
    WwgQ                     $
   d dl Z d dlZd dlmZ d dlmZmZ d dlmZ d dlm	Z	m
Z
mZmZmZmZ d dlmZmZmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ d dlmZmZmZm Z m!Z!m"Z"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z- d dl.m/Z/m0Z0 d dl1m2Z2m3Z3m4Z4 d dl5m6Z6 d dl7m8Z8m9Z9m:Z:m;Z;  ejx                  e=      Z> ed       G d d             Z?dej                  dej                  dede+de
ej                     f
dZCe G d d              ZDd!e'd"ed#eEd$efd%ZFdej                  dej                  d&eej                  ej                  f   ded'e'd(e+d)eEd$edee
e'   eDf   fd*ZHdej                  dej                  d&eej                  ej                  f   ded'e'd"ed)eEd$ede'fd+ZIe G d, d-e-             ZJd.e
e/   dej                  d/ej                  d0eeL   dee/   f
d1ZMd/ej                  d2eej                     d3ej                  dej                  deEf
d4ZOd&ej                  dej                  d3ej                  d/ej                  dej                  d5eJdeEfd6ZPdej                  d2eej                     d3ej                  d/ej                  dej                  d5eJdeEfd7ZQd8e/d9e)d:e%d5eJd;eEf
d<ZRd&eej                  ej                  f   ded8e/d=e'd"ed>e	eSe
e/   f   d?eEd5eJd$edeeeS      fd@ZTd8e/dAej                  d(e+d5eJdeeEej                  f   f
dBZU	 	 dZdej                  d3ej                  d>e	eSe
e/   f   d5eJd:ee%   dCee)   dee/   fdDZVd8e/d5eJd;eEfdEZWd3ej                  d&eej                  ej                  f   d8e/d)eEd5eJdeeeS      fdFZXd3ej                  d&eej                  ej                  f   d8e/dGee/   d5eJf
dHZY	 d[dIe6d&ej                  d5eJdJee   fdKZZdLeeS   dMe[d5eJd$efdNZ\	 	 d\d&eej                  ej                  f   d=e'd"ed$ee   fdOZ] ed       G dP dQ             Z^ ed       G dR dS             Z_ ed       G dT dU             Z`d&eej                  ej                  f   ded8e/d=e'dIe6d>e	eSe
e/   f   d?eEd5eJd$edee_   fdVZa	 	 d\d&eej                  ej                  f   d=e'dIe6dJed$ee   de`fdWZbdX Zcd&eej                  ej                  f   dAej                  dej                  dej                  fdYZdy)]    N)defaultdict)	dataclassfield)datetime)DictListOptionalSetTupleUnion)cmscrlx509)InvalidSignature)ValProcState)	AuthorityAuthorityWithCert)ValidationContext)CertificateFetchErrorCRLNoMatchesErrorCRLValidationErrorCRLValidationIndeterminateErrorPathValidationErrorPSSParameterMismatchRevokedError)ValidationTimingParams)ValidationPath)CertRevTrustPolicy)CertificateRegistry)Errors)CRLContainerRevinfoUsabilityRating)KNOWN_CRL_ENTRY_EXTENSIONSKNOWN_CRL_EXTENSIONSVALID_REVOCATION_REASONS)RevinfoManager)ConsListget_ac_extension_valueget_issuer_dnvalidate_sigT)frozenc                   ,    e Zd ZU dZeed<   ee   ed<   y)CRLWithPathsz0
    A CRL with a number of candidate paths
    r   pathsN)__name__
__module____qualname____doc__r!   __annotations__r   r        a/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko_certvalidator/revinfo/validate_crl.pyr-   r-   0   s     
r5   r-   crl_authority_namecertificate_listcert_issuer_authcert_registryreturnc                  K   |j                   }d }t        |t              r|j                  }|j	                  ||      }|s!| |j                   k7  r|j	                  | |      }|sX|j
                  Lg }| |h}|j
                  j                  |      2 3 d {   }|j                  |v s|j                  d|       +|S 7 (6 w)Nr   )	issuer
isinstancer   certificateretrieve_by_namefetcherfetch_crl_issuerssubjectinsert)	r7   r8   r9   r:   delegated_issuercert_issuer_cert
candidatesvalid_namescerts	            r6    _find_candidate_crl_issuer_certsrJ   :   s      (.."$56+77//*J ,0@0G0GG #33 0

