o
    Þ­jÒ  ã                   @  sB  U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z
 d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZ d dlmZ d d	lmZmZmZmZ d d
lm Z m!Z!m"Z"m#Z#m$Z$m%Z% z
d dl&m'Z( dZ)W n e*y‰   dZ)	d d¡dd„Z(Y nw dZ+dZ,dZ-dZ.dZ/dZ0dZ1d Z2d!Z3d"Z4d#Z5e 6d$¡Z7d%Z8d&Z9d'Z:d(Z;d)Z<d*Z=d+Z>e 6e9d, e: ej?¡Z@eAeBeCd-d.ƒƒƒZDeG d/d0„ d0ƒƒZEeEejFd1ejGd+d+ddd2�eEejFd1ejHd+d+ddd2�eEejFd1ejId+d3d+dd2�d4œZJd5eKd6< e.e/e0d7œZLd¢d:d;„ZMd£d>d?„ZNe9d@ e:d@ fd¤dEdF„ZOd¥dIdJ„ZPd¦dKdL„ZQd§dPdQ„ZRd¨dTdU„ZSd¨dVdW„ZTd©dYdZ„ZUd¨d[d\„ZVdªd^d_„ZWG d`da„ daƒZXG dbdc„ dcƒZYG ddde„ deƒZZG dfdg„ dgƒZ[G dhdi„ diƒZ\d«djdk„Z]G dldm„ dmƒZ^G dndo„ doƒZ_e,eYƒ e-eZƒ e+e\ƒ e.e[dpe `¡ ƒe/e[dqe a¡ ƒe0e[dre b¡ ƒe2e^ƒ e3e_ƒ iZcd¬dtdu„Zdejeejfejgejhejif Zj	d­ddvœd®d{d|„Zkd¯d€d�„Zlejeejmejnejoejpf Zqejeejmejnejpf ZrG d‚dƒ„ dƒejsƒZtG d„d…„ d…ƒZud°d‰dŠ„Zv	d d±dŒd�„Zwd±dŽd�„Zxd²d’d“„Zyd³d—d˜„Zz	d­d´d™dš„Z{dµd›dœ„Z|ejeejfejgejif Z}d�Z~G dždŸ„ dŸƒZdS )¶é    )ÚannotationsN)Úencodebytes)Ú	dataclass)Úutils©ÚUnsupportedAlgorithm)Úhashes)ÚdsaÚecÚed25519ÚpaddingÚrsa)ÚAEADDecryptionContextÚCipherÚ
algorithmsÚmodes)ÚEncodingÚKeySerializationEncryptionÚNoEncryptionÚPrivateFormatÚPublicFormatÚ_KeySerializationEncryption)ÚkdfTFÚpasswordÚbytesÚsaltÚdesired_key_bytesÚintÚroundsÚignore_few_roundsÚboolÚreturnc                 C  ó   t dƒ‚)NzNeed bcrypt moduler   )r   r   r   r   r   © r#   úm/var/www/html/CropPilot/venv/lib/python3.10/site-packages/cryptography/hazmat/primitives/serialization/ssh.pyÚ_bcrypt_kdf1   s   r%   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   sk-ssh-ed25519@openssh.coms"   sk-ecdsa-sha2-nistp256@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   noneó
   aes256-ctré   s   (.*?)é   é   c                   @  sF   e Zd ZU ded< ded< ded< ded< ded< d	ed
< ded< dS )Ú
_SSHCipherztype[algorithms.AES]Úalgr   Úkey_lenz3type[modes.CTR] | type[modes.CBC] | type[modes.GCM]ÚmodeÚ	block_lenÚiv_lenú
int | NoneÚtag_lenr    Úis_aeadN)Ú__name__Ú
__module__Ú__qualname__Ú__annotations__r#   r#   r#   r$   r*   \   s   
 r*   é    )r+   r,   r-   r.   r/   r1   r2   é   )r&   s
   aes256-cbcs   aes256-gcm@openssh.comzdict[bytes, _SSHCipher]Ú_SSH_CIPHERS)Ú	secp256r1Ú	secp384r1Ú	secp521r1Úkeyú&SSHPrivateKeyTypes | SSHPublicKeyTypesc                 C  sŠ   t | tjƒrt|  ¡ ƒ}|S t | tjƒrt| ƒ}|S t | tjtjfƒr't	}|S t | t
jt
jfƒr4t}|S t | tjtjfƒrAt}|S tdƒ‚)NúUnsupported key type)Ú
isinstancer
   ÚEllipticCurvePrivateKeyÚ_ecdsa_key_typeÚ
public_keyÚEllipticCurvePublicKeyr   ÚRSAPrivateKeyÚRSAPublicKeyÚ_SSH_RSAr	   ÚDSAPrivateKeyÚDSAPublicKeyÚ_SSH_DSAr   ÚEd25519PrivateKeyÚEd25519PublicKeyÚ_SSH_ED25519Ú
ValueError)r=   Úkey_typer#   r#   r$   Ú_get_ssh_key_typeŽ   s$   óõ
÷ùÿþrP   rC   úec.EllipticCurvePublicKeyc                 C  s*   | j }|jtvrtd|j›�ƒ‚t|j S )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )ÚcurveÚnameÚ_ECDSA_KEY_TYPErN   )rC   rR   r#   r#   r$   rB   ¡   s   

