updated files

dist/ba_data/python-site-packages/cryptography/hazmat/primitives/serialization/__init__.py

@@ -0,0 +1,63 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+from cryptography.hazmat.primitives._serialization import (
+    BestAvailableEncryption,
+    Encoding,
+    KeySerializationEncryption,
+    NoEncryption,
+    ParameterFormat,
+    PrivateFormat,
+    PublicFormat,
+    _KeySerializationEncryption,
+)
+from cryptography.hazmat.primitives.serialization.base import (
+    load_der_parameters,
+    load_der_private_key,
+    load_der_public_key,
+    load_pem_parameters,
+    load_pem_private_key,
+    load_pem_public_key,
+)
+from cryptography.hazmat.primitives.serialization.ssh import (
+    SSHCertificate,
+    SSHCertificateBuilder,
+    SSHCertificateType,
+    SSHCertPrivateKeyTypes,
+    SSHCertPublicKeyTypes,
+    SSHPrivateKeyTypes,
+    SSHPublicKeyTypes,
+    load_ssh_private_key,
+    load_ssh_public_identity,
+    load_ssh_public_key,
+)
+
+__all__ = [
+    "load_der_parameters",
+    "load_der_private_key",
+    "load_der_public_key",
+    "load_pem_parameters",
+    "load_pem_private_key",
+    "load_pem_public_key",
+    "load_ssh_private_key",
+    "load_ssh_public_identity",
+    "load_ssh_public_key",
+    "Encoding",
+    "PrivateFormat",
+    "PublicFormat",
+    "ParameterFormat",
+    "KeySerializationEncryption",
+    "BestAvailableEncryption",
+    "NoEncryption",
+    "_KeySerializationEncryption",
+    "SSHCertificateBuilder",
+    "SSHCertificate",
+    "SSHCertificateType",
+    "SSHCertPublicKeyTypes",
+    "SSHCertPrivateKeyTypes",
+    "SSHPrivateKeyTypes",
+    "SSHPublicKeyTypes",
+]

dist/ba_data/python-site-packages/cryptography/hazmat/primitives/serialization/base.py

@@ -0,0 +1,73 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import typing
+
+from cryptography.hazmat.primitives.asymmetric import dh
+from cryptography.hazmat.primitives.asymmetric.types import (
+    PrivateKeyTypes,
+    PublicKeyTypes,
+)
+
+
+def load_pem_private_key(
+    data: bytes,
+    password: typing.Optional[bytes],
+    backend: typing.Any = None,
+    *,
+    unsafe_skip_rsa_key_validation: bool = False,
+) -> PrivateKeyTypes:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_pem_private_key(
+        data, password, unsafe_skip_rsa_key_validation
+    )
+
+
+def load_pem_public_key(
+    data: bytes, backend: typing.Any = None
+) -> PublicKeyTypes:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_pem_public_key(data)
+
+
+def load_pem_parameters(
+    data: bytes, backend: typing.Any = None
+) -> dh.DHParameters:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_pem_parameters(data)
+
+
+def load_der_private_key(
+    data: bytes,
+    password: typing.Optional[bytes],
+    backend: typing.Any = None,
+    *,
+    unsafe_skip_rsa_key_validation: bool = False,
+) -> PrivateKeyTypes:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_der_private_key(
+        data, password, unsafe_skip_rsa_key_validation
+    )
+
+
+def load_der_public_key(
+    data: bytes, backend: typing.Any = None
+) -> PublicKeyTypes:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_der_public_key(data)
+
+
+def load_der_parameters(
+    data: bytes, backend: typing.Any = None
+) -> dh.DHParameters:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_der_parameters(data)

dist/ba_data/python-site-packages/cryptography/hazmat/primitives/serialization/pkcs12.py