 -//;
)+;< (//AA
 	+ 	+$ ||{*!!!T*	+ 
s0   BCC B>C C)C>C  Cc                   x    e Zd ZU eed<   dZeed<   dZeed<   dZeed<   dZeed<    e	e
      Zee   ed<   d	 Zy
)_CRLIssuerSearchErrscandidate_issuersr   candidates_skippedsignatures_failedunauthorized_certspath_building_failures)default_factoryexplicit_errorsc                 @   | j                   dkD  }| j                   r| j                  | j                   k(  r
t               S | j                  | j                   k(  rt	        d      S | j
                  | j                   k(  rt	        |rd      S d      S | j                  | j                   k(  rt	        |rd      S d      S | j                  r't        | j                        dk(  r| j                  d   S d}|d	j                  d
 | j                  D              z  }t	        |      S )N   z#CRL signature could not be verifiedzDThe CRL issuers that were identified are not authorized to sign CRLszAThe CRL issuer that was identified is not authorized to sign CRLszSThe chain of trust for the CRL issuers that were identified could not be determinedzQThe chain of trust for the CRL issuer that was identified could not be determinedr   z&Unable to determine CRL trust status. z; c              3   2   K   | ]  }t        |        y wN)str).0es     r6   	<genexpr>z/_CRLIssuerSearchErrs.get_exc.<locals>.<genexpr>   s     BSVBs   )
rM   rN   r   rO   r   rP   rQ   rS   lenjoin)selfpluralmsgs      r6   get_excz_CRLIssuerSearchErrs.get_exci   s+   ''!+&&&&$*@*@@$&&##t'='==%&KLL$$(>(>>%  .	  ((D,B,BB% * *	  !!c$*>*>&?1&D''**:C499BT-A-ABBBC%c**r5   N)r/   r0   r1   intr3   rN   rO   rP   rQ   r   listrS   r   r   ra   r4   r5   r6   rL   rL   `   sN    s"#C#05d0KOT,-K+r5   rL   candidate_crl_issuer_pathvalidation_contextissuing_authority_identical
proc_statec                   K   |j                  | j                        ry 	 |j                  }|s|j                  d      dz   }ddlm} |j                  j                  |       } ||| t        ||             d {    y 7 # t        $ rN}| j                  }t        j                  d|j                  j                   d	|
       t        d|       d }~ww xY ww)NT)	never_defz CRL issuerr   )intl_validate_path)ee_name_overridecert_path_stack)rg   zPath for CRL issuer z could not be validated.exc_infoz8The CRL issuer certificate path could not be validated. )check_validationlastrk   describe_certpyhanko_certvalidator.validaterj   rl   consr   r   loggerwarningrC   human_friendlyr   )	rd   re   rf   rg   temp_overriderj   	new_stackrZ   iss_certs	            r6   _validate_crl_issuer_pathrz      s      **+D+I+IJ
"33*((4(8=H  	F..334MN	 %#!.	
 	
 	
  	