ÿ
rB   ó   
Údataúutils.BufferÚprefixÚsuffixc                 C  s   d  |t| ƒ|g¡S )Nó    )ÚjoinÚ_base64_encode)rV   rX   rY   r#   r#   r$   Ú_ssh_pem_encode«   s   r]   r.   ÚNonec                 C  s    | r
t | ƒ| dkrtdƒ‚dS )zRequire data to be full blocksr   zCorrupt data: missing paddingN)ÚlenrN   )rV   r.   r#   r#   r$   Ú_check_block_size³   s   ÿr`   c                 C  s   | rt dƒ‚dS )z!All data should have been parsed.zCorrupt data: unparsed dataN)rN   ©rV   r#   r#   r$   Ú_check_empty¹   s   ÿrb   Ú
ciphernameúbytes | Noneú)Cipher[modes.CBC | modes.CTR | modes.GCM]c                 C  sV   |st dƒ‚t|  }t|||j|j |dƒ}t| |d|j… ¡| ||jd… ¡ƒS )z$Generate key + iv and return cipher.z9Key is password-protected, but password was not provided.TN)Ú	TypeErrorr9   r%   r,   r/   r   r+   r-   )rc   r   r   r   ÚciphÚseedr#   r#   r$   Ú_init_cipher¿   s   ÿÿþri   Ú
memoryviewútuple[int, memoryview]c                 C  ó6   t | ƒdk r
tdƒ‚tj| dd… dd�| dd… fS )ÚUint32é   úInvalid dataNÚbig©Ú	byteorder©r_   rN   r   Ú
from_bytesra   r#   r#   r$   Ú_get_u32Õ   ó   "ru   c                 C  rl   )ÚUint64é   ro   Nrp   rq   rs   ra   r#   r#   r$   Ú_get_u64Ü   rv   ry   útuple[memoryview, memoryview]c                 C  s8   t | ƒ\}} |t| ƒkrtdƒ‚| d|… | |d… fS )zBytes with u32 length prefixro   N)ru   r_   rN   )rV   Únr#   r#   r$   Ú_get_sshstrã   s   r|   c                 C  s4   t | ƒ\}} |r|d dkrtdƒ‚t |d¡| fS )zBig integer.r   é   ro   rp   )r|   rN   r   rt   )rV   Úvalr#   r#   r$   Ú
_get_mpintë   s   r   r~   c                 C  s4   | dk rt dƒ‚| sdS |  ¡ d d }t | |¡S )z!Storage format for signed bigint.r   znegative mpint not allowedrZ   rx   )rN   Ú
bit_lengthr   Úint_to_bytes)r~   Únbytesr#   r#   r$   Ú	_to_mpintó   s   rƒ   c                   @  sx   e Zd ZU dZded< d$d%d	d
„Zd&dd„Zd'dd„Zd'dd„Zd(dd„Z	d'dd„Z
d)dd„Zd*d+dd „Zd,d"d#„ZdS )-Ú	_FragListz,Build recursive structure without data copy.zlist[utils.Buffer]ÚflistNÚinitúlist[utils.Buffer] | Noner!   r^   c                 C  s   g | _ |r| j  |¡ d S d S ©N)r…   Úextend)Úselfr†   r#   r#   r$   Ú__init__  s   ÿz_FragList.__init__r~   rW   c                 C  s   | j  |¡ dS )zAdd plain bytesN)r…   Úappend©rŠ   r~   r#   r#   r$   Úput_raw  ó   z_FragList.put_rawr   c                 C  ó   | j  |jddd�¡ dS )zBig-endian uint32rn   rp   ©Úlengthrr   N©r…   rŒ   Úto_bytesr�   r#   r#   r$   Úput_u32  ó   z_FragList.put_u32c                 C  r�   )zBig-endian uint64rx   rp   r‘   Nr“   r�   r#   r#   r$   Úput_u64  r–   z_FragList.put_u64úbytes | _FragListc                 C  sN   t |tttfƒr|  t|ƒ¡ | j |¡ dS |  | ¡ ¡ | j 	|j¡ dS )zBytes prefixed with u32 lengthN)
r@   r   rj   Ú	bytearrayr•   r_   r…   rŒ   Úsizer‰   r�   r#   r#   r$   Ú
put_sshstr  s
   z_FragList.put_sshstrc                 C  s   |   t|ƒ¡ dS )z*Big-endian bigint prefixed with u32 lengthN)r›   rƒ   r�   r#   r#   r$   Ú	put_mpint  s   z_FragList.put_mpintc                 C  s   t tt| jƒƒS )zCurrent number of bytes)ÚsumÚmapr_   r…   ©rŠ   r#   r#   r$   rš      r�   z_FragList.sizer   Údstbufrj   Úposc                 C  s2   | j D ]}t|ƒ}||| }}||||…< q|S )zWrite into bytearray)r…   r_   )rŠ   r    r¡   ÚfragÚflenÚstartr#   r#   r$   Úrender$  s
   
z_FragList.renderr   c                 C  s"   t t|  ¡ ƒƒ}|  |¡ | ¡ S )zReturn as bytes)rj   r™   rš   r¥   Útobytes)rŠ   Úbufr#   r#   r$   r¦   ,  s   
z_FragList.tobytesrˆ   )r†   r‡   r!   r^   )r~   rW   r!   r^   )r~   r   r!   r^   )r~   r˜   r!   r^   ©r!   r   )r   )r    rj   r¡   r   r!   r   ©r!   r   )r3   r4   r5   Ú__doc__r6   r‹   rŽ   r•   r—   r›   rœ   rš   r¥   r¦   r#   r#   r#   r$   r„   ý   s   
 




	
r„   c                   @  óB   e Zd ZdZddd„Zdd	d
„Zddd„Zd dd„Zd!dd„ZdS )"Ú_SSHFormatRSAzhFormat for RSA keys.

    Public:
        mpint e, n
    Private:
        mpint n, e, d, iqmp, p, q
    rV   rj   r!   ú"tuple[tuple[int, int], memoryview]c                 C  s$   t |ƒ\}}t |ƒ\}}||f|fS )zRSA public fields©r   )rŠ   rV   Úer{   r#   r#   r$   Ú
get_public<  s   z_SSHFormatRSA.get_publicú#tuple[rsa.RSAPublicKey, memoryview]c                 C  s.   |   |¡\\}}}t ||¡}| ¡ }||fS )zMake RSA public key from data.)r°   r   ÚRSAPublicNumbersrC   )rŠ   rV   r¯   r{   Úpublic_numbersrC   r#   r#   r$   Úload_publicD  s   z_SSHFormatRSA.load_publicÚunsafe_skip_rsa_key_validationr    ú$tuple[rsa.RSAPrivateKey, memoryview]c              	   C  sª   t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}	}||f|kr.tdƒ‚t ||¡}
t ||	¡}t ||¡}t ||	||
|||¡}|j|d�}||fS )zMake RSA private key from data.z Corrupt data: rsa field mismatch©rµ   )r   rN   r   Úrsa_crt_dmp1Úrsa_crt_dmq1r²   ÚRSAPrivateNumbersÚprivate_key)rŠ   rV   Ú	pubfieldsrµ   r{   r¯   ÚdÚiqmpÚpÚqÚdmp1Údmq1r³   Úprivate_numbersr»   r#   r#   r$   Úload_privateM  s$   ÿÿz_SSHFormatRSA.load_privaterC   úrsa.RSAPublicKeyÚf_pubr„   r^   c                 C  s$   |  ¡ }| |j¡ | |j¡ dS )zWrite RSA public keyN)r³   rœ   r¯   r{   )rŠ   rC   rÆ   Úpubnr#   r#   r$   Úencode_publice  s   z_SSHFormatRSA.encode_publicr»   úrsa.RSAPrivateKeyÚf_privc                 C  sZ   |  ¡ }|j}| |j¡ | |j¡ | |j¡ | |j¡ | |j¡ | |j¡ dS )zWrite RSA private keyN)	rÃ   r³   rœ   r{   r¯   r½   r¾   r¿   rÀ   )rŠ   r»   rÊ   rÃ   r³   r#   r#   r$   Úencode_privatem  s   z_SSHFormatRSA.encode_privateN)rV   rj   r!   r­   )rV   rj   r!   r±   )rV   rj   rµ   r    r!   r¶   )rC   rÅ   rÆ   r„   r!   r^   )r»   rÉ   rÊ   r„   r!   r^   ©	r3   r4   r5   rª   r°   r´   rÄ   rÈ   rË   r#   r#   r#   r$   r¬   3  s    


	
r¬   c                   @  sL   e Zd ZdZd!dd„Zd"d	d
„Zd#dd„Zd$dd„Zd%dd„Zd&dd„Z	d S )'Ú_SSHFormatDSAzhFormat for DSA keys.

