
     h<                        d dl Z d dlZd dlmZ d dlmZ d dlmZmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZmZ d dlmZmZmZmZmZ d dlmZm Z m!Z!m"Z"m#Z#m$Z$ d dl%m&Z&m'Z'm(Z(m)Z) ddl*m+Z+m,Z,m-Z- ddl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6 ddl7m8Z8 ddl9m:Z:m;Z;m<Z< ddl=m>Z> g dZ? e j@        eA          ZBdeejC                 fdZDdee          fdZEdejC        deFfdZG G d d          ZH edddg          ZI	 dedeeI         fd ZJd!eHfd"ZKd#eHd$ed%eLfd&ZMd' ZN	 	 	 	 	 	 	 d3d#eHd)ee         d*ee         d+ee         d,ee         d-ee8         d.eLd/ee>         de;fd0ZO	 	 	 d4d#eHd1ee         d,ee         d.eLde:f
d2ZPdS )5    N)
namedtuple)datetime)ListOptionalUnion)cmsx509)ValidationContext)ValidationPath)genericmisc)pdf_name)PdfFileReaderprocess_data_at_eof)DEFAULT_DIFF_POLICY
DiffPolicy
DiffResultModificationLevelSuspiciousModification)FieldMDPSpecMDPPermSeedLockDocumentSigSeedSubFilterSigSeedValFlagsSigSeedValueSpec)SignedDataCertsUnacceptableSignerErrorbyte_range_digestextract_signer_info   )SignatureValidationErrorSigSeedValueValidationErrorValidationInfoReadingError)cms_basic_validationcollect_signer_attr_statuscollect_timing_infocompute_signature_tst_digestextract_certs_for_validationextract_self_reported_tsextract_tst_datavalidate_tst_signed_data)KeyUsageConstraints)DocumentTimestampStatusPdfSignatureStatusSignatureCoverageLevel)CMSAlgorithmUsagePolicy)EmbeddedPdfSignature
DocMDPInforead_certification_dataasync_validate_pdf_signatureasync_validate_pdf_timestampreport_seed_value_validationextract_contentsreturnc                     	 | d         }n# t           $ r Y d S w xY w|D ]&}|                                }|d         |k    r|c S 'd S )Nz
/Referencez/TransformMethod)KeyError
get_object)signature_objmethodsig_refsrefs       `/var/www/html/Sam_Eipo/venv/lib/python3.11/site-packages/pyhanko/sign/validation/pdf_embedded.py_extract_reference_dictrA   I   sw     .   tt  nn!"f,,JJJ -4s    
c                     t          | d          }|d S 	 |d                             d          }t          |          S # t          t          f$ r}t          d          |d }~ww xY w)N/DocMDP/TransformParams/Pz#Failed to read document permissions)rA   raw_getr   
ValueErrorr:   r!   )r<   r?   	raw_permses       r@   _extract_docmdp_for_sigrJ   W   s    
!-
;
;C
{t*+33D99	y!!!!   &1
 
	s   )A   A&A!!A&
sig_objectc                    	 |                      dt          j        j                  }n"# t          $ r t          j        d          w xY wt          |t          j        t          j	        f          st          j        d          |j
        S )z
    Internal function to extract the (DER-encoded) signature bytes from a PDF
    signature dictionary.

    :param sig_object:
        A signature dictionary.
    :return:
        The extracted contents as a byte string.
    z	/Contents)decryptz+Could not read /Contents entry in signaturez/Contents must be string-like)rF   r   EncryptedObjAccessRAWr:   r   PdfReadError
isinstanceTextStringObjectByteStringObjectoriginal_bytes)rK   cms_contents     r@   r7   r7   d   s    O ((!;!? ) 
 
