§
    ¥”jvÛ  ã                   ó  — d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm	Z	m
Z
mZmZ d dlmZmZmZmZ d dlmZ d dlmZ ddlmZ dd	lmZmZ dd
lmZmZ ddlmZm Z  ddl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 ddl4m5Z5m6Z6m7Z7m8Z8m9Z9 ddl:m;Z;m<Z< ddl=m>Z>m?Z?m@Z@mAZA ddlBmCZCmDZDmEZEmFZFmGZGmHZH ddlImJZJ ddlKmLZL ddlMmNZN ddlOmPZP ddlQmRZRmSZSmTZTmUZU  ejV        eW¦  «        ZX	 dGdee?         fd„ZY	 dGde de<dee?         fd„ZZdej[        dee\         dee\         de]fd„Z^	 dGdej[        deee\                  fd „Z_d!ej`        d"efd#„Za ebg d$¢¦  «        Zcd%ejd        d&e\d'eefd(„Zfd)ejg        fd*„Zhd!ej`        d+eJfd,„Zid!ej`        d-ej[        de fd.„Zjd/ej[        d0ejk        fd1„Zl ed2¬3¦  «         G d4„ d5¦  «        ¦   «         Zm e?¦   «         dfd!ej`        de d6e?d/eej[                 d'emf
d7„Zne G d8„ d9¦  «        ¦   «         Zo ebg d:¢¦  «        Zpejq         G d;„ d<ejr        ¦  «        ¦   «         Zsdesjt        fde de<d=edee?         d>esf
d?„Zud@ed=efdA„Zvd=efdB„Zwde de<d=efdC„Zxdej[        dDeod=efdE„Zydej[        dDeod=efdF„ZzdS )Hé    N)Ú	dataclass)ÚDictÚ	FrozenSetÚIterableÚListÚOptionalÚSet)ÚalgosÚcmsÚcoreÚx509)ÚValidity)ÚInvalidSignatureé   )ÚValProcState)Ú
AAControlsÚTarget)ÚAuthorityWithCertÚTrustAnchor)ÚACTargetDescriptionÚValidationContext)ÚCRLFetchErrorÚCRLNoMatchesErrorÚCRLValidationIndeterminateErrorÚDisallowedAlgorithmErrorÚExpiredErrorÚInsufficientRevinfoErrorÚInvalidAttrCertificateErrorÚInvalidCertificateErrorÚNotYetValidErrorÚOCSPFetchErrorÚOCSPNoMatchesErrorÚOCSPValidationErrorÚ OCSPValidationIndeterminateErrorÚPathBuildingErrorÚPathValidationErrorÚPSSParameterMismatchÚStaleRevinfoErrorÚValidationError)ÚExcludedSubtreesÚPermittedSubtreesÚdefault_excluded_subtreesÚdefault_permitted_subtreesÚprocess_general_subtrees)ÚQualifiedPolicyÚValidationPath)ÚAlgorithmUsagePolicyÚPKIXValidationParamsÚRevocationCheckingRuleÚintersect_policy_sets)ÚPolicyTreeNodeÚPolicyTreeRootÚapply_policy_mappingÚenumerate_policy_mappingsÚprune_unacceptable_policiesÚupdate_policy_tree)ÚCertificateCollection)Ú
verify_crl)Úverify_ocsp_response)ÚSignatureValidator)ÚConsListÚextract_dir_nameÚget_ac_extension_valueÚget_declared_revinfoÚ
parametersc                 óN   — t          j        t          | ||¬¦  «        ¦  «        }|S )aÂ  
    Validates the path using the algorithm from
    https://tools.ietf.org/html/rfc5280#section-6.1.

    Critical extensions on the end-entity certificate are not validated
    and are left up to the consuming application to process and/or fail on.

    .. note::
        This is a synchronous equivalent of :func:`.async_validate_path` that
        calls the latter in a new event loop. As such, it can't be used
        from within asynchronous code.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the path to validate

    :param parameters:
        Additional input parameters to the PKIX validation algorithm.
        These are not used when validating CRLs and OCSP responses.

    :raises:
        pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path
        pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked

    :return:
        The final certificate in the path - an instance of
        asn1crypto.x509.Certificate
    )rC   )ÚasyncioÚrunÚasync_validate_path)Úvalidation_contextÚpathrC   Úresults       úm/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko_certvalidator/validate.pyÚvalidate_pathrL   J   s0   € õF Œ[ÝÐ.°ÀÐLÑLÔLñô €Fð €Mó    rH   rI   c              ƒ   ó|   K  — t          t          j        |¦  «        ¬¦  «        }t          | |||¬¦  «        ƒ d{V —†S )aö  
    Validates the path using the algorithm from
    https://tools.ietf.org/html/rfc5280#section-6.1.

    Critical extensions on the end-entity certificate are not validated
    and are left up to the consuming application to process and/or fail on.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the path to validate

    :param parameters:
        Additional input parameters to the PKIX validation algorithm.
        These are not used when validating CRLs and OCSP responses.

    :raises:
        pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path
        pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked

    :return:
        The final certificate in the path - an instance of
        asn1crypto.x509.Certificate
    )Úcert_path_stack)rC   Ú
proc_stateN)r   r?   ÚsingÚintl_validate_path)rH   rI   rC   rP   s       rK   rG   rG   s   sa   è è € õ@ ­h¬m¸DÑ.AÔ.AÐBÑBÔB€JÝ#Ø˜D¨ZÀJðñ ô ð ð ð ð ð ð ð rM   ÚcertÚ	key_usageÚextended_key_usageÚextended_optionalc                 ó   — |€t          ¦   «         }|€t          ¦   «         }|}| j        r|| j        j        z
  }t          ¦   «         }|du r
| j        s|}n#| j        �|t          | j        j        ¦  «        z
  }|s|r‚t	          ||z  ¦  «        dk    rdnd}g }t          ||z  ¦  «        D ]+}|                     |                     dd¦  «        ¦  «         Œ,t          d|› d	d
 	                    |¦  «        › �¦  «        ‚dS )aW  
    Validates the end-entity certificate from a
    pyhanko_certvalidator.path.ValidationPath object to ensure that the
    certificate is valid for the key usage and extended key usage purposes
    specified.

    THE CERTIFICATE PATH MUST BE VALIDATED SEPARATELY VIA validate_path()!

    :param cert:
        An asn1crypto.x509.Certificate object returned from validate_path()

    :param key_usage:
        A set of unicode strings of the required key usage purposes

    :param extended_key_usage:
        A set of unicode strings of the required extended key usage purposes

    :param extended_optional:
        A bool - if the extended_key_usage extension may be omitted and still
        considered valid

    :raises:
        pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for the usages specified
    NFr   ÚsÚ Ú_ú z;The X.509 certificate provided is not valid for the purposez of ú, )
ÚsetÚkey_usage_valueÚnativeÚextended_key_usage_valueÚlenÚsortedÚappendÚreplacer   Újoin)	rS   rT   rU   rV   Úmissing_key_usageÚmissing_extended_key_usageÚpluralÚfriendly_purposesÚpurposes	            rK   Úvalidate_usagerk   ™   sl  € ð> ÐÝ‘E”Eˆ	àÐ!Ý ™UœUÐà!ÐØÔð DØ%¨Ô(<Ô(CÑCÐå!$¡¤ÐØ˜EÐ!Ð!¨$Ô*GÐ!Ø%7Ð"Ð"Ø	Ô	&Ð	2Ø%7½#ØÔ)Ô0ñ;
ô ;
ñ &
Ð"ð ð 
Ð6ð 
õ Ð$Ð'AÑAÑBÔBÀQÒFÐFð ˆCàð 	ð
 ÐÝÐ/Ð2LÑLÑMÔMð 	@ð 	@ˆGØ×$Ò$ W§_¢_°S¸#Ñ%>Ô%>Ñ?Ô?Ð?Ð?Ý%ðAØðAð AØ"&§)¢)Ð,=Ñ">Ô">ðAð Añ
ô 
ð 	
ð
ð 
rM   c                 ó¬   — t          | dh|pt          ¦   «         |du¬¦  «         | j        }|�$t          |d         ¦  «        rt	          d¦  «        ‚dS dS )u…   
    Validate AA certificate profile conditions in RFC 5755 Â§ 4.5

