
    Wwg}I                       d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZmZ ddl	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlZddlmZmZ ddlmZ dd	lmZm Z  dd
l!m"Z" ddl#m$Z$ ddl%m&Z& ddl'm(Z(m)Z) ddl*m+Z+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7 ddl8m9Z9 ddl:m;Z; ddl<m=Z= ddl>m?Z?m@Z@mAZA ddlBmCZCmDZD ddlEmFZFmGZG ddlHmIZI ddlJmKZK ddlLmMZMmNZN ddlOmPZPmQZQmRZRmSZSmTZT ddlUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\ ddl]m^Z^m_Z_m`Z`maZa ddlbmcZc ddldmeZemfZfmgZgmhZhmiZimjZjmkZkmlZl d d!lmmnZn d"d#lompZp d"d$l`mqZq d"d%lrmsZsmtZtmuZumvZvmwZwmxZx d"d&lymzZz g d'Z{ ej                  e}      Z~ ed(eid)*      Zd+e5d,ee   fd-Zd+e5d,ee   fd.Z G d/ d0      Z ed)1       G d2 d3ee                Ze G d4 d5             Zedddd6d7ej                  d8ewd9ed:ee   d;ee;   d<ee,   d=eeee
f      d,efd>       Zedddd6d7ej                  d8ewd9ed;ee;   d<ee,   d=eeee
f      d,efd?       Zdddelfd7ej                  d8ewd9ed;ee;   d<ee,   d=eeee
f      d,efd@ZdAej                  dBe?dCedDeej                     fdEZdFee&   d,ee5ddf   fdGZdHeeiedf   fdIZdelfd7ej                  dFe&d9ed=eeee
f      d,ef
dJZdKedLed,efdMZdNej                  dOeidPe&dQee&   dRee   f
dSZd8ewd;e;d<e,fdTZeddddddUdNej                  d8ewd:ee   d;ee;   dVee   d<ee,   dRee   d=eeee
f      d,efdW       ZeddddddUdNej                  d8ewd;ee;   dVee   d<ee,   dRee   d=eeee
f      d,efdX       ZdddddekfdNej                  d8ewd;ee;   dVee   d<ee,   dRee   d=eeee
f      d,efdYZdNej                  dFe&dPe&dQee&   dZecdVee   dRee   d=eeee
f      d[eez   d:ee   d,eeef   fd\Z ed)1       G d] d^e             Z eeRj.                  eQj0                  eQj2                  eQj4                  eQj6                  eQj8                  h      ZeddddddUdNej                  d8ewd;ee;   dVee   d<ee,   dRee   d=eeee
f      d,efd_       ZeddddddUdNej                  d8ewd:ee   d;ee;   dVee   d<ee,   dRee   d=eeee
f      d,efd`       ZdddddekfdNej                  d8ewd;ee;   dVee   d<ee,   dRee   d=eeee
f      d,efdaZ G db dceD      ZddeIdeedfe3fdgZdheKdeedfe3fdiZdje jD                  d<e,dCedkeAfdlZdje jD                  dme+d<e,d,ee=ef   fdnZdNej                  d8ewdfe3doeeQ   dpedqed,e=fdrZ	 ddNej                  d8ewdfe3doeeQ   dpee   d,eTfdsZ ed)1       G dt du             Z ed)1       G dv dw             Zdxej                  d,eeddf   fdyZdxej                  d,efdzZd{ejV                  d,eeddf   fd|Zd}e^d,eeddf   fd~ZdeNdedeen   d,ee   fdZ	 ddee   d8ewdee;   d,e3fdZ eeRj.                  eQj2                  eQj4                  eQj8                  eQj`                  eQj0                  eQjb                  eQj6                  h      Z eeQj4                  eQj8                  eQj`                  eQj0                  eQjb                  h      Z ed)1       G d de             Zde_d8ewdfe3d;e;d,ee   f
dZdeNfdZ	 	 dde_detd;ee;   dRee   d,ef
dZ	 dde_detdedee   d,ef
dZy)a  
This module contains a number of functions to handle AdES signature validation.


.. danger::
    This API is incubating, and not all features of the spec have been fully
    implemented at this stage. There will be bugs, and API changes may still
    occur.
    N)copy)	dataclass)datetimetimezone)AnyDict	FrozenSet	GeneratorGenericIterableIteratorListOptionalSetTupleTypeTypeVarUnionoverload)cmskeys)pdf)tspx509)CertificateList)OCSPResponse)ValidationContext)CertTrustAnchorTrustAnchor)CertValidationPolicySpecValidationDataHandlers)	PathError)past_validate)KnownPOE
POEManagerPOETypeValidationObjectValidationObjectTypedigest_for_poe)ades_gather_prima_facie_revinfo)ValidationTimingInfo)ValidationPath)AlgorithmUsagePolicyNonRevokedStatusAssertionRevocationCheckingRule)PathBuilderTrustManager)CRLContainerOCSPContainer)CRLOfInterest)OCSPResponseOfInterest)HistoricalResolverPdfFileReader)AdESFailureAdESIndeterminate
AdESPassed
AdESStatusAdESSubIndic)CMSExtractionErrorCMSStructuralErrorMultivaluedAttributeErrorNonexistentAttributeErrorextract_certificate_infofind_cms_attributefind_unique_cms_attribute)DocumentSecurityStoreEmbeddedPdfSignatureerrorsgeneric_cms)KeyUsageConstraints)DocumentTimestampStatusPdfSignatureStatusRevocationDetailsSignatureCoverageLevelSignatureStatusSignerAttributeStatusStandardCMSSignatureStatusTimestampSignatureStatus   )
DiffPolicy   )enumerate_ocsp_certs)NoDSSFoundError)LocalKnowledgePdfSignatureValidationSpecRevinfoOnlineFetchingRuleRevocationInfoGatheringSpecSignatureValidationSpec"bootstrap_validation_data_handlers)CMSAlgorithmUsagePolicy)	ades_basic_validationades_with_time_validationades_lta_validationades_timestamp_validation#simulate_future_ades_lta_validationAdESBasicValidationResultAdESWithTimeValidationResultAdESLTAValidationResult#derive_validation_object_identifier
StatusTypeT)bound	covariantvoreturnc                    | j                   t        j                  k(  r| j                  j	                         S | j                   t        j
                  k(  r$| j                  j                  j	                         S | j                   t        j                  k(  r$| j                  j                  j	                         S | j                   t        j                  t        j                  fv r| j                  d   d   d   j                  S y )Nsigner_infosr   	signature)object_typer(   CERTIFICATEvaluedumpCRLcrl_dataOCSP_RESPONSEocsp_response_dataSIGNED_DATA	TIMESTAMPnative)ri   s    S/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko/sign/validation/ades.py$derive_validation_object_binary_datarz      s     
~~-999xx}}	/33	3xx  %%''	/==	=xx**//11	((&& 
 xx'*;7>>>    c                    | j                   t        j                  k(  r3t        | j                  j                               j                         }n| j                   t        j                  k(  r<t        | j                  j                  j                               j                         }n| j                   t        j                  k(  r<t        | j                  j                  j                               j                         }nd| j                   t        j                  t        j                  fv r7t        | j                  d   d   d   j                        j                         }ny d| j                   j                   d| S )Nrl   r   rm   zvo--)rn   r(   ro   r)   rp   rq   hexrr   rs   rt   ru   rv   rw   rx   )ri   markers     ry   re   re      s    
~~-9990446	/33	3 1 1 6 6 89==?	/==	= ; ; @ @ BCGGI	((&& 
  HH^$Q'4;;