  O O O MNNNO g.0HI  A  ?@@@%%s	   &) Ac                      e Zd ZU dZej        ed<   	 ej        ed<   	 ej        ed<   	 de	dej        de
fdZdefd	Zedeej                 fd
            Zedeej                 fd            Zedej        fd            Zedej        fd            Zed             Zedee         fd            Zedeej                 fd            ZddZdefdZedee          fd            Z!edee"         fd            Z#edee$         fd            Z%de&fdZ'dee&         fdZ(de)fdZ*d Z+de,de-e.e/f         fdZ0dS )r1   zA
    Class modelling a signature embedded in a PDF document.
    	sig_fieldrK   signed_datareaderfq_namec                 P   || _         t          |t          j                  r|                                }|| _        |                    d          }|                                x| _        }t          |t          j                  sJ 	 |                    d          | _	        n"# t          $ r t          j        d          w xY wt          |          x| _        }t          j                            |          }|d         }|| _        t'          |          | _        d | _        | j        d         }	|	d         j                                        | _        |d         }
|
d         j        }|d	k    r| j        | _        n1|d
k    r+|
d         j        d         }|d         d         j        | _        | j         j                            |j                  | _        d | _        d | _         d | _!        d | _"        d | _#        dx| _$        | _%        d | _&        d | _'        d| _(        || _)        d S )Nz/Vz
/ByteRangez,Could not read /ByteRange entry in signaturecontentdigest_algorithm	algorithmencap_content_infocontent_typedatatst_infomessage_imprinthash_algorithmF)*rY   rQ   r   IndirectObjectr;   rW   rF   rK   DictionaryObject
byte_ranger:   r   rP   r7   pkcs7_contentr   ContentInfoloadrX   r   signer_info_sd_cert_infonativelowermd_algorithmexternal_md_algorithmparsedxrefsget_last_change	referencesigned_revisioncoverageexternal_digest	total_len_docmdp	_fieldmdp_docmdp_queried_fieldmdp_queriedtst_signature_digestdiff_result_integrity_checkedrZ   )selfrY   rW   rZ   sig_object_refrK   rU   messagerX   digest_algoecir`   mis                r@   __init__zEmbeddedPdfSignature.__init__   s7    i!788 	/!,,..I""**400'5'@'@'B'BB**g&>?????	(00>>DOO 	 	 	#>  	 ,<J+G+GG[/&&{33i(+6.{;;8< &'9:'4;AACC./>*16!!)-):D&&Z'' Y&'89B)+,<)=* &  ${0@@$ 
  
 04(,*.158==t559!"'s   
B% %Cr8   c                 P    | j         t          | j                  | _         | j         S )N)rl   r(   rX   r   s    r@   _init_cert_infoz$EmbeddedPdfSignature._init_cert_info   s'    %!=d>N!O!OD!!    c                 N    t          |                                 j                  S )z2
        Embedded attribute certificates.
        )listr   attribute_certsr   s    r@   embedded_attr_certsz(EmbeddedPdfSignature.embedded_attr_certs   s!    
 D((**:;;;r   c                 N    t          |                                 j                  S )zQ
        Embedded X.509 certificates, excluding than that of the signer.
        )r   r   other_certsr   s    r@   other_embedded_certsz)EmbeddedPdfSignature.other_embedded_certs   s!    
 D((**6777r   c                 4    |                                  j        S )z,
        Certificate of the signer.
        )r   signer_certr   s    r@   r   z EmbeddedPdfSignature.signer_cert   s    
 ##%%11r   c                 R    | j                             dt          d                    S )a  
        Returns the type of the embedded signature object.
        For ordinary signatures, this will be ``/Sig``.
        In the case of a document timestamp, ``/DocTimeStamp`` is returned.

        :return:
            A PDF name object describing the type of signature.
        z/Type/Sig)rK   getr   r   s    r@   sig_object_typez$EmbeddedPdfSignature.sig_object_type   s$     ""7HV,<,<===r   c                     | j         S )zC
        :return:
            Name of the signature field.
        )rZ   r   s    r@   
field_namezEmbeddedPdfSignature.field_name  s     |r   c                     t          | j                  }||S 	 | j        d         }t          j        |          S # t
          $ r Y dS w xY w)z
        :return:
            The signing time as reported by the signer, if embedded in the
            signature's signed attributes.
        Nz/M)r)   rk   rK   r   parse_pdf_dater:   )r   tsst_as_pdf_dates      r@   self_reported_timestampz,EmbeddedPdfSignature.self_reported_timestamp  sb     &d&677>I	!_T2N).999 	 	 	44	s    ; 
A	A	c                 *    t          | j                  S )z
        :return:
            The signed data component of the timestamp token embedded in this
            signature, if present.
        )r*   rk   r   s    r@   attached_timestamp_dataz,EmbeddedPdfSignature.attached_timestamp_data  s       0111r   NFc                    |                                   |                                  |                                  |                                 | _        |pt
          }|s|                     |          | _        d| _        dS )a  
        Compute the various integrity indicators of this signature.