    Public:
        mpint p, q, g, y
    Private:
        mpint p, q, g, y, x
    rV   rj   r!   útuple[tuple, memoryview]c                 C  s@   t |ƒ\}}t |ƒ\}}t |ƒ\}}t |ƒ\}}||||f|fS )zDSA public fieldsr®   )rŠ   rV   r¿   rÀ   ÚgÚyr#   r#   r$   r°   †  s
   z_SSHFormatDSA.get_publicú#tuple[dsa.DSAPublicKey, memoryview]c           	      C  sJ   |   |¡\\}}}}}t |||¡}t ||¡}|  |¡ | ¡ }||fS )zMake DSA public key from data.)r°   r	   ÚDSAParameterNumbersÚDSAPublicNumbersÚ	_validaterC   )	rŠ   rV   r¿   rÀ   rÏ   rÐ   Úparameter_numbersr³   rC   r#   r#   r$   r´   Ž  s   
z_SSHFormatDSA.load_publicrµ   r    ú$tuple[dsa.DSAPrivateKey, memoryview]c                 C  sz   |   |¡\\}}}}}t|ƒ\}}||||f|krtdƒ‚t |||¡}	t ||	¡}
|  |
¡ t ||
¡}| ¡ }||fS )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r°   r   rN   r	   rÒ   rÓ   rÔ   ÚDSAPrivateNumbersr»   )rŠ   rV   r¼   rµ   r¿   rÀ   rÏ   rÐ   ÚxrÕ   r³   rÃ   r»   r#   r#   r$   rÄ   ™  s   
z_SSHFormatDSA.load_privaterC   údsa.DSAPublicKeyrÆ   r„   r^   c                 C  sL   |  ¡ }|j}|  |¡ | |j¡ | |j¡ | |j¡ | |j¡ dS )zWrite DSA public keyN)r³   rÕ   rÔ   rœ   r¿   rÀ   rÏ   rÐ   )rŠ   rC   rÆ   r³   rÕ   r#   r#   r$   rÈ   ©  s   
z_SSHFormatDSA.encode_publicr»   údsa.DSAPrivateKeyrÊ   c                 C  s$   |   | ¡ |¡ | | ¡ j¡ dS )zWrite DSA private keyN)rÈ   rC   rœ   rÃ   rØ   )rŠ   r»   rÊ   r#   r#   r$   rË   ¶  s   z_SSHFormatDSA.encode_privater³   údsa.DSAPublicNumbersc                 C  s    |j }|j ¡ dkrtdƒ‚d S )Ni   z#SSH supports only 1024 bit DSA keys)rÕ   r¿   r€   rN   )rŠ   r³   rÕ   r#   r#   r$   rÔ   ½  s   ÿz_SSHFormatDSA._validateN)rV   rj   r!   rÎ   )rV   rj   r!   rÑ   )rV   rj   rµ   r    r!   rÖ   )rC   rÙ   rÆ   r„   r!   r^   )r»   rÚ   rÊ   r„   r!   r^   )r³   rÛ   r!   r^   )
r3   r4   r5   rª   r°   r´   rÄ   rÈ   rË   rÔ   r#   r#   r#   r$   rÍ   }  s    




rÍ   c                   @  sL   e Zd ZdZd#dd„Zd$dd„Zd%dd„Zd&dd„Zd'dd„Zd(d d!„Z	d"S ))Ú_SSHFormatECDSAz–Format for ECDSA keys.

    Public:
        str curve
        bytes point
    Private:
        str curve
        bytes point
        mpint secret
    Ússh_curve_namer   rR   úec.EllipticCurvec                 C  s   || _ || _d S rˆ   )rÝ   rR   )rŠ   rÝ   rR   r#   r#   r$   r‹   Ï  s   
z_SSHFormatECDSA.__init__rV   rj   r!   ú0tuple[tuple[memoryview, memoryview], memoryview]c                 C  s^   t |ƒ\}}t |ƒ\}}|| jkrtdƒ‚t|ƒdkrtdƒ‚|d dkr)tdƒ‚||f|fS )zECDSA public fieldszCurve name mismatchr   zInvalid EC point: empty datarn   zNeed uncompressed point)r|   rÝ   rN   r_   ÚNotImplementedError)rŠ   rV   rR   Úpointr#   r#   r$   r°   Ó  s   
z_SSHFormatECDSA.get_publicú,tuple[ec.EllipticCurvePublicKey, memoryview]c                 C  s.   |   |¡\\}}}tj | j| ¡ ¡}||fS ©z Make ECDSA public key from data.)r°   r
   rD   Úfrom_encoded_pointrR   r¦   )rŠ   rV   Ú_rá   rC   r#   r#   r$   r´   á  s
   
ÿz_SSHFormatECDSA.load_publicrµ   r    ú-tuple[ec.EllipticCurvePrivateKey, memoryview]c                 C  sH   |   |¡\\}}}t|ƒ\}}||f|krtdƒ‚t || j¡}||fS )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r°   r   rN   r
   Úderive_private_keyrR   )rŠ   rV   r¼   rµ   Ú
curve_namerá   Úsecretr»   r#   r#   r$   rÄ   ë  s   z_SSHFormatECDSA.load_privaterC   rQ   rÆ   r„   r^   c                 C  s*   |  tjtj¡}| | j¡ | |¡ dS )zWrite ECDSA public keyN)Úpublic_bytesr   ÚX962r   ÚUncompressedPointr›   rÝ   )rŠ   rC   rÆ   rá   r#   r#   r$   rÈ   ÷  s
   ÿz_SSHFormatECDSA.encode_publicr»   úec.EllipticCurvePrivateKeyrÊ   c                 C  s,   |  ¡ }| ¡ }|  ||¡ | |j¡ dS )zWrite ECDSA private keyN)rC   rÃ   rÈ   rœ   Úprivate_value)rŠ   r»   rÊ   rC   rÃ   r#   r#   r$   rË     s   z_SSHFormatECDSA.encode_privateN)rÝ   r   rR   rÞ   )rV   rj   r!   rß   ©rV   rj   r!   râ   )rV   rj   rµ   r    r!   ræ   )rC   rQ   rÆ   r„   r!   r^   )r»   rí   rÊ   r„   r!   r^   )
r3   r4   r5   rª   r‹   r°   r´   rÄ   rÈ   rË   r#   r#   r#   r$   rÜ   Ã  s    






rÜ   c                   @  r«   )"Ú_SSHFormatEd25519z~Format for Ed25519 keys.

