| Current File : //usr/lib64/python3.9/site-packages/cryptography/x509/__pycache__/base.cpython-39.pyc |
a
�a� � @ s� d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z d dl m
Z
mZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZm Z d dl m Z m Z d d l m!Z! e�d
d d �Z"G d d
� d
e#�Z$ee ej%ee dd�dd�Z&e!ej%ej'e!e(f dd�dd�Z)ejejd�dd�Z*G dd� d�Z+G dd� d�Z,G dd � d ej-�Z.G d d � d e#�Z/G d d � d e j0d!�Z1e1�2ej1� G d"d#� d#e j0d!�Z3e3�2ej3� G d$d%� d%e3�Z4G d&d'� d'e j0d!�Z5e5�2ej5� G d(d)� d)e j0d!�Z6e6�2ej6� dBe(ej7e1d*�d+d,�Z8dCe(ej7e1d*�d-d.�Z9dDe(ej7e6d*�d/d0�Z:dEe(ej7e6d*�d1d2�Z;dFe(ej7e5d*�d3d4�Z<dGe(ej7e5d*�d5d6�Z=G d7d8� d8e>�Z?G d9d:� d:e>�Z@G d;d<� d<e>�ZAG d=d>� d>e>�ZBeCd?�d@dA�ZDdS )H� N)�utils)�x509)�hashes�
serialization)�dsa�ec�ed25519�ed448�rsa�x25519�x448)� CERTIFICATE_PUBLIC_KEY_TYPES�PRIVATE_KEY_TYPES�PUBLIC_KEY_TYPES)� Extension�
ExtensionType�
Extensions�_make_sequence_methods)�Name� _ASN1Type)�ObjectIdentifieri� � c s& e Zd Zeedd�� fdd� Z� ZS )�AttributeNotFoundN)�msg�oid�returnc s t t| ��|� || _d S �N)�superr �__init__r )�selfr r �� __class__� �</usr/lib64/python3.9/site-packages/cryptography/x509/base.pyr * s zAttributeNotFound.__init__)�__name__�
__module__� __qualname__�strr r �
__classcell__r" r" r r# r ) s r )� extension�
extensionsr c C s" |D ]}|j | j krtd��qd S )Nz$This extension has already been set.)r �
ValueError)r) r* �er" r" r# �_reject_duplicate_extension/ s r- )r �
attributesr c C s" |D ]\}}|| krt d��qd S )Nz$This attribute has already been set.)r+ )r r. Zattr_oid�_r" r" r# �_reject_duplicate_attribute9 s r0 ��timer c C s: | j dur2| �� }|r|nt�� }| jdd�| S | S dS )z�Normalizes a datetime to a naive datetime in UTC.
time -- datetime to normalize. Assumed to be in UTC if not timezone
aware.
