
    Wwg?                     :   d dl Z d dlmZmZ d dlmZmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZmZmZmZ d dlmZmZ d dlmZ d d	lmZmZmZ d d
lmZ d dlm Z  d dl!m"Z"m#Z#m$Z$m%Z% d dl&m'Z'm(Z(m)Z) d dl*m+Z+ ddgZ,dede dededeee"   ee'   f   f
dZ-defdZ.dede
j^                  dedej`                  def
dZ1dedededefd Z2d!ee   dededee   d"ej`                  defd#Z3ded$ede ded%ee   ded&e+e4   d'e+e   defd(Z5ded$ede ded%ee   dedefd)Z6y)*    N)datetime	timedelta)IterableListOptionalSetTuple)algoskeysx509)ValProcState)DisallowedAlgorithmErrorInsufficientPOEErrorInsufficientRevinfoErrorRevokedError)ValidationTimingInfoValidationTimingParams)ValidationPath)AlgorithmUsagePolicyCertRevTrustPolicyRevocationCheckingRule)RevinfoContainer)RevinfoManager)CRLOfInterest_check_cert_on_crl_and_delta_CRLErrs collect_relevant_crls_with_paths)OCSPResponseOfInterest_check_ocsp_status%collect_relevant_responses_with_paths)ConsList
time_slideades_gather_prima_facie_revinfopathrevinfo_managercontrol_timerevocation_checking_rulereturnc                    K   | j                   }|j                  r#t        || ||       d{   }|j                  }ng }|j                  r&t        || ||       d{   }|j                  }||fS g }||fS 7 K7 w)a  
    Gather potentially relevant revocation information for the leaf
    certificate of a candidate validation path.
    Only the scope of the revocation information will be checked, no
    detailed validation will occur.

    :param path:
        The candidate validation path.
    :param revinfo_manager:
        The revocation info manager.
    :param control_time:
        The time horizon that serves as a relevance cutoff.
    :param revocation_checking_rule:
        Revocation info rule controlling which kind(s) of revocation
        information will be fetched.
    :return:
        A 2-element tuple containing a list of the fetched CRLs and
        OCSP responses, respectively.
    N)leafocsp_relevantr    	responsescrl_relevantr   crls)	r$   r%   r&   r'   certocsp_resultocsps
crl_resultr.   s	            [/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko_certvalidator/ltv/time_slide.pyr#   r#   *   s     4 99D--A$
 
 %%,,;$
 

  ; ;

s!   *A<A80A<A:A<:A<c              #      K   | }|df |j                   dkD  r'|j                         }|df |j                   dkD  r&y y w)NT   F)pkix_lencopy_and_drop_leaf)r$   cur_paths     r3   _tailsr9   W   sK     H
D.


a
..0o 

a
s   =A Aalgo_policy	algo_used
public_keyval_proc_statec                 "   | j                  |||      }|d   j                  }|j                  s`|j                  rt	        ||j                        }|S d| d}|j
                  |d|j
                   z  }t        j                  ||d       |S )N	algorithmz
Algorithm z- is banned outright without time constraints.z	 Reason: )banned_since)signature_algorithm_allowednativeallowednot_allowed_afterminfailure_reasonr   
from_state)r:   r;   r&   r<   r=   sig_constraint	algo_namemsgs           r3   _apply_algo_policyrK   _   s     !<<<N +&--I!!++ |^-M-MNL  YK ($ %  ,,8>#@#@"ABB*55! 
     revinfo_containerrev_trust_policytime_tolerancec           
          |j                  |t        t        | | d      |            }|j                  }|j                  j
                  s|j                  xs |}|t        ||       } | S )NT)validation_timebest_signature_timepoint_in_time_validation)timing_inforO   )	usable_atr   r   issuance_dateratingusable_adeslast_usable_atrE   )r&   rM   rN   rO   	usabilityrV   cutoff_dates          r3   "_update_control_time_for_unrevokedr\   ~   s{     "++, ,$0)-
 *	