,11"8#3#3#B#B"C D  	 	

 !FqcJ
 	
	
s<   CAB =B>B CB 	CA	CCCrI   	cert_pathcertificate_registryis_indirectc                   K   t        j                  |j                               j                         }t	        | |||       d {   }	|j
                  }
t        t        |	            }g }|	D ]  }|j                  |
k(  }|j                  |
k(  xr |j                  |k7  }|s|s|s|xj                  dz  c_
        N|j                  }|r$d|j                  vr|xj                  dz  c_        	 t        ||j                         |j%                  |      }|s	 |j'                  |      }|j-                  |        ||fS 7 # t         $ r |xj"                  dz  c_        Y w xY w# t(        $ r |xj*                  dz  c_        Y w xY ww)N)r9   r:   )rM   rU   crl_sign)hashlibsha256dumpdigestrJ   namerL   r\   rC   r=   rN   key_usage_valuenativerP   _verify_crl_signature
public_keyr   rO   check_path_verif_recursiontruncate_to_issuer_and_appendLookupErrorrQ   append)r7   r8   rI   r9   r{   r|   r}   rg   cert_sha256candidate_crl_issuerscert_issuer_nameerrscandidate_pathscandidate_crl_issuerdirect_issuerindirect_issuerr   	cand_paths                     r6   _find_candidate_crl_pathsr      s     ..-446K"B)*	#  (,,#6K2LMDO 5 ,*,448HH !''+;; ;$++{: 	
 _[##q(#.>>z1G1GG##q(#	 " "6"A"A 99:NO	%CC(	 	y)Y,*Z D  oR " 	""a'"	  ++q0+s[   AFEB)F1EFE),FE&#F%E&&F)FF
FFc          
      ~  K   t        | |||||j                  ||       d {   \  }}	|D ]  }
|
j                  }|j                  |      r |j                  j                  ||       |
c S |j                  |      }
	 | xr; |d uxr5 |j                  j                         |j                  j                         k(  }t        |
|||       d {    |j                  j                  ||       |
c S  |	j                         7 7 7# t        $ r&}|	j                  j                  |       Y d }~d }~ww xY ww)NrI   r9   r{   r|   r}   rg   )rd   re   rf   rg   )r   r|   rp   r   revinfo_managerrecord_crl_issuerr   r   r   rz   r   rS   r   ra   )r7   r8   rI   r9   r{   re   r}   rg   r   r   rd   r   rf   rZ   s                 r6   _find_crl_issuerr      sv     #<)/DD	# 	OT &5 *!8== 001EF..@@ "6 -, %.$K$K %
!	 /:/ + , :$//446'22779: (
 ,*C#5,G%	   ..@@ "6 -,O*V ,,.m	R " 	  ''*	sM   !D=DAD=?ADD	!D3D=	D	D:D5/D=5D::D=c                       e Zd ZU dZeed<   y)_CRLErrsr   issuer_failuresN)r/   r0   r1   r   rb   r3   r4   r5   r6   r   r   @  s    OSr5   r   delta_listscrl_idpparent_crl_akic                     | D ]b  }|j                   }|j                  |k7  r|j                  }||||4||j                  |j                  k7  rP||j                  k7  r`|c S  y rW   )crl_datar=    issuing_distribution_point_valuer   authority_key_identifier)r   r7   r   r   candidate_delta_cl_contcandidate_delta_cldelta_crl_idps          r6   _find_matching_delta_crlr   E  s     $/ '4==$$(:: +KKO 9M$97>>]5I5I#I /HHH&&)'* r5   crl_dps
crl_issuerc                 P   d}d}d}g }| d   }|rd}|j                   dk(  r#|j                  D ]  }	|j                  |	        ns|j                  j	                         }
|
j                  j                  |j                  j                                |j                  t        j                  d|
             |r|D ]  }|r n|d   }|rd}|j                   dk(  r|j                  D ]
  }	|	|v sd} 7 9|j                  j	                         }
|
j                  j                  |j                  j                                t        j                  d|
      }||v sd}|d   sd}|d   D ]
  }||v sd}   nd}t        j                  d|      }	|	|v rd}|xs | xs | S )NFdistribution_pointT	full_namedirectory_namer   valuer   )r   chosenr   rC   copyuntagr   GeneralName)r   r   r   r7   has_idp_namehas_dp_nameidp_dp_matchidp_general_namesidp_dp_namegeneral_nameinner_extended_issuer_namedpdp_namedp_extended_issuer_namedp_crl_authority_names                  r6   _match_dps_idp_namesr   c  s    LKL./K{* + 2 2 7!((67 *4););)@)@)B&&--44[5G5G5M5M5OP$$  )1K  	B-.G"<<;.(/ "'+<<+/L!"
 2<1C1C1H1H1J..55<<,,. /3.>.>-5O/+ /2CC'+L!"-/-= ),0AA'+3	> ''!);
 ,,L>|+>;>r5   r   c                    t        || j                  ||      }|s(|j                  d|       |xj                  dz  c_        y|d   j                  r8| j
                  r,| j
                  d   j                  r|j                  d|       y|d   j                  r:| j
                  r| j
                  d   j                  du r|j                  d	|       y|d
   j                  r|j                  d|       yy)Nr   r   r   r7   z{The CRL issuing distribution point extension does not share any names with the certificate CRL distribution point extensionrU   Fonly_contains_user_certscazMCRL only contains end-entity certificates and certificate is a CA certificateonly_contains_ca_certszNCRL only contains CA certificates and certificate is an end-entity certificateonly_contains_attribute_certsz(CRL only contains attribute certificatesT)r   crl_distribution_points_valuer   r   r   basic_constraints_value)rI   r8   r   r   r7   r   matchs          r6   _handle_crl_idp_ext_constraintsr     s    !22-	E  		
 	! )*11((,,T299KK2 
  '(//,,++D188EAKK/ 
  ./6668H	
 r5   c                     t        ||||      }|s(|j                  d|        |xj                  dz  c_        y|d   j                  xs |d   j                  }|r|j                  d|        yy)	Nr   zThe CRL issuing distribution point extension does not share any names with the attribute certificate's CRL distribution point extensionrU   Fr   r   zVCRL only contains public-key certificates, but certificate is an attribute certificateT)r   r   r   r   )r8   r   r   r   r7   r   r   pkc_onlys           r6   )_handle_attr_cert_crl_idp_ext_constraintsr     s     !-	E / 		
 	! 	*+22 	4+,33  6	