    :param cert:
    :param extended_key_usage:
    :return:
    Údigital_signatureN)rT   rU   rV   ÚcazlThe X.509 certificate provided is a CA certificate, so it cannot be used to validate attribute certificates.)rk   r]   Úbasic_constraints_valueÚboolr   )rS   rU   Úbcs      rK   Úvalidate_aa_usagerr   Ù   sx   € õ ØØ&Ð'Ø-Ð6µ±´Ø,°DÐ8ð	ñ ô ð ð 
Ô	%€BØ	€~�$˜r $œx™.œ.€~Ý%ðDñ
ô 
ð 	
ð €~€~€~rM   Ú	attr_certÚacceptable_targetsc                 ó„  — t          | d¦  «        }|€d S |D ]›}|D ]–}|j        dk    r|j        }|j        }n>|j        dk    r|j        }|j        }n$t
                               d|j        › d�¦  «         ŒZ	 ||v }n0# t          $ r# |                     ¦   «         d„ |D ¦   «         v }Y nw xY w|r  d S Œ—Œœt          d¦  «        ‚)NÚtarget_informationÚtarget_nameÚtarget_groupú'z1' is not supported as a targeting mode; ignoring.c                 ó6   — h | ]}|                      ¦   «         ’ŒS © )Údump)Ú.0Úns     rK   ú	<setcomp>z)_validate_ac_targeting.<locals>.<setcomp>  s    € Ð/NÐ/NÐ/N¸Q°·²±´Ð/NÐ/NÐ/NrM   zAC targeting check failed)
rA   ÚnameÚchosenÚvalidator_namesÚgroup_membershipsÚloggerÚinfoÚ
ValueErrorr|   r   )rs   rt   Útarget_infoÚtargetsÚtargetÚgen_nameÚvalid_namesÚ	target_oks           rK   Ú_validate_ac_targetingr�   ö   s4  € õ )¨Ð4HÑIÔI€KØÐØˆð ð ð ˆØð 	ð 	ˆFØŒ{˜mÒ+Ð+Ø!œ=�Ø0Ô@��Ø” Ò.Ð.Ø!œ=�Ø0ÔB��å—’ð!˜œð !ð !ð !ñô ð ð ðOØ$¨Ð3�	�	øÝð Oð Oð Oð
 %ŸMšM™OœOÐ/NÐ/NÀ+Ð/NÑ/NÔ/NÐN�	�	�	ðOøøøð ð Ø���ðð+	õ2 &Ð&AÑ
BÔ
BÐBs   Á6A;Á;*B(Â'B()Úauthority_information_accessÚauthority_key_identifierÚcrl_distribution_pointsÚfreshest_crlÚkey_identifierÚno_rev_availrv   Úaudit_identityÚ
iss_serialÚerr_msg_prefixÚreturnc                 ód   — | d         }t          ||¦  «        }d|j        | d         j        fz  }|S )zp
    Render a cms.IssuerSerial value into something that matches
    x509.Certificate.issuer_serial output.
    Úissueró   %s:%dÚserial)r@   Úsha256r_   )r•   r–   Úissuer_namesÚissuer_dirnameÚresult_bytess        rK   Ú_parse_iss_serialr    0  sE   € ð ˜hÔ'€LÝ% l°NÑCÔC€NØØÔØ�8ÔÔ#ðñ €Lð ÐrM   Úaki_extc                 óÐ   — | d         j         }d x}}t          | d         t          j        ¦  «        s1t	          | d         d¦  «        }| d         j         }|�d|j        |fz  }|||fS )Nr’   Úauthority_cert_issuerz2Could not decode authority issuer in AKI extensionÚauthority_cert_serial_numberrš   )r_   Ú
isinstancer   ÚVoidr@   rœ   )r¡   ÚakiÚauth_iss_serÚauth_iss_dirnameÚauth_sers        rK   Ú_process_aki_extr«   @  s‰   € Ø
Ð"Ô
#Ô
*€CØ&*Ð*€LÐ#Ý�gÐ5Ô6½¼	ÑBÔBð JÝ+ØÐ+Ô,Ø@ñ
ô 
Ðð Ð9Ô:ÔAˆØÐØ#Ð'7Ô'>ÀÐ&IÑIˆLàÐ  ,Ð.Ð.rM   Úregistryc              #   óà  K  — | d         d         }d }d }|j         dk    r|j        }n”|j        }t          |d         t          j        ¦  «        s|d         }t          |d         t          j        ¦  «        st          |d         d¦  «        }t          |d         t          j        ¦  «        st          d¦  «        ‚t          | d	¦  «        }|�/t          |¦  «        \  }}}	|	�|�||	k    rt          d
¦  «        ‚|	}nd }d}
d }|�t          |d¦  «        }|�|                     |¦  «        }|�|f}
n|�|                     |¦  «        }
|
D ]"}|�|j        |k    rŒ|�|j        |k    rŒ|V — Œ#d S )NÚac_infor™   Úv1_formÚissuer_nameÚbase_certificate_idz3Could not identify AA issuer in base_certificate_idÚobject_digest_infoz9Could not identify AA; objectDigestInfo is not supported.r�   z\AC's AKI extension and issuer include conflicting identifying information for the issuing AAr{   zCould not identify AA by name)r€   r�   r¥   r   r¦   r    ÚNotImplementedErrorrA   r«   r   r@   Úretrieve_by_issuer_serialÚretrieve_by_nameÚsubjectr’   )rs   r¬   Ú
issuer_recÚaa_namesÚaa_iss_serialÚissuerv2r¡   r§   Ú	aa_issuerÚaki_aa_iss_serialÚ
candidatesÚaa_nameÚ
exact_certÚaa_candidates                 rK   Ú_candidate_ac_issuersrÁ   O  sç  è è € ð ˜9Ô% hÔ/€JØ,0€HØ%)€MØ„˜)Ò#Ð#ØÔ$ˆˆà)Ô0ˆÝ˜( =Ô1µ4´9Ñ=Ô=ð 	/Ø Ô.ˆHÝ˜(Ð#8Ô9½4¼9ÑEÔEð 	õ .ØÐ.Ô/ØEñô ˆMõ ˜(Ð#7Ô8½$¼)ÑDÔDð 	å%ØKñô ð õ
 % YÐ0JÑKÔK€GØÐÝ,<¸WÑ,EÔ,EÑ)ˆˆYÐ)ØÐ(ØÐ(¨]Ð>OÒ-OÐ-OÝ1ðAñô ð ð
 !2�øàˆà-/€JØ€GØÐÝ" 8Ð-LÑMÔMˆØÐ Ø×7Ò7¸ÑFÔFˆ
ØÐ!Ø$˜ˆJøØ	Ð	Ø×.Ò.¨wÑ7Ô7ˆ
à"ð ð ˆØÐ <Ô#7¸7Ò#BÐ#BØØˆ?˜|Ô:¸cÒAÐAàØÐÐÐÐðð rM   Úaa_certc                 ó  — | d         }| d         d         }|j         }|j                             |||j        ¬¦  «        }|j        |j        k    rt          d¦  «        ‚|s't          d|d         j        › d�d	d
|j        ¬¦  «        ‚	 |j         	                    | d         j        | d          
                    ¦   «         |j        |¬¦  «         d S # t          $ r t          d¦  «        ‚t          $ r t          d¦  «        ‚w xY w)NÚsignature_algorithmr®   Ú	signature©Ú
public_keyz{Signature algorithm declaration in signed portion of AC does not match the signature algorithm declaration on the envelope.zoThe attribute certificate could not be validated because the signature uses the disallowed signature algorithm Ú	algorithmz. TF)Ú
is_ee_certÚis_side_validationÚbanned_since©rÅ   Úsigned_dataÚpublic_key_inforÄ   zgThe signature parameters for the attribute certificate do not match the constraints on the public key. z]The attribute certificate could not be validated because the signature could not be verified.)Úbest_signature_timeÚalgorithm_policyÚsignature_algorithm_allowedrÇ   r_   r   r   Únot_allowed_afterÚsig_validatorÚvalidate_signaturer|   r'   r   )rs   rÂ   rH   Úsd_algoÚembedded_sd_algoÚuse_timeÚdigest_alloweds          rK   Ú_check_ac_signaturerÙ   Ž  sƒ  € ð
 Ð-Ô.€GØ  Ô+¨KÔ8ÐØ!Ô5€HàÔ+×GÒGØ�X¨'Ô*<ð 	Hñ 	
ô 	
ð ð
 „~Ð)Ô0Ò0Ð0Ý)ðIñ
ô 
ð 	
ð ð 
Ý&ð/à�{Ô#Ô*ð/ð /ð /ð Ø$Ø'Ô9ð
ñ 
ô 
ð 	
ð
ØÔ(×;Ò;Ø Ô,Ô3Ø! )Ô,×1Ò1Ñ3Ô3ð
 $Ô.Ø 'ð 	<ñ 		
ô 		
ð 		
ð 		
ð 		
øõ  ð 
ð 
ð 
Ý)ð?ñ
ô 
ð 	
õ ð 
ð 
ð 
Ý)ð/ñ
ô 
ð 	
ð
øøøs   Â	AC Ã2DÚholder_certÚholderc                 óÌ  — |d         }t          ¦   «         }t          |t          j        ¦  «        s0t	          |d¦  «        }|| j        k    r|                     d¦  «         |d         }t          |t          j        ¦  «        s0t          |d¦  «        }|| j        k    r|                     d¦  «         |d         }t          |t          j        ¦  «        st          d¦  «        ‚|S )a  
    Match a candidate holder certificate against the holder entry of an
    attribute certificate.