#% 	 %%&ax00r{   c                   @    e Zd Zdee   fdZdee   fdZed        Z	y)ValidationObjectSetobject_collectionsc                 \    fd} |       D ci c]  \  }}||
 c}}| _         y c c}}w )Nc               3   d   K   t        j                   D ]  } t        |       }|s|| f  y wN)	itertoolschainre   )objidentr   s     ry   _pairsz,ValidationObjectSet.__init__.<locals>._pairs   s7      (:; %;C@*$%s   #0	0)_things)selfr   r   kvs    `   ry   __init__zValidationObjectSet.__init__   s)    	% *02A122s   (rj   c                 H    t        | j                  j                               S r   )iterr   values)r   s    ry   __iter__zValidationObjectSet.__iter__   s    DLL'')**r{   c                      t        d      S N )r   r   r{   ry   emptyzValidationObjectSet.empty   s    "2&&r{   N)
__name__
__module____qualname__r   r'   r   r   r   staticmethodr   r   r{   ry   r   r      s:    3H5E,F 3+(#34 + ' 'r{   r   )frozenc                   L    e Zd ZU dZeed<   	 ee   ed<   	 ee   ed<   	 e	ed<   y)rb   uR   
    Result of validation of basic signatures.

    ETSI EN 319 102-1, § 5.3
    ades_subindic
api_statusfailure_msgvalidation_objectsN)
r   r   r   __doc__r<   __annotations__r   rf   strr   r   r{   ry   rb   rb      sD       $$ #
 ,+r{   rb   c                       e Zd ZU eed<   ee   ed<   ee   ed<   ee   ed<    ej                  e
      Ze
ed<   dZee   ed<   dZee   ed	<   dZee   ed
<   dZee   ed<   d Zy)_InternalBasicValidationResultr   signature_poe_timesignature_not_before_timevalidation_path)default_factorystatus_kwargsNtrust_subindic_updatesignature_ts_validitycontent_ts_validitysigner_attr_statusc                    | j                   }| j                  |d<   | j                  r| j                  |d<   |r| j                  r| j                  |d<   |r| j                  r| j                  |d<   |rW| j
                  rK| j
                  j                  |d<   | j
                  j                  |d<   | j
                  j                  |d<    |di |S )	Nr   trust_problem_indictimestamp_validitycontent_timestamp_validityac_attrscades_signer_attrsac_validation_errsr   )	r   r   r   r   r   r   r   r   r   )r   
status_clswith_ts
with_attrsr   s        ry   updatez%_InternalBasicValidationResult.update   s    **+/+?+?'(%%373M3MM/0t11262L2LM./t//(( 67 $11(,(?(?(H(HM*%'':: ./ '':: ./ *M**r{   )r   r   r   r<   r   r   r   r,   dataclassesfielddictr   r   r   rP   r   r   rN   r   r   r{   ry   r   r      s     **'11n--++++DAM4A488L18@D8$<=D>B":;B:>!67>+r{   r   )timing_infovalidation_data_handlersextra_status_kwargstst_signed_datavalidation_specexpected_tst_imprintr   r   r   r   c                   K   y wr   r   )r   r   r   r   r   r   r   s          ry   r`   r`           !$   c                   K   y wr   r   )r   r   r   r   r   r   s         ry   r`   r`     s      !$r   c                    K   |xs t        j                         }|j                  xs |j                  }|t	        ||      }|j                  ||      }t        | ||||       d{   S 7 w)uW  
    Validate a timestamp token according to ETSI EN 319 102-1 § 5.4.

    :param tst_signed_data:
        The ``SignedData`` value of the timestamp.
    :param validation_spec:
        Validation settings to apply.
    :param expected_tst_imprint:
        The expected message imprint in the timestamp token.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nspecr   r   handlers)r   r   )r+   nowts_cert_validation_policycert_validation_policyr[   build_validation_context'_ades_timestamp_validation_from_context)	r   r   r   r   r   r   r   r   validation_contexts	            ry   r`   r`   !  s     B ;!5!9!9!;K11 	211 
  '#E k$
  0HH*B I  9/   s   A(A1*A/+A1signer_infoalgo_policycontrol_time
public_keyc                     | d   }|j                  |||      }|sYd|j                   d| d}t        j                  ||j                  t
        j                        t
        j                        y )Nsignature_algorithm)r   zSignature algorithm z not allowed as of z:, which is the time of the earliest PoE for the signature.ades_subindication)signature_algorithm_allowedsignature_algorF   SignatureValidationErrornot_allowed_afterr9   CRYPTO_CONSTRAINTS_FAILURE!CRYPTO_CONSTRAINTS_FAILURE_NO_POE)r   r   r   r   sig_algosig_allowedmsgs          ry   #_ades_signature_crypto_policy_checkr   Y  s     +66K*LH99,: : K "8#:#:"; <  >? 	
 -- 008 "<<
 	

 'HH
 	
 r{   r   c              #   d  K   | y | j                   D ]d  }t        j                  |      D ]  }t        t        j
                  |         t        |      D ]  }t        t        j                  |         f | j                  D ]'  }t        t        j                  t        |             ) y wr   )ocspsr3   
load_multir'   r(   rt   rT   ro   crlsrr   r2   )r   ocspcontcertcrls        ry   _enumerate_validation_objectsr   s  s      !"(( K!,,T2 	MD"#7#E#EtLL	M(. 	KD"#7#C#CTJJ	KK
 "&& L377c9JKKLs   B.B0statusc              #     K   | y | j                   }|r3|j                  d      D ]  }t        t        j                  |         t        | t              r:t        | j                        E d {    t        | j                        E d {    t        | t              r;t        | j                        E d {    t        | j                        E d {    y y 7 m7 R7 '7 w)NT)include_root)r   
iter_certsr'   r(   ro   
isinstancerO   _enumerate_certs_in_pathsr   r   r   r   r   )r   pathr   s      ry   r   r     s      ~!!DOOO6 	KD"#7#C#CTJJ	K&45,V-F-FGGG,V-N-NOOO&89,V-I-IJJJ,V-G-GHHH : 	HOJHsH   A-C%/C0C%C,C%9C!:C%C#C%C%!C%#C%c                 >  K   t        t        |            }t        |xs i       }t        j                  | ||       d {   }|j                  |        |di |}|j                  st        t        j                  |d |      S |j                  st        t        j                  |d |      S t        | ||d d        d {   }	||	_        t        t        |      t        |	            }t        |	j                   |	j                  |dd      d |      S 7 7 Vw)N)r   r   r   r   r   r   ac_validation_contextr   Fr   r   r   )r   r   r   rG   validate_tst_signed_datar   intactrb   r8   HASH_FAILUREvalidSIG_CRYPTO_FAILURE_process_basic_validationr   r   r   r   )
r   r   r   r   r   vosr   status_kwargs_from_validationr   interm_results
             ry   r   r     s=     ;<NO
PC,23M*5*N*N-1+ %!
 67(-(F==(%22"	
 	