N)�tzinfo)r3 Z utcoffset�datetimeZ timedelta�replace)r2 �offsetr" r" r# �_convert_to_naive_utc_timeC s
r7 c @ s� e Zd Zejjfeeedd�dd�Z e
ed�dd��Z e
ed�dd ��Zd
d � Z e
jed �d
d�Ze
jed �dd�Zed�dd�ZdS )� AttributeN)r �value�_typer c C s || _ || _|| _d S r )�_oid�_valuer: )r r r9 r: r" r" r# r R s zAttribute.__init__�r c C s | j S r )r; �r r" r" r# r \ s z
Attribute.oidc C s | j S r )r< r> r" r" r# r9 ` s zAttribute.valuec C s d� | j| j�S )Nz <Attribute(oid={}, value={!r})>)�formatr r9 r> r" r" r# �__repr__d s zAttribute.__repr__��otherr c C s2 t |t�stS | j|jko0| j|jko0| j|jkS r )�
isinstancer8 �NotImplementedr r9 r: �r rB r" r" r# �__eq__g s
�
�zAttribute.__eq__c C s
| |k S r r" rE r" r" r# �__ne__q s zAttribute.__ne__c C s t | j| j| jf�S r )�hashr r9 r: r> r" r" r# �__hash__t s zAttribute.__hash__)r$ r% r& r Z
UTF8Stringr9 r �bytes�intr �propertyr r@ �typing�Any�boolrF rG rI r" r" r" r# r8 Q s ��
r8 c @ sH e Zd Zeje dd�dd�Zed�\ZZ Z
dd� Z e ed�d d
�Z
dS ) �
AttributesN)r. r c C s t |�| _d S r )�list� _attributes)r r. r" r" r# r y s zAttributes.__init__rR c C s d� | j�S )Nz<Attributes({})>)r? rR r> r" r" r# r@ � s zAttributes.__repr__�r r c C s0 | D ]}|j |kr| S qtd�|�|��d S )NzNo {} attribute was found)r r r? )r r �attrr" r" r# �get_attribute_for_oid� s
z Attributes.get_attribute_for_oid)r$ r% r& rM �Iterabler8 r r �__len__�__iter__� __getitem__r@ r rU r" r" r" r# rP x s � rP c @ s e Zd ZdZdZdS )�Versionr � N)r$ r% r& Zv1�v3r" r" r" r# rZ � s rZ c s& e Zd Zeedd�� fdd� Z� ZS )�InvalidVersionN)r �parsed_versionr c s t t| ��|� || _d S r )r r] r r^ )r r r^ r r" r# r � s zInvalidVersion.__init__)r$ r% r& r' rK r r( r" r" r r# r] � s r] c @ sx e Zd Zejejed�dd��Zej e
d�dd��Z ej e d�dd��Z
ejed�d d
��Zej ejd�d d ��Zej ejd�d
d��Zej ed�dd��Zej ed�dd��Zej ejej d�dd��Zej ed�dd��Zej ed�dd��Z ej ed�dd��Z ej ed�dd ��Z eje e d �d d ��Z!eje e d �d d!��Z"eje
d�d"d#��Z#eje$j%ed$�d%d&��Z&d'S )(� Certificate�� algorithmr c C s dS �z4
Returns bytes using digest passed.
Nr" �r ra r" r" r# � fingerprint� s zCertificate.fingerprintr= c C s dS )z3
Returns certificate serial number
Nr" r> r" r" r# �
serial_number� s zCertificate.serial_numberc C s dS )z1
Returns the certificate version
Nr" r> r" r" r# �version� s zCertificate.versionc C s dS �z(
Returns the public key
Nr" r> r" r" r# �
public_key� s zCertificate.public_keyc C s dS )z?
Not before time (represented as UTC datetime)
Nr" r> r" r" r# �not_valid_before� s z Certificate.not_valid_beforec C s dS )z>
Not after time (represented as UTC datetime)
Nr" r> r" r" r# �not_valid_after� s zCertificate.not_valid_afterc C s dS )z1
Returns the issuer name object.
Nr" r> r" r" r# �issuer� s zCertificate.issuerc C s dS �z2
Returns the subject name object.
Nr" r> r" r" r# �subject� s zCertificate.subjectc C s dS �zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr" r> r" r" r# �signature_hash_algorithm� s z$Certificate.signature_hash_algorithmc C s dS �zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr" r> r" r" r# �signature_algorithm_oid� s z#Certificate.signature_algorithm_oidc C s dS )z/
Returns an Extensions object.
Nr" r> r" r" r# r* � s zCertificate.extensionsc C s dS �z.
Returns the signature bytes.
Nr" r> r" r" r# � signature� s zCertificate.signaturec C s dS )zR
Returns the tbsCertificate payload bytes as defined in RFC 5280.
Nr" r> r" r" r# �tbs_certificate_bytes� s z!Certificate.tbs_certificate_bytesrA c C s dS �z"
Checks equality.
Nr" rE r" r" r# rF � s zCertificate.__eq__c C s dS �z#
Checks not equal.