    :param holder_cert:
        Candidate holder certificate.
    :param holder:
        Holder value to match against.
    :return:
        Return the parts of the holder entry that mismatched as a set.
        Possible values are `'base_certificate_id'`, `'entity_name'` and
        `'object_digest_info'`.
        If the returned set is empty, all entries in the holder entry
        matched the information in the certificate.
    r±   z,Could not identify holder certificate issuerÚentity_namezCould not identify AC holder DNr²   z-Object digest info is currently not supported)
r]   r¥   r   r¦   r    Úissuer_serialÚaddr@   r¶   r³   )rÚ   rÛ   Úbase_cert_idÚ
mismatchesÚdesignated_iss_serialrÝ   Ú	holder_dnÚobj_digest_infos           rK   Úcheck_ac_holder_matchrå   Á  sü   € ð" Ð/Ô0€LÝ‘”€Jõ �l¥D¤IÑ.Ô.ð 2õ !2ØÐHñ!
ô !
Ðð ! KÔ$=Ò=Ð=Ø�NŠNÐ0Ñ1Ô1Ð1à˜Ô'€Kå�k¥4¤9Ñ-Ô-ð *Ý$ØÐ:ñ
ô 
ˆ	ð ˜Ô+Ò+Ð+Ø�NŠN˜=Ñ)Ô)Ð)ð Ð1Ô2€OÝ�o¥t¤yÑ1Ô1ð 
Ý!Ø;ñ
ô 
ð 	
ð ÐrM   T)Úfrozenc                   óp   — e Zd ZU dZej        ed<   	 ej        ed<   	 e	ed<   	 e
eej        f         ed<   dS )ÚACValidationResultzF
    The result of a successful attribute certificate validation.
    rs   rÂ   Úaa_pathÚapproved_attributesN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   ÚAttributeCertificateV2Ú__annotations__r   ÚCertificater0   r   ÚstrÚAttCertAttributer{   rM   rK   rè   rè   ñ  sz   € € € € € € ðð ð Ô)Ð)Ð)Ñ)ðð ÔÐÐÑðð ÐÐÑðð ˜c 3Ô#7Ð7Ô8Ð8Ð8Ñ8ðð rM   rè   Úaa_pkix_paramsc              ƒ   óœ  ‡K  — d„ | d         d         D ¦   «         }d„ |                      ¦   «         D ¦   «         }|rKt          dt          |¦  «        dk    rdnd› d	d
                     t	          |¦  «        ¦  «        › d�¦  «        ‚d|v r(|j        }|€t          d¦  «        ‚t          | |¦  «         | d         d         }t          |¦  «        dk    rt          d¦  «        ‚|�7t          ||¦  «        }|r%t          dd
                     |¦  «        › �¦  «        ‚|j	        }	t          | |j        ¦  «        }
g }dŠ|
D �]}	 t          |¦  «         n,# t          $ r}|                     |¦  «         Y d}~Œ8d}~ww xY w	 |	                     |¦  «        ƒ d{V —†}n,# t          $ r}|                     |¦  «         Y d}~Œ�d}~ww xY w|D ]w}	 t!          |||t#          t%          j        |¦  «        d¬¦  «        t(          j        ¬¦  «        ƒ d{V —† |Š n,# t,          $ r}|                     |¦  «         Y d}~Œpd}~ww xY w�Œ‰€|st          d¦  «        ‚|d         ‚‰j        }t1          | ||¦  «         | d         d         }‰                     | ¦  «        }t#          t%          j        |¦  «        ddt          |¦  «        ¬¦  «        }t5          t7          |d         |d         dœ¦  «        |j        |j        |¬¦  «         d|vrt=          | |||¬ ¦  «        ƒ d{V —† ˆfd!„| d         d"         D ¦   «         }t?          | |‰|¬#¦  «        S )$a½  
    Validate an attribute certificate with respect to a given validation
    context.

    :param attr_cert:
        The attribute certificate to validate.
    :param validation_context:
        The validation context to validate against.
    :param aa_pkix_params:
        PKIX validation parameters to supply to the path validation algorithm
        applied to the attribute authority's certificate.
    :param holder_cert:
        Certificate of the presumed holder to match against the AC's holder
        entry. If not provided, the holder check is left to the caller to
        perform.

