
    Wwg?"                        d dl Z d dlmZ d dlmZ d dlmZmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZmZ ddlmZmZmZm Z m!Z! ddl"m#Z#m$Z$ dejJ                  dejL                  defdZ' G d dee jP                        Z) G d de)      Z* e+h d      Z,e)j[                   ee,            Z.de.dfde/de/dej`                  dejJ                  de1d ee)   d!ee   fd"Z2d#ejf                  fd$Z4y)%    N)datetime)Optional)algoscmskeysx509)serialization)padding)DSAPublicKey)ECDSAEllipticCurvePublicKey)Ed448PublicKey)Ed25519PublicKey)RSAPublicKey)AlgorithmUsageConstraintAlgorithmUsagePolicyDisallowWeakAlgorithmsPolicy   )MultivaluedAttributeErrorNonexistentAttributeErrorfind_unique_cms_attribute&get_pyca_cryptography_hash_for_signingprocess_pss_params   )DisallowedAlgorithmErrorSignatureValidationErrorsignature_algomessage_digest_algoreturnc                    | d   j                   dk(  r0|d   j                   }|dv rt        d      S t        dd| d	      S 	 t        j                  d| j                  i      }|N|j                         |j                         k7  r-t        dd|d   j                    d
| d   j                    	      S t        d      S # t
        $ r d }Y iw xY w)N	algorithmed448)shake256shake256_lenT)allowedFzDigest algorithm z: does not match value implied by signature algorithm ed448)r%   failure_reasonz5 does not match value implied by signature algorithm )nativer   r   DigestAlgorithm	hash_algo
ValueErrordump)r   r   algosig_hash_algo_objs       T/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko/sign/validation/utils.py_ensure_digest_matchr/       s    k"))W4 #;/66//+D99+'v .P Q !!11.223
 	%""$(;(@(@(BB'#$7$D$K$K#L MG!+.5568
 	
 $D11  ! !s   !C CCc                   p    e Zd ZdZdej
                  dej                  dee   de	fdZ
ededd fd       Zy	)
CMSAlgorithmUsagePolicyz4
    Algorithm usage policy for CMS signatures.
    r   r   momentr   c                     t        ||      S )a  
        Verify whether a digest algorithm is compatible with the digest
        algorithm implied by the provided signature algorithm, if any.

        By default, this enforces the convention (requirement in RFC 8933) that
        the message digest must be computed using the same digest algorithm
        as the one used by the signature, if applicable.

        Checking whether the individual algorithms are allowed is not the
        responsibility of this method.

        :param signature_algo:
            A signature mechanism to use
        :param message_digest_algo:
            The digest algorithm used for the message digest
        :param moment:
            The point in time for which the assessment needs to be made.
        :return:
            A usage constraint.
        )r/   )selfr   r   r2   s       r.   digest_combination_allowedz2CMSAlgorithmUsagePolicy.digest_combination_allowedN   s    4 $N4GHH    policyc                 <    t        | t              r| S t        |       S )aP  
        Lift a 'base' :class:`.AlgorithmUsagePolicy` to a CMS usage algorithm
        policy with default settings. If the policy passed in is already
        a :class:`.CMSAlgorithmUsagePolicy`, return it as-is.

        :param policy:
            The underlying original policy
        :return:
            The lifted policy
        )
isinstancer1   _DefaultPolicyMixin)r7   s    r.   lift_policyz#CMSAlgorithmUsagePolicy.lift_policyj   s     f56M&v..r6   N)__name__
__module____qualname____doc__r   SignedDigestAlgorithmr(   r   r   r   r5   staticmethodr   r;    r6   r.   r1   r1   I   sl    I33I #22I "	I
 
"I8 /0 /5N / /r6   r1   c                       e Zd ZdefdZdej                  dee   de	fdZ
dej                  dee   deej                     de	fdZy	)
r:   underlying_policyc                     || _         y N)_policy)r4   rD   s     r.   __init__z_DefaultPolicyMixin.__init__}   s	    (r6   r,   r2   r   c                 :    | j                   j                  ||      S rF   )rG   digest_algorithm_allowed)r4   r,   r2   s      r.   rJ   z,_DefaultPolicyMixin.digest_algorithm_allowed   s     ||44T6BBr6   
public_keyc                 <    | j                   j                  |||      S rF   )rG   signature_algorithm_allowed)r4   r,   r2   rK   s       r.   rM   z/_DefaultPolicyMixin.signature_algorithm_allowed   s"     ||77&*
 	
r6   N)r<   r=   r>   r   rH   r   r(   r   r   r   rJ   r@   r   PublicKeyInforM   rB   r6   r.   r:   r:   |   s|    )*> )C))C3;H3EC	!C