 \\(%88"	
 	
 4""& M #0M
S	,];C %#11 ''% ( 
  E%.s%   ?DDBDDADDsigned
tst_digestc                    K   t        j                  | |      }|t        |||       d {   S t        t        j
                  d d t        j                               S 7 3w)Nr  r   r   r   r   )rG   extract_tst_datar   rb   r9   GENERICr   r   )r   r   r  r  r   s        ry   _ades_process_attached_tsr
    sj      "22;vNO"<
 
 	

 %'//.446	 
s   *A"A 4A"signed_datatemp_statusts_validation_contextr   r   c                   K   |j                   }|j                  }t        j                  |       }d }|t        j
                  t        j                  fv rt        ||dt        j                  |d   d      j                         d {   }	|	j                  t        j                  k(  r|	j                  }|J |t        |j                  |      }n|j                  }|t        j
                  k(  r-|j                   }
|
J |
j"                  }t$        j&                  }n&|j(                  j*                  }t        j,                  }|J ||k\  r|}t        j.                  |       }t        j0                  |j2                  |j4                  ||d          d {   }|xs t        j                  }t7        ||||t9        di |d |j:                  d|i      S 7 Q7 Cw)	NTsigned_attrsmessage_digestr  r  )sd_attr_certificatessigner_certr   sd_signed_attrsvalidation_time)r   r   r   r   r   r   r   r   r   )r  r   rG   extract_signer_infor9   REVOKED_NO_POEOUT_OF_BOUNDS_NO_POEr
  rC   rx   r   r:   OKr   max	timestamprevocation_detailsrevocation_dater8   REVOKEDsigning_certnot_valid_afterEXPIREDrA   collect_signer_attr_statusattribute_certsr  r   rN   r   )r  r  r  r   r   r  ades_trust_statusr   	ts_statuscontent_ts_resultrevo_detailscutoffperm_status	cert_infoattr_status_kwargsr   s                   ry   r   r     s     "11O0;0O0O11+>K48I((..  #<!"<<N+-=f#
 
 **jmm;)44I((((4,/'')B-) -6,?,?) !$5$D$DD*==#///%55)11$11AA/77 -888(F2$/! 44[AI  +EE&66))0#N3	   &6M)#/%";0F3EF#33(/:	 	i
Zs&   BGGDGGAGGc                     | j                   j                  ||      }| j                  | j                  j                  ||      }n|}| j                  | j                  j                  ||      }nd }|||fS )Nr   )r   r   r   ac_validation_policy)r   r   r   r   r  r   s         ry   	_init_vcsr.  -  s     	..GG#.F 	H 	
 
 00<55NN'2J O  	 !3++700II'2J J  	 !%46KKKr{   )r   
raw_digestr   r   r   r/  c                   K   y wr   r   r  r   r   r   r/  r   r   r   s           ry   r]   r]   O  s      !$r   c                   K   y wr   r   r  r   r   r/  r   r   r   s          ry   r]   r]   ]  r   r   c                   K   |xs t        j                         }|t        ||      }t        |||      \  }}	}
t	        | ||	|
|j
                  |||||j                  
       d{   }t        |t              r|S |j                  t        dd      }t        t        |      t        |
      t        |	      t        |            }t        |j                  |d|      S 7 yw)u  
    Validate a CMS signature according to ETSI EN 319 102-1 § 5.3.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param raw_digest:
        The expected message digest attribute value.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nr   )
r  r   r  r   key_usage_settingsr/  r   r   r   algorithm_policyFTr   r   )r+   r   r[   r.  _ades_basic_validationr5  signature_algorithm_policyr   rb   r   rO   r   r   r   r   )r  r   r   r/  r   r   r   r   r   r  r   r  r   r   s                 ry   r]   r]   j  s    H ;!5!9!9!;K'#E k$
  	/;0HI	 1-33*==";/(CC M -!:;)6)=)="Ed *> *F %&89%&;<%&;<!&)	C %#11	 3s   A%C#'C!(A:C#r5  r6  c
                   K   t        |xs i       }
t        t        |      t        |      t        |            }	 t        j                  | ||||       d {   }|
j                  |        |	di |
}|j                  st        t        j                  |d |      S |j                   st        t        j"                  |d |      S t%        | ||||       d {   }|
|_        |S 7 # t        j                  $ r?}t        |j                  xs t        j                  |j                  d |      cY d }~S d }~ww xY w7 dw)N)r/  r   r5  r6  r  r   r   r   )r   r   r   rG   cms_basic_validationr   rF   r   rb   r   r9   r	  failure_messager   r8   r   r   r   r   r   )r  r   r  r   r5  r/  r   r   r6  r   r   r   r  er   r  s                   ry   r7  r7    sY     ,23M
%&89%&;<%&;<C

.9.N.N!11-/
 )
% 	:; )9=9F==(%22"	
 	
 \\(%88"	
 	
 43"; M #0MS)
 ** 
(..K2C2K2K))"	
 	