        :param diff_policy:
            Policy to evaluate potential incremental updates that were appended
            to the signed revision of the document.
            Defaults to
            :const:`~pyhanko.sign.diff_analysis.DEFAULT_DIFF_POLICY`.
        :param skip_diff:
            If ``True``, skip the difference analysis step entirely.
        TN)	_enforce_hybrid_xref_policycompute_digestcompute_tst_digestevaluate_signature_coveragerv   r   evaluate_modificationsr~   r   )r   diff_policy	skip_diffs      r@   compute_integrity_infoz+EmbeddedPdfSignature.compute_integrity_info(  s     	((***!!! 88::!8%8 	H#::;GGD"&r   c                 L   | j         st          d          | j        }| j        }| j        }d}|Nt          |t                    r|j        nt          j	        }|t          j	        k    p|duo|j
        |j
        k     }n |t          j        k    r|t          j        k    }|||d}|S )a  
        Compile the integrity information for this signature into a dictionary
        that can later be passed to :class:`.PdfSignatureStatus` as kwargs.

        This method is only available after calling
        :meth:`.EmbeddedPdfSignature.compute_integrity_info`.
        zGCall compute_integrity_info() before invokingsummarise_integrity_info()N)rv   	docmdp_okr~   )r   r!   docmdp_levelr~   rv   rQ   r   modification_levelr   OTHERvaluer/   ENTIRE_REVISIONENTIRE_FILE)r   docmdpr~   rv   r   	mod_levelstatus_kwargss          r@   summarise_integrity_infoz-EmbeddedPdfSignature.summarise_integrity_infoA  s     & 	*-  
 "&=	 " k:66-..&,  .44 K$&I9?V\+III /???
 !$:$FFI !"&
 

 r   c                 j    	 | j         d         }n# t          $ r Y d S w xY wt          j        |          S )Nz/SV)rW   r:   r   from_pdf_object)r   sig_sv_dicts     r@   seed_value_specz$EmbeddedPdfSignature.seed_value_specn  sH    	./KK 	 	 	44	/<<<s    
c                     | j         r| j        S t          | j                  }|4	 | j        d         }t          |d                   }n# t          $ r Y nw xY w|| _        d| _         |S )av  
        :return:
            The document modification policy required by this signature or
            its Lock dictionary.

            .. warning::
                This does not take into account the DocMDP requirements of
                earlier signatures (if present).

                The specification forbids signing with a more lenient DocMDP
                than the one currently in force, so this should not happen
                in a compliant document.
                That being said, any potential violations will still invalidate
                the earlier signature with the stricter DocMDP policy.

        )r<   Nz/LockrE   T)r{   ry   rJ   rK   rW   r   r:   )r   r   	lock_dicts      r@   r   z!EmbeddedPdfSignature.docmdp_levelv  s    $  	 <(tGGG> N73	 411   #s   "A
 

AAc                     | j         r| j        S t          | j        d          }d| _         |dS 	 t	          j        |d                   }n)# t          t          f$ r}t          d          |d}~ww xY w|| _        |S )z
        :return:
            Read the field locking policy of this signature, if applicable.
            See also :class:`~.pyhanko.sign.fields.FieldMDPSpec`.
        z	/FieldMDPTNrD   z!Failed to read /FieldMDP settings)	r|   rz   rA   rK   r   r   rG   r:   r!   )r   ref_dictsprI   s       r@   fieldmdpzEmbeddedPdfSignature.fieldmdp  s     ! 	">!*4?KHH!%4	-h7I.JKKBBH% 	 	 	*3 	 	s   A A1A,,A1c                     | j         | j         S t          | j        j        | j        | j                  \  | _        }|| _         |S )z
        Compute the ``/ByteRange`` digest of this signature.
        The result will be cached.

        :return:
            The digest value.
        N)rg   ro   )rw   r   rY   streamrg   rp   rx   r   digests     r@   r   z#EmbeddedPdfSignature.compute_digest  sS     +''!2K3"
 "
 "

  &r   c                 X    | j         | j         S t          | j                  x| _         }|S )a  
        Compute the digest of the signature needed to validate its timestamp
        token (if present).

        .. warning::
            This computation is only relevant for timestamp tokens embedded
            inside a regular signature.
            If the signature in question is a document timestamp (where the
            entire signature object is a timestamp token), this method
            does not apply.

        :return:
            The digest value, or ``None`` if there is no timestamp token.
        )r}   r'   rk   r   s     r@   r   z'EmbeddedPdfSignature.compute_tst_digest  s<      $0,,-I.
 .
 	
!F r   c                 :   | j         j        }| j         j        }t          | j                  dk    s| j        d         dk    rt
          j        S | j        \  }}}}|                    dt          j	                   t          | j
                  dz  dz   }||z   |z   }|                                |k    }	|	rt
          j        S |||z   k    }
|
st
          j        S |                    |           | j        }	 t          |          }|                    |          }||k    rt
          j        S n!# t"          j        $ r t
          j        cY S w xY wt'          |dz             D ]0}|                    |          }|j        |k    rt
          j        c S 1t
          j        S )z
        Internal method used to evaluate the coverage level of a signature.

