ɝj1@UddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddlm Z ddlm Z m Z mZejdk\rddlmZnddlmZdd lmZmZdd lmZmZmZmZmZdd lmZdd lmZdd lm Z!ddlm"Z#ddlm$Z%ddlm&Z'ddlm(Z)gdZ*eejVejXejZej\ej^fZ0eejbejdejfejhejjfZ6ee0e6fZ7ee8e de8ffZ9e%jtZ;dedeecd?@GdAdBZddRdCZe dE dSdDZfy)T) annotationsN) b16encode)Sequence)partial)AnyCallableUnion) ) deprecated)utilsx509)dsaeced448ed25519rsa)StrOrBytesPath) byte_string)exception_from_error_queue)ffi)lib) make_assert) path_bytes) FILETYPE_ASN1 FILETYPE_PEM FILETYPE_TEXTTYPE_DSATYPE_RSAX509ErrorPKeyX509Name X509StoreX509StoreContextX509StoreContextErrorX509StoreFlagsdump_certificatedump_privatekeydump_publickeyget_elliptic_curveget_elliptic_curvesload_certificateload_privatekeyload_publickey.intrrirrTYPE_DHTYPE_ECceZdZdZy)r!z7 An error occurred in an `OpenSSL.crypto` API. N)__name__ __module__ __qualname____doc__O/home/uftp/webrtc-recorder/.venv/lib/python3.12/site-packages/OpenSSL/crypto.pyr!r!jsr9r!cT|8tjtj}tj}n;t j d|}tj |t|}|fdd}t|tjk7t j||}|S)z Allocate a new OpenSSL memory BIO. Arrange for the garbage collector to clean it up automatically. :param buffer: None or some bytes to use to put into the BIO so that they can be read out. char[]c,tj|SN)_libBIO_free)biorefs r:freez_new_mem_buf..frees==% %r9)rArrBrreturnr) r?BIO_new BIO_s_memr@_ffinewBIO_new_mem_buflen_openssl_assertNULLgc)bufferrArCdatas r: _new_mem_bufrPts~ll4>>+,}}xx&)""4V5'+ &C499$% ''#t C Jr9ctjd}tj||}tj|d|ddS)zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**rN)rGrHr?BIO_get_mem_datarN)rA result_buffer buffer_lengths r:_bio_to_stringrUs?HHX&M))#}=M ;;}Q' 7 ::r9ct|ts tdt|tj k7t j||}|dk(r tdy)a The the time value of an ASN1 time object. @param boundary: An ASN1_TIME pointer (or an object safely castable to that type) which will have its value set. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. zwhen must be a byte stringrzInvalid stringN) isinstancebytes TypeErrorrKrGrLr?ASN1_TIME_set_string ValueError)boundarywhen set_results r:_set_asn1_timer_sW dE "455H )***8T:JQ)**r9ctj}t|tjk7tj |tj }t|||S)a Behaves like _set_asn1_time but returns a new ASN1_TIME object. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. )r? ASN1_TIME_newrKrGrLrMASN1_TIME_freer_)r]rets r:_new_asn1_timerdsH    CC499$% ''#t** +C3 Jr9cJtjd|}tj|dk(rytj|tj k(r(tj tj|Stjd}tj||t|dtjk7tjd|d}tj|}tj |}tj|d|S)a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. z ASN1_STRING*rNzASN1_GENERALIZEDTIME**) rGcastr?ASN1_STRING_lengthASN1_STRING_typeV_ASN1_GENERALIZEDTIMEstringASN1_STRING_get0_datarHASN1_TIME_to_generalizedtimerKrLASN1_GENERALIZEDTIME_free) timestampstring_timestampgeneralized_timestamp string_data string_results r:_get_asn1_timerssyy; /0A5 ./43N3NN{{4556FGHH $)A B )))5JK-a0DII=>99^5J15MN001AB  K0  &&')_namesselfs r:__init__z_X509NameInvalidator.__init__s &( r9c:|jj|yr>)rwappendrynames r:addz_X509NameInvalidator.adds 4 r9c*|jD]}|`yr>)rw_namer}s r:clearz_X509NameInvalidator.clearsKK D  r9NrDNoner~r#rDr)r4r5r6rzrrr8r9r:rurus)!r9ruceZdZdZdZdZddZddZeddZ e dddZ e d dd Z dd Z dd Zy )r"zD A class representing an DSA or RSA public key or key pair. FTctj}tj|tj|_d|_y)NF)r? EVP_PKEY_newrGrM EVP_PKEY_free_pkey _initializedrypkeys r:rzz PKey.__init__s0  "WWT4#5#56 !r9cddlm}m}|jr0t t |}t jt||Stt |}t jt||dS)a Export as a ``cryptography`` key. :rtype: One of ``cryptography``'s `key interfaces`_. .. _key interfaces: https://cryptography.io/en/latest/hazmat/ primitives/asymmetric/rsa/#key-interfaces .. versionadded:: 16.1.0 r)load_der_private_keyload_der_public_keyN)password) ,cryptography.hazmat.primitives.serializationrr _only_publicr*rtypingrf_Key_dump_privatekey_internal)ryrrders r:to_cryptography_keyzPKey.to_cryptography_keysZ    5C;;t%8%=> >+M4@C;;t%9#%MN Nr9c t|tjtjtj tj tjtjtjtjtjtjf s t!dddlm}m}m}m}t|tjtj tjtjtjfr4t-t.