 r5   certificate_list_contrevinfo_policytiming_paramsis_deltac                 B   | j                  ||      }|rdnd}|j                  }|t        j                  k7  rg|t        j                  k(  r!| d}|j                  |j                         n|t        j                  k(  r| d}n| d}|j                  || d       y	y)
N)policyr   z	Delta CRLCRLz is not recent enoughz is too recentz# freshness could not be establishedT)is_freshness_failureF)		usable_atratingr"   OKSTALEupdate_stalelast_usable_atTOO_NEWr   )	r   r   r   r   r   freshness_resultprefixr   r`   s	            r6   _check_crl_freshnessr     s     -66# 7  %[%F$$F'***+111H12C.==>-555HN+CH?@CC.TJr5   pathdelta_lists_by_issuer
use_deltasc	           
      n  K   |j                   }		 t        ||j                  |j                  |      \  }
}|j
                  j                  |	      }|s(	 t        ||	| ||||
|       d {   }|j                  }t        || ||
|      }|y t!        ||j"                  |j$                  |d      sy |r&t'        |	||j"                  |j$                  ||      }nd }	 t)        || |||	      \  }}|j$                  }|j,                  r|j.                  nd }|r |||k  rt1        j2                  ||d
|      |S # t        $ r Y y w xY w7 # t        $ r |xj                  dz  c_
        Y y t        t        f$ r)}|j                  |j                  d   |	       Y d }~y d }~ww xY w# t*        $ r Y y w xY ww)Nr|   r   )rI   r9   r{   re   r}   rg   rU   r   r   rI   r   r}   r   Fr   )r8   r   r   r   r   r   )r   rI   r   delta_certificate_list_contr   r   )reasonrevocation_dtrevinfo_typerg   )r   _get_crl_authority_namer   r|   r   r   check_crl_issuerr   rp   r   r   r   r   r   args!_get_crl_scope_assuming_authorityr   r   r   _maybe_get_delta_crl_check_cert_on_crl_and_deltaNotImplementedErrorpoint_in_time_validationvalidation_timer   format)rI   r9   r   r   re   r   r   r   rg   r8   r}   r7   r   crl_issuer_pathrZ   interim_reasonsr   revoked_daterevoked_reasontimingcontrol_times                        r6   _handle_single_crlr   &  s     -55	*A!!!!3!H!H	+
'' $33DDJ 	$4" !1#5'%	% 	O )--J 83O ))((  &:-!%44,::"7'
# '+#
'C!"7(C(
$n  --F"("A"At  </<,3N!!!&!	
 	