    Public:
        bytes point
    Private:
        bytes point
        bytes secret_and_point
    rV   rj   r!   ú$tuple[tuple[memoryview], memoryview]c                 C  s   t |ƒ\}}|f|fS )zEd25519 public fields)r|   )rŠ   rV   rá   r#   r#   r$   r°     s   
z_SSHFormatEd25519.get_publicú+tuple[ed25519.Ed25519PublicKey, memoryview]c                 C  s(   |   |¡\\}}tj | ¡ ¡}||fS ©z"Make Ed25519 public key from data.)r°   r   rL   Úfrom_public_bytesr¦   )rŠ   rV   rá   rC   r#   r#   r$   r´     s
   ÿz_SSHFormatEd25519.load_publicrµ   r    ú,tuple[ed25519.Ed25519PrivateKey, memoryview]c           	      C  sb   |   |¡\\}}t|ƒ\}}|dd… }|dd… }||ks#|f|kr'tdƒ‚tj |¡}||fS )z#Make Ed25519 private key from data.Nr7   z$Corrupt data: ed25519 field mismatch)r°   r|   rN   r   rK   Úfrom_private_bytes)	rŠ   rV   r¼   rµ   rá   Úkeypairré   Úpoint2r»   r#   r#   r$   rÄ   '  s   z_SSHFormatEd25519.load_privaterC   úed25519.Ed25519PublicKeyrÆ   r„   r^   c                 C  s   |  tjtj¡}| |¡ dS )zWrite Ed25519 public keyN)rê   r   ÚRawr   r›   )rŠ   rC   rÆ   Úraw_public_keyr#   r#   r$   rÈ   5  s   ÿz_SSHFormatEd25519.encode_publicr»   úed25519.Ed25519PrivateKeyrÊ   c                 C  sR   |  ¡ }| tjtjtƒ ¡}| tjtj¡}t||gƒ}|  	||¡ | 
|¡ dS )zWrite Ed25519 private keyN)rC   Úprivate_bytesr   rú   r   r   rê   r   r„   rÈ   r›   )rŠ   r»   rÊ   rC   Úraw_private_keyrû   Ú	f_keypairr#   r#   r$   rË   >  s   ÿÿz _SSHFormatEd25519.encode_privateN)rV   rj   r!   rñ   ©rV   rj   r!   rò   )rV   rj   rµ   r    r!   rõ   )rC   rù   rÆ   r„   r!   r^   )r»   rü   rÊ   r„   r!   r^   rÌ   r#   r#   r#   r$   rð     s    
	



	rð   c                 C  s2   t | ƒ\}} | ¡  d¡std|› d�ƒ‚|| fS )z!
    U2F application strings
    s   ssh:z4U2F application string does not start with b'ssh:' (ú))r|   r¦   Ú
startswithrN   )rV   Úapplicationr#   r#   r$   Úload_applicationO  s   ÿÿr  c                   @  ó$   e Zd ZdZddd„Zdd	d
„ZdS )Ú_SSHFormatSKEd25519zÏ
    The format of a sk-ssh-ed25519@openssh.com public key is:

        string		"sk-ssh-ed25519@openssh.com"
        string		public key
        string		application (user-specified, but typically "ssh:")
    rV   rj   r!   rò   c                 C  ó&   t tƒ |¡\}}t|ƒ\}}||fS ró   )Ú_lookup_kformatrM   r´   r  ©rŠ   rV   rC   rå   r#   r#   r$   r´   e  ó   z_SSHFormatSKEd25519.load_publicútyping.NoReturnc                 C  r"   )Nz,sk-ssh-ed25519 private keys cannot be loadedr   ©rŠ   rV   r#   r#   r$   r°   m  ó   ÿz_SSHFormatSKEd25519.get_publicNr   ©rV   rj   r!   r  ©r3   r4   r5   rª   r´   r°   r#   r#   r#   r$   r  \  s    
r  c                   @  r  )Ú_SSHFormatSKECDSAzò
    The format of a sk-ecdsa-sha2-nistp256@openssh.com public key is:

        string		"sk-ecdsa-sha2-nistp256@openssh.com"
        string		curve name
        ec_point	Q
        string		application (user-specified, but typically "ssh:")
    rV   rj   r!   râ   c                 C  r  rã   )r  Ú_ECDSA_NISTP256r´   r  r	  r#   r#   r$   r´     r
  z_SSHFormatSKECDSA.load_publicr  c                 C  r"   )Nz4sk-ecdsa-sha2-nistp256 private keys cannot be loadedr   r  r#   r#   r$   r°   ‡  r  z_SSHFormatSKECDSA.get_publicNrï   r  r  r#   r#   r#   r$   r  u  s    
	r  s   nistp256s   nistp384s   nistp521rO   c                 C  s4   t | tƒst| ƒ ¡ } | tv rt|  S td| ›�ƒ‚)z"Return valid format or throw errorzUnsupported key type: )r@   r   rj   r¦   Ú_KEY_FORMATSr   )rO   r#   r#   r$   r  ›  s
   