Nr" rE r" r" r# rG � s zCertificate.__ne__c C s dS �z"
Computes a hash.
Nr" r> r" r" r# rI � s zCertificate.__hash__��encodingr c C s dS )zB
Serializes the certificate to PEM or DER format.
Nr" �r ry r" r" r# � public_bytes� s zCertificate.public_bytesN)'r$ r% r& �abc�abstractmethodr �
HashAlgorithmrJ rd �abstractpropertyrK re rZ rf r
rh r4 ri rj r rk rm rM �Optionalro r rq r r* rs rt �objectrO rF rG rI r �Encodingr{ r" r" r" r# r_ � sF
�r_ )� metaclassc @ sJ e Zd Zejed�dd��Zejejd�dd��Zeje d�dd��Z
dS ) �RevokedCertificater= c C s dS )zG
Returns the serial number of the revoked certificate.
Nr" r> r" r" r# re s z RevokedCertificate.serial_numberc C s dS )zH
Returns the date of when this certificate was revoked.
Nr" r> r" r" r# �revocation_date
s z"RevokedCertificate.revocation_datec C s dS )zW
Returns an Extensions object containing a list of Revoked extensions.
Nr" r> r" r" r# r* s z RevokedCertificate.extensionsN) r$ r% r& r| r rK re r4 r� r r* r" r" r" r# r� s r� c @ sX e Zd Zeejed�dd�Zeed�dd��Zeejd�dd��Z eed�d d
��Z
d S ) �_RawRevokedCertificate�re r� r* c C s || _ || _|| _d S r ��_serial_number�_revocation_date� _extensions�r re r� r* r" r" r# r s z _RawRevokedCertificate.__init__r= c C s | j S r )r� r> r" r" r# re ) s z$_RawRevokedCertificate.serial_numberc C s | j S r )r� r> r" r" r# r� - s z&_RawRevokedCertificate.revocation_datec C s | j S r )r� r> r" r" r# r* 1 s z!_RawRevokedCertificate.extensionsN) r$ r% r& rK r4 r r rL re r� r* r" r" r" r# r� s �
r� c @ s� e Zd Zejejed�dd��Zeje j
ed�dd��Z eje e
je d�dd ��Zeje
je j
d
�d d ��Zejed
�d
d��Zejed
�dd��Zeje
jej d
�dd��Zejejd
�dd��Zejed
�dd��Zejed
�dd��Z ejed
�dd��Z eje e d�d d ��Z eje e d�d d ��Z!eje d
�d d!��Z"e
j#e ed"�d#d$��Z$e
j#e%e
j&e d"�d%d$��Z$eje
j'e e%f e
j'ee
j&e f d"�d&d$��Z$eje
j(e d
�d'd(��Z)eje*e d)�d*d+��Z+d,S )-�CertificateRevocationListrx c C s dS )z:
Serializes the CRL to PEM or DER format.
Nr" rz r" r" r# r{ 7 s z&CertificateRevocationList.public_bytesr` c C s dS rb r" rc r" r" r# rd = s z%CertificateRevocationList.fingerprint)re r c C s dS )zs
Returns an instance of RevokedCertificate or None if the serial_number
is not in the CRL.
Nr" )r re r" r" r# �(get_revoked_certificate_by_serial_numberC s zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr= c C s dS rn r" r> r" r" r# ro L s z2CertificateRevocationList.signature_hash_algorithmc C s dS rp r" r> r" r" r# rq U s z1CertificateRevocationList.signature_algorithm_oidc C s dS )zC
Returns the X509Name with the issuer of this CRL.
Nr" r> r" r" r# rk [ s z CertificateRevocationList.issuerc C s dS )z?
Returns the date of next update for this CRL.
Nr" r> r" r" r# � next_updatea s z%CertificateRevocationList.next_updatec C s dS )z?
Returns the date of last update for this CRL.