        .. note::
            This is a convenience option in case there's only one reasonable
            candidate holder certificate (e.g. when the attribute certificates
            are part of a CMS SignedData value with only a single signer).
    :return:
        An :class:`.ACValidationResult` detailing the validation result,
        if successful.
    c                 óP   — i | ]#}|d          j         t          |d         ¦  «        “Œ$S )Úextn_idÚcritical)r_   rp   )r}   Úexts     rK   ú
<dictcomp>z%async_validate_ac.<locals>.<dictcomp>/  s=   € ð ð ð àð 	ˆIŒÔ�t C¨
¤OÑ4Ô4ðð ð rM   r®   Ú
extensionsc                 ó.   — h | ]\  }}|r|t           v¯|’ŒS r{   )ÚSUPPORTED_AC_EXTENSIONS)r}   rù   Úcrits      rK   r   z$async_validate_ac.<locals>.<setcomp>3  s<   € ð 'ð 'ð 'áˆC�Øð'ð Õ6Ð6Ð6ð 	à6Ð6Ð6rM   z^The AC could not be validated because it contains the following unsupported critical extensionr   rX   rY   ú: r\   ú.rv   NzkThe attribute certificate is targeted, but no targeting information is available in the validation context.rÛ   r   zAC holder entry is emptyzYCould not match AC holder entry against supplied holder certificate; mismatched entries: zAA certificate)rO   Úee_name_override)rC   rP   Úcert_profilez:Could not find a suitable AA for the attribute certificateÚatt_cert_validity_periodFzattribute certificate)rO   rÊ   r  Ú
init_indexÚnot_before_timeÚnot_after_time)Ú
not_beforeÚ	not_after©ÚvalidityÚmomentÚ	tolerancerP   r“   ©rP   c                 ób   •— i | ]+}‰                      |d          ¦  «        ¯|d          j        |“Œ,S )Útype)Úaa_attr_in_scoper_   )r}   Úattrré   s     €rK   rú   z%async_validate_ac.<locals>.<dictcomp>   sJ   ø€ ð ð ð àØ×#Ò# D¨¤LÑ1Ô1ðØˆVŒÔ˜Tðð ð rM   Ú
attributes)rs   rÂ   ré   rê   ) Úitemsr   ra   re   rb   Úacceptable_ac_targetsr   r�   rå   Úpath_builderrÁ   Úcertificate_registryrr   rc   Úasync_build_pathsr%   rR   r   r?   rQ   ÚEECertProfileÚATTRIBUTE_AUTHORITYr)   ÚlastrÙ   Úcopy_and_appendÚ_check_validityr   r  Útime_toleranceÚ_check_revocationrè   )rs   rH   rô   rÚ   Úextensions_presentÚunsupported_critical_extensionsÚ	targ_descÚ	ac_holderrá   r  Úaa_candidatesÚ
exceptionsrÀ   ÚeÚpathsÚcandidate_pathrÂ   r
  Úac_pathrP   Úok_attrsré   s                        @rK   Úasync_validate_acr*    sõ  øè è € ðDð à˜YÔ'¨Ô5ðñ ô Ðð'ð 'à+×1Ò1Ñ3Ô3ð'ñ 'ô 'Ð#ð
 'ð 
Ý%ðEåÐ9Ñ:Ô:¸aÒ?Ð?ˆsˆsÀRðEð Eð �yŠy�Ð ?Ñ@Ô@ÑAÔAðEð Eð Eñ
ô 
ð 	
ð Ð1Ð1Ð1Ø&Ô<ˆ	ØÐÝ-ðFñô ð õ 	˜y¨)Ñ4Ô4Ð4à˜)Ô$ XÔ.€IÝ
ˆ9�~„~˜ÒÐÝ)Ð*DÑEÔEÐEàÐÝ*¨;¸	ÑBÔBˆ
Øð 	Ý-ðLØ48·I²I¸jÑ4IÔ4IðLð Lñô ð ð
 &Ô2€LÝ)ØÐ%Ô:ñô €Mð #%€JØ(,€GØ%ð %ñ %ˆð	Ý˜lÑ+Ô+Ð+Ð+øÝ*ð 	ð 	ð 	Ø×Ò˜aÑ Ô Ð ØˆHˆHˆHˆHøøøøð	øøøð	Ø&×8Ò8¸ÑFÔFÐFÐFÐFÐFÐFÐFˆEˆEøÝ ð 	ð 	ð 	Ø×Ò˜aÑ Ô Ð ØˆHˆHˆHˆHøøøøð	øøøð $ð 	%ð 	%ˆNð%Ý(Ø&Ø"Ø-Ý+Ý(0¬°nÑ(EÔ(EØ)9ð ñ  ô  õ "/Ô!Bð	ñ 	ô 	ð 	ð 	ð 	ð 	ð 	ð 	ð 	ð )�Ø�øÝ"ð %ð %ð %Ø×!Ò! !Ñ$Ô$Ð$Ð$Ð$Ð$Ð$Ð$øøøøð%øøøùð €àð 	 Ý#ØLñô ð ð ˜Q”-Ðð Œl€GÝ˜	 7Ð,>Ñ?Ô?Ð?à˜Ô#Ð$>Ô?€Hð ×%Ò% iÑ0Ô0€GÝÝ œ gÑ.Ô.Ø Ø0Ý�w‘<”<ð	ñ ô €Jõ Ýà&Ð'8Ô9Ø%Ð&6Ô7ðð ñ
ô 
ð "Ô(Ø$Ô3Øð
ñ 
ô 
ð 
ð Ð/Ð/Ð/ÝØÐ)¨7¸zð
ñ 
ô 
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
ð 	
ðð ð ð à˜iÔ(¨Ô6ðñ ô €Hõ ØØØØ$ð	ñ ô ð sI   ÅEÅ
E;ÅE6Å6E;Å?FÆ
GÆ%F?Æ?GÇAHÈ
H>ÈH9È9H>c            
       ó4  — e Zd ZU dZed         ed<   eed<   eed<   eed<   eed<   eed<   ej        ed	<   ej	        ed
<   e
ed<   eed<   dZeed<   ededee         fd„¦   «         Zdej        fd„Zdedefd„Zdefd„Zdej        dededej        def
d„ZdS )Ú_PathValidationStatez^
    State variables that need to be maintained while traversing a certification
    path
    r6   Úvalid_policy_treeÚexplicit_policyÚinhibit_any_policyÚpolicy_mappingÚmax_path_lengthÚmax_aa_path_lengthÚworking_public_keyÚworking_issuer_nameÚpermitted_subtreesÚexcluded_subtreesFÚaa_controls_usedÚtrust_anchorrC   c                 ó®  — |j         }| x}}|j        �|j        }|j        �|j        }|j        }|�Í|�Ët	          |j        |j        ¦  «        }|j        o|j        }|j        o|j        }	|j        o|j        }
t          |j
        pt          ¦   «         ¦  «        }|j
        �|                     |j
        ¦  «         t          |j        pt          ¦   «         ¦  «        }|j        �|                     |j        ¦  «         nr|p|pt#          ¦   «         }|j        }|j        }	|j        }|j        }
t          |j
        pt          ¦   «         ¦  «        }t          |j        pt          ¦   «         ¦  «        }t%          t'          j        dt+          ¦   «         dh¦  «        |||	rdn| dz   |rdn| dz   |
rdn| dz   |j        j        |j        j        ||¬¦
  «
        }||fS )NÚ
any_policyr   r   )
r-  r5  r6  r.  r/  r0  r3  r4  r1  r2  )Útrust_qualifiersr1  r2  Ústandard_parametersr4   Úuser_initial_policy_setÚinitial_any_policy_inhibitÚinitial_explicit_policyÚinitial_policy_mapping_inhibitr+   Úinitial_permitted_subtreesr-   Úintersect_withr*   Úinitial_excluded_subtreesr,   Ú
union_withr2   r,  r6   Úinit_policy_treer]   Ú	authorityrÇ   r€   )Úpath_lengthr8  rC   Útrust_anchor_qualsr1  r2  Útrust_anchor_paramsÚacceptable_policiesr>  r?  r@  rA  rC  Ústates                 rK   Úinit_pkix_validation_statez/_PathValidationState.init_pkix_validation_stateÁ  sz  € ð *Ô:ÐØ/:Ð:ˆÐ,ØÔ-Ð9Ø0Ô@ˆOØÔ-Ð9Ø!3Ô!FÐØ0ÔDÐàÐ!Ð&9Ð&Eå"7ØÔ2Ø#Ô;ñ#ô #Ðð
 Ô5ð :ØÔ9ð 'ð Ô2ð 7ØÔ6ð $ð Ô9ð >ØÔ=ð +õ *;ØÔ5ð 0Ý-Ñ/Ô/ñ*ô *Ð&ð #Ô=ÐIØ*×9Ò9Ø'ÔBñô ð õ )9ØÔ4ð /Ý,Ñ.Ô.ñ)ô )Ð%ð #Ô<ÐHØ)×4Ò4Ø'ÔAñô ð øð
 ÐKÐ1ÐKÕ5IÑ5KÔ5Kð ð #-Ô"DÐØ&0Ô&HÐ#Ø)3Ô)NÐ&àÔ9ð +õ *;ØÔ5ð 0Ý-Ñ/Ô/ñ*ô *Ð&õ )9ØÔ4ð /Ý,Ñ.Ô.ñ)ô )Ð%õ
 %å,Ô=Ø�c™eœe l ^ñô ð  :Ø7à"9ÐN˜Q˜Q¸{ÈQ¹à/ÐD��°[À1±_ð 4ÐH��¸Àq¹ð  ,Ô5Ô@Ø ,Ô 6Ô ;à+ð  2ð5
ñ 
ô 
ˆð8 Ð)Ð)Ð)rM   rS   c                 óÆ  — |j         sQ| j        dk    r| xj        dz  c_        | j        dk    r| xj        dz  c_        | j        dk    r| xj        dz  c_        |j        }|rR|d         j        }|�t          | j        |¦  «        | _        |d         j        }|�t          | j        |¦  «        | _        |j        �&t          |j        j        | j        ¦  «        | _        d S d S )Nr   r   Úrequire_explicit_policyÚinhibit_policy_mapping)Úself_issuedr.  r0  r/  Úpolicy_constraints_valuer_   ÚminÚinhibit_any_policy_value)ÚselfrS   Úpolicy_constraintsrN  rO  s        rK   Úupdate_policy_restrictionsz/_PathValidationState.update_policy_restrictions$  s-  € àÔð 		-àÔ# qÒ(Ð(ØÐ$Ô$¨Ñ)Ð$Ô$àÔ" aÒ'Ð'ØÐ#Ô# qÑ(Ð#Ô#àÔ&¨!Ò+Ð+ØÐ'Ô'¨1Ñ,Ð'Ô'ð "Ô:ÐØð 	à&8Ø)ô'äð $ð 'Ð2Ý'*ØÔ(Ð*Añ(ô (�Ô$ð &8Ø(ô&äð #ð &Ð1Ý&)ØÔ'Ð)?ñ'ô '�Ô#ð
