j(5^ddlZddlmZddlmZddlmZddlmZmZm Z m Z m Z m Z m Z ddlmZddlmZddlmZmZmZmZmZdd lmZdd lmZdd lmZgd Zd ZedZ edZ!edZ"Gdde#Z$edGddZ%Gddej&Z'e"dZ(edGddZ)Gddej&Z*GddZ+edGd d!e+Z,edGd"d#e+Z-edGd$d%e+Z.ej/Gd&d'ej&Z0edGd(d)e+Z1edGd*d+Z2edGd,d-Z3edGd.d/e3Z4edGd0d1e3Z5d2e3fd3Z6Gd4d5Z7Gd6d7eZ8dS)8N) defaultdict) dataclass)datetime)Dict FrozenSet GeneratorIterableOptionalSetTuple)x509)KeyUsageConstraints) AuthorityAuthorityWithCert TrustAnchorTrustedServiceTypeTrustQualifiers)InvalidCertificateError)ValidationPath) TrustManager) CA_QC_URIQTST_URIAdditionalServiceInformationBaseServiceInformationCAServiceInformationCertSubjectDNCriterionCriteriaCombination CriteriaList CriterionKeyUsageCriterionPolicySetCriterionQTSTServiceInformation QcCertType Qualificationr$QualifiedServiceInformation Qualifier TSPRegistryTSPServiceParsingErrorTSPTrustManagerzhttp://uri.etsi.org/TrstSvcz/Svctype/CA/QCz/Svctype/TSA/QTSTz /TrustedListceZdZdS)r(N)__name__ __module__ __qualname__t/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko/sign/validation/qualified/tsp.pyr(r(2sDr/r(T)frozenc:eZdZUeed<eed<eeed<dS)ruricritical textual_infoN)r+r,r-str__annotations__boolr r.r/r0rr6s4 HHHNNN3-r/rc"eZdZdZdZ dZ dZdS)r#z( Type of qualified certificate. qct_esign qct_esealqct_webN)r+r,r-__doc__QC_ESIGNQC_ESEALQC_WEBr.r/r0r#r#=s=HHFr/r#z /SvcInfoExtceZdZUdZeed< eed< eed< eeed< ee j dfed< e e ed< e e ed <d S) rz5 Common information about a trusted service. service_type service_name valid_from valid_until.provider_certs additional_info_certificate_typeother_additional_infoN)r+r,r-r=r6r7rr r r Certificaterr#rr.r/r0rrUs(#### $*C/0000'0 &;;;; %%ABBBBr/rc\eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZedZdS)r&z= Qualifier as specified in ETSI TS 119 612, 5.5.9.2. QCWithSSCDQCNoSSCDQCSSCDStatusAsInCert QCWithQSCDQCNoQSCDQCQSCDStatusAsInCertQCQSCDManagedOnBehalfQCForLegalPerson QCForESig QCForESealQCForWSA NotQualified QCStatementc$td|jS)N/)_SVCINFOEXT_URI_BASEvalueselfs r0r3z Qualifier.uris&55555r/N)r+r,r-r= WITH_SSCDNO_SSCDSSCD_AS_IN_CERT WITH_QSCDNO_QSCDQSCD_AS_IN_CERTQSCD_MANAGED_ON_BEHALF LEGAL_PERSONFOR_ESIG FOR_ESEALFOR_WSA NOT_QUALIFIED QC_STATEMENTpropertyr3r.r/r0r&r&s{IG,OIG,O4%LHIG"M L 66X666r/r&c,eZdZdZdejdefdZdS)rz> Criterion for a qualifier to apply to a certificate. certreturnct)z Evaluate a certificate against this criterion. :param cert: The certificate to evaluate. :return: ``True`` if the criterion matches, ``False`` otherwise. )NotImplementedErrorr]rms r0matcheszCriterion.matchess "!r/N)r+r,r-r=r rIr8rrr.r/r0rrsC "D, " " " " " " "r/rc:eZdZUdZeed< dejdefdZ dS)r z` Criterion that matches certificates that meet the specified key usage constraints. settingsrmrnc^ |j|dS#t$rYdSwxYw)NTF)rtvalidaterrqs r0rrzKeyUsageCriterion.matchessD  M " "4 ( ( (4&   55 s  ,,N) r+r,r-r=rr7r rIr8rrr.r/r0r r sX "!!!D,r/r cFeZdZUdZeeed< dejde fdZ dS)r!z_ Criterion that matches certificates that meet the specified certificate policies. required_policy_oidsrmrnc`|jpd}d|D}|j|S)Nr.c(h|]}|djS)policy_identifierdotted).0pols r0 z-PolicySetCriterion.matches..s!PPPc#129PPPr/)certificate_policies_valuerxissubset)r]rm policy_extfound_policiess r0rrzPolicySetCriterion.matchess94: PPZPPP(11.AAAr/N) r+r,r-r=rr6r7r rIr8rrr.r/r0r!r!sd $C.