|j1|j2|j4S|j7|j2|j8|}t;t.|S)z Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer)Encoding NoEncryption PrivateFormat PublicFormat)rWr DSAPrivateKey DSAPublicKeyrEllipticCurvePrivateKeyEllipticCurvePublicKeyrEd25519PrivateKeyEd25519PublicKeyrEd448PrivateKeyEd448PublicKeyr RSAPrivateKey RSAPublicKeyrYrrrrrr/r public_bytesDERSubjectPublicKeyInfo private_bytesPKCS8r.)cls crypto_keyrrrrrs r:from_cryptography_keyzPKey.from_cryptography_keys( !!  **))))((%%$$!!    23 3      ))(($$    "''LL,"C"C ** m11<>C#=#6 6r9z`PKey.generate_key is deprecated. You should use the key generation APIs in cryptography instead.c t|ts tdt|ts td|tk(r|dkr t dt j }tj|t j}t j|t jt j}t j|||tj}t|dk(t j |j"|}t|dk(d|_y|t$k(r t j&}t|tjk7tj|t j(}t j*||tjdtjtjtj}t|dk(tt j,|dk(tt j.|j"|dk(d|_yt1d) a3 Generate a key pair of the given type, with the given number of bits. This generates a key "into" the this object. :param type: The key type. :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA` :param bits: The number of bits. :type bits: :py:data:`int` ``>= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerrzInvalid number of bitszNo such key typeTN)rWr0rYrr[r?BN_newrGrMBN_free BN_set_wordRSA_F4RSA_newRSA_generate_key_exrLrKEVP_PKEY_assign_RSArrDSA_newDSA_freeDSA_generate_parameters_exDSA_generate_keyEVP_PKEY_set1_DSAr!r)rytypebitsexponentrresultrress r: generate_keyzPKey.generate_keyKs($$56 6$$56 6 8 qy !9::{{}Hwwx6H   Xt{{ 3,,.C--c4499MF FaK (--djj#>F FaK ("!X ,,.C C499, -''#t}}-C11T499aDIItyyC C1H % D11#6!; < D224::sCqH I!*+ +r9zJPKey.check is deprecated. You should use the APIs in cryptography instead.c|jr tdtj|j tj k7r tdtj |j}tj|tj}tj|}|dk(ryty)ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.rTN) rrYr? EVP_PKEY_typer EVP_PKEY_RSAEVP_PKEY_get1_RSArrGrMRSA_free RSA_check_key_raise_current_error)ryrrs r:checkz PKey.checks"   -. .   diik *d.?.? ?EF F$$TZZ0ggc4==)##C( Q;r9c@tj|jS)zT Returns the type of the key :return: The type of the key. )r? EVP_PKEY_idrrxs r:rz PKey.types  ++r9c@tj|jS)zh Returns the number of bits of the key :return: The number of bits of the key. )r? EVP_PKEY_bitsrrxs r:rz PKey.bitss !!$**--r9Nr)rDr)rrrDr")rr0rr0rDrrDboolrDr0)r4r5r6r7rrrzr classmethodrr rrrrr8r9r:r"r"szLL" O.7777r 36! 6!p  4,.r9r"cveZdZdZdZd fd Zed dZed dZed dZ d dZ ddZ dd Z xZ S)_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` NcNt|trt| |StS)z Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. )rWrsuper__ne__NotImplemented)ryother __class__s r:rz_EllipticCurve.__ne__s$ e^ ,7>%( (r9cjtjd}tjd|}j||t fd|DS)z Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. rzEC_builtin_curve[]c3VK|] }j|j"ywr>)from_nidnid).0crrs r: z7_EllipticCurve._load_elliptic_curves..s D3<<QUU+Ds&))EC_get_builtin_curvesrGrLrHset)rr num_curvesbuiltin_curvess`` r:_load_elliptic_curvesz$_EllipticCurve._load_elliptic_curvessO..tyy!< "6 C !!.*=D^DDDr9c^|j|j||_|jS)a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. )_curvesr)rrs r:_get_elliptic_curvesz#_EllipticCurve._get_elliptic_curvess* ;; 33C8CK{{r9c x|||tj|j|jdS)a Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. ascii)rGrj OBJ_nid2sndecode)rrrs r:rz_EllipticCurve.from_nids03T[[)<=DDWMNNr9c.||_||_||_y)a :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)r?_nidr~)ryrrr~s r:rzz_EllipticCurve.__init__s   r9c"d|jdS)Nzr~rxs r:__repr__z_EllipticCurve.