@@ -0,0 +1,229 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import typing
+
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives._serialization import PBES as PBES
+from cryptography.hazmat.primitives.asymmetric import (
+    dsa,
+    ec,
+    ed448,
+    ed25519,
+    rsa,
+)
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
+
+__all__ = [
+    "PBES",
+    "PKCS12PrivateKeyTypes",
+    "PKCS12Certificate",
+    "PKCS12KeyAndCertificates",
+    "load_key_and_certificates",
+    "load_pkcs12",
+    "serialize_key_and_certificates",
+]
+
+PKCS12PrivateKeyTypes = typing.Union[
+    rsa.RSAPrivateKey,
+    dsa.DSAPrivateKey,
+    ec.EllipticCurvePrivateKey,
+    ed25519.Ed25519PrivateKey,
+    ed448.Ed448PrivateKey,
+]
+
+
+class PKCS12Certificate:
+    def __init__(
+        self,
+        cert: x509.Certificate,
+        friendly_name: typing.Optional[bytes],
+    ):
+        if not isinstance(cert, x509.Certificate):
+            raise TypeError("Expecting x509.Certificate object")
+        if friendly_name is not None and not isinstance(friendly_name, bytes):
+            raise TypeError("friendly_name must be bytes or None")
+        self._cert = cert
+        self._friendly_name = friendly_name
+
+    @property
+    def friendly_name(self) -> typing.Optional[bytes]:
+        return self._friendly_name
+
+    @property
+    def certificate(self) -> x509.Certificate:
+        return self._cert
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, PKCS12Certificate):
+            return NotImplemented
+
+        return (
+            self.certificate == other.certificate
+            and self.friendly_name == other.friendly_name
+        )
+
+    def __hash__(self) -> int:
+        return hash((self.certificate, self.friendly_name))
+
+    def __repr__(self) -> str:
+        return "<PKCS12Certificate({}, friendly_name={!r})>".format(
+            self.certificate, self.friendly_name
+        )
+
+
+class PKCS12KeyAndCertificates:
+    def __init__(
+        self,
+        key: typing.Optional[PrivateKeyTypes],
+        cert: typing.Optional[PKCS12Certificate],
+        additional_certs: typing.List[PKCS12Certificate],
+    ):
+        if key is not None and not isinstance(
+            key,
+            (
+                rsa.RSAPrivateKey,
+                dsa.DSAPrivateKey,
+                ec.EllipticCurvePrivateKey,
+                ed25519.Ed25519PrivateKey,
+                ed448.Ed448PrivateKey,
+            ),
+        ):
+            raise TypeError(
+                "Key must be RSA, DSA, EllipticCurve, ED25519, or ED448"
+                " private key, or None."
+            )
+        if cert is not None and not isinstance(cert, PKCS12Certificate):
+            raise TypeError("cert must be a PKCS12Certificate object or None")
+        if not all(
+            isinstance(add_cert, PKCS12Certificate)
+            for add_cert in additional_certs
+        ):
+            raise TypeError(
+                "all values in additional_certs must be PKCS12Certificate"
+                " objects"
+            )
+        self._key = key
+        self._cert = cert
+        self._additional_certs = additional_certs
+
+    @property
+    def key(self) -> typing.Optional[PrivateKeyTypes]:
+        return self._key
+
+    @property
+    def cert(self) -> typing.Optional[PKCS12Certificate]:
+        return self._cert
+
+    @property
+    def additional_certs(self) -> typing.List[PKCS12Certificate]:
+        return self._additional_certs
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, PKCS12KeyAndCertificates):
+            return NotImplemented
+
+        return (
+            self.key == other.key
+            and self.cert == other.cert
+            and self.additional_certs == other.additional_certs
+        )
+
+    def __hash__(self) -> int:
+        return hash((self.key, self.cert, tuple(self.additional_certs)))
+
+    def __repr__(self) -> str:
+        fmt = (
+            "<PKCS12KeyAndCertificates(key={}, cert={}, additional_certs={})>"
+        )
+        return fmt.format(self.key, self.cert, self.additional_certs)
+
+
+def load_key_and_certificates(
+    data: bytes,
+    password: typing.Optional[bytes],
+    backend: typing.Any = None,
+) -> typing.Tuple[
+    typing.Optional[PrivateKeyTypes],
+    typing.Optional[x509.Certificate],
+    typing.List[x509.Certificate],
+]:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_key_and_certificates_from_pkcs12(data, password)
+
+
+def load_pkcs12(
+    data: bytes,
+    password: typing.Optional[bytes],
+    backend: typing.Any = None,
+) -> PKCS12KeyAndCertificates:
+    from cryptography.hazmat.backends.openssl.backend import backend as ossl
+
+    return ossl.load_pkcs12(data, password)
+
+
+_PKCS12CATypes = typing.Union[
+    x509.Certificate,
+    PKCS12Certificate,
+]
+
+
+def serialize_key_and_certificates(
+    name: typing.Optional[bytes],
+    key: typing.Optional[PKCS12PrivateKeyTypes],
+    cert: typing.Optional[x509.Certificate],
+    cas: typing.Optional[typing.Iterable[_PKCS12CATypes]],
+    encryption_algorithm: serialization.KeySerializationEncryption,
+) -> bytes:
+    if key is not None and not isinstance(
+        key,
+        (
+            rsa.RSAPrivateKey,
+            dsa.DSAPrivateKey,
+            ec.EllipticCurvePrivateKey,
+            ed25519.Ed25519PrivateKey,
+            ed448.Ed448PrivateKey,
+        ),
+    ):
+        raise TypeError(
+            "Key must be RSA, DSA, EllipticCurve, ED25519, or ED448"
+            " private key, or None."
+        )
+    if cert is not None and not isinstance(cert, x509.Certificate):
+        raise TypeError("cert must be a certificate or None")
+
+    if cas is not None:
+        cas = list(cas)
+        if not all(
+            isinstance(
+                val,
+                (
+                    x509.Certificate,
+                    PKCS12Certificate,
+                ),
+            )
+            for val in cas
+        ):
+            raise TypeError("all values in cas must be certificates")
+
+    if not isinstance(
+        encryption_algorithm, serialization.KeySerializationEncryption
+    ):
+        raise TypeError(
+            "Key encryption algorithm must be a "
+            "KeySerializationEncryption instance"
+        )
+
+    if key is None and cert is None and not cas:
+        raise ValueError("You must supply at least one of key, cert, or cas")
+
+    from cryptography.hazmat.backends.openssl.backend import backend
+
+    return backend.serialize_key_and_certificates_to_pkcs12(
+        name, key, cert, cas, encryption_algorithm
+    )