2sS   8EC+ C)C+ .A-EE E)C+ +D=>4D82D=3E8D==Ec                   (    e Zd ZU eed<   ee   ed<   y)rc   best_signature_timer   N)r   r   r   r   r   r   r   r{   ry   rc   rc     s    !!'11r{   rc   c                   K   y wr   r   r3  s          ry   r^   r^     s      $'r   c                   K   y wr   r   r1  s           ry   r^   r^     s      $'r   c                 @	  K   |xs t        j                         }|t        ||      }t        |||      \  }}	}
| d   d   d   j                  }|j
                  |   }t        | ||	|
|j                  |||||j                  
       d{   }t        |t              rkt        t        |      t        |	      t        |
      t        |j                              }t        |j                   |j                  |j"                  |||      S |j                   t$        vrt        |t&              sJ |j(                  }|j+                  |dd	      }t        t        |      t        |	      t        |
      t        |            }t        |j                   |d|||      S t-        j.                  |       }|j+                  |d
d	      }t-        j0                  |      }|[t        t        |      t        |	      t        |
      t        |            }t        t2        j4                  |d|j6                  ||      S t9        ||d
|       d{   }t        t        |      t        |	      t        |
      t        |      t        |j                              }|j                   t:        j<                  k7  rt        |j                   |d|||      S |j                  }t        |t>              sJ |tA        |jB                  |      }n|jB                  }||_"        ||_#        |j                   t2        jH                  k(  r6|jJ                  }||jL                  k\  rt        |j                   |d|||      S |j                   t2        jN                  k(  r8||jP                  jR                  k  rt        t2        jT                  |d|||      S |j                   t2        jV                  k(  s|j                   t2        jX                  k(  r*||jZ                  k\  rt        |j                   |d|||      S |$||kD  rt        t2        j\                  |d|||      S d|_/        d|j`                  d<   |j+                  |dd	      }t        t:        j<                  |d|||      S 7 7 Rw)u  
    Validate a CMS signature with time according to ETSI EN 319 102-1 § 5.5.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param raw_digest:
        The expected message digest attribute value.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nr   rl   r   rm   )	r   r  r   r5  r/  r   r   r   r6  )r   r   r   r>  r   r   Tr   FzNo signature timestamp presentr  r   )1r+   r   r[   r.  rx   poe_managerr7  r5  r8  r   rb   r   r   r   r   rc   r   r   _WITH_TIME_FURTHER_PROCr   r   r   rG   r  compute_signature_tst_digestr9   SIG_CONSTRAINTS_FAILUREr>  r
  r:   r  rP   minr  r   r   r  r  r  r  r  not_valid_beforeNOT_YET_VALIDr   	TRY_LATERerror_time_horizonTIMESTAMP_ORDER_FAILUREr   r   )r  r   r   r/  r   r   r   r   r   r  r   	sig_bytesr   r  r   r   r   r  r  sig_ts_resultr%  r'  r   s                          ry   r^   r^   &  s    H ;!5!9!9!;K'#E k$
  	/;0HI	 N+A.{;BBI1==iH0-33*==";/(CC M -!:;!)*<=)*?@)*?@%m&>&>?	
 ,'55$//%11 2&?"
 	
 
	$	$,C	C-)GHHH$1$K$K!")) * 

 ")*<=)*?@)*?@%j1	
 ,'55! 2&?"
 	
 11+>K&&Ed ' K 99+FJ ")*<=)*?@)*?@%m4	
 ,+CC"8 + ? ?&?"
 	
 4'* M %&89%&;<%&;<!-0!-":":;C ""jmm3+'55" 2&?"
 	
 ((I i!9:::% !4!46HI&00*3M''9M$""&7&F&FF*5*H*H!=!==/+99& $6*C#&  
	$	$(9(N(N	N  8 8 I II//==& $6*C#&  	##>>	?&&*;*E*EE !?!??/+99& $6*C#&  	"-%(::++CC" 2&?"
 	
 +/M'9=M 56!!*dt!LF' mm."; OVs&   B	RRF=R	R
IRRc                   Z    e Zd Zdej                  defdZdej                  dee   fdZ	y)_TrustNoOner   rj   c                      y)NFr   r   r   s     ry   is_rootz_TrustNoOne.is_root  s    r{   c                     t        d      S r   )r   rQ  s     ry   find_potential_issuersz"_TrustNoOne.find_potential_issuers  s     Bxr{   N)
r   r   r   r   CertificateboolrR  r   r   rT  r   r{   ry   rO  rO  
  s;    D,,  $$	+	r{   rO  r   r(  rB  c                 D    t        fd| j                  D              S )Nc              3   V   K   | ]   }|j                   j                     k   " y wr   )r   leaf).0	prov_pathr(  rB  s     ry   	<genexpr>z0_crl_issuer_cert_poe_boundary.<locals>.<genexpr>  s-       	INN''(F2s   &))any
prov_paths)r   r(  rB  s    ``ry   _crl_issuer_cert_poe_boundaryr_    s#        r{   r   c                 :    || j                   j                     |k  S r   )r[  rY  )r   r(  rB  s      ry   _ocsp_issuer_cert_poe_boundaryra    s     t~~**+v55r{   r   revocation_checking_rulec                    K   j                   }|j                   t                     }dt        j                  f fd}t        j                  |D cg c]
  } ||       c}      }j                  }	g }
g }t               }|D ]  }| d {   \  }}|D ]i  }t        | j                  |	      r|
j                  |       ,|j                  j                  j                         }|j                  t!        |             k |D ]i  }t#        | j                  |	      r|j                  |       ,|j$                  j&                  j                         }|j                  t!        |             k  |
s|r6j(                  j+                  |       j(                  j-                  |       |
|fS c c}w 7 )w)N)r   trust_managerissc                 d    t        t        |       g       }t        |j                        S )N)trust_anchorintermrY  )r   revinfo_managerr   rb  )r,   r   r*   ri  )re  truncated_pathr   r   rb  r   s     ry   _for_candidate_issuerzB_find_revinfo_data_for_leaf_in_past.<locals>._for_candidate_issuer6  s:    '(-bt
 /4DD%%=	
 	
r{   )cert_registryrT  rO  r   rU  asyncioas_completedrB  setr_  r   appendr   rs   rq   addr)   ra  ocsp_responseru   ri  
evict_crlsevict_ocsps)r   r   r   rb  registrycandidate_issuersrk  re  job_futuresrB  r   r   to_evictfut_resultsnew_crls	new_ocspscrl_oirevinfo_dataocsp_ois   ````               ry   #_find_revinfo_data_for_leaf_in_pastr  #  s     (55H 77 8 	
4#3#3 	
 	
 &&/@A	s	#AK +66K "D*,E 5H" ;$//)  	;F,,,k F#%zz22779^L9:	; ! 	;G---{ W%&44GGLLN^L9:	;;0 u 00;;HE 00<<XF;K 	B 0s   AG F8)+G F=D)G validation_policy_specc           	      ^  K   t        |j                  |j                        }d }|j                  |       }	 |2 3 d {   }t	        j
                  t        |||d              d {   }|j                  }|j                  }|N|J ||fc |j                          d {    S 7 k7 C7 	6 	 |j                          d {  7   n# |j                          d {  7   w xY wd}	|t        j                  |	|      t        j                  |	 dt        j                        w)N)rd  ru  )r   r  r   init_control_timez2Unable to construct plausible past validation pathr;  r   z": no prima facie paths constructed)r0   rd  rl  async_build_paths_lazyrG   handle_certvalidator_errorsr#   error_subindicsuccess_resultcancelrF   r   r9   NO_CERTIFICATE_CHAIN_FOUND)
r   r  r   path_buildercurrent_subindicationpaths	cand_pathpast_resultr  r   s
             ry   _build_and_past_validate_certr  j  sC    
 ,::)77L
 !//5E$ 	2 	2) + G G"+A-E&*	! K %0$>$>!)88O$,&222 /11lln!	2 	!  %  llnelln
>C(--4I
 	