 Ô(Ð4Ý&)ØÔ-Ô4°dÔ6Mñ'ô 'ˆDÔ#Ð#Ð#ð 5Ð4rM   ÚindexrP   c                 óâ   — |r%| j         �t          || j         ||¬¦  «        | _         n	|€d | _         | j         €5| j        dk    r,t          j        d|                     ¦   «         › �|¦  «        ‚d S d S )N)ÚdepthÚany_policy_uninhibitedr   úNThe path could not be validated because there is no valid set of policies for )r-  r:   r.  r&   Ú
from_stateÚdescribe_cert)rT  rW  Úcertificate_policiesrZ  rP   s        rK   Úprocess_policiesz%_PathValidationState.process_policiesK  s¬   € ð  ð 
	* DÔ$:Ð$FÝ%7Ø$ØÔ&ØØ'=ð	&ñ &ô &ˆDÔ"Ð"ð "Ð)Ø%)ˆDÔ"ð Ô!Ð)¨dÔ.BÀaÒ.GÐ.GÝ%Ô0ð@Ø#-×#;Ò#;Ñ#=Ô#=ð@ð @àñô ð ð *Ð)Ð.GÐ.GrM   c                 ó>  — | j                              |¦  «        }|s2t          j        d|                     ¦   «         › d|j        › �|¦  «        ‚| j                             |¦  «        }|s2t          j        d|                     ¦   «         › d|j        › �|¦  «        ‚d S )Nz9The path could not be validated because not all names of z: are in the permitted namespace of the issuing authority. z6The path could not be validated because some names of z; are excluded from the namespace of the issuing authority. )r5  Úaccept_certr&   r\  r]  Úerror_messager6  )rT  rS   rP   Úwhitelist_resultÚblacklist_results        rK   Úcheck_name_constraintsz+_PathValidationState.check_name_constraintsf  sã   € àÔ2×>Ò>¸tÑDÔDÐØð 	Ý%Ô0ðNØ×+Ò+Ñ-Ô-ðNð Nà-=Ô-KðNð Nð ñ	ô ð ð  Ô1×=Ò=¸dÑCÔCÐØð 	Ý%Ô0ð4Ø×+Ò+Ñ-Ô-ð4ð 4ð $Ô1ð4ð 4ð ñô ð ð	ð 	rM   rÐ   r  rÓ   c                 ód  — |d         }|d         j         }|                     ||| j        ¬¦  «        }|sLd|                     ¦   «         › d|› d�}	|j        �|	d|j        › d�z  }	t          j        |	||j        ¬¦  «        ‚	 |                     |d	         j         |d
          	                    ¦   «         | j        |¬¦  «         d S # t          $ r, t          j        d|                     ¦   «         › d�|¦  «        ‚t          $ r, t          j        d|                     ¦   «         › d�|¦  «        ‚w xY w)NrÄ   rÈ   rÆ   z9The path could not be validated because the signature of z) uses the disallowed signature mechanism r   z	 Reason: )rË   Úsignature_valueÚtbs_certificaterÌ   zThe signature parameters for z0 do not match the constraints on the public key.z could not be verified)r_   rÑ   r3  r]  Úfailure_reasonr   r\  rÒ   rÔ   r|   r'   r&   r   )
rT  rS   rÐ   rP   r  rÓ   rÕ   Úsd_algo_nameÚsig_algo_allowedÚmsgs
             rK   Úcheck_certificate_signaturez0_PathValidationState.check_certificate_signaturez  sÐ  € ð 04Ð4IÔ/JˆØ˜{Ô+Ô2ˆØ+×GÒGØ�V¨Ô(?ð Hñ 
ô 
Ðð  ð 	ð7Ø ×.Ò.Ñ0Ô0ð7ð 7à'3ð7ð 7ð 7ð ð
  Ô.Ð:ØÐEÐ#3Ô#BÐEÐEÐEÑE�Ý*Ô5ØØØ-Ô?ðñ ô ð ð	Ø×,Ò,ØÐ0Ô1Ô8Ø Ð!2Ô3×8Ò8Ñ:Ô:Ø $Ô 7Ø$+ð	 -ñ ô ð ð ð øõ $ð 	ð 	ð 	Ý%Ô0ð@°
×0HÒ0HÑ0JÔ0Jð @ð @ð @àñô ð õ
  ð 	ð 	ð 	Ý%Ô0ðFØ×+Ò+Ñ-Ô-ðFð Fð Fàñô ð ð	øøøs   ÂAC ÃA*D/N)rë   rì   rí   rî   r   rð   Úintr   ÚPublicKeyInfoÚNamer+   r*   r7  rp   Ústaticmethodr   r2   rL  rñ   rV  r   r_  re  r1   Údatetimer>   rm  r{   rM   rK   r,  r,  ®  s�  € € € € € € ðð ð
  Ð 0Ô1Ð1Ð1Ñ1ØÐÐÑØÐÐÑØÐÐÑØÐÐÑØÐÐÑØÔ*Ð*Ð*Ñ*ØœÐ"Ð"Ñ"Ø)Ð)Ð)Ñ)Ø'Ð'Ð'Ñ'Ø"Ð�dÐ"Ð"Ñ"àð`*à!ð`*ð Ð1Ô2ð`*ð `*ð `*ñ „\ð`*ðD%¨tÔ/?ð %ð %ð %ð %ðNàðð
 !ðð ð ð ð6°|ð ð ð ð ð(-àÔð-ð /ð-ð !ð	-ð
 Ô!ð-ð *ð-ð -ð -ð -ð -ð -rM   r,  )rŽ   r�   Úbasic_constraintsr�   rU   r‘   r’   rT   Úocsp_no_checkr^  Úpolicy_mappingsrU  r/  Úname_constraintsÚsubject_alt_nameÚaa_controlsz1.3.6.1.5.5.7.1.3Úqc_statementsc                   ó   — e Zd ZdZdZdS )r  ÚregularÚattribute_authorityN)rë   rì   rí   ÚREGULARr  r{   rM   rK   r  r  Æ  s   € € € € € à€GØ/ÐÐÐrM   r  rP   r  c              ƒ   ó0  K  — | j         }|j        j        }|j        �&|j        |k    rt	          j        |j        |¬¦  «        ‚|j        �&|j        |k     rt          j        |j        |¬¦  «        ‚|j        }|j        }t           
                    |||¦  «        \  }	}
t          |g d¬¦  «        }|j        }t          |t          ¦  «        r#|                      |j        |¦  «         |j        }nd}d}| j        }t          |j        t&          j        ¦  «        r|                     |j        |¦  «        }t-          d|dz   ¦  «        D �]}||         }|xj        dz  c_        |	                     || j        || j        | j        ¦  «         | j        }|d         d         }t;          ||||¬	¦  «         |s/|                     ||¦  «        st=          || ||¬
¦  «        ƒ d{V —† |j        |	j         k    r+tC          j"        d| #                    ¦   «         › d�|¦  «        ‚||k    s|j$        s|	 %                    ||¬¦  «         |	 &                    ||j'        |	j(        dk    p||k     o|j$        |¬¦  «         ||k     rtS          |||	|¬¦  «         |tT          j+        k    rtY          ||	||¬¦  «         |j-        t\          z
  }|retC          j"        d| #                    ¦   «         › dt_          |¦  «        dk    rdnd› dd 0                    tc          |¦  «        ¦  «        › �|¦  «        ‚| r+| 2                    |¦  «        }|                      ||¦  «         �Œ|�>tg          |	||
||¬¦  «        }| 4                    |¦  «         | 4                    |¦  «         |S )a  
    Internal copy of validate_path() that allows overriding the name of the
    end-entity certificate as used in exception messages. This functionality is
    used during chain validation when dealing with indirect CRLs issuer or
    OCSP responder certificates.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the path to validate