 m  	 ! 	  A% %'9: 	KKq	#34	Z  s   F5&D; F5E *E
+E ;A"F5F& 1A
F5;	EF5EF5
E F#*F5,F#:FF5F##F5&	F2/F51F22F5r   c                     | j                   }|j                  }t        |xr |d   j                        }|s|j                  }||fS |d   }|rc|j
                  dk(  r|j                  d   j                  }||fS |j                         j                  j                  |j                        }||fS |j                  r+|j                  |j                        }	|	j                  }||fS |j                  d|        t        )zR
    Figure out the name of the entity on behalf of which the CRL was issued.
    indirect_crlr   r   r   zcCRL is marked as an indirect CRL, but provides no mechanism for locating the CRL issuer certificate)r   r   boolr   r=   r   r   r   r   r   retrieve_by_key_identifierrC   r   )
r   r   r|   r   r8   r   r}   r7   crl_idp_nametmp_crl_issuers
             r6   r   r     s4    -55 	99  wA7>#:#A#ABK-44, ***) 34  K/%1%8%8%;%B%B"" *** &6%:%:%<%C%C%J%J ''&" *** 661LL 99N "0!7!7 *** KKD%
 r5   r   c                    | j                   rt        | j                         dk(  ry |j                  }| j                  }|j	                  |j
                  g       }t        |||| j                        }	|	sy |	j                  }
t        |	|d      sy 	 t        |
|j                         |r|rt        |	|||d      r|	S y # t        $ r |j                  d|	       Y y w xY w)Nr   )r   r7   r   r   Tr   z)Delta CRL signature could not be verified)freshest_crl_valuer\   rC   r   gethashabler   r   r   &_verify_no_unknown_critical_extensionsr   r   r   r   r   )r8   r   r   r   r   r   r7   r   candidate_delta_listsr   delta_certificate_lists              r6   r   r     s    //223q8 #++99  255##R #;)-'@@	# '8AA1#TD 4j6K6KL -'
 /.!  7'	
 s   B? ?CCc                 v    | j                   j                  }|t        z
  r|j                  d|rdnd |        yy)Nz@One or more unrecognized critical extensions are present in the z	delta CRLr   FT)r   critical_extensionsr$   r   )r   r   r   
extensionss       r6   r  r    sI     '//CCJ(("*;68!	

 r5   c                    |j                   }|j                  }t        |t        j                        }d}d}	|r|j
                  }
nt        |d      }
|
r:t        j                  d| j                        }|
D ]  }|d   s	d}||d   v sd}	 | j                  }t        |      }||k(  }|xr |	xr |}|xr |	 xs | }| j                  |k(  }|s|s|r|r|xj                  dz  c_        y |(|rt        ||| |||      }nt        |
|| |||	      }|sy d }|r|d
   j                  |d
   j                  }d }|r|}|t        j                          }n|}t#        ||d      sy |S )NFcrl_distribution_pointsr   r   r   TrU   )rI   r8   r   r   r7   r   )r   r8   r   r   r7   r   only_some_reasonsr   )r   r   r>   r   Certificater   r(   r   rC   r)   r=   r   r   r   r   r%   r   r  )r   rI   r   r}   r   r8   r   is_pkchas_dp_crl_issuerdp_matchr   crl_issuer_general_namer   r7   r   same_issuerindirect_matchmissing_idpindirect_crl_issuercrl_idp_matchidp_reasonsreason_keysr   s                          r6   r   r     s    -5599  d../FH44(/HI"&"2"2!););#
  	$B,$(!*b.>>#H		$ $++$T*$(88K&C8CN#IX)H[K$++/?? 7J	! ;!1%#5M F!1%#5M  K7./66B1299K!2779% 2te r5   r   c                 z   |j                   }d }d }t        |      }|r(|j                   }		 t        |||	| j                        \  }}|	 t        |||| j                        \  }}|r|j                  dk(  rd }d }||fS # t        $ r |j                  d|        w xY w# t        $ r |j                  d|        w xY w)Nz]One or more unrecognized critical extensions are present in the CRL entry for the certificateremove_from_crl)r   r)   find_cert_in_listrC   r   r   r   )
r   rI   r   r   r   r8   r   r   r   r	  s
             r6   r   r   h  s    -55NL$T*"!<!E!E	+< &""	,(L. 
	+<&(8*:L:L,(L. .//3DD''7 # 	KK4+
 	 # 	KK4%
 	s   A= 	B =BB:r   r   c                   K   | j                  |       d {   }| j                  }t        t              }t        t              }|D ]x  }|j                  }	||j
                  }
|
|
|kD  s||   |kD  r-	 |	j                  j                  }|	j                  ||   j                  |       n||   j                  |       z ||fS 7 # t        $ r5}d}t        j                  ||       |j                  ||	       Y d }~d }~ww xY ww)Nz/Generic processing error while classifying CRL.rm   )async_retrieve_crlspoe_managerr   rc   r   issuance_dater=   r  delta_crl_indicator_valuer   
ValueErrorloggingdebug)r   rI   r   r   certificate_listsr!  complete_lists_by_issuerr   r   r8   issuedissuer_hashablerZ   r`   s                 r6   _classify_relevant_crlsr+    s%     .AA$GG!--K*40'-!2 /099#*88FL(45D 	/.55>>O99A(9@@) &o6==)'/4 $%:::? H6  	/CCMM#*KK-..	/s;   D
CAD
6AC	D
		D+D=D
DD
checked_reasons
total_crlsc                 D   | dhz  } | t         k7  r||j                  k(  rt        d|j                          d      S |j                  s|j                  dd        t        d|j                          d|j                  |j                  r|j                        S d       S y )Nunusedz%No CRLs were issued by the issuer of z, or any indirect CRL issuerz6The available CRLs do not cover all revocation reasonszUnable to determine if z; is revoked due to insufficient information from known CRLs)failuressuspect_stale)	r%   r   r   rq   r0  r   r   freshness_failures_onlystale_last_usable_at)r,  r-  r   rg   s       r6   _process_crl_completenessr4    s     z!O22---$7++-. /  }}KKH$ /%j&>&>&@%A BI J]] // ))	
 		