Nr" r> r" r" r# � last_updateg s z%CertificateRevocationList.last_updatec C s dS )zS
Returns an Extensions object containing a list of CRL extensions.
Nr" r> r" r" r# r* m s z$CertificateRevocationList.extensionsc C s dS rr r" r> r" r" r# rs s s z#CertificateRevocationList.signaturec C s dS )zO
Returns the tbsCertList payload bytes as defined in RFC 5280.
Nr" r> r" r" r# �tbs_certlist_bytesy s z,CertificateRevocationList.tbs_certlist_bytesrA c C s dS ru r" rE r" r" r# rF s z CertificateRevocationList.__eq__c C s dS rv r" rE r" r" r# rG � s z CertificateRevocationList.__ne__c C s dS )z<
Number of revoked certificates in the CRL.
Nr" r> r" r" r# rW � s z!CertificateRevocationList.__len__)�idxr c C s d S r r" �r r� r" r" r# rY � s z%CertificateRevocationList.__getitem__c C s d S r r" r� r" r" r# rY � s c C s dS )zS
Returns a revoked certificate (or slice of revoked certificates).
Nr" r� r" r" r# rY � s c C s dS )z8
Iterator over the revoked certificates
Nr" r> r" r" r# rX � s z"CertificateRevocationList.__iter__)rh r c C s dS )zQ
Verifies signature of revocation list against given public key.
Nr" )r rh r" r" r# �is_signature_valid� s z,CertificateRevocationList.is_signature_validN),r$ r% r& r| r} r r� rJ r{ r r~ rd rK rM r� r� r� r ro r rq r rk r4 r� r� r r* rs r� r� rO rF rG rW �overloadrY �slice�List�Union�IteratorrX r r� r" r" r" r# r� 6 sV �
� �r� c @ s6 e Zd Zejeed�dd��Zejeed�dd��Zeje d�dd��Z
eje d�d d
��Z ej
ed�d d ��Zej
ejej d�d
d��Zej
ed�dd��Zej
ed�dd��Zej
ed�dd��Zejej e d�dd��Z ej
e d�dd��Z ej
e d�dd��Z ej
ed�d d ��Z!ejee d �d d ��Z"d!S )"�CertificateSigningRequestrA c C s dS ru r" rE r" r" r# rF � s z CertificateSigningRequest.__eq__c C s dS rv r" rE r" r" r# rG � s z CertificateSigningRequest.__ne__r= c C s dS rw r" r> r" r" r# rI � s z"CertificateSigningRequest.__hash__c C s dS rg r" r> r" r" r# rh � s z$CertificateSigningRequest.public_keyc C s dS rl r" r> r" r" r# rm � s z!CertificateSigningRequest.subjectc C s dS rn r" r> r" r" r# ro � s z2CertificateSigningRequest.signature_hash_algorithmc C s dS rp r" r> r" r" r# rq � s z1CertificateSigningRequest.signature_algorithm_oidc C s dS )z@
Returns the extensions in the signing request.
Nr" r> r" r" r# r* � s z$CertificateSigningRequest.extensionsc C s dS )z/
Returns an Attributes object.
Nr" r> r" r" r# r. � s z$CertificateSigningRequest.attributesrx c C s dS )z;
Encodes the request to PEM or DER format.
Nr" rz r" r" r# r{ � s z&CertificateSigningRequest.public_bytesc C s dS rr r" r> r" r" r# rs � s z#CertificateSigningRequest.signaturec C s dS )zd
Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
2986.
Nr" r> r" r" r# �tbs_certrequest_bytes� s z/CertificateSigningRequest.tbs_certrequest_bytesc C s dS )z8
Verifies signature of signing request.
Nr" r> r" r" r# r� � s z,CertificateSigningRequest.is_signature_validrS c C s dS )z:
Get the attribute value for a given OID.