r  r·   Úbackendú
typing.Anyrµ   ÚSSHPrivateKeyTypesc                C  sö  t  d| ¡ |durt  d|¡ t | ¡}|stdƒ‚| d¡}| d¡}t 	t
| ƒ||… ¡} |  t¡s9tdƒ‚t
| ƒttƒd… } t| ƒ\}} t| ƒ\}} t| ƒ\}	} t| ƒ\}
} |
dkrctdƒ‚t| ƒ\}} t|ƒ\}}t|ƒ}| |¡\}}t|ƒ |tks‡|tk�r| ¡ }|tvr–td|›�ƒ‚|tkr¡td|›�ƒ‚t| j}t| j}t| ƒ\}} t| jrÅt| ƒ}t|ƒ|krÄtd	ƒ‚nt| ƒ t||ƒ t|	ƒ\}}t|ƒ\}}t|ƒ t||| ¡ |ƒ}| ¡ }t
| |¡ƒ}t| j�rt |t!ƒsÿJ ‚t| "|¡ƒ nt| #¡ ƒ n|�rt$d
ƒ‚t| ƒ\}} t| ƒ d}t||ƒ t|ƒ\}}t|ƒ\}}||k�r;tdƒ‚t|ƒ\}}||k�rJtdƒ‚|j%|||d�\}}t|ƒ\}}|t&dt|ƒ… k�ritdƒ‚t |t'j(ƒ�ryt)j*dt j+dd� |S )z.Load private key from OpenSSH custom encoding.rV   Nr   zNot OpenSSH private key formatr(   zOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherz4Password was given but private key is not encrypted.rx   zCorrupt data: broken checksumzCorrupt data: key type mismatchr·   zCorrupt data: invalid paddingúDSSH DSA keys are deprecated and will be removed in a future release.é   ©Ú
stacklevel),r   Ú_check_byteslikeÚ_check_bytesÚ_PEM_RCÚsearchrN   r¤   ÚendÚbinasciiÚ
a2b_base64rj   r  Ú	_SK_MAGICr_   r|   ru   r  r°   rb   Ú_NONEr¦   r9   r   Ú_BCRYPTr.   r1   r2   r   r`   ri   Ú	decryptorÚupdater@   r   Úfinalize_with_tagÚfinalizerf   rÄ   Ú_PADDINGr	   rH   ÚwarningsÚwarnÚDeprecatedIn40)rV   r   r  rµ   ÚmÚp1Úp2rc   ÚkdfnameÚ
kdfoptionsÚnkeysÚpubdataÚpub_key_typeÚkformatr¼   Úciphername_bytesÚblklenr1   ÚedataÚtagr   Úkbufr   rg   ÚdecÚck1Úck2rO   r»   rå   r#   r#   r$   Úload_ssh_private_key¬  s¢   



ÿ


ÿ
ÿ



ýür=  r»   Úencryption_algorithmr   c                 C  sä  t  d|¡ t| tjƒrtjdt jdd� t| ƒ}t	|ƒ}t
ƒ }|rQt}t| j}t}t}	t|tƒr:|jdur:|j}	t d¡}
| |
¡ | |	¡ t|||
|	ƒ}nt }}d}d}d}t d¡}d	}t
ƒ }| |¡ | |  ¡ |¡ t
||gƒ}| |¡ | | |¡ | |¡ | td|| ¡ |  … ¡ t
ƒ }| t¡ | |¡ | |¡ | |¡ | |¡ | |¡ | |¡ | ¡ }| ¡ }tt || ƒƒ}| !|¡ || }|durê| "¡  #|||… ||d… ¡ t$|d|… ƒS )
z3Serialize private key with OpenSSH custom encoding.r   úISSH DSA key support is deprecated and will be removed in a future releasern   r  Nr'   rx   r(   rZ   )%r   r  r@   r	   rH   r)  r*  r+  rP   r  r„   Ú_DEFAULT_CIPHERr9   r.   r#  Ú_DEFAULT_ROUNDSr   Ú_kdf_roundsÚosÚurandomr›   r•   ri   r"  rÈ   rC   rË   rŽ   r(  rš   r!  rj   r™   r¥   Ú	encryptorÚupdate_intor]   )r»   r   r>  rO   r4  Úf_kdfoptionsrc   r6  r/  r   r   rg   r1  ÚcheckvalÚcommentÚf_public_keyÚ	f_secretsÚf_mainÚslenÚmlenr§   Úofsr#   r#   r$   Ú_serialize_ssh_private_key  sj   ü
ÿ















 rP  c                   @  s   e Zd ZdZdZdS )ÚSSHCertificateTyper(   r  N)r3   r4   r5   ÚUSERÚHOSTr#   r#   r#   r$   rQ  y  s    rQ  c                   @  s¼   e Zd Zd9dd„Zed:dd„ƒZd;dd„Zed<d d!„ƒZed=d#d$„ƒZed:d%d&„ƒZ	ed>d'd(„ƒZ
ed<d)d*„ƒZed<d+d,„ƒZed?d-d.„ƒZed?d/d0„ƒZd;d1d2„Zd:d3d4„Zd@d6d7„Zd8S )AÚSSHCertificateÚ_noncerj   Ú_public_keyÚSSHPublicKeyTypesÚ_serialr   Ú_cctypeÚ_key_idÚ_valid_principalsúlist[bytes]Ú_valid_afterÚ_valid_beforeÚ_critical_optionsúdict[bytes, bytes]Ú_extensionsÚ	_sig_typeÚ_sig_keyÚ_inner_sig_typeÚ
_signatureÚ_tbs_cert_bodyÚ_cert_key_typer   Ú
_cert_bodyc                 C  sŠ   || _ || _|| _zt|ƒ| _W n ty   tdƒ‚w || _|| _|| _|| _	|	| _
|
| _|| _|| _|| _|| _|| _|| _|| _d S )NzInvalid certificate type)rU  rV  rX  rQ  Ú_typerN   rZ  r[  r]  r^  r_  ra  rb  rc  rd  re  rg  rh  rf  )rŠ   rU  rV  rX  rY  rZ  r[  r]  r^  r_  ra  rb  rc  rd  re  rf  rg  rh  r#   r#   r$   r‹     s*   ÿ
zSSHCertificate.__init__r!   c                 C  ó
   t | jƒS rˆ   )r   rU  rŸ   r#   r#   r$   Únonce¨  ó   
zSSHCertificate.nonceÚSSHCertPublicKeyTypesc                 C  s   t  t| j¡S rˆ   )ÚtypingÚcastrm  rV  rŸ   r#   r#   r$   rC   ¬  s   zSSHCertificate.public_keyc                 C  ó   | j S rˆ   )rX  rŸ   r#   r#   r$   Úserial±  ó   zSSHCertificate.serialrQ  c                 C  rp  rˆ   )ri  rŸ   r#   r#   r$   Útypeµ  rr  zSSHCertificate.typec                 C  rj  rˆ   )r   rZ  rŸ   r#   r#   r$   Úkey_id¹  rl  zSSHCertificate.key_idc                 C  rp  rˆ   )r[  rŸ   r#   r#   r$   Úvalid_principals½  rr  zSSHCertificate.valid_principalsc                 C  rp  rˆ   )r^  rŸ   r#   r#   r$   Úvalid_beforeÁ  rr  zSSHCertificate.valid_beforec                 C  rp  rˆ   )r]  rŸ   r#   r#   r$   Úvalid_afterÅ  rr  zSSHCertificate.valid_afterc                 C  rp  rˆ   )r_  rŸ   r#   r#   r$   Úcritical_optionsÉ  rr  zSSHCertificate.critical_optionsc                 C  rp  rˆ   )ra  rŸ   r#   r#   r$   Ú
extensionsÍ  rr  zSSHCertificate.extensionsc                 C  s&   t | jƒ}| | j¡\}}t|ƒ |S rˆ   )r  rb  r´   rc  rb   )rŠ   Ú	sigformatÚsignature_keyÚsigkey_restr#   r#   r$   r{  Ñ  s   
zSSHCertificate.signature_keyc                 C  s"   t | jƒd tjt | jƒdd� S )Nó    F)Únewline)r   rg  r  Ú
b2a_base64rh  rŸ   r#   r#   r$   rê   ×  s   ÿþÿzSSHCertificate.public_bytesr^   c                 C  s  |   ¡ }t|tjƒr| t| jƒt| jƒ¡ d S t|tj	ƒrIt
| jƒ\}}t
|ƒ\}}t|ƒ t ||¡}t|jƒ}| |t| jƒt |¡¡ d S t|tjƒsQJ ‚| jtkr[t ¡ }n| jtkret ¡ }n| jtkslJ ‚t ¡ }| t| jƒt| jƒt ¡ |¡ d S rˆ   )r{  r@   r   rL   Úverifyr   re  rf  r
   rD   r   rb   Ú
asym_utilsÚencode_dss_signatureÚ_get_ec_hash_algrR   ÚECDSAr   rF   rd  rG   r   ÚSHA1Ú_SSH_RSA_SHA256ÚSHA256Ú_SSH_RSA_SHA512ÚSHA512r   ÚPKCS1v15)rŠ   r{  ÚrrV   ÚsÚcomputed_sigÚhash_algr#   r#   r$   Úverify_cert_signatureÞ  s6   ÿ
ÿ