 --"e#EF0KK
 	
s   5D-C B0B*B0&C (B,)C 	C D-$B.%D-*B0,C .D-0C 2D-CD-C' C#!C''AD-current_time_sub_indicr  is_timestampc                   K   t        |d|      }| d   d   d   j                  }||   }	 t        |       }	|	j                  }
|j                  j                  |	j                         |r|j                  xs |j                  }n|j                  }t        |
|||j                  j                   j"                         d {   \  t%        |
||	       d {   \  }}fd
}||k  r|t        j&                  k(  s|t        j(                  k(  r	 |        |S |t        j*                  t        j,                  fv r|S |t        j.                  t        j0                  fv rL||
j2                  k  r%t        j                  dt4        j6                        ||
j8                  k  r	 |        |S t        j:                  d|      # t        $ r& t        j                  dt        j                        w xY w7 67  w)NT)is_historicalpoe_manager_overriderl   r   rm   z,signer certificate not included in signaturer   )r   rb  )r  r   c                  r    t        xs       s't        j                  } t        j                  d|       y )N)zoPOE for signature available, but could not obtain sufficient POE for the issuance of the revocation informationr  )rV  r9   REVOCATION_OUT_OF_BOUNDS_NO_POErF   r   )r   	leaf_crls
leaf_ocspss    ry   (_pass_contingent_on_revinfo_issuance_poezQ_ades_past_signature_validation.<locals>._pass_contingent_on_revinfo_issuance_poe  s=    I+,&FFF11!
 $*  -r{   z'Signature predates cert validity periodr  zHPast signature validation did not manage to improve current time result.)r[   rx   rA   r  rl  register_multipleother_certsr=   rF   r   r9   NO_SIGNING_CERTIFICATE_FOUNDr   r   r  revinfo_policyrevocation_checking_policyee_certificate_ruler  r  rI  REVOKED_CA_NO_POEr   r  OUT_OF_BOUNDS_NOT_REVOKEDrG  r8   rH  r   SigSeedValueValidationError)r  r   rB  r  r  r  r   signature_bytesr>  r*  r   r   	cert_pathr  r  r  r  s                  @@ry   _ades_past_signature_validationr    s"      Bt+  ".1!4[AHHO%o6

,[9	$$ ..@@!!	
 55 655 	
 "1!G!G"E &"11LL``# Iz (E5!9( "I
 o- #&7&F&FF%):)D)DD46#//??(
 
 #2277(
 
 #T%:%::55$M'2'@'@  %(<(<<8:   
,
,. 2 Y  
--:0MM
 	

"s<   )G?<G *AG?G9G?G<C*G?/G66G?<G?c                   K   | d   }|d   j                   dk(  }|(t        j                  t        j                               }	 t        | |||||       d{    t        j                  S 7 # t        j                  $ r=}t        j                  |       |j                  xs t        j                  cY d}~S d}~wt        $ r/}t        j                  |       t        j                   cY d}~S d}~ww xY ww)u  
    Validate a CMS signature in the past according
    to ETSI EN 319 102-1 § 5.6.2.4.

    This is internal API.

    .. danger::
        The notion of "past validation" used here is only valid in the
        narrow technical sense in which it is used within AdES.
        It should _never_ be relied upon as a standalone validation routine.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param poe_manager:
        The POE manager from which to source existence proofs.
    :param current_time_sub_indic:
        The AdES subindication from validating the signature
        at the current time with the relevant settings.
    :param init_control_time:
        Initial value for the control time parameter.
    :return:
        An AdES subindication indicating the validation result
        after going through the past validation process.
    encap_content_infocontent_typetst_infoNtzr  r   rB  r  r  r  )rx   r   r   tzlocalget_localzoner  r:   r  rF   r   loggerwarningr   r9   r	  r"   !CERTIFICATE_CHAIN_GENERAL_FAILURE)r  r   rB  r  r  ecir  r<  s           ry   ades_past_signature_validationr    s     D *
+C~&--;L $LLG,A,A,CDC-#+##9/%
 	
 	
 }}	
 ** Aq##@'8'@'@@ Cq BBBCs`   AC9A0 A.A0 -C9.A0 0C62B;5C66C9;C6$C1+C6,C91C66C9c                   "    e Zd ZU eed<   eed<   y)_PrimaFaciePOEItemdigestvalidation_objectN)r   r   r   bytesr   r'   r   r{   ry   r  r  7  s    M''r{   r  c                   p    e Zd ZU eed<   eed<   ee   ed<   ej                  ed<   e
ed<   eed<   defdZy	)
_PrimaFaciePOEFromTimeStamppdf_revisiontimestamp_dtpoes_impliedtimestamp_token_signed_data
doc_digestforensic_infomanagerc           	          | j                   D ]L  }|j                  t        t        j                  |j
                  | j                  |j                               N y N)poe_typer  poe_timer  )r  register_known_poer$   r&   
VALIDATIONr  r  r  )r   r  things      ry   add_to_poe_managerz._PrimaFaciePOEFromTimeStamp.add_to_poe_managerG  sO    && 	E&&$// <<!..&+&=&=		r{   N)r   r   r   intr   r   r	   r  r   
SignedDatar  r   r%   r  r   r{   ry   r  r  =  s<    .//!$/	* 	r{   r  sdc              #   $  K   | d   D ]  }|j                   }|j                         }|j                  dk(  rt        j                  }n!|j                  dk(  rt        j
                  }n`t        |      }t        |t        ||              y w)Ncertificatescertificatev2_attr_certrn   rp   r  r  )	chosenrq   namer(   ro   OTHERr)   r  r'   )r  cert_choicer   datavo_typer  s         ry   &_extract_cert_digests_from_signed_datar  S  s      .) 
  xxz},*66G/ +00G % .7#N
 	
!
s   BBc                 D    | d   d   j                   }|d   j                  S )Nr  contentgen_time)parsedrx   )r  r  s     ry   _get_tst_timestampr  m  s)    34Y?FFHJ&&&r{   revinfo_archivalc           
   #   T  K   | d   D ]J  }t        t        |j                               t        t        j
                  t        |                   L | d   D ]J  }t        t        |j                               t        t        j                  t        |                   L y w)Nr   r  r  r   )	r  r)   rq   r'   r(   rr   r2   rt   r3   )r  r   r   s      ry   ._read_validation_objects_from_revinfo_archivalr  r  s       & 
 !#((*-.044"3'
 	