Nr" )r r r" r" r# rU s z/CertificateSigningRequest.get_attribute_for_oidN)#r$ r% r& r| r} r� rO rF rG rK rI r rh r r rm rM r� r r~ ro r rq r r* rP r. r r� rJ r{ rs r� r� rU r" r" r" r# r� � s:
�r� )�data�backendr c C s
t �| �S r )� rust_x509�load_pem_x509_certificate�r� r� r" r" r# r� s r� c C s
t �| �S r )r� �load_der_x509_certificater� r" r" r# r� s r� c C s
t �| �S r )r� �load_pem_x509_csrr� r" r" r# r� s r� c C s
t �| �S r )r� �load_der_x509_csrr� r" r" r# r� % s r� c C s
t �| �S r )r� �load_pem_x509_crlr� r" r" r# r� , s r� c C s
t �| �S r )r� �load_der_x509_crlr� r" r" r# r� 3 s r� c @ s� e Zd Zdg g feje ejee ejej e
e f d�dd�Z ed d�dd�Z
eed d�d d
�Ze
e d d �d d
�Zdeejej ejed�dd�ZdS )� CertificateSigningRequestBuilderN)� subject_namer* r. c C s || _ || _|| _dS )zB
Creates an empty X.509 certificate request (v1).
N)�
_subject_namer� rR )r r� r* r. r" r" r# r : s z)CertificateSigningRequestBuilder.__init__��namer c C s4 t |t�std��| jdur$td��t|| j| j�S )zF
Sets the certificate requestor's distinguished name.
�Expecting x509.Name object.N�&The subject name may only be set once.)rC r � TypeErrorr� r+ r� r� rR �r r� r" r" r# r� G s
�z-CertificateSigningRequestBuilder.subject_name��extval�criticalr c C sD t |t�std��t|j||�}t|| j� t| j| j|g | j �S )zE
Adds an X.509 extension to the certificate request.
�"extension must be an ExtensionType)
rC r r� r r r- r� r� r� rR �r r� r� r) r" r" r# �
add_extensionS s
�z.CertificateSigningRequestBuilder.add_extension)r r9 r c C sL t |t�std��t |t�s$td��t|| j� t| j| j| j||fg �S )zK
Adds an X.509 attribute with an OID and associated value.
z oid must be an ObjectIdentifierzvalue must be bytes) rC r r� rJ r0 rR r� r� r� )r r r9 r" r" r# �
add_attributee s
�z.CertificateSigningRequestBuilder.add_attribute�� private_keyra r� r c C s | j du rtd��t�| ||�S )zF
Signs the request using the requestor's private key.
Nz/A CertificateSigningRequest must have a subject)r� r+ r� Zcreate_x509_csr�r r� ra r� r" r" r# �signy s
z%CertificateSigningRequestBuilder.sign)N)r$ r% r& rM r� r r� r r �Tupler rJ r r� rO r� r� r r r~ rN r� r� r" r" r" r# r� 9 s, � �
� � �
�r� c
@ s e Zd ZU ejee ed< ddddddg feje eje eje
eje eje j eje j ejee dd�dd�Z
e d d�dd�Ze d d�d d
�Ze
d d �d d
�Ze d d�dd�Ze j d d�dd�Ze j d d�dd�Zeed d�dd�Zd eejej ejed�dd�ZdS ) �CertificateBuilderr� N)� issuer_namer� rh re ri rj r* r c C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S r )
rZ r\ Z_version� _issuer_namer� � _public_keyr� �_not_valid_before�_not_valid_afterr� )r r� r� rh re ri rj r* r" r" r# r � s
zCertificateBuilder.__init__r� c C sD t |t�std��| jdur$td��t|| j| j| j| j | j
| j �S )z3
Sets the CA's distinguished name.
r� N�%The issuer name may only be set once.) rC r r� r� r+ r� r� r� r� r� r� r� r� r" r" r# r� � s
�z CertificateBuilder.issuer_namec C sD t |t�std��| jdur$td��t| j|| j| j| j | j
| j �S )z:
Sets the requestor's distinguished name.