dist/ba_data/python-site-packages/cryptography/hazmat/primitives/serialization/pkcs7.py

@@ -0,0 +1,235 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import email.base64mime
+import email.generator
+import email.message
+import email.policy
+import io
+import typing
+
+from cryptography import utils, x509
+from cryptography.hazmat.bindings._rust import pkcs7 as rust_pkcs7
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
+from cryptography.utils import _check_byteslike
+
+
+def load_pem_pkcs7_certificates(data: bytes) -> typing.List[x509.Certificate]:
+    from cryptography.hazmat.backends.openssl.backend import backend
+
+    return backend.load_pem_pkcs7_certificates(data)
+
+
+def load_der_pkcs7_certificates(data: bytes) -> typing.List[x509.Certificate]:
+    from cryptography.hazmat.backends.openssl.backend import backend
+
+    return backend.load_der_pkcs7_certificates(data)
+
+
+def serialize_certificates(
+    certs: typing.List[x509.Certificate],
+    encoding: serialization.Encoding,
+) -> bytes:
+    return rust_pkcs7.serialize_certificates(certs, encoding)
+
+
+PKCS7HashTypes = typing.Union[
+    hashes.SHA224,
+    hashes.SHA256,
+    hashes.SHA384,
+    hashes.SHA512,
+]
+
+PKCS7PrivateKeyTypes = typing.Union[
+    rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey
+]
+
+
+class PKCS7Options(utils.Enum):
+    Text = "Add text/plain MIME type"
+    Binary = "Don't translate input data into canonical MIME format"
+    DetachedSignature = "Don't embed data in the PKCS7 structure"
+    NoCapabilities = "Don't embed SMIME capabilities"
+    NoAttributes = "Don't embed authenticatedAttributes"
+    NoCerts = "Don't embed signer certificate"
+
+
+class PKCS7SignatureBuilder:
+    def __init__(
+        self,
+        data: typing.Optional[bytes] = None,
+        signers: typing.List[
+            typing.Tuple[
+                x509.Certificate,
+                PKCS7PrivateKeyTypes,
+                PKCS7HashTypes,
+            ]
+        ] = [],
+        additional_certs: typing.List[x509.Certificate] = [],
+    ):
+        self._data = data
+        self._signers = signers
+        self._additional_certs = additional_certs
+
+    def set_data(self, data: bytes) -> PKCS7SignatureBuilder:
+        _check_byteslike("data", data)
+        if self._data is not None:
+            raise ValueError("data may only be set once")
+
+        return PKCS7SignatureBuilder(data, self._signers)
+
+    def add_signer(
+        self,
+        certificate: x509.Certificate,
+        private_key: PKCS7PrivateKeyTypes,
+        hash_algorithm: PKCS7HashTypes,
+    ) -> PKCS7SignatureBuilder:
+        if not isinstance(
+            hash_algorithm,
+            (
+                hashes.SHA224,
+                hashes.SHA256,
+                hashes.SHA384,
+                hashes.SHA512,
+            ),
+        ):
+            raise TypeError(
+                "hash_algorithm must be one of hashes.SHA224, "
+                "SHA256, SHA384, or SHA512"
+            )
+        if not isinstance(certificate, x509.Certificate):
+            raise TypeError("certificate must be a x509.Certificate")
+
+        if not isinstance(
+            private_key, (rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey)
+        ):
+            raise TypeError("Only RSA & EC keys are supported at this time.")
+
+        return PKCS7SignatureBuilder(
+            self._data,
+            self._signers + [(certificate, private_key, hash_algorithm)],
+        )
+
+    def add_certificate(
+        self, certificate: x509.Certificate
+    ) -> PKCS7SignatureBuilder:
+        if not isinstance(certificate, x509.Certificate):
+            raise TypeError("certificate must be a x509.Certificate")
+
