneInfoEIDAS_START_DATEPRE_EIDAS_QCP_PLUS_POLICYrr(is_qscdrQSCD_BY_POLICYPRE_EIDAS_QCP_POLICYr5applicable_tsps_on_pathrarVrTrappendrXrBrjoinrPwarningsubjecthuman_friendly UNQUALIFIED) r6rsrtr8rU path_policiesreference_time policy_oidsstatuses_foundrLrM uniq_statuses service_infos r0check_entity_cert_qualifiedz1QualificationAssessor.check_entity_cert_qualifiedse y$ 011 %F .DDTJJ //11  8< !233$ $ $  , , , ,JJMJJJK(K77 '!" -<D;2AA*: !!! &44 '  F F F   .88~NN = =B4LLmR%6O%99 o =%%r?&;<<<;;N;;;;; ~  ! # #&q!!$9J19M   1 $ $ 99%%7E%%%L NNAt|/JAA2>AA    'q!!$9J19M  M&{tLLL L99%%7E%%%L NNt|/J6C    '{tLLL Lr/r4)r*r+r,r-rr7 staticmethodr rrrKrrTrrrarrr]rrrrrr.r/r0rr<sd &[&&&&  T%5  /    \  D  " 5D   \     &  !/    \  0 &0 (30 0 0 \0 fBFYMYM"YM,4X,>YM YMYMYMYMYMYMr/r requirementsqualification_resultrsc b|j}t|tjst d|j}g}|js)td|jj dtj |j J|j |j jj}t|j t r|}nBt"t$jt(t$ji|t$j}||j ks |jdkr+|d|jj d|j d |jc|j|jvrU|d|jj d |jjd d d |jDd |jc|j|jvrU|d|jj d|jjd d d|jDd |r.td|tj dS)zf Internal method to enforce the requirements of a qualification policy during validation. z3Qualification only makes sense for public-key certszCertificate for z is not qualified)ades_subindicationNrz Certificate z. is not directly trusted as a service of type .z is qualified,but the type z6 is not permitted by the requirements. Must be one of rc3$K|] }|jV dSr4nameryts r0rz'enforce_requirements..Gs$HHAHHHHHHr/z* is qualified,but the key management type c3$K|] }|jV dSr4rrs r0rz'enforce_requirements..Qs$LLALLLLLLr/z; ) rrr r TypeErrorstatusr&rrrrSIG_CONSTRAINTS_FAILURErrequire_service_typer service_typestrrrCERTIFICATE_AUTHORITYrTIME_STAMPING_AUTHORITYget UNSUPPORTEDpkix_lenrpermit_cert_typesr'rrpermit_key_mgmt_typesr()rrrsr8rerr_strsservice_type_urirs r0r r s 9D dD, - -OMNNN ! (FH   & Mt|: M M M0H     2 > > >(4 3 = J  l7 = = D+LL-C,Dc"$6$BCC  L= = =}q  OO8t|:884888    &2 N,"@ @ @ Lt|: L L"N/ L LyyHH)GHHHHH L L L    *6  ",*L L L Pt|: P P+1+A+F P PyyLL)KLLLLL P P P    & IIh  0H      r/)6loggingr dataclassesrrtypingrrrrr r r asn1cryptor pyhanko.sign.adesr pyhanko.sign.ades.reportrpyhanko.sign.validation.errorsr#pyhanko.sign.validation.policy_declr*pyhanko.sign.validation.qualified.q_statusrrr%pyhanko.sign.validation.qualified.tsprrrrrrrrpyhanko_certvalidator.authorityrpyhanko_certvalidator.pathr__all__ getLoggerr*rPrrrrr@rErrrr r.r/r0rsIIIIIIIIIIIIIIIIII,,,,,,666666CCCCCCIIIIII                    ?>>>>>555555     8 $ $8!Q1a 1 12C D D(,o  .6      7   TMTMTMTMTMTMTMTMnE +E -E  E E E E E E r/