__repr__s Q''r9c|jj|j}tj|tj S)z Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. )r?EC_KEY_new_by_curve_namerrGrM EC_KEY_free)rykeys r: _to_EC_KEYz_EllipticCurve._to_EC_KEYs3ii00;wwsD,,--r9rrrDr)rrrDset[_EllipticCurve])rrrr0rDr)rrrr0r~strrDrrDrrDr)r4r5r6r7rrrrrrrzrr __classcell__rs@r:rrscG EE"  OO "(.r9rzSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.c4tjtS)a Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. )rrr?r8r9r:r,r,s  . .t 44r9zRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.c^tD]}|j|k(s|cStd|)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve name)r,r~r[)r~curves r:r+r+0s7 %& :: L )4 00r9zUX509Name support in pyOpenSSL is deprecated. You should use the APIs in cryptography.cdeZdZdZd dZd fd Zd dZddZddZddZ ddZ dd Z dd Z xZ S)r#a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. ctj|j}tj|tj |_y)z Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)r? X509_NAME_duprrGrMX509_NAME_freer}s r:rzzX509Name.__init__ds0!!$**-''$(;(;< r9c |jdrt | ||St|tur#t dt|j ddtjt|}|tjk(r ttdttj|j D]}tj"|j |}tj$|}tj&|}||k(sStj(|j |}tj*|nt-|tr|j/d}tj0|j |tj2|t5|dd}|s tyy#t$r YtdwxYw) N_z$attribute name must be string, not 'z.200'No such attributeutf-8r) startswithr __setattr__rrrYr4r? OBJ_txt2nid _byte_string NID_undefrr!AttributeErrorrangeX509_NAME_entry_countrX509_NAME_get_entryX509_NAME_ENTRY_get_object OBJ_obj2nidX509_NAME_delete_entryX509_NAME_ENTRY_freerWencodeX509_NAME_add_entry_by_NID MBSTRING_UTF8rJ) ryr~valuerientent_objent_nid add_resultrs r:rzX509Name.__setattr__ns ??3 7&tU3 3 :S K((.a1  |D12 $..  $&!!45 5t11$**=> A**4::q9C55c:G&&w/Gg~11$**a@))#.  eS !LL)E44 JJT//E B  ")  !45 5 s F<< GGctjt|}|tjk(r t t dtj|j|d}|dk(rytj|j|}tj|}tjd}tj||}t|dk\ tj|d|ddj!d}tj"|d|S#t $r Yt dwxYw#tj"|dwxYw)a  Find attribute. An X509Name object has the following attributes: countryName (alias C), stateOrProvince (alias ST), locality (alias L), organization (alias O), organizationalUnit (alias OU), commonName (alias CN) and more... r r Nunsigned char**rr )r?rrrrr!rX509_NAME_get_index_by_NIDrrX509_NAME_ENTRY_get_datarGrHASN1_STRING_to_UTF8rKrNr OPENSSL_free) ryr~r entry_indexentryrOrS data_lengthrs r: __getattr__zX509Name.__getattr__s2|D12 $..  $&!!45 555djj#rJ " (([A,,U3!23 ..}dC  q() 0[[q!1;?BIIF   mA. / -  !45 5 *   mA. /s D#+D<# D98D9<Ect|tstStj|j |j dk(SNrrWr#rr? X509_NAME_cmprryrs r:__eq__zX509Name.__eq__s2%*! !!!$**ekk:a??r9ct|tstStj|j |j dkSr/r0r2s r:__lt__zX509Name.__lt__s2%*! !!!$**ekk:Q>>r9c tjdd}tj|j|t |}t |tjk7djtj|jdS)z6 String representation of an X509Name r<izr ) rGrHr?X509_NAME_onelinerrJrKrLformatrjr)ryrS format_results r:rzX509Name.__repr__sq3/ .. JJ s='9   23'.. KK & - -g 6  r9c@tj|jS)a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` )r?X509_NAME_hashrrxs r:hashz X509Name.hashs""4::..r9ctjd}tj|j|}t |dk\tj |d|dd}tj|d|S)z Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` r%rN)rGrHr? i2d_X509_NAMErrKrNr))ryrS encode_resultrrs r:rz X509Name.dersi!23 **4::}E  *+ M!$4mDQG  -*+r9cg}ttj|jD]}tj|j|}tj |}tj |}tj|}tj|}tjtj|tj|dd}|jtj||f|S)z Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)rr?rrrrr'rrrGrNrkrgr|rj) ryrrr fnamefvalrr~rs r:get_componentszX509Name.get_componentsst11$**=> 6A**4::q9C33C8E005D""5)C??3'DKK**40$2I2I$2OE MM4;;t,e4 5 6  r9r)r~rrrrDr)r~rrD str | NonerrrrDrX)rDzlist[tuple[bytes, bytes]])r4r5r6r7rzrr-r3r5rr<rrCrrs@r:r#r#Fs8 0=%#N&P@ ?   / r9r#c(eZdZdZd-dZed.dZd/dZed0dZe dd1dZ d2dZ d3d Z e d d4d Z e d d5d Zd6dZd7dZd2dZe dd8dZd2dZe dd9dZe dd9dZd:dZd;dZddZdd Zd?d!Zd@d"Ze d#dAd$Ze d%dBd&Z e d'dAd(Z!e d)dCd*Z"d2d+Z#y,)Dr z An X.509 certificate. ctj}t|tjk7tj |tj |_t|_ t|_ yr>) r?X509_newrKrGrLrM X509_free_x509ru_issuer_invalidator_subject_invalidator)ryrs r:rzz X509.