 	
 		
 3r5   c                   K   t        | t        j                        }|xs$ t        t	        j
                  |      |sdnd      }|j                  }t               }t        || |       d{   \  }}		 |j                  |       }
g }|j                         D ]  }|j                  |        t        |      }t!               }|D ]&  }	 t#        | |
||||	|||	       d{   }|||z  }( t-        ||||      }||y7 # t        $ r t        d|j                          d      w xY w7 L# t$        $ r5}d}t'        j(                  ||       |j+                  ||       Y d}~d}~ww xY ww)	a  
    Verifies a certificate against a list of CRLs, checking to make sure the
    certificate has not been revoked. Uses the algorithm from
    https://tools.ietf.org/html/rfc5280#section-6.3 as a basis, but the
    implementation differs to allow CRLs from unrecorded locations.

    :param cert:
        An asn1crypto.x509.Certificate or asn1crypto.cms.AttributeCertificateV2
        object to check for in the CRLs

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the cert's
        validation path, or in the case of an AC, the AA's validation path.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for caching
        validation information

    :param use_deltas:
        A boolean indicating if delta CRLs should be used

    :param proc_state:
        Internal state for error reporting and policy application decisions.

    :raises:
        pyhanko_certvalidator.errors.CRLNoMatchesError - when none of the CRLs match the certificate
        pyhanko_certvalidator.errors.CRLValidationError - when any error occurs trying to verify the CertificateList
        pyhanko_certvalidator.errors.RevokedError - when the CRL indicates the certificate has been revoked
    zattribute certificateN)rl   rk   +Could not determine issuer certificate for 	 in path.)	rI   r9   r   r   re   r   r   r   rg   .Generic processing error while validating CRL.rm   )r>   r   r  r   r'   singr   r   r+  find_issuing_authorityr   r   rq   valuesextendr\   setr   r$  r%  r&  r   r4  )rI   r   re   r   rg   r  r   r   r(  r   r9   crls_to_processissuer_crlsr-  r,  r   r   rZ   r`   excs                       r6   
verify_crlrA    s    J d../F | d+8>0D J
 )88O:D &otTBB 
66t< O/668 ,{+,_%JeO!0 4	4$6!1&;#5&;%%
% 
O *?24* $T:C 	 W 	C  
9'')*)5
 	