 !( 
 !$))+..0>>#D)
 	

s   B&B(dssc              #     K   | j                   D ]i  }|j                         j                  }t        t	        |      t        t        j                  t        t        j                  |                         k | j                  D ]i  }|j                         j                  }t        t	        |      t        t        j                  t        t        j                  |                         k | j                  j!                         D ]j  }|j                         j                  }t        t	        |      t        t        j"                  t$        j&                  j                  |                   l y w)Nr  r  )r   
get_objectr  r  r)   r'   r(   rr   r2   r   loadr   rt   r3   r   certsr   ro   r   rU  )r  crl_objr  ocsp_objcert_objs        ry   !_read_validation_objects_from_dssr    s6     88 
!!#(( !$'.044"?#7#7#=>
 	

 II 
""$)) !$'.0>>#L$5$5d$;<
 	

 II$$& 
""$)) !$'.0<<&&++D1
 	

s   E9E;rinclude_content_tsdiff_policyc                 h   t               }t               }g }t        | j                        D ]  \  }}|j                  ||d u        t	        | |j
                        }|j                  }	d }
d}|j                  dk(  r|	}
d}n#|r!t        j                  |j                  d      }
|
	 t        j                  |      }|j                  t        |             |j                  |       |j!                         }|j#                         t$        j&                  k\  }|rT|j)                  t+        |j
                  t-        |
      t/        |      |
||j1                                      t               }|j                  t3        |
             |j                  t3        |	             |j                  d   }|s'	 t5        |d	      }|j                  t7        |             |j                  d
   j<                  }|j?                  tA        tC        |      tE        tF        jH                  |j                                     	 tK        |d      }	 tK        |j                  d   d      }tO        jP                  ||      D ]^  }|d   }|d   D ]O  }|d
   j<                  }|j?                  tA        tC        |      tE        tF        jR                  |                   Q `  |S # t        $ r Y w xY w# t8        t:        f$ r Y &w xY w# t:        tL        f$ r d}Y w xY w# t:        tL        f$ r d}Y w xY w)N)	skip_diff)revisionFz/DocTimeStampTr  )r  r  r  r  r  r  r  adobe_revocation_info_archivalrm   r  r  content_time_stampr   unsigned_attrssignature_time_stampr  rl   )*ro  	enumerateembedded_signaturescompute_integrity_infor6   signed_revisionr  sig_object_typerG   r  r   rD   read_dssr   r  rU   compute_digestevaluate_signature_coveragerL   ENTIRE_REVISIONrp  r  r  	frozensetsummarise_integrity_infor  rC   r  r?   r@   rx   rq  r  r)   r'   r(   rv   rB   r>   r   r   rw   )r  r  r  collected_so_farfor_next_tsprima_facie_poe_setsixembedded_sighist_handlerr  ts_signed_data	is_doc_tsr  r  coverage_normalr  revinfo_attrrL  content_tsessignature_tsests_datats_data_contentts_signer_infots_sig_bytess                           ry   0_build_prima_facie_poe_index_from_pdf_timestampsr    sc   < 14 ,/5K ?A
 &a&;&;< GL++!T) 	, 	
 *44
 '3&>&>37	''?:(NI(99((N %+44\B ''(I#(NO ##K0%446J88:)99:  $++/%1%A%A%7%G%./?%@4B#-&2&K&K&M	 "e6~F 	A+NO
 $//?-$&F  ""B<P !,,[9@@	%i0"2 4 @ @
 '22#
	
	-2L	 /(()9:&N !~|D 	G%i0O"1."A -k:AA&-l;
 +;(<(F(F"1+
	oGR  G # Z ./HI 2 *+=> 	L	 *+=> 	 N	 sH   )/K 6&K0>LL 	K-,K-0LLLLL10L1r  cur_timing_infoc           
        K   t        | d       }|xs( t        j                  t        j                               }t               }|j                  j                  |       t        |      D ]w  \  }}t        |      }|t        |      dz
  k  r||dz      }|j                  |       t        |||      }	t        |j                  |||j                  |	|j                  t                d {   }
|
j"                  }|j$                  t&        j(                  k(  r|j                  |       |j$                  t&        j*                  k(  rt-        j.                  d|      t1        |t2              sJ t5        |j                  ||||j6                  	       d {   }|j$                  t&        j(                  k(  r|j                  |       ct-        j.                  d
|       |S 7 7 Pw)Nc                     | j                   S r   r  )ps    ry   <lambda>z+_validate_prima_facie_poe.<locals>.<lambda>h  s
     r{   )keyr  rS   r   r  )r   r   r   r   r   r   r   z9Permanent failure while evaluating timestamp in PoE chainr   )r  r   rB  r  r  zZCould not validate timestamp in PoE chain at current time, and past validation also failed)sortedr+   r   r  r  r%   local_knowledger  r  r   lenr[   r`   r  r  r  rI   r   r   r;   PASSEDFAILEDrF   r   r   r9   r  r  )r  r   r  candidate_poesresulting_poesr  poetemporary_poesnext_poer   cur_time_result	sub_indicr  s                ry   _validate_prima_facie_poer%  ^  s     06NON% )=)A)A  "*O  \N##66~F^, 2Cn-N#a''%b1f-H''7#E'!/$
 
 !:;;+'!$%= # 1 1.!
 
 $11	z000 "">2!2!2211K#,  i):;;; >;; /*'0"1"A"A! K !!Z%6%66&&~655<'0 ]2f O
0s&   C,G..G*/B,G.G,AG.,G.c                   4    e Zd ZU dZee   ed<   	 ee   ed<   y)rd   u   
    Result of a PAdES validation for a signature providing long-term
    availability and integrity of validation material.
    See ETSI EN 319 102-1, § 5.6.3.
     oldest_evidence_record_timestampsignature_timestamp_statusN)r   r   r   r   r   r   r   rb   r   r{   ry   rd   rd     s,     '/x&88 !))B CCr{   rd   r  c                   K   | j                   d   j                  }| j                  }|j                  xs |j                  }|j
                  }|y | j                         }|J t        ||||t        |||             d {   }	|	j                  }
t        |
t              r|
t        v ry	 t        ||||
|j                  d       d {   }t        t         j"                  |	j$                  r!t'        j(                  |	j$                  |      nd d |	j*                        }n|	}|d	   d
   j4                  }|D|j7                  |d   d   |j                        r!|d   j                  }|j9                  ||       |S 7 7 # t,        j.                  $ rE}t        |j0                  xs |
|j2                  |	j$                  |	j*                        }Y d }~d }~ww xY ww)Nrm   r  )r   r   r   r   r   Tr  )r   r   r  r  r  message_imprinthash_algorithm)momentr  )r   rx   attached_timestamp_datar   r   algorithm_usage_policycompute_tst_digestr`   r[   r   r   r9   _LTA_TS_FURTHER_PROCr  r  rb   r:   r  r   r   replacer   rF   r   r   r;  r  digest_algorithm_allowedregister)r  r   rB  r   r  signature_tsr   r   r   signature_ts_prelim_resultts_current_time_sub_indicr   signature_ts_resultr<  r  signature_ts_dts                   ry   _process_signature_tsr9    s     #..{;BBO#/#G#GL11 	211  )??K'::<+++'@$'1!C#!,"