(((BD,BBBBBBBr/r!c@eZdZUeeed<dejdefdZ dS)rrequired_rdn_part_oidsrmrncf|j}d|jD}|j|S)Nc2h|]}|D]}|djS)typer|)r~rdnpairs r0rz1CertSubjectDNCriterion.matches..s@   $'  AEDL     r/)subjectchosenrr)r]rm subject_dnfound_rdn_part_oidss r0rrzCertSubjectDNCriterion.matchessE $   +5+<   *334GHHHr/N) r+r,r-rr6r7r rIr8rrr.r/r0rrsS%cN***ID,IIIIIIIr/rc"eZdZdZdZ dZ dZdS)rz. Defines how to combine sub-criteria. all atLeastOnenoneN)r+r,r-r=ALL AT_LEAST_ONENONEr.r/r0rrs= C L Dr/rcReZdZUdZeed< eeed< dej de fdZ dS)rz* Combine several criteria as one. combine_ascriteriarmrncR|jtjkr tfd|jDS|jtjkr t fd|jDS|jtjkr!t fd|jD St)Nc3BK|]}|VdSNrrr~crms r0 z'CriteriaList.matches.. ->>1qyy>>>>>>r/c3BK|]}|VdSrrrs r0rz'CriteriaList.matches..rr/c3BK|]}|VdSrrrs r0rz'CriteriaList.matches..s-BBq199T??BBBBBBr/) rrrrrranyrrprqs `r0rrzCriteriaList.matches s ?15 5 5>>>> >>>>> > _ 3 @ @ @>>>> >>>>> > _ 3 8 8 8BBBBDMBBBBBB B% %r/N) r+r,r-r=rr7rrr rIr8rrr.r/r0rrsp$### """"&D,&&&&&&&r/rc6eZdZUdZeeed< eed<dS)r$zU Representation of a qualification in the sense of ETSI TS 119 612, 5.5.9.2. qualifiers criteria_listN)r+r,r-r=rr&r7rr.r/r0r$r$sF)$$$$ r/r$c6eZdZUdZeed< eeed<dS)r%zB Representation of a service with conditional qualifiers. base_infoqualificationsN)r+r,r-r=rr7rr$r.r/r0r%r%'sF&%%%m,,,,r/r%c*eZdZUdZeeed<dS)rz+ Qualified CA service description. expired_certs_revocation_infoN)r+r,r-r=r rr7r.r/r0rr8s3 $,H#5555r/rceZdZdZdS)r"z, Qualified TSA service description. N)r+r,r-r=r.r/r0r"r"Isr/r"sic:|jjdSd|jjfS)N)Nr)rrE)rs r0_service_sort_keyrPs" |'w",***r/c eZdZdZddZdefdZdefdZde d e e d e e fd Zed e e fd Zed e e fd Zded e d ee ddffdZdS)r'z Registry of trusted service providers (TSPs), typically populated from a trust list. Currently, a TSP registry can keep track of qualified CAs and TSAs (QTSTs). r]cjtt|_tt|_dSr)rset_ca_cert_to_si_tst_cert_to_sir\s r0__init__zTSPRegistry.__init___s0        r/ca_service_infoc~|jjD]/}|jt||0dS)z Register a trusted certificate authority. :param ca_service_info: Service information about the CA. N)rrFrradd)r]rrms r0 register_cazTSPRegistry.register_cagsO$-< N ND   1$ 7 7 8 < <_ M M M M N Nr/qtst_service_infoc~|jjD]/}|jt||0dS)z Register a trusted time stamping authority. :param qtst_service_info: Service information about the TSA. N)rrFrrr)r]rrms r0 register_tstzTSPRegistry.register_tstqsP&/> Q QD  !24!8!8 9 = =>O P P P P Q Qr/ authoritymomentrnc#Kt|j|t|j|z}t|td}|D].