"
  	4BCMM#*KK233	4sg   A)E/+D ,E/4D AE/D.D, D.+E/'D))E/,D..	E,7+E'"E/'E,,E/c                   .    e Zd ZU dZeed<   	 ee   ed<   y)ProvisionalCRLTrustz_
    A provisional CRL path, together with an optional delta CRL that may be
    relevant.
    r   deltaN)r/   r0   r1   r2   r   r3   r	   r!   r4   r5   r6   rC  rC  J  s&    
  L!!r5   rC  c                   Z    e Zd ZU dZeed<   	 ee   ed<   	 eed<   	 e	j                  ed<   y)CRLOfInterestz
    A CRL of interest.
    r   
prov_pathsr}   r7   N)r/   r0   r1   r2   r!   r3   r   rC  r   r   Namer4   r5   r6   rF  rF  ]  sE     
 ())
  		!r5   rF  c                   4    e Zd ZU dZee   ed<   	 ee   ed<   y)CRLCollectionResultzb
    The result of a CRL collection operation for AdES point-in-time
    validation purposes.
    crlsfailure_msgsN)r/   r0   r1   r2   r   rF  r3   rX   r4   r5   r6   rJ  rJ  y  s*    
 }
 s)r5   rJ  c	           
      `  K   |j                   }	|j                  }
	 t        ||j                  |
|      \  }}	 t        ||	| |||
||       d {   \  }}g }|D ]S  }|j                  }t        || |||      }|"|rt        |	|||      }nd }t        ||      }|j                  |       U |sy t!        ||||      S # t        $ r Y y w xY w7 # t        $ r |xj                  dz  c_        Y y t        t        f$ r)}|j                  |j                  d   |	       Y d }~y d }~ww xY ww)	Nr   r   rU   r   r   )r8   r   r   r   )r   rD  )r   rG  r}   r7   )r   r|   r   r   r   r   r   r   r   r   r   r   rp   r   r   rC  rF  )rI   r9   r   r   r   r   r   r   rg   r8   registryr}   r7   r   _rZ   provisional_resultsr   putative_issuerr   rD  provs                         r6   _assess_crl_relevancerS    s}     -5533H	*A!!!!)	+
''#<-!)#!	$
 	
$ $ )	#..;&"7#
 "(!1*&;	E E"	?""4(/)2 !&-	 g  
	
  !!#56 AFF1I/0sj   D.C C CC A,D.	CD.CD.C D+2D.4D+D&!D.&D++D.c                   K   |xs t        t        j                  |            }t               }t	        || ||      }| d{   \  }}	g }
|j                         D ]  }|
j                  |        	 |j                  |       }g }|
D ]2  }	 t        | ||||	||||	       d{   }||j                  |       4 t!        ||j"                  D cg c]  }|d	   	 c}
      S 7 # t        $ r t        d|j                          d      w xY w7 m# t        $ r5}d}t        j                  ||       |j                  ||       Y d}~d}~ww xY wc c}w w)ah  
    Collect potentially relevant CRLs with the associated validation
    paths. Will not perform actual path validation.

    :param cert:
        The certificate under scrutiny.
    :param path:
        The path currently being evaluated.
    :param revinfo_manager:
        The revocation info manager.
    :param control_time:
        The control time before which the validation info should have been
        issued.
    :param use_deltas:
        Whether to include delta CRLs.
    :param proc_state:
        The state of any prior validation process.
    :return:
        A :class:`.CRLCollectionResult`.
    )rl   )r   Nr6  r7  )	rI   r9   r   r   r   r   r   r   rg   r8  rm   r   )rK  rL  )r   r'   r9  r   r+  r;  r<  r:  r   r   rq   rS  r   r$  r%  r&  rJ  r0  )rI   r   r   r   r   rg   r   classify_jobr(  r   r>  r?  r9   relevant_crlsr   resultrZ   r`   fs                      r6    collect_relevant_crls_with_pathsrY    s    : P|HMM$<OPJ:D*t,L =I6H33 O/668 ,{+,
66t< M!0 4	40!1&;&;% /%
 
F !$$V,4( $(MM2qad2 M 7I  
9'')*)5
 	


  	4BCMM#*KK233	4 3sr   AEC'/E5C) ED%D&D=EE
	E)'DED	E+E	EEEc                     	 t        | d   j                  | d   j                         || d   | d   d          y# t        $ r}t	        d      |d}~wt
        $ r t	        d      w xY w)	a2  
    Verifies the digital signature on an asn1crypto.crl.CertificateList object

    :param certificate_list:
        An asn1crypto.crl.CertificateList object

    :raises:
        pyhanko_certvalidator.errors.CRLValidationError - when the signature is
        invalid or uses an unsupported algorithm
    	signaturetbs_cert_listsignature_algorithm
parameters)r[  signed_datapublic_key_infosigned_digest_algorithmr^  z/Invalid signature parameters on CertificateListNz5Unable to verify the signature of the CertificateList)r*   r   r   r   r   r   )r8   r   rZ   s      r6   r   r   (  s    
&{3::(9>>@&$45J$K'(=>|L	
    =
	  