__init__sJ}} )*WWT4>>2 #7#9 $8$:!r9c|j|}tj|tj|_t |_t |_|Sr>) __new__rGrMr?rIrJrurKrL)rrcerts r:_from_raw_x509_ptrzX509._from_raw_x509_ptrsA{{3WWT4>>2 #7#9 $8$:! r9c>ddlm}tt|}||S)z Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r)load_der_x509_certificate)cryptography.x509rRr(r)ryrRrs r:to_cryptographyzX509.to_cryptography"s @}d3(--r9ct|tjs tdddlm}|j |j}tt|S)z Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificaterr) rWr CertificaterYrrrrr-r)r crypto_certrrs r:from_cryptographyzX509.from_cryptography/sD+t'7'7834 4I&&x||4 s33r9zYX509.set_version is deprecated. You should use cryptography's CertificateBuilder instead.ct|ts tdtt j |j |dk(y)a  Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerrN)rWr0rYrKr?X509_set_versionrJ)ryversions r: set_versionzX509.set_versionCs8'3'89 9--djj'BaGHr9c@tj|jS)z Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` )r?X509_get_versionrJrxs r: get_versionzX509.get_versionVs$$TZZ00r9cBtjt}tj|j|_|j t jk(r tt j|j tj|_d|_ |S)z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` T) r"rNr?X509_get_pubkeyrJrrGrLrrMrrrs r: get_pubkeyzX509.get_pubkey_sg||D!))$**5 :: " "WWTZZ););<   r9zXX509.set_pubkey is deprecated. You should use cryptography's CertificateBuilder instead.ct|ts tdtj|j |j }t|dk(y)z Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` pkey must be a PKey instancerN)rWr"rYr?X509_set_pubkeyrJrrK)ryrr^s r: set_pubkeyzX509.set_pubkeyns@$%:; ;))$**djjA  a(r9zRX509.sign is deprecated. You should use cryptography's CertificateBuilder instead.ct|ts td|jr t d|j s t dt jt|}|tjk(r t dt j|j|j|}t|dkDy)a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` rezKey only has public partzKey is uninitializedNo such digest methodrN)rWr"rYrr[rr?EVP_get_digestbynamerrGrL X509_signrJrrK)ryrdigestevp_md sign_results r:signz X509.signs $%:; ;   78 8  34 4**<+?@ TYY 45 5nnTZZVD  a(r9ctj|j}tjd}tj |tj tj |tj|d}|tjk(r tdtjtj|S)z Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **rzUndefined signature algorithm) r?X509_get0_tbs_sigalgrJrGrHX509_ALGOR_get0rLrrr[rj OBJ_nid2ln)rysig_algalgrs r:get_signature_algorithmzX509.get_signature_algorithms++DJJ7hh'( S$))TYY@s1v& $.. <= ={{4??3/00r9ctjt|}|tjk(r t dtj dtj}tj dd}t||d<tj|j|||}t|dk(djtj||dDcgc]}t|jc}Scc}w)a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` rizunsigned char[]zunsigned int[]rr:)r?rjrrGrLr[rHEVP_MAX_MD_SIZErJ X509_digestrJrKjoinrNrupper)ry digest_namerlrS result_length digest_resultchs r:rlz X509.digests**< +DE TYY 45 5!2D4H4HI !115 }- a(( JJ }   *+yy++m]15EF " ##%    s Dc@tj|jS)z Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` )r?X509_subject_name_hashrJrxs r:subject_name_hashzX509.subject_name_hashs**4::66r9z_X509.set_serial_number is deprecated. You should use cryptography's CertificateBuilder instead.c`t|ts tdt|dd}|j d}t j d}tj||}t|t jk7tj|dt j}tj|dt|t jk7t j|tj}tj|j |}t|dk(y)z Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerNrzBIGNUM**rr)rWr0rYhexrrGrHr? BN_hex2bnrKrLBN_to_ASN1_INTEGERrrMASN1_INTEGER_freeX509_set_serialNumberrJ)ryserial hex_serialhex_serial_bytes bignum_serialr asn1_serialr^s r:set_serial_numberzX509.set_serial_numbers&#&78 8[_ %,,W5,  /?@$))+,--mA.> J  ]1%& tyy01ggk4+A+AB // KH  a(r9ctj|j}tj|tj } tj |} t j|}t|d}|tj|tj|S#tj|wxYw#tj|wxYw)zx Return the serial number of this certificate. :return: The serial number. :rtype: int ) r?X509_get_serialNumberrJASN1_INTEGER_to_BNrGrL BN_bn2hexrjr0r)r)ryrrrhexstring_serialrs r:get_serial_numberzX509.get_serial_numbers00< // TYYG  ( 6J .