))
 "
 T//0	

 
"
r6   r:   >   md2md5sha1F	signaturesigned_datacertsignature_algorithmmd_algorithmalgorithm_policy
time_indicc                    ||j                  |||j                        }|sJd|d   j                   d}	|j                  |	d|j                   z  }	t	        |	|j
                  du       |j                  |t        j                  d|i      d      }
|
s#t	        |
j                  |
j
                  du 	      	 |j                  }t        ||
      }t        j                  |j                  j                               }|j                  }|dk(  r9t!        |t"              sJ |j%                  | |t'        j(                         |       y|dk(  r;t!        |t"              sJ t+        |d   ||
      \  }}|j%                  | |||       y|dk(  r&t!        |t,              sJ |j%                  | ||       y|dk(  r/t!        |t.              sJ |j%                  | |t1        |             y|dv r%t!        |t2              sJ |j%                  | |       y|dv r%t!        |t4              sJ |j%                  | |       yt7        d| d      # t        $ r |}Y w xY w)z1
    Validate a raw signature. Internal API.
    N)r2   rK   zSignature algorithm r!   z, is not allowed by the current usage policy.z	 Reason: )	permanent)r   r   r2   )failure_messagerZ   )	prehashedrsassa_pkcs1v15
rsassa_pss
parametersdsaecdsaed25519r"   zSignature mechanism z is not supported.)rM   rK   r'   r&   r   not_allowed_afterr5   r   r(   r)   r*   r   r	   load_der_public_keyr+   r   r9   r   verifyr
   PKCS1v15r   r   r   r   r   r   NotImplementedError)rR   rS   rT   rU   rV   r\   rW   rX   sig_algo_allowedmsgdigest_compatibleverify_md_algo	verify_mdpub_keysig_algopss_paddingr)   s                    r.   validate_rawrp      s    #+GG
t H 
  &&{3::; </0 
  ..:#3#B#B"CDD*/AATI  -GG. % 5 5l+!  H 
 !* 1 @ @+==E 
&,66 7)I //0D0D0FGG"11H$$'<000y+w/?/?/A9M	\	!'<000!3-|y"
Y 	y+{IF	U	'<000y+y9	W	'#9:::y+uY/?@	Y	'#3444y+.	W	'>222y+.!"8*,>?
 	
A  &%&s   <I IIsigner_infoc                 v    	 t        | d   d      }|j                  S # t        t        f$ r t	        d      w xY w)Nsigned_attrsmessage_digestzUMessage digest not found in signature, or multiple message digest attributes present.)r   r'   r   r   r   )rq   embedded_digests     r.   extract_message_digestrv      sQ    	
3')9
 %%%%'@A 
&)
 	

s    8)5abcr   typingr   
asn1cryptor   r   r   r   cryptography.hazmat.primitivesr	   )cryptography.hazmat.primitives.asymmetricr
   -cryptography.hazmat.primitives.asymmetric.dsar   ,cryptography.hazmat.primitives.asymmetric.ecr   r   /cryptography.hazmat.primitives.asymmetric.ed448r   1cryptography.hazmat.primitives.asymmetric.ed25519r   -cryptography.hazmat.primitives.asymmetric.rsar   !pyhanko_certvalidator.policy_declr   r   r   generalr   r   r   r   r   errorsr   r   r@   r(   r/   ABCr1   r:   	frozensetDEFAULT_WEAK_HASH_ALGORITHMSr;   DEFAULT_ALGORITHM_USAGE_POLICYbytesCertificatestrrp   
SignerInforv   rB   r6   r.   <module>r      sC   
   - - 8 = F K N F   G&2//&2..&2 &2R0/2CGG 0/f
1 
(  ))?@ !8!D!D !=>"   	'%)P
P
P
 

P
 44	P

 P
 P
 "P
f

 

r6   