r� Nr� ) rC r r� r� r+ r� r� r� r� r� r� r� r� r" r" r# r� � s
�z CertificateBuilder.subject_name)�keyr c C s` t |tjtjtjtjt j
t j t
jf�s.td��| jdur@td��t| j| j|| j| j| j| j�S )zT
Sets the requestor's public key (as found in the signing request).
z�Expecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rC r Z DSAPublicKeyr
Z RSAPublicKeyr ZEllipticCurvePublicKeyr ZEd25519PublicKeyr ZEd448PublicKeyr ZX25519PublicKeyr Z
X448PublicKeyr� r� r+ r� r� r� r� r� r� r� )r r� r" r" r# rh � s2 �� �
�z CertificateBuilder.public_key��numberr c C sh t |t�std��| jdur$td��|dkr4td��|�� dkrHtd��t| j| j| j || j
| j | j �S )z5
Sets the certificate serial number.
�'Serial number must be of integral type.N�'The serial number may only be set once.r z%The serial number should be positive.� �3The serial number should not be more than 159 bits.)
rC rK r� r� r+ �
bit_lengthr� r� r� r� r� r� r� �r r� r" r" r# re � s&
��z CertificateBuilder.serial_numberr1 c C sz t |tj�std��| jdur&td��t|�}|tk r>td��| jdurZ|| jkrZtd��t| j | j
| j | j || j| j
�S )z7
Sets the certificate activation time.
�Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rC r4 r� r� r+ r7 �_EARLIEST_UTC_TIMEr� r� r� r� r� r� r� �r r2 r" r" r# ri s,
���z#CertificateBuilder.not_valid_beforec C sz t |tj�std��| jdur&td��t|�}|tk r>td��| jdurZ|| jk rZtd��t| j | j
| j | j | j|| j
�S )z7
Sets the certificate expiration time.
r� Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rC r4 r� r� r+ r7 r� r� r� r� r� r� r� r� r� r" r" r# rj s2
�����z"CertificateBuilder.not_valid_afterr� c C sT t |t�std��t|j||�}t|| j� t| j| j | j
| j | j | j
| j|g �S )z=
Adds an X.509 extension to the certificate.
r� )rC r r� r r r- r� r� r� r� r� r� r� r� r� r" r" r# r� @ s
�z CertificateBuilder.add_extensionr� c C sz | j du rtd��| jdu r$td��| jdu r6td��| jdu rHtd��| jdu rZtd��| jdu rltd��t�| ||�S )zC
Signs the certificate using the CA's private key.
Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key) r� r+ r� r� r� r� r� r� Zcreate_x509_certificater� r" r" r# r� V s
zCertificateBuilder.sign)N) r$ r% r& rM r� r r �__annotations__r� r r
rK r4 r r� r� rh re ri rj rO r� r r r~ rN r_ r� r" r" r" r# r� � sL
�
� � % � !� �
�r� c @ s� e Zd ZU ejee ed< eje ed< dddg g fej e
ej e j ej e j ejee eje d�dd�Z e
d d�dd �Z
e j d d
�d d �Ze j d d
�dd�Zeed d�dd�Zed d�dd�Zdeej ej ejed�dd�ZdS )� CertificateRevocationListBuilderr� �_revoked_certificatesN)r� r� r� r* �revoked_certificatesc C s" || _ || _|| _|| _|| _d S r )r� � _last_update� _next_updater� r� )r r� r� r� r* r� r" r" r# r x s
z)CertificateRevocationListBuilder.__init__)r� r c C s< t |t�std��| jd ur$td��t|| j| j| j| j �S )Nr� r� )
rC r r� r� r+ r� r� r� r� r� )r r� r" r" r# r� � s
�z,CertificateRevocationListBuilder.issuer_name)r� r c C sr t |tj�std��| jd ur&td��t|�}|tk r>td��| jd urZ|| jkrZtd��t| j || j| j
| j �S )Nr� �!Last update may only be set once.�8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rC r4 r� r� r+ r7 r� r� r� r� r� r� )r r� r" r" r# r� � s(
���z,CertificateRevocationListBuilder.last_update)r� r c C sr t |tj�std��| jd ur&td��t|�}|tk r>td��| jd urZ|| jk rZtd��t| j | j|| j
| j �S )Nr� r� r� z8The next update date must be after the last update date.) rC r4 r� r� r+ r7 r� r� r� r� r� r� )r r� r" r" r# r� � s(
���z,CertificateRevocationListBuilder.next_updater� c C sL t |t�std��t|j||�}t|| j� t| j| j | j
| j|g | j �S )zM
Adds an X.509 extension to the certificate revocation list.