#';;z#: -r2!!*- LL '!!*- LL 's$C"B(=C(B??CCzaX509.gmtime_adj_notAfter is deprecated. You should use cryptography's CertificateBuilder instead.ct|ts tdtj|j }tj ||y)z Adjust the time stamp on which the certificate stops being valid. :param int amount: The number of seconds by which to adjust the timestamp. :return: ``None`` amount must be an integerN)rWr0rYr?X509_getm_notAfterrJX509_gmtime_adj)ryamountnotAfters r:gmtime_adj_notAfterzX509.gmtime_adj_notAfters>&#&78 8**4::6 Xv.r9zbX509.gmtime_adj_notBefore is deprecated. You should use cryptography's CertificateBuilder instead.ct|ts tdtj|j }tj ||y)z Adjust the timestamp on which the certificate starts being valid. :param amount: The number of seconds by which to adjust the timestamp. :return: ``None`` rN)rWr0rYr?X509_getm_notBeforerJr)ryr notBefores r:gmtime_adj_notBeforezX509.gmtime_adj_notBefore"s>&#&78 8,,TZZ8  Y/r9c:|j}| td|jd}tjj |d}tj j }tjj|jd}||kS)z Check whether the certificate has expired. :return: ``True`` if the certificate has expired, ``False`` otherwise. :rtype: bool NzUnable to determine notAfterr z %Y%m%d%H%M%SZ)tzinfo) get_notAfterr[rdatetimestrptimetimezoneutcnowreplace)ry time_bytes time_string not_afterUTCutcnows r: has_expiredzX509.has_expired3s&&(  ;< < ''0 %%..{OL ##""&&s+3343@6!!r9c8t||jSr>)rsrJ)rywhichs r:_get_boundary_timezX509._get_boundary_timeDseDJJ/00r9c@|jtjS)a  Get the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rr?rrxs r: get_notBeforezX509.get_notBeforeGs&&t'?'?@@r9c:t||j|Sr>)r_rJ)ryrr]s r:_set_boundary_timezX509._set_boundary_timeTseDJJ/66r9z[X509.set_notBefore is deprecated. You should use cryptography's CertificateBuilder instead.cB|jtj|S)z Set the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )rr?rryr]s r: set_notBeforezX509.set_notBeforeYs&&t'?'?FFr9c@|jtjS)a  Get the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rr?rrxs r:rzX509.get_notAfterjs&&t'>'>??r9zZX509.set_notAfter is deprecated. You should use cryptography's CertificateBuilder instead.cB|jtj|S)z Set the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )rr?rrs r: set_notAfterzX509.set_notAfterws&&t'>'>EEr9ctjt}||j|_t |jt jk7||_|Sr>) objectrNr#rJrrKrGrL_owner)ryrr~s r: _get_namezX509._get_namesE~~h'4::&  dii/0  r9ct|ts td||j|j}t |dk(y)Nzname must be an X509Namer)rWr#rYrJrrK)ryrr~r^s r: _set_namezX509._set_names8$)67 74::tzz2  a(r9zPX509.get_issuer is deprecated. You should use cryptography's X.509 APIs instead.cz|jtj}|jj ||S)a Return the issuer of this certificate. This creates a new :class:`X509Name` that wraps the underlying issuer name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this issuer. :return: The issuer of this certificate. :rtype: :class:`X509Name` )rr?X509_get_issuer_namerKrr}s r: get_issuerzX509.get_issuers1 ~~d778   $$T* r9zXX509.set_issuer is deprecated. You should use cryptography's CertificateBuilder instead.cx|jtj||jj y)z Set the issuer of this certificate. :param issuer: The issuer. :type issuer: :py:class:`X509Name` :return: ``None`` N)rr?X509_set_issuer_namerKr)ryissuers r: set_issuerzX509.set_issuers* t00&9   &&(r9zQX509.get_subject is deprecated. You should use cryptography's X.509 APIs instead.cz|jtj}|jj ||S)a Return the subject of this certificate. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate. :rtype: :class:`X509Name` )rr?X509_get_subject_namerLrr}s r: get_subjectzX509.get_subjects1 ~~d889 !!