I &33M''  ..?-"{L9LrL   revoked_dateissuer_public_keyc                 `    | rt        | |      }|j                  }||t        |||||      }|S N)rE   revinfo_sig_mechanism_usedrK   )r]   r&   rM   r:   r^   r=   r;   s          r3   _update_control_timerb      sJ     <6!<<I9#8)
 rL   init_control_timealgo_usage_policy
cert_stack
path_stackc                 	  &'()K   |&j                   }| j                  dk(  r|S t        t        t        t	        |                         }	j
                  }
|	D ]  \  }}t        |&|r|j                  n|j                         d {   \  }}|j                  }|j                  |j                               '|j                  |       (t        (      }|
|   &kD  r?t        j                  d|j                  j                    d&j#                          d|      |sl|sjt%        |t&        j(                        r|j                  j                   }nd}|j*                  +t-        j                  d&j#                          d	| d|      d
}d }|D ]\  }|j.                  j0                  }|r|&kD  s|
|j.                     &kD  r4|j2                  }t5        '      t5        d |D              z  )t7        j8                  &'()fd|D          d {   }t;        &g|      &|D ]  }t=        |j>                  j                  ||j.                  |j@                  tC                     \  }}|j>                  j                  }t%        |t&        j(                        sJ ||d uz  }|j.                  }||j0                  |j0                  k  r|}tE        |&||jF                  |      & _ d }|D ]  }|jH                  }|j0                  }|r|&kD  s|
|jH                     &kD  r5tK        |jL                  &'(       d {   &	 tO        |t        (      &       d }||d uz  }|jL                  j                  }!t%        |!t&        j(                        sJ ||j0                  |k  r|}tE        |&||!jF                  |      & 9t        |jU                               d   }"tW        |d   &|"jF                  |      &|r||fD #cg c]  }#|#|#	 }$}#tY        |$&fdd       }%|%t[        &|%      & &S 7 7 >7 # tP        $ r} | jR                  }Y d } ~ 	d } ~ ww xY wc c}#w w)Nr   )r%   r&   r'   )cert_path_stackz0No proof of existence available for certificate z at control time .zattribute certificatezNo revocation info from before z found for certificate Fc              3   <   K   | ]  }|j                           y wr`   )dump).0r/   s     r3   	<genexpr>z_time_slide.<locals>.<genexpr>
  s      G $		Gs   c              3      K   | ]]  }|j                   j                  rE|j                   j                  j                         vrt        |j                   	        _ yw)re   rf   N)r$   r*   rk   _time_slide)
rl   crl_pathrd   r&   new_cert_stacknew_path_stackrN   r%   sub_path_skip_listrO   s
     r3   rm   z_time_slide.<locals>.<genexpr>  sj       ! **$MM..335=OO   $'()&#1#1	 	s   A#A&)
crl_issuerr/   certificate_list_contdelta_certificate_list_conterrs)rM   r:   r^   r=   ro   )ocsp_response
proc_stater&   signature_algorithm)r=   c                 $    | j                   xs S r`   )rV   )xr&   s    r3   <lambda>z_time_slide.<locals>.<lambda>  s    aoo= rL   )keydefault)r&   rM   rN   rO   ).revocation_checking_policyr6   listreversedr9   poe_managerr#   ee_certificate_ruleintermediate_ca_cert_ruler*   consrk   r   r   rG   subjecthuman_friendly	isoformat
isinstancer   Certificateocsp_no_check_valuer   crlrV   
prov_pathssetasynciogatherrE   r   r$   deltar   rb   r<   ry   rp   	prov_pathr   r   revocation_dtiter_authoritiesrK   maxr\   )*r$   rc   r%   rN   rd   rO   re   rf   checking_policypartial_pathsr   current_pathis_eer.   r1   r/   rz   identonce_revokedmost_recent_crlcrl_of_interestissued	sub_pathssub_path_control_timescandidate_crl_pathr]   revoked_reasoncrl_iss_certcrl_containermost_recent_ocspocsp_of_interestocsp_containereocsp_iss_certleaf_car~   revinfo_itemsmost_recent_revinfor&   rr   rs   rt   s*     ````                                @@@@r3   rp   rp      s      %L&AAO }}   $vd|"456M!--K, ye;+%   33$>>	
 	
e   #5#.!.A
t|+&11B<<..//@))+,A/ 	  E$ 0 0133/ ''/.995l6L6L6N5O-eWA7    $ B	O$((66FL(223lB'22I .1-@3 G(4G D . ,3>>  %., &"& F/EFGL&/ "/K166;;*9*=*=0B0H0H!0,n  266;;!,0@0@AAAD 88 / 3 3#+&44#112 '4O3  &3 1&2&=&=#- )OB	H   % -	-;;N#11FL(/==>M!, ** !))	" 	L/""0+NK!-
  $ L44L,66;;MmT-=-=>>> (#11F:#1 /"0-"/":":)LM-	^ (<88:;B?G-!*+"")L ,o>9!-9M 9 #&=#
 #.A!-&9%5#1	 iyv u	
v&z	"   / /B9s   BR	QFR	QD5R	QR	Q!3B&R	R	!R)R-R	R	R	R	!	R*Q<6R	<RR	c                    K   t        | |||||t        j                         t        j                                d{   S 7 w)a  
    Execute the ETSI EN 319 102-1 time slide algorithm against the given path.

    .. warning::
        This is incubating internal API.

    .. note::
        This implementation will also attempt to take into account chains of
        trust of indirect CRLs. This is not a requirement of the specification,
        but also somewhat unlikely to arise in practice in cases where AdES
        compliance actually matters.

    :param path:
        The prospective validation path against which to execute the time slide
        algorithm.
    :param init_control_time:
        The initial control time, typically the current time.
    :param revinfo_manager:
        The revocation info manager.
    :param rev_trust_policy:
        The trust policy for revocation information.
    :param algo_usage_policy:
        The algorithm usage policy.
    :param time_tolerance:
        The tolerance to apply when evaluating time-related constraints.
    :return:
        The resulting control time.
    ro   N)rp   r!   empty)r$   rc   r%   rN   rd   rO   s         r3   r"   r"     sF     H >>#>>#	 	 	 	s   ;AAA)7r   r   r   typingr   r   r   r   r	   
asn1cryptor
   r   r   pyhanko_certvalidator._stater   pyhanko_certvalidator.errorsr   r   r   r   pyhanko_certvalidator.ltv.typesr   r   pyhanko_certvalidator.pathr   !pyhanko_certvalidator.policy_declr   r   r   &pyhanko_certvalidator.revinfo.archivalr   %pyhanko_certvalidator.revinfo.managerr   *pyhanko_certvalidator.revinfo.validate_crlr   r   r   r   +pyhanko_certvalidator.revinfo.validate_ocspr   r   r    pyhanko_certvalidator.utilr!   __all__r#   r9   SignedDigestAlgorithmPublicKeyInforK   r\   rb   bytesrp   r"    rL   r3   <module>r      s3    ( 7 7 ( ( 5  6 
 D @  
 0:
;*
*#* * 5	*
 4%; <<=*Z %**  ""	
 !>!!'! )! 	!H8$ ( ./	
 )) !.S
SS $S )	S
   45S S S (S Sl-
-- $- )	-
   45- - -rL   