    :param proc_state:
        Internal state for error reporting and policy application decisions.

    :param parameters:
        Additional input parameters to the PKIX validation algorithm.
        These are not used when validating CRLs and OCSP responses.

    :param cert_profile:
        End-entity certificate profile to use.
        Currently, this is only used to decide whether to process the AAControls extension.

    :return:
        The final certificate in the path - an instance of
        asn1crypto.x509.Certificate
    N©Ú
valid_fromrP   ©Ú
expired_dtrP   )ÚintermÚleafFr   rh  r
  r	  )rS   rH   rI   rP   ú(The path could not be validated because z! issuer name could not be matchedr  r   )rZ  rP   z6 contains the following unsupported critical extensionrX   rY   rÿ   r\   )rK  rS   rJ  rG  rP   )5r  r8  r;  r€  r    ÚformatÚvalid_untilr   Úpkix_lenr,  rL  r0   rF  r¥   r   Úrecord_validationÚcertificateÚrevinfo_managerr„  r   rñ   Úcheck_asserted_unrevokedÚrangerW  rm  rÐ   rÏ   rÓ   r  r  r  r™   r4  r&   r\  r]  rP  re  r_  Úcertificate_policies_valuer/  Ú_prepare_next_stepr  r  Ú_check_aa_controlsÚcritical_extensionsÚSUPPORTED_EXTENSIONSra   re   rb   r  Ú_finish_policy_processingÚ_set_qualified_policies)rH   rI   rP   rC   r  r  Ú
qualifiersr8  rG  rK  rJ  Úcompleted_pathrF  rS   Úleaf_asserted_nonrevokedr‹  rW  r  r
  r   Úqualified_policiess                        rK   rR   rR   Ì  sÔ  è è € ðH  Ô&€FàÔ"Ô3€JØÔÐ(¨ZÔ-BÀVÒ-KÐ-KÝÔ%Ø!Ô,¸ð
ñ 
ô 
ð 	
ð 
Ô	Ð	+°
Ô0FÈÒ0OÐ0OÝÔ!Ø!Ô-¸*ð
ñ 
ô 
ð 	
ð Ô$€Là”-€Kõ 	×7Ò7Ø�\ :ñ	ô 	ñØØõ &4Ø˜R dð&ñ &ô &€Nð
 Ô&€IÝ�)Õ.Ñ/Ô/ð à×,Ò,ØÔ! >ñ	
ô 	
ð 	
ð Ô$ˆˆàˆð  %ÐØ(Ô8€OÝ�$”)�TÔ-Ñ.Ô.ð 
Ø#2×#KÒ#KØŒI�vñ$
ô $
Ð õ �q˜+¨™/Ñ*Ô*ð XGñ XGˆØ�EŒ{ˆàÐÔ˜AÑÐÔà×)Ò)ØØÔ/ØØÔ2ØÔ,ñ	
ô 	
ð 	
ð 'Ô5ˆ	ØÐ)Ô*¨:Ô6ˆÝØØØØ!ð		
ñ 	
ô 	
ð 	
ð )ð		à#×<Ò<¸TÀ6ÑJÔJð		õ $ØØ#5ØØ%ð	ñ ô ð ð ð ð ð ð ð ð Œ;˜%Ô3Ò3Ð3Ý%Ô0ð(Ø×+Ò+Ñ-Ô-ð(ð (ð (ð ñ	ô ð ð �KÒÐ tÔ'7ÐØ×(Ò(¨¸*Ð(ÑEÔEÐEð 	×ÒØØÔ+ð Ô(¨1Ò,ð >Ø˜KÒ'Ð<¨DÔ,<à!ð 	ñ 		
ô 		
ð 		
ð �;ÒÐå˜u d¨E¸jÐIÑIÔIÐIà�=Ô<Ò<Ð<Ý˜t U¨E¸jÐIÑIÔIÐIð
 Ô$Õ';Ñ;ð 	(ð +ð 	Ý%Ô0ðJØ×+Ò+Ñ-Ô-ðJð Jõ Ð=Ñ>Ô>À!ÒCÐC�3�3ÈðJð Jð —Y’Y�vÐ&EÑFÔFÑGÔGð	Jð Jð
 ñô ð ð ð 	Gð
 ,×;Ò;¸DÑAÔAˆNØ×0Ò0°°~ÑFÔFÐFùð ÐÝ6ØØØ 3Ø#Ø!ð
ñ 
ô 
Ðð 	×$Ò$Ð%7Ñ8Ô8Ð8à×.Ò.Ð/AÑBÔBÐBà€KrM   r
  c                 óÚ   — || d         j         |z
  k     r!t          j        | d         j         |¬¦  «        ‚|| d         j         |z   k    r!t          j        | d         j         |¬¦  «        ‚d S )Nr  r  r  r�  )r_   r    r†  r   r	  s       rK   r  r  ‘  sŒ   € ð �˜Ô&Ô-°	Ñ9Ò9Ð9ÝÔ%Ø Ô-Ô4Àð
ñ 
ô 
ð 	
ð �˜Ô%Ô,¨yÑ8Ò8Ð8ÝÔ!Ø Ô,Ô3À
ð
ñ 
ô 
ð 	
ð 9Ð8rM   c                 óÔ  ‡‡— | j         dk    r| xj         dz  c_         |j        r|j        d         j        dk    rd| _         | j        €d Šn%|dhk    r| j        Šnt	          ‰| j        |¦  «        Št          ¦   «         }‰�1dt          t                   fˆˆfd„}t           |¦   «         ¦  «        }n6| j         dk    r+t          j	        d| 
                    ¦   «         › d�|¦  «        ‚|S )	Nr   r   rN  r:  r—   c               3   ó  •K  — ‰€J ‚‰                      ‰¦  «        D ]c} | j        }|dk    r,t          d„ |                      ¦   «         D ¦   «         ¦  «        }nd}t	          ||t          | j        ¦  «        ¬¦  «        V — Œdd S )Nr:  c              3   óD   K  — | ]}|j         j        d k    ¯|j        V — ŒdS )r:  N)ÚparentÚvalid_policy)r}   Úancestors     rK   ú	<genexpr>zD_finish_policy_processing.<locals>._enum_policies.<locals>.<genexpr>Ä  sA   è è € ð 1ð 1à$Ø#œ?Ô7¸<ÒGÐGð !Ô-àGÐGÐGÐGð1ð 1rM   )Úuser_domain_policy_idÚissuer_domain_policy_idr•  )Úat_depthrž  ÚnextÚpath_to_rootr/   Ú	frozensetÚqualifier_set)Úaccepted_policyÚ
listed_polr¡  ÚintersectionrG  s      €€rK   Ú_enum_policiesz1_finish_policy_processing.<locals>._enum_policies»  sÌ   øè è € àÐ+Ð+Ð+Ø#/×#8Ò#8¸Ñ#EÔ#Eð ð �Ø,Ô9�
Ø Ò-Ð-õ -1ð 1ð 1à(7×(DÒ(DÑ(FÔ(Fð1ñ 1ô 1ñ -ô -Ð)Ð)ð -9Ð)å%Ø*?Ø,6Ý(¨Ô)FÑGÔGðñ ô ð ð ð ð ð%ð rM   r[  r   )r.  rQ  r_   r-  r9   r¦  r   r/   r&   r\  r]  )rK  rS   rJ  rG  rP   r˜  r«  rª  s      `   @rK   r“  r“  ž  sF  øø€ ð Ô Ò!Ð!ØÐÔ Ñ"ÐÔàÔ$ð &ØÔ(Ð)BÔCÔJÈaÒOÐOØ$%ˆEÔ!ð ÔÐ&Øˆˆð 
  Ò	.Ð	.ØÔ.ˆˆõ 3Ø˜Ô0Ð2Eñ
ô 
ˆõ 6?±[´[ÐØÐð	¥­Ô 9ð 	ð 	ð 	ð 	ð 	ð 	ð 	õ6 ' ~ ~Ñ'7Ô'7Ñ8Ô8ÐÐØ	Ô	 !Ò	#Ð	#Ý!Ô,ð:Ø&×4Ò4Ñ6Ô6ð:ð :ð :àñ
ô 
ð 	
ð
 ÐrM   c              ƒ   ód  K  — d}d}d}d}d}g }	t          | ¦  «        \  }
}|
p|}|j        j        }|j        r|j        n|j        }d }|j        rû|rù	 t          | |||¬¦  «        ƒ d {V —† d}d}nÚ# t          $ r9}|	 	                    d„ |j
        D ¦   «         ¦  «         d}d}|j        }Y d }~nœd }~wt          $ r Y n�t          $ rK}|j        rd}|                     |¦  «         n"|	                     |j        d         ¦  «         d}Y d }~n>d }~wt$          $ r.}|	                     |j        d         ¦  «         d}d}Y d }~nd }~ww xY w|sr|j        rk|	r d                     d„ |	D ¦   «         ¦  «        }nd}d	|                     ¦   «         › d
|› �}|rt-          j        |||¦  «        ‚t1          j        ||¦  «        ‚|o|t4          j        k    }d}d }|j        p| o|t4          j        k    }|j        o|
}|s|rÇ|sÅ	 t?          | |||¬¦  «        ƒ d {V —† d}d}d}n¤# t@          $ r9}|	 	                    d„ |j
        D ¦   «         ¦  «         d}d}|j        }Y d }~nfd }~wtB          $ r Y nWtD          $ rK}|j        rd}|                     |¦  «         n"|	                     |j        d         ¦  «         d}Y d }~nd }~ww xY w|sr|j        rk|	r d                     d„ |	D ¦   «         ¦  «        }nd}d|                     ¦   «         › d
|› �}|rt-          j        |||¦  «        ‚t1          j        ||¦  «        ‚|j#        p|o|t4          j$        k    }|p|}| o|}|sÔ|sz|rx|rvd|                     d¬¦  «        › dd                     |	¦  «        › �}|p|}|r,|r|rtK          ||¦  «        n|}t-          j        |||¦  «        ‚t1          j        ||¦  «        ‚|rXtM          | tN          j(        ¦  «        r| j)        j*        }nd}t1          j        d|                     ¦   «         › d|› �|¦  «        ‚d S d S )NFr  Tc                 ó   — g | ]