%%d+ r9zYX509.set_subject is deprecated. You should use cryptography's CertificateBuilder instead.cx|jtj||jj y)z Set the subject of this certificate. :param subject: The subject. :type subject: :py:class:`X509Name` :return: ``None`` N)rr?X509_set_subject_namerLr)rysubjects r: set_subjectzX509.set_subjects* t117; !!'')r9c@tj|jS)z Get the number of extensions on this certificate. :return: The number of extensions. :rtype: :py:class:`int` .. versionadded:: 0.12 )r?X509_get_ext_countrJrxs r:get_extension_countzX509.get_extension_counts&&tzz22r9Nr)rrrDr )rDx509.Certificate)rXrrDr )r\r0rDrr)rDr")rr"rDr)rr"rlrrDrrE)r}rrDrX)rr0rDr)rr0rDrr)rrrD bytes | None)rDr)rzCallable[..., Any]r]rXrDr)r]rXrDr)rrrDr#)rrr~r#rDr)rDr#)rr#rDr)rr#rDr)$r4r5r6r7rzrrPrTrYr r]r`rcrgrorvrlrrrrrrrrrrrrrrrrrrrr8r9r:r r s; .44& 5 I  I1  5 )  ) 5) )81& >7 5) )8(( 5 /  / 5 0  0""1 A7'7/47 7  5 G  G @ 5 F  F )  -   5 )  ) -   5 *  * 3r9r cfeZdZUdZej Zded<ejZ ded<ejZ ded<ejZ ded<ejZded<ej Zded<ej$Zded <ej(Zded <ej,Zded <ej0Zded <y )r'a  Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html r0 CRL_CHECK CRL_CHECK_ALLIGNORE_CRITICAL X509_STRICTALLOW_PROXY_CERTS POLICY_CHECKEXPLICIT_POLICY INHIBIT_MAPCHECK_SS_SIGNATURE PARTIAL_CHAINN)r4r5r6r7r?X509_V_FLAG_CRL_CHECKr__annotations__X509_V_FLAG_CRL_CHECK_ALLrX509_V_FLAG_IGNORE_CRITICALrX509_V_FLAG_X509_STRICTrX509_V_FLAG_ALLOW_PROXY_CERTSrX509_V_FLAG_POLICY_CHECKrX509_V_FLAG_EXPLICIT_POLICYrX509_V_FLAG_INHIBIT_MAPrX509_V_FLAG_CHECK_SS_SIGNATURErX509_V_FLAG_PARTIAL_CHAINrr8r9r:r'r's//Is/77M37;;OS;33K3!??s?55L#5;;OS;33K3"AAA77M37r9r'cNeZdZdZd dZd dZd dZd dZd dZ d ddZ y)r$a An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. c~tj}tj|tj|_yr>)r?X509_STORE_newrGrMX509_STORE_free_storerystores r:rzzX509Store.__init__s(##%ggeT%9%9: r9ct|ts ttj|j |j }t|dk(y)a Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. rN)rWr rYr?X509_STORE_add_certrrJrK)ryrOrs r:add_certzX509Store.add_certs< $%+ &&t{{DJJ?q!r9ct|tjrddlm}t |j |j}tj|tj}t|tjk7tj|tj}n tdttj |j"|dk7y)a Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. rrVz?CRL must be of type cryptography.x509.CertificateRevocationListN)rWrCertificateRevocationListrrrPrrr?d2i_X509_CRL_biorGrLrKrM X509_CRL_freerYX509_STORE_add_crlr)rycrlrrA openssl_crls r:add_crlzX509Store.add_crl.s c499 : Ms// =>C//TYY?K K4994 5''+t'9'9:C>  // SAQFGr9c\ttj|j|dk7y)a Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. rN)rKr?X509_STORE_set_flagsr)ryflagss r: set_flagszX509Store.set_flagsLs", 11$++uEJKr9c:tj}tj|tj}tj |t j|jttj|j|dk7y)a Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. rN) r?X509_VERIFY_PARAM_newrGrMX509_VERIFY_PARAM_freeX509_VERIFY_PARAM_set_timecalendartimegm timetuplerKX509_STORE_set1_paramr)ryvfy_timeparams r:set_timezX509Store.set_timedsm **,t::; '' 8??8#5#5#78  224;;F!KLr9Nc|tj}n t|}|tj}n t|}tj|j ||}|s t yy)a Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rGrL _path_bytesr?X509_STORE_load_locationsrr)rycafilecapath load_results r:load_locationszX509Store.load_locations|s`F >YYF (F >YYF (F44 KK  "r9r)rOr rDr)rzx509.CertificateRevocationListrDr)rr0rDr)r zdatetime.datetimerDrr>)rStrOrBytesPath | NonerrrDr) r4r5r6r7rzrrrrrr8r9r:r$r$sI ;",H<L0M6)-1#%1#&1#  1#r9r$c4eZdZdZ dfd ZxZS)r&z An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` c@t||||_||_yr>)rrzerrors certificate)rymessagerrrs r:rzzX509StoreContextError.__init__s! ! &r9)rrrz list[Any]rr rDr)r4r5r6r7rzrrs@r:r&r&s2''$-'<@' ''r9r&cveZdZdZ d d dZe d dZed dZddZddZ ddZ dd Z y)r%a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` NcL||_||_|j||_yr>)r_cert_build_certificate_stack_chain)ryrrchains r:rzzX509StoreContext.