}|jj}|jj}|r||kr |r||kr|V/dS)au Retrieve the service definitions in this registry on behalf of which the specified authority might act. .. note:: This includes all supported types of qualified services, not just certificate authorities. :param authority: Authority to evaluate. :param moment: Time at which to evaluate the service definitions. If none is specified, all matching service definitions will be returned, irrespective of their validity windows. :return: List of service definitions matching the authority. T)keyreverseN)tuplerrsortedrrrDrE)r]rr all_servicessorted_servicesservicerDrEs r0applicable_service_definitionsz*TSPRegistry.applicable_service_definitions{s*T0;<.s!EEEwr3EEEEr/)ritemsr\s r0known_certificate_authoritiesz)TSPRegistry.known_certificate_authoritiess( FE$"5";";"="=EEEEr/cHd|jDS)zS List known time stamping authorities identified by this registry. ch|] \}}|| Sr.r.)r~tsars r0rz:TSPRegistry.known_timestamp_authorities..s!HHHSCHHHHr/)rrr\s r0known_timestamp_authoritiesz'TSPRegistry.known_timestamp_authoritiess( IHD$8$>$>$@$@HHHHr/pathNc#pK|D]}|||Ed{VdS)a List applicable trusted service providers on the provided validation path. :param path: The validation path to evaluate. :param moment: Time at which to evaluate the service definitions. If none is specified, all matching service definitions will be returned, irrespective of their validity windows. :return: A generator that yields any service definitions matching the authorities on the validation path. N)iter_authoritiesr)r]rrrs r0applicable_tsps_on_pathz#TSPRegistry.applicable_tsps_on_paths\"'')) G GB::2vFF F F F F F F F F G Gr/)r]r')r+r,r-r=rrrr"rrr rr r%rrkrrrrrr.r/r0r'r'WsP    N+?NNNNQ.DQQQQ""",4X,>" - .""""HFx /BFFFXF IXi-@IIIXI G"G,4G .d: ;GGGGGGr/r'cfeZdZdZdefdZdedeefdZ de j de eddffd Z dS) r)zH Trust manager implementation based on a :class:`.TSPRegistry`. tsp_registryc||_dSr)r)r]rs r0rzTSPTrustManager.__init__s(r/rrnc tt|j|d}n#t$rYdSwxYwt t jtt j i |j j t j }t|t||j j|j jS)N)r)trusted_service_typerDrE)quals)nextiterrr StopIterationrrCERTIFICATE_AUTHORITYrTIME_STAMPING_AUTHORITYgetrrB UNSUPPORTEDrrrDrE)r]rsdrBs r0as_trust_anchorzTSPTrustManager.as_trust_anchors %DD!$EBB   44  )? (@  #bl');)G H H  !%1<2L4    s69 AArmNc#K|jjD]2}||}|r||r|V3dSr)rrris_potential_issuer_of)r]rmr as_anchors r0find_potential_issuersz&TSPTrustManager.find_potential_issuerssa*H  I,,Y77I Y==dCC   r/)r+r,r-r=r'rrr rrr rIrrr.r/r0r)r)s)[))))  x 7L    2 $ ;d* +      r/r))9enum collectionsr dataclassesrrtypingrrrr r r r asn1cryptor pyhanko.sign.validation.settingsrpyhanko_certvalidator.authorityrrrrrpyhanko_certvalidator.errorsrpyhanko_certvalidator.pathrpyhanko_certvalidator.registryr__all___TRSTSVC_URI_BASErr_TRUSTEDLIST_URI_BASE ValueErrorr(rEnumr#rZrr&rr r!runiquerrr$r%rr"rr'r)r.r/r0rs ######!!!!!!MMMMMMMMMMMMMMMMMM@@@@@@A@@@@@555555777777   02 0 0 0  2 2 2,:::     Z    $        *0<<< $,,,,,,,,^66666 6660""""""""" $ & $BBBBBBBB, $IIIIIYIII$) * $&&&&&9&&&4 $          $          $     6     $8 +5++++hGhGhGhGhGhGhGhGV' ' ' ' ' l' ' ' ' ' r/