( 
" !; H H 	,.?@%)==	 %D( /''@"-"="=!% O #<(mm 2<<	  ''2==(7
  #=#P#P#, 901)<CCH;#G#G"#$45** $H $ #:.55_o> }
"*, .. 	";22O6O--5@@#=#P#P	#	sP   BG!F(G!.F FAF %AG!F G;GG!GG!readerc           
      &   	 t        j                  |       }|j                  D cg c]I  }t        j                  t        j                  |j                         j                              D ]  }| K }}}|j                  D cg c]9  }t        t        j                  |j                         j                              ; }}t        |j                               }t        |||      }|S c c}}w c c}w # t        $ r t               }Y |S w xY w)N)rs   )known_ocsps
known_crlsknown_certs)rD   r  r   r3   r   r   r  r  r  r   r2   r   list
load_certsrV   rU   )	r:  r  respr   	dss_ocspsr   dss_crls	dss_certsr  s	            ry   _dss_to_local_knowledgerE  *  s   +#,,V4 		
%00!!$//"3"8"89
  

	 
 xx
 /"6"6s~~7G7L7L"MN
 
 )*	(!!
 '

  +(*+s/   $C9 AC.4C9 >C4)C9 .C9 9DDpdf_validation_specc                    K   |xs( t        j                  t        j                               }t	         j
                  d|j                        }|j                  }|j                  }t         j
                        }t        |j                  |j                  z   |j                  |j                  z   |j                  |j                  z   |j                  |j                        }t!        j"                  ||      }	d}
d}	 t%        ||	|       d{   }
t'        t)         fd	|      d
 d      }||j*                  }n!|j                  st,        j/                  d       |t5               }
|j7                  |
       |
J t9        |	|t;        |
            }t=         j>                  |	|| jA                         | jC                         tD               d{   }|jF                  }|tH        vrAd| d}tK        ||jL                  ||jN                  |jP                  |d|jR                        S  jT                  d   jV                  }|
jY                  |tZ        j\                  |jN                         t_         |	t;        |
      |       d{   }ta        |tb              r;t;        |
      }	 te         j>                  |	|||jf                  d       d{    |}
|
|   }|	jl                  jn                  }	  jp                  }|#ts         jT                  |||jt                         tv        jx                  }d}tK        ||jL                  |||jP                  |||jR                        S 7 c# t0        j2                  $ r"}t,        j/                  d|       Y d}~Ed}~ww xY w7 7 7 # t0        j2                  $ rX}||   }tK        |jh                  xs ||jj                  |jL                  ||jP                  |||jR                        cY d}~S d}~ww xY w# t0        j2                  $ r'}|jh                  xs |}|jj                  }Y d}~d}~ww xY ww)u  
    Validate a PAdES signature providing long-term availability and integrity
    of validation material. See ETSI EN 319 102-1, § 5.6.3.

    For the purposes of PAdES validation, the chain of document time stamps
    in the document serves as the unique Evidence Record (ER).

    :param embedded_sig:
        The PDF signature to validate.
    :param pdf_validation_spec:
        PDF signature validation settings.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A validation result.
    r  Tr  r  )r:  )r<  r=  r>  
known_poesnonrevoked_assertions)r  N)r   r  c                 6    | j                   j                  kD  S r   )r  r  )r   r  s    ry   r  z%ades_lta_validation.<locals>.<lambda>  s    C,,|/K/KK r{   c                     | j                   S r   r  )r   s    ry   r  z%ades_lta_validation.<locals>.<lambda>  s    C,, r{   )r  defaultzRNo document timestamps after signature; proceeding without past proof of existencezXDocument timestamp chain failed to validate; proceeding without past proof of existence.)exc_info)r   r   r  )r  r   r   r   r/  r   r   r   z?Validation of signature at current time failed with indication z!. Past validation not applicable.)r   r   r   r>  r   r'  r(  r   rm   )r  dt)r   rB  r   Fr  )r   r   r   r>  r   r(  r'  r   )r   r   r   )r   r   r   r>  r   r(  r'  r   )=r+   r   r  r  r  r:  r  signature_validation_specr  rE  rV   r<  r=  r>  rI  rJ  r   r1  r%  rF  filterr  r  r  rF   r   r%   r  r[   r   r^   r  r  r  rJ   r   _LTA_FURTHER_PROCrd   r   r>  r   r   r   rx   r3  r&   r  r9  r   r9   r  r  r   r;  r   r.  r  r   r   r:   r  )r  rF  r   r   poe_listr   init_local_knowledge	dss_factsr  augmented_validation_specupdated_poe_managerr'  oldest_docts_recordr<  with_time_data_handlerssignature_prelim_resultr  r   r  r7  past_sig_poe_managersig_poer   r   r   r   s   `                         ry   r_   r_   E  s    4  !5!9!9  ""K
 @'33H *CCO*:: (|/B/BCI$(44y7L7LL'22Y5I5II(44y7L7LL'222HHO !, 3 3! '+$
$=5'%
 
 "K -
 */B/O/O, ++NN2 (/(l**+>?*** A&!"56
 %> ,,1!8..0";(AAC%	% 	 5BB%6601 2 	
 '0.99# 7 K K'AA-M'+6II
 	
 #..{;BBO  ##"66 !  !61,-	!  (*;<  $$78	1(44 90'="-"="="   #7( -_= 	"88OO (!-!9!9"/(('/??	 #
 ##*55.#==#6)I2EE m
. ** 
/ 	 	
 	

*	V .. 	*?;G*22L6L--2==$++EE+>4#:#M#M 	J ** (,,F0F''(s   DQ'M< M9AM< 'A8Q'N4 B9Q'N7Q':(N< "N:#N< )Q'AP* 1Q'9M< <N1N,&Q',N11Q'7Q':N< <P'AP"P'Q'"P''Q'*Q$=QQ'Q$$Q'future_validation_timecurrent_reference_timec           	        K   |xs$ t        j                  t        j                        t	        |d|      }t        | j                  dd      |j                  }|j                  t        | j                        t        j                        }	 | j                  j                  d   }|j                  t        |j                  j                   |             fd}t%        j&                  t         |             |	      }	t%        j&                  |t%        j&                  |t)        t*        j,                        |	
            }
t/        | |
|       d{   S # t"        $ r Y w xY w7 w)a  
    .. versionadded:: 0.21.0

    Simulate a future LTA validation of a PDF signature, assuming
    perfect timestamp maintenance until the specified point in time.

    .. warning::
        This is experimental API.