+        return PKCS7SignatureBuilder(
+            self._data, self._signers, self._additional_certs + [certificate]
+        )
+
+    def sign(
+        self,
+        encoding: serialization.Encoding,
+        options: typing.Iterable[PKCS7Options],
+        backend: typing.Any = None,
+    ) -> bytes:
+        if len(self._signers) == 0:
+            raise ValueError("Must have at least one signer")
+        if self._data is None:
+            raise ValueError("You must add data to sign")
+        options = list(options)
+        if not all(isinstance(x, PKCS7Options) for x in options):
+            raise ValueError("options must be from the PKCS7Options enum")
+        if encoding not in (
+            serialization.Encoding.PEM,
+            serialization.Encoding.DER,
+            serialization.Encoding.SMIME,
+        ):
+            raise ValueError(
+                "Must be PEM, DER, or SMIME from the Encoding enum"
+            )
+
+        # Text is a meaningless option unless it is accompanied by
+        # DetachedSignature
+        if (
+            PKCS7Options.Text in options
+            and PKCS7Options.DetachedSignature not in options
+        ):
+            raise ValueError(
+                "When passing the Text option you must also pass "
+                "DetachedSignature"
+            )
+
+        if PKCS7Options.Text in options and encoding in (
+            serialization.Encoding.DER,
+            serialization.Encoding.PEM,
+        ):
+            raise ValueError(
+                "The Text option is only available for SMIME serialization"
+            )
+
+        # No attributes implies no capabilities so we'll error if you try to
+        # pass both.
+        if (
+            PKCS7Options.NoAttributes in options
+            and PKCS7Options.NoCapabilities in options
+        ):
+            raise ValueError(
+                "NoAttributes is a superset of NoCapabilities. Do not pass "
+                "both values."
+            )
+
+        return rust_pkcs7.sign_and_serialize(self, encoding, options)
+
+
+def _smime_encode(
+    data: bytes, signature: bytes, micalg: str, text_mode: bool
+) -> bytes:
+    # This function works pretty hard to replicate what OpenSSL does
+    # precisely. For good and for ill.
+
+    m = email.message.Message()
+    m.add_header("MIME-Version", "1.0")
+    m.add_header(
+        "Content-Type",
+        "multipart/signed",
+        protocol="application/x-pkcs7-signature",
+        micalg=micalg,
+    )
+
+    m.preamble = "This is an S/MIME signed message\n"
+
+    msg_part = OpenSSLMimePart()
+    msg_part.set_payload(data)
+    if text_mode:
+        msg_part.add_header("Content-Type", "text/plain")
+    m.attach(msg_part)
+
+    sig_part = email.message.MIMEPart()
+    sig_part.add_header(
+        "Content-Type", "application/x-pkcs7-signature", name="smime.p7s"
+    )
+    sig_part.add_header("Content-Transfer-Encoding", "base64")
+    sig_part.add_header(
+        "Content-Disposition", "attachment", filename="smime.p7s"
+    )
+    sig_part.set_payload(
+        email.base64mime.body_encode(signature, maxlinelen=65)
+    )
+    del sig_part["MIME-Version"]
+    m.attach(sig_part)
+
+    fp = io.BytesIO()
+    g = email.generator.BytesGenerator(
+        fp,
+        maxheaderlen=0,
+        mangle_from_=False,
+        policy=m.policy.clone(linesep="\r\n"),
+    )
+    g.flatten(m)
+    return fp.getvalue()
+
+
+class OpenSSLMimePart(email.message.MIMEPart):
+    # A MIMEPart subclass that replicates OpenSSL's behavior of not including
+    # a newline if there are no headers.
+    def _write_headers(self, generator) -> None:
+        if list(self.raw_items()):
+            generator._write_headers(self)