üz$SSHCertificate.verify_cert_signatureN)"rU  rj   rV  rW  rX  r   rY  r   rZ  rj   r[  r\  r]  r   r^  r   r_  r`  ra  r`  rb  rj   rc  rj   rd  rj   re  rj   rf  rj   rg  r   rh  rj   r©   )r!   rm  r¨   )r!   rQ  )r!   r\  )r!   r`  )r!   r^   )r3   r4   r5   r‹   Úpropertyrk  rC   rq  rs  rt  ru  rv  rw  rx  ry  r{  rê   r�  r#   r#   r#   r$   rT  ~  s0    
)


rT  rR   rÞ   úhashes.HashAlgorithmc                 C  s@   t | tjƒr
t ¡ S t | tjƒrt ¡ S t | tjƒsJ ‚t ¡ S rˆ   )	r@   r
   Ú	SECP256R1r   r‡  Ú	SECP384R1ÚSHA384Ú	SECP521R1r‰  )rR   r#   r#   r$   rƒ  ÿ  s   rƒ  ú"SSHCertificate | SSHPublicKeyTypesc           "      C  sp  t  d| ¡ t | ¡}|stdƒ‚| d¡ }}| d¡}d}| t¡r/d}|d ttƒ … }|t	kr9|s9t
dƒ‚t|ƒ}z	tt |¡ƒ}W n ttjfyT   tdƒ‚w |rY|}	t|ƒ\}
}|
|krgtd	ƒ‚|rot|ƒ\}}| |¡\}}|�r2t|ƒ\}}t|ƒ\}}t|ƒ\}}t|ƒ\}}g }|r¤t|ƒ\}}| t|ƒ¡ |s•t|ƒ\}}t|ƒ\}}t|ƒ\}}t|ƒ}t|ƒ\}}t|ƒ}t|ƒ\}}t|ƒ\}}t|ƒ\}}|t	krà|sàt
d
ƒ‚|	d t|ƒ … }t|ƒ\}}t|ƒ t|ƒ\}} |tk�r|tttfv�s|tk�r||k�rtdƒ‚t| ƒ\}!} t| ƒ t||||||||||||||!|||	ƒS t|ƒ |S )NrV   zInvalid line formatr(   r  FTz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r  Ú_SSH_PUBKEY_RCÚmatchrN   ÚgroupÚendswithÚ_CERT_SUFFIXr_   rJ   r   r  rj   r  r   rf   ÚErrorr|   r´   ry   ru   rŒ   r   Ú_parse_exts_optsrb   rG   r†  rˆ  rT  )"rV   Ú_legacy_dsa_allowedr,  rO   Úorig_key_typeÚkey_bodyÚ	with_certr4  ÚrestÚ	cert_bodyÚinner_key_typerk  rC   rq  Úcctypert  Ú
principalsru  Ú	principalrw  rv  Úcrit_optionsrx  Úextsry  rå   Úsig_key_rawÚsig_typeÚsig_keyÚtbs_cert_bodyÚsignature_rawÚinner_sig_typeÚsig_restÚ	signaturer#   r#   r$   Ú_load_ssh_public_identity	  s¨   


ÿÿþÿ
ÿïr²  c                 C  s   t | ƒS rˆ   )r²  ra   r#   r#   r$   Úload_ssh_public_identityh  s   r³  Ú	exts_optsr`  c                 C  s˜   i }d }| rJt | ƒ\}} t|ƒ}||v rtdƒ‚|d ur$||k r$tdƒ‚t | ƒ\}} t|ƒdkr@t |ƒ\}}t|ƒdkr@tdƒ‚t|ƒ||< |}| s|S )NzDuplicate namezFields not lexically sortedr   z!Unexpected extra data after value)r|   r   rN   r_   )r´  ÚresultÚ	last_namerS   ÚbnameÚvalueÚextrar#   r#   r$   r�  n  s$   ór�  rW  Úhash_algorithmúhashes.MD5 | hashes.SHA256c                 C  sj   t |tjtjfƒstdƒ‚t| ƒ}t|ƒ}tƒ }| |¡ | 	| |¡ | 
¡ }t |¡}| |¡ | ¡ S )Nz+hash_algorithm must be either MD5 or SHA256)r@   r   ÚMD5r‡  rf   rP   r  r„   r›   rÈ   r¦   ÚHashr%  r'  )r=   rº  rO   r4  rÆ   Ússh_binary_dataÚhash_objr#   r#   r$   Ússh_key_fingerprint‚  s   


rÀ  c                 C  sF   t | dd�}t|tƒr| ¡ }n|}t|tjƒr!tjdtj	dd� |S )NT)rž  r  r  r  )
r²  r@   rT  rC   r	   rI   r)  r*  r   r+  )rV   r  Úcert_or_keyrC   r#   r#   r$   Úload_ssh_public_key˜  s   