__init__s$    33E: r9cdd}|t|dk(rtjStj}t |tjk7tj ||}|D]}t|ts tdt tj|jdkDtj||jdksmtj|jt|S)Ncttj|D]-}tj||}tj|/tj |yr>)rr? sk_X509_num sk_X509_valuerI sk_X509_free)srxs r:cleanupz:X509StoreContext._build_certificate_stack..cleanupsQ4++A./ "&&q!,q! "   a r9rz+One of the elements is not an X509 instance)r'rrDr)rJrGrLr?sk_X509_new_nullrKrMrWr rY X509_up_refrJ sk_X509_pushrIr) certificatesr)stackrOs r:rz)X509StoreContext._build_certificate_stacks !  3|#4#999 %%'*+w'  'DdD) MNN D,,TZZ81< =   3q8tzz*$& ' r9ctjtjtj|j d}tj|tj ||g}tj|}tj|}tj|}t|||S)z Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. r ) rGrjr?X509_verify_cert_error_stringX509_STORE_CTX_get_errorrX509_STORE_CTX_get_error_depthX509_STORE_CTX_get_current_certX509_dupr rPr&) store_ctxrrrJrpycerts r:_exception_from_contextz(X509StoreContext._exception_from_contexts++  . .--i8   &/   ) )) 4  / / :  44Y? e$((/$Wff==r9ctj}t|tjk7tj |tj }tj||jj|jj|j}t|dk(tj|}|dkr|j||S)a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. rr)r?X509_STORE_CTX_newrKrGrLrMX509_STORE_CTX_freeX509_STORE_CTX_initrrrJr X509_verify_certr7)ryr5rcs r:_verify_certificatez$X509StoreContext._verify_certificates++-  TYY./GGIt'?'?@ && t{{))4::+;+;T[[  q!##I. !8..y9 9r9c||_y)z Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)rrs r: set_storezX509StoreContext.set_store+s  r9c$|jy)a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)r=rxs r:verify_certificatez#X509StoreContext.verify_certificate6s   "r9c|j}tj|}t|tj k7g}t tj|D]Z}tj||}t|tj k7tj|}|j|\tj||S)aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 ) r=r?X509_STORE_CTX_get1_chainrKrGrLrr$r%r rPr|r&)ryr5 cert_stackrrrOr6s r:get_verified_chainz#X509StoreContext.get_verified_chainBs,,. 33I>  dii/0t'' 34 "A%%j!4D DDII- .,,T2F MM& !  " *% r9r>)rr$rr r!Sequence[X509] | NonerDr)r-rFrDr)r5rrDr&r)rr$rDrr)rDz list[X509]) r4r5r6r7rz staticmethodrr7r=r?rArEr8r9r:r%r%s &(, ;;;% ;  ;+ :>>20  #r9r%ct|tr|jd}t|}|tk(rCt j |tjtjtj}n9|tk(r%t j|tj}n td|tjk(r ttj|S)a Load a certificate (X509) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param bytes buffer: The buffer the certificate is stored in :return: The X509 object r3type argument must be FILETYPE_PEM or FILETYPE_ASN1)rWrrrPrr?PEM_read_bio_X509rGrLr d2i_X509_bior[rr rP)rrNrArs r:r-r-_s&#w' v C |%%c499diiK    dii0NOO tyy  " "4 ((r9c^t}|tk(r!tj||j}na|t k(r!tj ||j}n7|tk(r#tj||jdd}n tdt|dk(t|S)a Dump the certificate *cert* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXT) :param cert: The certificate to dump :return: The buffer with the dumped certificate in rCtype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTr) rPrr?PEM_write_bio_X509rJr i2d_X509_bior X509_print_exr[rKrU)rrOrA result_codes r:r(r(|s .C |--c4::>  ''TZZ8  ((djj!Q?    K1$% # r9ct}|tk(rtj}n%|tk(rtj }n t d|||j}|dk7r tt|S)z Dump a public key to a buffer. :param type: The file type (one of :data:`FILETYPE_PEM` or :data:`FILETYPE_ASN1`). :param PKey pkey: The public key to dump :return: The buffer with the dumped key in it. :rtype: bytes rIr) rPrr?PEM_write_bio_PUBKEYri2d_PUBKEY_bior[rrrU)rrrA write_biorQs r:r*r*sf .C |--  '' NOOC,Ka # r9c t}t|ts td|I| tdt j t |}|tjk(rtdtj}t||}|tk(rXt j||j|tjd|j|j}|j!n|t"k(r!t j$||j}n|t&k(rt j(|jtj*k7r tdtj,t j.|jtj0}t j2||d}n tdt5|dk7t7|S)a Dump the private key *pkey* into a buffer string encoded with the type *type*. Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it using *cipher* and *passphrase*. :param type: The file type (one of :const:`FILETYPE_PEM`, :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`) :param PKey pkey: The PKey to dump :param cipher: (optional) if encrypted PEM format, the cipher to use :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The buffer with the dumped key in :rtype: bytes .. deprecated:: 26.3.0 Use the serialization APIs on ``cryptography`` private key types instead. zpkey must be a PKeyzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namerz-Only RSA keys are supported for FILETYPE_TEXTrM)rPrWr"rYr?EVP_get_cipherbynamerrGrLr[_PassphraseHelperrPEM_write_bio_PrivateKeyrcallback callback_argsraise_if_problemri2d_PrivateKey_biorrrrMrr RSA_printrKrU) rrcipher passphraserA cipher_objhelperrQrs r:r)r)s2 .C dD !-..   8 ..|F/CD  "23 3YY tZ 0F |33  JJ  II OO    !  --c4::>     DJJ '4+<+< <KL Lggd,,TZZ8$--HnnS#q1    K1$% # r9zGdump_privatekey is deprecated. You should use the APIs in cryptography.r)rcxeZdZ d ddZed dZed dZefd dZ d dZ y) rXch|tk7r | td||_||_||_g|_y)Nz0only FILETYPE_PEM key format supports encryption)rr[ _passphrase _more_args _truncate _problems)ryrr` more_argstruncates r:rzz_PassphraseHelper.__init__ s@ < J$:B &#!*,r9c|jtjSt|jtst |jr tj d|jStd)Npem_password_cb2Last argument must be a byte string or a callable.) rerGrLrWrXcallablerZ_read_passphraserYrxs r:rZz_PassphraseHelper.callbacks]    #99  ((% 0HT=M=M4N==!2D4I4IJ JD r9c|jtjSt|jtst |jrtjSt d)Nrm)rerGrLrWrXrnrYrxs r:r[z_PassphraseHelper.callback_args$sO    #99  ((% 0HT=M=M4N99 D r9c|jr' t||jjdy#|$rY#wxYwr/)rh_exception_from_error_queuepop)ry exceptionTypes r:r\z"_PassphraseHelper.raise_if_problem/sF >> +M:..$$Q' ' !  s 5==c t|jr2|jr|j|||}n,|j|}n|jJ|j}t|ts t dt ||kDr|jr|d|}n t dtt |D] }|||dz||<t |S#t$r%}|jj|Yd}~yd}~wwxYw)NzBytes expectedz+passphrase returned by callback is too longrr) rnrerfrWrXr[rJrgr Exceptionrhr|)rybufsizerwflaguserdatarres r:roz"_PassphraseHelper._read_passphrase9s (()??!--dFHEF!--f5F''333))fe, !1226{T!>>#ET]F$E3v;' +AE*A +v;   NN ! !! $ sCC D!DDN)FF) rr0r`PassphraseCallableT | NonerirrjrrDrr)rtztype[Exception]rDr) rwrrxr0ryrrzrrDr0) r4r5r6rzpropertyrZr[r!r\ror8r9r:rXrXs   --/- -  -  - AF(!+.:= r9rXc4t|tr|jd}t|}|tk(rCt j |tjtjtj}n9|tk(r%t j|tj}n td|tjk(r ttjt}tj|t j |_d|_|S)a< Load a public key from a buffer. :param type: The file type (one of :data:`FILETYPE_PEM`, :data:`FILETYPE_ASN1`). :param buffer: The buffer the key is stored in. :type buffer: A Python string object, either unicode or bytestring. :return: The PKey object. :rtype: :class:`PKey` rrIT)rWrrrPrr?PEM_read_bio_PUBKEYrGrLrd2i_PUBKEY_bior[rr"rNrMrrr)rrNrAevp_pkeyrs r:r/r/Vs&#w' v C |++ DIItyy   &&sDII6NOO499 << D4#5#56DJD Kr9cNt|tr|jd}t|}t ||}|t k(rKt j|tj|j|j}|jn9|tk(r%t j|tj}n td|tjk(r t!t"j%t"}tj&|t j(|_|S)a Load a private key (PKey) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the key is stored in :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The PKey object rrI)rWrrrPrXrr?PEM_read_bio_PrivateKeyrGrLrZr[r\rd2i_PrivateKey_bior[rr"rNrMrr)rrNr`rArbrrs r:r.r.xs"&#w' v C tZ 0F |// FOOV-A-A  !  **3 :NOO499 << D4#5#56DJ Kr9r>)rNrrDr)rArrDrX)r\rr]rXrDr)r]rXrDr)rnrrDr)rDr)r~rrDr)rr0rNrXrDr )rr0rOr rDrX)rr0rr"rDrX)NN) rr0rr"r_rDr`r|rDrX)rr0rN str | bytesrDr")rr0rNrr`r|rDr")g __future__rrr functoolssysrbase64rcollections.abcrrrrr version_infowarningsr typing_extensions cryptographyr r)cryptography.hazmat.primitives.asymmetricrrrrr OpenSSL._utilrrrrrrrrGrr?r _make_assertrr__all__rrrrr _PrivateKeyrrrrr _PublicKeyrrXPassphraseCallableTSSL_FILETYPE_PEMrrSSL_FILETYPE_ASN1rrrr EVP_PKEY_DSAr EVP_PKEY_DHr1 EVP_PKEY_ECr2rvr!rrKrPrUr_rdrsrur"rr,r+total_orderingr#r r'r$r&r%r-r(r*r)rr4DeprecationWarningrXr/r.r8r9r:rsV" $ w#,$) 2         [* $%E8CJ#778)) c)++ s+ !!#!!!#!I :EBu%4;+2&:  F.F.Rd.d.N  5  5 1 1$    D_3_3D88.g#g#T'I'"[[|):88-1 F F F F+ F  FR,    KK\J.2& & &+& &r9