    The purpose of this utility function is to act as a sanity check
    for signers and signature archivists.
    It takes validation spec, a future validation time and
    a current reference time (defaults to the current time), and, by fiat,
    generates proofs of existence for all relevant objects in the PDF for that
    reference time. It then executes the PAdES LTA validation algorithm
    with that set of PoEs against the future validation time, with all
    remote fetching functionality disabled.

    The idea is that this allows the caller to assess whether a signature is
    "LTA maintainable", i.e. whether it contains the necessary information for
    the signature to remain validatable if the timestamp chain is extended
    properly. If this check fails but the signature validates at the current
    time, it may indicate a lack of contemporaneous revocation information.

    :param embedded_sig:
        The signature under scrutiny.
    :param pdf_validation_spec:
        The validation spec against which the simulated validation
        should be executed.
    :param future_validation_time:
        The future validation time at which the validation should be simulated.
    :param current_reference_time:
        The reference time at which all relevant objects in the PDF are
        presumed to have been proven to exist for the purposes of
        the (future) validation being simulated. Defaults to the current time.
    :return:
        An AdES LTA validation result.
    r  T)r  point_in_time_validationr>  NrH  )atc               3     K   j                        E d {    j                        E d {    D ]F  } | j                  D ]5  }t        t        j                  |j
                  |j                         7 H y 7 i7 Rwr  )assert_existence_known_atr  r$   r&   PROVIDEDr  r  )prima_facie_poeitemdss_knowledger   orig_local_knowledgeprima_facie_poess     ry   _poesz2simulate_future_ades_lta_validation.<locals>._poesg  s     
 (AA#FFF ::3???/ 
	O'44 	 $--;; &*&<&<	 		
	 	G?s    BBBBABB)rI  rJ  )revinfo_gathering_policyr  )rP  )r   )r   r   r   utcr+   r  r:  rP  r  rE  r?  rJ  embedded_timestamp_signaturesrp  r.   r  sha256
IndexErrorr   r1  rY   rX   
LOCAL_ONLYr_   )r  rF  r]  r^  r   orig_sig_validation_specnew_nonrevoked_assertionslast_tsrk  updated_local_knowledgeupdated_pdf_validation_specrh  r   ri  rj  s              @@@@ry   ra   ra   "  sj    X !
AHLLHLL$AC&.!%2K
 H$  3LL3CC+L,?,?@M $%9%O%O P%%CCBG!((%##**/E	
& *11=7 #."5"5"-"5"5$%@)44& 4#
	# %#  M  Ls8   BE:A	E) !BE:$E8%E:)	E52E:4E55E:r   )NN)r   rm  r   r   loggingr   r   r   r   typingr   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r  
asn1cryptor   r   r   asn1_pdfr   r   asn1crypto.crlr   asn1crypto.ocspr   pyhanko_certvalidatorr   pyhanko_certvalidator.authorityr   r   pyhanko_certvalidator.contextr    r!   pyhanko_certvalidator.errorsr"   #pyhanko_certvalidator.ltv.ades_pastr#   pyhanko_certvalidator.ltv.poer$   r%   r&   r'   r(   r)   $pyhanko_certvalidator.ltv.time_slider*   pyhanko_certvalidator.ltv.typesr+   pyhanko_certvalidator.pathr,   !pyhanko_certvalidator.policy_declr-   r.   r/   pyhanko_certvalidator.registryr0   r1   &pyhanko_certvalidator.revinfo.archivalr2   r3   *pyhanko_certvalidator.revinfo.validate_crlr4   +pyhanko_certvalidator.revinfo.validate_ocspr5   pyhanko.pdf_utils.readerr6   r7   pyhanko.sign.ades.reportr8   r9   r:   r;   r<   pyhanko.sign.generalr=   r>   r?   r@   rA   rB   rC   pyhanko.sign.validationrD   rE   rF   rG    pyhanko.sign.validation.settingsrH   pyhanko.sign.validation.statusrI   rJ   rK   rL   rM   rN   rO   rP   diff_analysisrR   r  rT   rU   policy_declrV   rW   rX   rY   rZ   r[   utilsr\   __all__	getLoggerr   r  rf   r  rz   r   re   r   rb   r   r  r`   
SignerInfoPublicKeyInfor   r   r   r   rV  r
  r   r.  r]   r7  rc   r  r  r   r  r  rI  r  rC  r^   rO  r_  ra  rU  r  r  r  r  r  r  r  r  RevocationInfoArchivalr  r  r  r%  r  r  rR  r0  rd   r9  rE  r_   ra   r   r{   ry   <module>r     sK        ! '    $    &   * ( 3 H 3 =  Q @ 5 
 E N D N F     A	 	 	 ' % #  +
 
		8	$\DI
e_$1,< 1# 1.' '$ $
 3  > !+ !+ !+H 
 37AE48	$^^	$,	$  	$
 Z 	$ ./	$ ''=>	$ "$sCx.1	$ 	$ 
	$ 
 37AE48$^^$,$  $
 ./$ ''=>$ "$sCx.1$ $ 
$ 37AE48'5^^5,5  5 ./	5
 ''=>5 "$sCx.15 5p

%
 
 ++,	
4L !23Lt+,LI/#A4GHI* 59'2^^2)2  2 "$sCx.1	2 2j-1?D$QQ Q -Q $$56	Q
  (1QhL,L%L 5LD 
 37"&AE4848
$
$,
$ Z 	
$
 ./
$ 
$ ''=>
$  (1
$ "$sCx.1
$ 
$ 

$ 

 37"&AE4848	$	$,	$ ./		$
 	$ ''=>	$  (1	$ "$sCx.1	$ 	$ 
	$ 37"&AE4848)MM,M ./M 	M
 ''=>M  (1M "$sCx.1M M`<<)< -< $$56	<
 ,< <  (1< "$sCx.1< 67< Z < $&DDE<~ $2#< 2 2
 $;;((++##..	  

 37"&AE4848	'	',	' ./		'
 	' ''=>	'  (1	' "$sCx.1	' "	' 
	' 
 37"&AE4848
'
',
' Z 	
'
 ./
' 
' ''=>
'  (1
' "$sCx.1
' "
' 

'  37"&AE4848)aa,a ./a 	a
 ''=>a  (1a "$sCx.1a "aH, 	 (7A6
 6*26AK6D


D4D D 5	DN(



(
4(
 5(
 >8#$	(
Vgg,g g %%67	g
  g g g^ -15C5C,5C 5C %%67	5C
  )5C 5Cp $( ( (
 $  *

!4-.
4'3>> 'h '

55
!4-.
*
	
!4-.
@t t t  *%t  

%&	t z 7;F:;F
 -F 23F FR ((++..33;;99##	  !++..33;;99  $:  ,Q&Q,Q Q &	Q
 '(Qh< 3748	Z&Z3Z ./Z  (1	Z
 ZB 26	l&l3l %l %X.	l
 lr{   