ürÂ  c                 C  sl   t | tjƒrtjdtjdd� t| ƒ}t|ƒ}t	ƒ }| 
|¡ | | |¡ t | ¡ ¡ ¡ }d |d|g¡S )z&One-line public key format for OpenSSHr?  rn   r  rZ   r}  )r@   r	   rI   r)  r*  r   r+  rP   r  r„   r›   rÈ   r  r  r¦   Ústripr[   )rC   rO   r4  rÆ   Úpubr#   r#   r$   Úserialize_ssh_public_key¬  s   ü
rÅ  é   c                
   @  s˜   e Zd Zddddg dddg g f
d>dd„Zd?dd„Zd@dd„ZdAd!d"„ZdBd%d&„ZdCd(d)„Zd*d+„ Z	dDd.d/„Z
dEd1d2„ZdFd5d6„ZdFd7d8„ZdGd<d=„ZdS )HÚSSHCertificateBuilderNFrV  úSSHCertPublicKeyTypes | NonerX  r0   ri  úSSHCertificateType | NonerZ  rd   r[  r\  Ú_valid_for_all_principalsr    r^  r]  r_  úlist[tuple[bytes, bytes]]ra  c                 C  s@   || _ || _|| _|| _|| _|| _|| _|| _|	| _|
| _	d S rˆ   ©
rV  rX  ri  rZ  r[  rÊ  r^  r]  r_  ra  )rŠ   rV  rX  ri  rZ  r[  rÊ  r^  r]  r_  ra  r#   r#   r$   r‹   Í  s   
zSSHCertificateBuilder.__init__rC   rm  r!   c                 C  s^   t |tjtjtjfƒstdƒ‚| jd urt	dƒ‚t
|| j| j| j| j| j| j| j| j| jd�
S )Nr?   zpublic_key already setrÌ  )r@   r
   rD   r   rF   r   rL   rf   rV  rN   rÇ  rX  ri  rZ  r[  rÊ  r^  r]  r_  ra  )rŠ   rC   r#   r#   r$   rC   å  s,   ýþ
öz SSHCertificateBuilder.public_keyrq  r   c                 C  sv   t |tƒs	tdƒ‚d|  krdk stdƒ‚ tdƒ‚| jd ur$tdƒ‚t| j|| j| j| j	| j
| j| j| j| jd�
S )Nzserial must be an integerr   ì            z"serial must be between 0 and 2**64zserial already setrÌ  )r@   r   rf   rN   rX  rÇ  rV  ri  rZ  r[  rÊ  r^  r]  r_  ra  )rŠ   rq  r#   r#   r$   rq    s(   
ÿ
özSSHCertificateBuilder.serialrs  rQ  c                 C  sR   t |tƒs	tdƒ‚| jd urtdƒ‚t| j| j|| j| j	| j
| j| j| j| jd�
S )Nz"type must be an SSHCertificateTypeztype already setrÌ  )r@   rQ  rf   ri  rN   rÇ  rV  rX  rZ  r[  rÊ  r^  r]  r_  ra  )rŠ   rs  r#   r#   r$   rs    s    

özSSHCertificateBuilder.typert  r   c                 C  sR   t |tƒs	tdƒ‚| jd urtdƒ‚t| j| j| j|| j	| j
| j| j| j| jd�
S )Nzkey_id must be byteszkey_id already setrÌ  )r@   r   rf   rZ  rN   rÇ  rV  rX  ri  r[  rÊ  r^  r]  r_  ra  )rŠ   rt  r#   r#   r$   rt  )  s    

özSSHCertificateBuilder.key_idru  c                 C  s|   | j rtdƒ‚tdd„ |D ƒƒr|stdƒ‚| jrtdƒ‚t|ƒtkr'tdƒ‚t| j| j	| j
| j|| j | j| j| j| jd�
S )NzDPrincipals can't be set because the cert is valid for all principalsc                 s  s   � | ]}t |tƒV  qd S rˆ   )r@   r   )Ú.0rØ   r#   r#   r$   Ú	<genexpr>E  s   € z9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>z5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsrÌ  )rÊ  rN   Úallrf   r[  r_   Ú_SSHKEY_CERT_MAX_PRINCIPALSrÇ  rV  rX  ri  rZ  r^  r]  r_  ra  )rŠ   ru  r#   r#   r$   ru  <  s:   ÿÿþÿÿöz&SSHCertificateBuilder.valid_principalsc                 C  sJ   | j rtdƒ‚| jrtdƒ‚t| j| j| j| j| j d| j| j	| j
| jd�
S )Nz@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTrÌ  )r[  rN   rÊ  rÇ  rV  rX  ri  rZ  r^  r]  r_  ra  rŸ   r#   r#   r$   Úvalid_for_all_principals`  s$   ÿöz.SSHCertificateBuilder.valid_for_all_principalsrv  úint | floatc                 C  sv   t |ttfƒstdƒ‚t|ƒ}|dk s|dkrtdƒ‚| jd ur$tdƒ‚t| j| j| j	| j
| j| j|| j| j| jd�
S )Nz$valid_before must be an int or floatr   rÍ  zvalid_before must [0, 2**64)zvalid_before already setrÌ  )r@   r   Úfloatrf   rN   r^  rÇ  rV  rX  ri  rZ  r[  rÊ  r]  r_  ra  )rŠ   rv  r#   r#   r$   rv  v  s&   
öz"SSHCertificateBuilder.valid_beforerw  c                 C  sv   t |ttfƒstdƒ‚t|ƒ}|dk s|dkrtdƒ‚| jd ur$tdƒ‚t| j| j| j	| j
| j| j| j|| j| jd�
S )Nz#valid_after must be an int or floatr   rÍ  zvalid_after must [0, 2**64)zvalid_after already setrÌ  )r@   r   rÔ  rf   rN   r]  rÇ  rV  rX  ri  rZ  r[  rÊ  r^  r_  ra  )rŠ   rw  r#   r#   r$   rw  Œ  s&   
öz!SSHCertificateBuilder.valid_afterrS   r¸  c                 C  st   t |tƒr
t |tƒstdƒ‚|dd„ | jD ƒv rtdƒ‚t| j| j| j| j	| j
| j| j| jg | j¢||f‘| jd�
S )Núname and value must be bytesc                 S  ó   g | ]\}}|‘qS r#   r#   ©rÎ  rS   rå   r#   r#   r$   Ú
<listcomp>¨  ó    z=SSHCertificateBuilder.add_critical_option.<locals>.<listcomp>zDuplicate critical option namerÌ  )r@   r   rf   r_  rN   rÇ  rV  rX  ri  rZ  r[  rÊ  r^  r]  ra  ©rŠ   rS   r¸  r#   r#   r$   Úadd_critical_option¢  s    öz)SSHCertificateBuilder.add_critical_optionc                 C  st   t |tƒr
t |tƒstdƒ‚|dd„ | jD ƒv rtdƒ‚t| j| j| j| j	| j
| j| j| j| jg | j¢||f‘d�
S )NrÕ  c                 S  rÖ  r#   r#   r×  r#   r#   r$   rØ  ¾  rÙ  z7SSHCertificateBuilder.add_extension.<locals>.<listcomp>zDuplicate extension namerÌ  )r@   r   rf   ra  rN   rÇ  rV  rX  ri  rZ  r[  rÊ  r^  r]  r_  rÚ  r#   r#   r$   Úadd_extension¸  s    öz#SSHCertificateBuilder.add_extensionr»   ÚSSHCertPrivateKeyTypesrT  c              	   C  sè  t |tjtjtjfƒstdƒ‚| jd u rt	dƒ‚| j
d u rdn| j
}| jd u r+t	dƒ‚| jd u r2dn| j}| js?| js?t	dƒ‚| jd u rHt	dƒ‚| jd u rQt	dƒ‚| j| jkr[t	d	ƒ‚| jjd
d„ d� | jjdd„ d� t| jƒ}|t }t d¡}t|ƒ}tƒ }| |¡ | |¡ | | j|¡ | |¡ | | jj¡ | |¡ tƒ }	| jD ]}
|	 |
¡ qª| |	 ¡ ¡ | | j¡ | | j¡ tƒ }| jD ]$\}}| |¡ t |ƒdkrêtƒ }| |¡ | | ¡ ¡ qË| |¡ qË| | ¡ ¡ tƒ }| jD ]%\}}| |¡ t |ƒdk�rtƒ }| |¡ | | ¡ ¡ qý| |¡ qý| | ¡ ¡ | d¡ t|ƒ}t|ƒ}tƒ }| |¡ | | !¡ |¡ | | ¡ ¡ t |tjƒ�rq| "| ¡ ¡}tƒ }| |¡ | |¡ | | ¡ ¡ nlt |tjƒ�r³t#|j$ƒ}| "| ¡ t %|¡¡}t& '|¡\}}tƒ }| |¡ tƒ }| (|¡ | (|¡ | | ¡ ¡ | | ¡ ¡ n*t |tjƒ�s¼J ‚tƒ }| t)¡ | "| ¡ t* +¡ t, -¡ ¡}| |¡ | | ¡ ¡ t. /| ¡ ¡ 0¡ }t1 2t3t4d 5|d|g¡ƒ¡S )NzUnsupported private key typezpublic_key must be setr   ztype must be setrZ   zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                 S  ó   | d S ©Nr   r#   ©rØ   r#   r#   r$   Ú<lambda>ù  ó    z,SSHCertificateBuilder.sign.<locals>.<lambda>)r=   c                 S  rÞ  rß  r#   rà  r#   r#   r$   rá  ú  râ  r7   r}  )6r@   r
   rA   r   rE   r   rK   rf   rV  rN   rX  ri  rZ  r[  rÊ  r^  r]  r_  Úsortra  rP   r›  rC  rD  r  r„   r›   rÈ   r—   r•   r¸  r¦   r_   rC   Úsignrƒ  rR   r„  r�  Údecode_dss_signaturerœ   rˆ  r   rŠ  r   r‰  r  r  rÃ  rn  ro  rT  r³  r[   )rŠ   r»   rq  rt  rO   Úcert_prefixrk  r4  ÚfÚfprincipalsr¿   ÚfcritrS   r¸  ÚfoptvalÚfextÚfextvalÚca_typeÚcaformatÚcafr±  ÚfsigrŽ  r‹  rŒ  ÚfsigblobÚ	cert_datar#   r#   r$   rä  Î  sÄ   ýþ