}|d          ‘ŒS ©r   r{   ©r}   Úfailures     rK   ú
<listcomp>z%_check_revocation.<locals>.<listcomp>  ó   € ÐBÐBÐB¨G˜W QœZÐBÐBÐBrM   r   z; c              3   ó4   K  — | ]}t          |¦  «        V — Œd S ©N©rò   ©r}   Úfs     rK   r   z$_check_revocation.<locals>.<genexpr>  ó(   è è € Ð9Ð9¨1¥ A¡¤Ð9Ð9Ð9Ð9Ð9Ð9rM   z.an applicable OCSP response could not be foundzHThe path could not be validated because the mandatory OCSP check(s) for z	 failed: c                 ó   — g | ]
}|d          ‘ŒS r®  r{   r¯  s     rK   r±  z%_check_revocation.<locals>.<listcomp>8  r²  rM   c              3   ó4   K  — | ]}t          |¦  «        V — Œd S r´  rµ  r¶  s     rK   r   z$_check_revocation.<locals>.<genexpr>H  r¸  rM   z$an applicable CRL could not be foundzGThe path could not be validated because the mandatory CRL check(s) for r…  )Ú
def_intermz revocation checks failed: rY   zUThe path could not be validated because no revocation information could be found for r[   )+rB   Úrevinfo_policyÚrevocation_checking_policyrÉ   Úee_certificate_ruleÚintermediate_ca_cert_ruleÚocsp_relevantr=   r$   ÚextendÚfailuresÚsuspect_staler"   r!   ÚtolerantÚ_report_soft_failrc   Úargsr#   Úocsp_mandatoryre   r]  r(   r†  r   r\  r3   ÚCRL_AND_OCSP_REQUIREDÚcrl_mandatoryÚCRL_OR_OCSP_REQUIREDÚcrl_relevantr<   r   r   r   ÚstrictÚCHECK_IF_DECLAREDÚmaxr¥   r   rñ   r¶   Úhuman_friendly)rS   rH   rI   rP   Úocsp_status_goodÚrevocation_check_failedÚocsp_matchedÚcrl_matchedÚ	soft_failrÂ  Úcert_has_crlÚcert_has_ocspÚrevinfo_declaredÚrev_check_policyÚrev_ruleÚocsp_suspect_stale_sincer%  Úerr_strrl  Ústatus_goodÚcrl_status_goodÚcrl_suspect_stale_sinceÚcrl_required_by_policyÚcrl_fetchableÚexpected_revinfoÚmatchedÚexpected_revinfo_not_foundÚmaybe_stale_cutoffÚstale_cutoffÚsubjs                                 rK   r  r  à  s»  è è € ð ÐØ#ÐØ€LØ€KØ€IØ€HÝ"6°tÑ"<Ô"<Ñ€L�-Ø#Ð4 }ÐàÔ)ÔDð ð
 Ô ð	8ÐÔ,Ð,àÔ7ð ð  $ÐàÔð   -ð  ð	 Ý&Ø�dÐ.¸:ðñ ô ð ð ð ð ð ð ð ð  $ÐØˆLˆLøÝ/ð 	7ð 	7ð 	7Ø�OŠOÐBÐB°q´zÐBÑBÔBÑCÔCÐCØ&*Ð#ØˆLØ'(¤Ð$Ð$Ð$Ð$Ð$Ð$øøøøÝ!ð 	ð 	ð 	ØˆDÝð 	/ð 	/ð 	/ØÔ ð /Ø �	Ø"×4Ò4°QÑ7Ô7Ð7Ð7à—’ ¤ q¤	Ñ*Ô*Ð*Ø*.Ð'øøøøøøøøøÝ"ð 	 ð 	 ð 	 Ø�OŠO˜AœF 1œIÑ&Ô&Ð&Ø&*Ð#ØˆLˆLˆLˆLˆLˆLøøøøð	 øøøð ð G Ô 7ð GØð 	GØ—i’iÐ9Ð9°Ð9Ñ9Ô9Ñ9Ô9ˆGˆGàFˆGðKØ&×4Ò4Ñ6Ô6ðKð KØAHðKð Kð 	ð $ð 	GÝ#Ô*ØÐ-¨zñô ð õ +Ô5°c¸:ÑFÔFÐFàð 	EØÕ.ÔDÒDð ð
 €OØ"Ðð &Ô3ð Øˆð 	DØÕ.ÔCÒCð ð Ô)Ð:¨l€MØð / -ð /¸ð /ð	/ÝØ�dÐ.¸:ðñ ô ð ð ð ð ð ð ð ð ',Ð#Ø"ˆOØˆKˆKøÝ.ð 	6ð 	6ð 	6Ø�OŠOÐBÐB°q´zÐBÑBÔBÑCÔCÐCØ&*Ð#ØˆKØ&'¤oÐ#Ð#Ð#Ð#Ð#Ð#øøøøÝ ð 	ð 	ð 	ØˆDÝð 	/ð 	/ð 	/ØÔ ð /Ø �	Ø"×4Ò4°QÑ7Ô7Ð7Ð7à—’ ¤ q¤	Ñ*Ô*Ð*Ø*.Ð'øøøøøøøøøð	/øøøð ð ˜xÔ5ð Øð 	=Ø—i’iÐ9Ð9°Ð9Ñ9Ô9Ñ9Ô9ˆGˆGà<ˆGðKØ&×4Ò4Ñ6Ô6ðKð KØAHðKð Kð 	ð #ð 	Ý#Ô*ØÐ,¨jñô ð õ +Ô5ØØñô ð ð  ”ð Øð 	AØÕ.Ô@Ò@ð ð
 Ð)˜\€GØ%, Ð!AÐ1AÐØð  Øð 	˜wð 	Ð+Bð 	ð8Ø×+Ò+°tÐ+Ñ<Ô<ð8ð 8à"&§)¢)¨HÑ"5Ô"5ð8ð 8ð ð )ÐCÐ,Cð ð "ð ð 0ð,Ø4Kð,•CÐ0Ð2IÑJÔJÐJà+ð õ
 (Ô.¨s°LÀ*ÑMÔMÐMå.Ô9ØØñô ð ð &ð 
	Ý˜$¥Ô 0Ñ1Ô1ð Ø”|Ô2��à�Ý*Ô5ðØ2<×2JÒ2JÑ2LÔ2Lðð àðð ð ñ	ô ð ð7 ð  ð,
	ð 
	sb   ÁA0 Á0
EÁ:/B.Â.EÂ=	EÃADÄEÄ$EÅEÇ>H È
J?È(/IÉJ?É+	J?É4AJ:Ê:J?rK  c                 ób  — t          j        | ¦  «        }|�f|j        s1|dk    r+t          j        d|                     ¦   «         › d�|¦  «        ‚d|_        |d         j        }|�||j        k     r||_        d S d S d S |j        r+t          j        d|                     ¦   «         › d�|¦  «        ‚d S )Nr   zEAA controls extension only present on part of the certificate chain: z6 has AA controls while preceding certificates do not. TÚpath_len_constraintz has no AA controls )r   Úread_extension_valuer7  r&   r\  r]  r_   r2  )rS   rK  rW  rP   rx  Únew_max_aa_path_lengths         rK   r�  r�  ˆ  s  € õ Ô1°$Ñ7Ô7€KØÐØÔ%ð 	¨%°!ª)¨)Ý%Ô0ðBØ&0×&>Ò&>Ñ&@Ô&@ðBð Bð Bð ñ	ô ð ð "&ˆÔà!,Ð-BÔ!CÔ!JÐà"Ð.Ø&¨Ô)AÒAÐAà'=ˆEÔ$Ð$Ð$ð /Ð.ØAÐAð 
Ô	ð 
Ý!Ô,ð#Ø",×":Ò":Ñ"<Ô"<ð#ð #ð #ð ñ	
ô 
ð 	
ð
ð 
rM   c                 ó,  — |j         rCt          |j         |¬¦  «        }|j        �&t          ||j        | |j        dk    ¬¦  «        |_        |j        |_        d }|j        j        dk    rC|j        j	        €7|j
        j        dk    r'|j
        d         }|d                              ¦   «         }|r,|j                             ¦   «         }||d         d<   ||_
        n|j        |_
        |j        }|�’|d         }	t          |	t          j        ¦  «        r'|j                             t%          |	¦  «        ¦  «         |d         }
t          |
t          j        ¦  «        r'|j                             t%          |
¦  «        ¦  «         |                     |¦  «         |j        s+t/          j        d	|                     ¦   «         › d
�|¦  «        ‚|j        s`|j        dk    rt/          j        d|¦  «        ‚|xj        dz  c_        |j        dk    rt/          j        d|¦  «        ‚|xj        dz  c_        |j        �|j        |j        k     r|j        |_        |j        r9d|j        j        vr-t/          j        d	|                     ¦   «         › d�|¦  «        ‚d S d S )Nr  r   )rY  Úpolicy_mapping_uninhibitedÚdsarÈ   rC   r5  r6  r…  z is not a CAzJThe path could not be validated because it exceeds the maximum path lengthr   z`The path could not be validated because it exceeds the maximum path length for an AA certificateÚkey_cert_signz$ is not allowed to sign certificates)Úpolicy_mappings_valuer8   r-  r7   r0  r¶   r4  rÇ   rÈ   Ú	hash_algor3  ÚcopyÚname_constraints_valuer¥   r   ÚGeneralSubtreesr5  rB  r.   r6  rD  rV  rn   r&   r\  r]  rP  r1  r2  r^   r_   )rW  rS   rK  rP   Ú
policy_mapÚcopy_paramsÚkey_algr3  Únc_valueÚnew_permitted_subtreesÚnew_excluded_subtreess              rK   r�  r�  ¨  s*  € ð Ô!ð Ý.ØÔ&°:ð
ñ 
ô 
ˆ
ð
 Ô"Ð.Ý&:ØØÔ'ØØ+0Ô+?À!Ò+Cð	'ñ 'ô 'ˆEÔ#ð !%¤€EÔð €KØ„Ô  EÒ)Ð)¨d¬oÔ.GÐ.OØÔ#Ô-°Ò6Ð6ØÔ.¨{Ô;ˆGØ! ,Ô/×4Ò4Ñ6Ô6ˆKàð 3Ø!œ_×1Ò1Ñ3Ô3ÐØ8CÐ˜;Ô'¨Ñ5Ø#5ˆÔ Ð à#'¤?ˆÔ ð &*Ô%@€HØÐØ!)Ð*>Ô!?ÐÝÐ,­dÔ.BÑCÔCð 	ØÔ$×3Ò3Ý(Ð)?Ñ@Ô@ñô ð ð !)Ð)<Ô =ÐÝÐ+­TÔ-AÑBÔBð 	ØÔ#×.Ò.Ý(Ð)>Ñ?Ô?ñô ð ð
 