 C
 	

s   7: 	A'AA'c                    |d   d   }t        | t        j                        r| j                  }n| d   d   j                  }|}|D ]  }|j
                  t        z
  r
t               |j                  r|j                  |k7  r|j                  }||k7  rM|d   j                  |k7  r`|j                  st        j                  d      }n|j                  }|d   j                  |fc S  y)	a!  
    Looks for a cert in the list of revoked certificates

    :param cert:
        An asn1crypto.x509.Certificate object of the cert being checked,
        or an asn1crypto.cms.AttributeCertificateV2 object in the case
        of an attribute certificate.

    :param cert_issuer_name:
        The certificate issuer's distinguished name

    :param certificate_list:
        An ans1crypto.crl.CertificateList object to look in for the cert

    :param crl_authority_name:
        The distinguished name of the default authority for which the CRL issues
        certificates.

    :return:
        A tuple of (None, None) if not present, otherwise a tuple of
        (asn1crypto.x509.Time object, asn1crypto.crl.CRLReason object)
        representing the date/time the object was revoked and why
    r\  revoked_certificatesac_infoserial_numberuser_certificateunspecifiedrevocation_dateNN)r>   r   r  re  r   r  r#   r   issuer_namecrl_reason_valuer   	CRLReason)	rI   r   r8   r7   rc  cert_seriallast_issuer_namerevoked_cert
crl_reasons	            r6   r  r  F  s    < ,O< $(()((9oo6==), B++.HH%'' $$((,<<+77//*+22kA,,}5J%66J-.55zAA+B. r5   ri  rW   )TN)er   r%  collectionsr   dataclassesr   r   r   typingr   r   r	   r
   r   r   
asn1cryptor   r   r   cryptography.exceptionsr   pyhanko_certvalidator._stater   pyhanko_certvalidator.authorityr   r   pyhanko_certvalidator.contextr   pyhanko_certvalidator.errorsr   r   r   r   r   r   r   pyhanko_certvalidator.ltv.typesr   pyhanko_certvalidator.pathr   !pyhanko_certvalidator.policy_declr   pyhanko_certvalidator.registryr   )pyhanko_certvalidator.revinfo._err_gatherr    &pyhanko_certvalidator.revinfo.archivalr!   r"   'pyhanko_certvalidator.revinfo.constantsr#   r$   r%   %pyhanko_certvalidator.revinfo.managerr&   pyhanko_certvalidator.utilr'   r(   r)   r*   	getLoggerr/   rt   r-   rH  CertificateListr  rJ   rL   r   rz   AttributeCertificateV2r   r   r   IssuingDistributionPointbytesr   CRLDistributionPointsr   r   r   r   rX   r   r   r   r  r   r   r+  rb   r4  rA  rC  rF  rJ  rS  rY  r   r  r4   r5   r6   <module>r     s     # (  : : % % 4 5 H ;   C 5 @ > < 
 A  
		8	$ $     #		#))#  	#
 '# 
$

#L '+ '+ '+T'
-'
 *'
 "&	'

 '
TD!		D!))D!   #"<"<<
=	D!
  D! D! .D! D! D! 4!556D!NA		A))A   #"<"<<
=	A
  A A *A A A AH v  l#		 )) UO	
 l<B?))B?d001B?   B? 			B?
 
B?J9


9))9   9 ))	9
 		9 9 
9x%))%d001%   % ))	%
 		% % 
%P'& * 	
 4j
  #"<"<<
=jj (j 	j
 *j  T,%7 78j j j j c#hjZ'+''+ii'+ .'+ 	'+
 4?'+^ 7;+/:)):  :  T,%7 78: 	:
 23: '(: l:z'/7CG]  ]
  #"<"<<
=] (] 	]
 ] c#h]@2(  2(
  #"<"<<
=2( (2( "*,!7	2(
 2(r (,	(;#(;


(; (; 8$	(;V 
X 
 
  
 	 
N )-\
  #"<"<<
=\
\ *\
 &\~ $  $ $  6 $  "L
  #"<"<<
=LL (L 	L
 $L  T,%7 78L L L L mLh )-K
  #"<"<<
=K
K $K 	K &K K\
<?
  #"<"<<
=?ii? ))? 			?r5   