r� ) rC r r� r r r- r� r� r� r� r� r� r� r" r" r# r� � s
�z.CertificateRevocationListBuilder.add_extension)�revoked_certificater c C s2 t |t�std��t| j| j| j| j| j|g �S )z8
Adds a revoked certificate to the CRL.
z)Must be an instance of RevokedCertificate) rC r� r� r� r� r� r� r� r� )r r� r" r" r# �add_revoked_certificate� s
�z8CertificateRevocationListBuilder.add_revoked_certificater� c C sD | j d u rtd��| jd u r$td��| jd u r6td��t�| ||�S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r� r+ r� r� r� Zcreate_x509_crlr� r" r" r# r� � s
z%CertificateRevocationListBuilder.sign)N)r$ r% r& rM r� r r r� r� r� r r4 r r� r� r� rO r� r� r r r~ rN r� r� r" r" r" r# r� t sH
�
� � � � � � �
�r� c @ s� e Zd Zddg feje ejej ejee d�dd�Z
ed d�dd�Z ejd d�d d
�Z e e
d d �d d
�Zdejed�dd�ZdS )�RevokedCertificateBuilderNr� c C s || _ || _|| _d S r r� r� r" r" r# r � s z"RevokedCertificateBuilder.__init__r� c C sX t |t�std��| jd ur$td��|dkr4td��|�� dkrHtd��t|| j| j�S )Nr� r� r z$The serial number should be positiver� r� ) rC rK r� r� r+ r� r� r� r� r� r" r" r# re s
�
�z'RevokedCertificateBuilder.serial_numberr1 c C sN t |tj�std��| jd ur&td��t|�}|tk r>td��t| j|| j �S )Nr� z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rC r4 r� r� r+ r7 r� r� r� r� r� r" r" r# r� s
�
�z)RevokedCertificateBuilder.revocation_dater� c C sD t |t�std��t|j||�}t|| j� t| j| j | j|g �S )Nr� )
rC r r� r r r- r� r� r� r� r� r" r" r# r� ( s
�z'RevokedCertificateBuilder.add_extension)r� r c C s: | j d u rtd��| jd u r$td��t| j | jt| j��S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r� r+ r� r� r r� )r r� r" r" r# �build6 s
��z RevokedCertificateBuilder.build)N)r$ r% r& rM r� rK r4 r� r r r re r� rO r� rN r� r� r" r" r" r# r� � s �
�
� � r� r= c C s t �t�d�d�d? S )N� Zbigr )rK �
from_bytes�os�urandomr" r" r" r# �random_serial_numberD s r� )N)N)N)N)N)N)Er| r4 r� rM Z cryptographyr Z"cryptography.hazmat.bindings._rustr r� Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr r r r r
r r Z/cryptography.hazmat.primitives.asymmetric.typesr
r r Z cryptography.x509.extensionsr r r r Zcryptography.x509.namer r Zcryptography.x509.oidr r� � Exceptionr r� r- r� rJ r0 r7 r8 rP �EnumrZ r] �ABCMetar_ �registerr� r� r� r� rN r� r� r� r� r� r� r� r� r� r� r� rK r� r" r" r" r# �<module> s� $ � �
'l x [ �� �� �� �� �� �� N n I