×$Ò$ TÑ*Ô*Ð*ð Œ7ð 
Ý!Ô,ð8Ø×'Ò'Ñ)Ô)ð8ð 8ð 8àñ
ô 
ð 	
ð Ôð &ØÔ  AÒ%Ð%Ý%Ô0ð&àñô ð ð
 	ÐÔ Ñ"ÐÔØÔ# qÒ(Ð(Ý%Ô0ð<àñô ð ð
 	Ð Ô  AÑ%Ð Ô ð 	ÔÐ(ØÔ  5Ô#8Ò8Ð8à $Ô 4ˆÔð 	Ôð
à 4Ô#7Ô#>Ð>Ð>å!Ô,ðPØ×'Ò'Ñ)Ô)ðPð Pð Pàñ
ô 
ð 	
ð	
ð 
à>Ð>rM   r´  ){rE   rr  ÚenumÚloggingÚdataclassesr   Útypingr   r   r   r   r   r	   Ú
asn1cryptor
   r   r   r   Úasn1crypto.x509r   Úcryptography.exceptionsr   Ú_stater   Ú
asn1_typesr   r   rF  r   r   Úcontextr   r   Úerrorsr   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   Ú
name_treesr*   r+   r,   r-   r.   rI   r/   r0   Úpolicy_declr1   r2   r3   r4   Úpolicy_treer5   r6   r7   r8   r9   r:   r¬   r;   Úrevinfo.validate_crlr<   Úrevinfo.validate_ocspr=   Úsig_validater>   Úutilr?   r@   rA   rB   Ú	getLoggerrë   r„   rL   rG   rñ   rò   rp   rk   rr   rï   r�   r¦  rý   ÚIssuerSerialÚbytesr    ÚAuthorityKeyIdentifierr«   rÁ   rÙ   ÚHolderrå   rè   r*  r,  r’  ÚuniqueÚEnumr  r}  rR   r  r“  r  r�  r�  r{   rM   rK   ú<module>r     s  ðð €€€Ø €€€Ø €€€Ø €€€Ø !Ð !Ð !Ð !Ð !Ð !Ø AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ Aà -Ð -Ð -Ð -Ð -Ð -Ð -Ð -Ð -Ð -Ð -Ð -Ø $Ð $Ð $Ð $Ð $Ð $Ø 4Ð 4Ð 4Ð 4Ð 4Ð 4à  Ð  Ð  Ð  Ð  Ð  Ø *Ð *Ð *Ð *Ð *Ð *Ð *Ð *Ø 5Ð 5Ð 5Ð 5Ð 5Ð 5Ð 5Ð 5Ø ;Ð ;Ð ;Ð ;Ð ;Ð ;Ð ;Ð ;ðð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð(ð ð ð ð ð ð ð ð ð ð ð ð ð ð 2Ð 1Ð 1Ð 1Ð 1Ð 1Ð 1Ð 1ðð ð ð ð ð ð ð ð ð ð ð ðð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ð ,Ð +Ð +Ð +Ð +Ð +Ø ,Ð ,Ð ,Ð ,Ð ,Ð ,Ø 7Ð 7Ð 7Ð 7Ð 7Ð 7Ø ,Ð ,Ð ,Ð ,Ð ,Ð ,ðð ð ð ð ð ð ð ð ð ð ð ð 
ˆÔ	˜8Ñ	$Ô	$€ð LPð&ð &Ø*2Ð3GÔ*Hð&ð &ð &ð &ðX 26ð#ð #Ø)ð#à
ð#ð Ð-Ô.ð#ð #ð #ð #ðL=
Ø
Ô
ð=
à�3Œxð=
ð ˜Cœð=
ð ð	=
ð =
ð =
ð =
ðD .2ð
ð 
Ø
Ô
ð
à   S¤Ô*ð
ð 
ð 
ð 
ð:$CØÔ)ð$Cà+ð$Cð $Cð $Cð $CðN $˜)ðð ð ñô Ð ð&ØÔ ðØ25ðà
ðð ð ð ð /˜dÔ9ð /ð /ð /ð /ð<ØÔ)ð<Ø5Jð<ð <ð <ð <ð~0
ØÔ)ð0
àÔð0
ð *ð0
ð 0
ð 0
ð 0
ðf- tÔ'7ð -ÀÄð -ð -ð -ð -ð` €�$ÐÑÔðð ð ð ð ñ ô ñ Ôðð< ,@Ð+?Ñ+AÔ+AØ.2ð	^ð ^ØÔ)ð^à)ð^ð )ð^ð ˜$Ô*Ô+ð	^ð
 ð^ð ^ð ^ð ^ðB ðxð xð xð xð xñ xô xñ „ðxðx !�yðð ð ñô Ð ð6 „ð0ð 0ð 0ð 0ð 0�D”Iñ 0ô 0ñ „ð0ð 26Ø"/Ô"7ðBð BØ)ðBà
ðBð ðBð Ð-Ô.ð	Bð
  ðBð Bð Bð BðJ

Øð

Ø7Cð

ð 

ð 

ð 

ð?Ø?Kð?ð ?ð ?ð ?ðDeà)ðeð ðeð ð	eð eð eð eðP
Ø
Ô
ð
àð
ð ð	
ð 
ð 
ð 
ð@e
à
Ô
ðe
ð  ðe
ð ð	e
ð e
ð e
ð e
ð e
ð e
rM   