ÿ





















ÿ
þzSSHCertificateBuilder.sign)rV  rÈ  rX  r0   ri  rÉ  rZ  rd   r[  r\  rÊ  r    r^  r0   r]  r0   r_  rË  ra  rË  )rC   rm  r!   rÇ  )rq  r   r!   rÇ  )rs  rQ  r!   rÇ  )rt  r   r!   rÇ  )ru  r\  r!   rÇ  )rv  rÓ  r!   rÇ  )rw  rÓ  r!   rÇ  )rS   r   r¸  r   r!   rÇ  )r»   rÝ  r!   rT  )r3   r4   r5   r‹   rC   rq  rs  rt  ru  rÒ  rv  rw  rÛ  rÜ  rä  r#   r#   r#   r$   rÇ  Ì  s.    õ




$



rÇ  )F)r   r   r   r   r   r   r   r   r   r    r!   r   )r=   r>   r!   r   )rC   rQ   r!   r   )rV   rW   rX   r   rY   r   r!   r   )rV   rW   r.   r   r!   r^   )rV   rW   r!   r^   )
rc   r   r   rd   r   r   r   r   r!   re   )rV   rj   r!   rk   )rV   rj   r!   rz   )r~   r   r!   r   )r!   rz   )rO   rW   rˆ   )
rV   rW   r   rd   r  r  rµ   r    r!   r  )r»   r  r   r   r>  r   r!   r   )rR   rÞ   r!   r‘  )rV   rW   r!   r–  )r´  rj   r!   r`  )r=   rW  rº  r»  r!   r   )rV   rW   r  r  r!   rW  )rC   rW  r!   r   )€Ú
__future__r   r  ÚenumrC  Úrern  r)  Úbase64r   r\   Údataclassesr   Úcryptographyr   Úcryptography.exceptionsr   Úcryptography.hazmat.primitivesr   Ú)cryptography.hazmat.primitives.asymmetricr	   r
   r   r   r   r�  Ú&cryptography.hazmat.primitives.ciphersr   r   r   r   Ú,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   Úbcryptr   r%   Ú_bcrypt_supportedÚImportErrorrM   rG   rJ   r  Ú_ECDSA_NISTP384Ú_ECDSA_NISTP521r›  Ú_SK_SSH_ED25519Ú_SK_SSH_ECDSA_NISTP256r†  rˆ  Úcompiler—  r!  Ú	_SK_STARTÚ_SK_ENDr#  r"  r@  rA  ÚDOTALLr  rj   r™   Úranger(  r*   ÚAESÚCTRÚCBCÚGCMr9   r6   rT   rP   rB   r]   r`   rb   ri   ru   ry   r|   r   rƒ   r„   r¬   rÍ   rÜ   rð   r  r  r  r’  r“  r•  r  r  ÚUnionrA   rE   rH   rK   r  r=  rP  rD   rF   rI   rL   rW  rm  ÚEnumrQ  rT  rƒ  r²  r³  r�  rÀ  rÂ  rÅ  rÝ  rÑ  rÇ  r#   r#   r#   r$   Ú<module>   s6   	ûý
ù	ù	ùí ý

ý








6JFI
Cø
	ýÿýû
rMýÿþÿ 
þ
_

ÿ
þÿ	