        :return:
            The coverage level of the signature.
           r      r    )rY   rr   r   lenrg   r/   UNCLEARseekosSEEK_ENDrh   tellr   ru   r   get_startxref_for_revisionCONTIGUOUS_BLOCK_FROM_STARTr   rP   rangeget_xref_container_infoend_locationr   )r   
xref_cacher   _len1start2len2embedded_sig_contentsigned_zone_lenfile_covered
contiguous
signed_rev	startxrefexpectedrevision	xref_metas                   r@   r   z0EmbeddedPdfSignature.evaluate_signature_coverage  s    [&
 # t1$$(:a(?(?)11 $4 	Ar{###  #4#566:Q>+(<<{{}}7 	6)55 t&:::
 	2)11 	O$$$)
	F+F33I!<<ZHHHH$$-II %  	F 	F 	F)EEEE	F
 j1n-- 	J 	JH"::8DDI%77-IIII 8 &55s   65D- -E
Ec                 \    | j         }|j        r|j        j        rt	          d          d S d S )NzJSettings do not permit validation of signatures in hybrid-reference files.)rY   strictrr   hybrid_xrefs_presentr!   )r   rY   s     r@   r   z0EmbeddedPdfSignature._enforce_hybrid_xref_policy  sJ    = 	V\> 	**  	 	 	 	r   r   c                    | j         t          j        k     rt          d          S | j         t          j        k    r&t          t          j        t                                S |	                    | j
        | j        | j        | j                  S )zY
        Internal method used to evaluate the modification level of a signature.
        z$Nonstandard signature coverage level)field_mdp_specdoc_mdp)rv   r/   r   r   r   r   r   NONEsetreview_filerY   ru   r   r   )r   r   s     r@   r   z+EmbeddedPdfSignature.evaluate_modifications'  s     =1AAA)6   ]4@@@/4cee<<<&&K =%	 ' 
 
 	
r   )NF)1__name__
__module____qualname____doc__r   rf   __annotations__r   
SignedDatar   strr   r   r   propertyr   AttributeCertificateV2r   r	   Certificater   r   
NameObjectr   r   r   r   r   r   r   dictr   r   r   r   r   r   r   bytesr   r   r/   r   r   r   r   r   r   r    r   r@   r1   r1      s-          '''' (((( JJ +J 	J J J JX" " " " "
 <T#*D%E < < < X< 8d4+;&< 8 8 8 X8 2T- 2 2 2 X2 	>!3 	> 	> 	> X	>   X ();    X  2#.)A 2 2 2 X2' ' ' '2+$ + + + +Z =*:!; = = = X= hw/    X> (<0    X,    &HUO    .F6-C F6 F6 F6 F6P  
%
	z11	2
 
 
 
 
 
r   r1   r2   
permission
author_sigrY   c                     	 | j         d         d         }n# t          $ r Y dS w xY wt          |          }t          ||          S )z
    Read the certification information for a PDF document, if present.

    :param reader:
        Reader representing the input document.
    :return:
        A :class:`.DocMDPInfo` object containing the relevant data, or ``None``.
    /PermsrC   N)rootr:   rJ   r2   )rY   certification_sigperms      r@   r3   r3   D  s_    "K1)<   tt ##455Dd-...s    
$$emb_sigc                    | j         }|d S | j        }|j        ?	 |j                            ||           n"# t          $ r}t          |          |d }~ww xY w|s|j        rt          d          | j        }|j        |j        	                                }	 | j
        j        d         }|                    d          }	|	|j        k    }
n$# t          t          j        t"          f$ r d}
Y nw xY w||
k    r+d }t          d ||           d ||
           d          |r/|j        j        }| j        }||k    rt          d	| d
| d          |j        }|sd S |d         }t+          |          }|t,          j        z  rR|j        K|j        st3          d          |j        d         }|&||k    r t          d|j        d
|j        d          |t,          j        z  r!|j        t:                              d           |t,          j        z  r|j         t3          d          |t,          j!        z  rv|j"        o| j        }|j"        tF          j$        k    r|tJ          j&        k    rt          d          |j"        tF          j'        k    r|tJ          j&        k    rt          d          | j(        }|t,          j)        z  r|j*        ddl+m,} 	  ||           d}n# tZ          $ r d}Y nw xY w|j*        |k    r#t          d|j*        rdndd|rdndd          |j*        r1|t*          j.        k    r!t          dt*          j.        j        z            |t,          j/        z  r;|j0        4| j1        2                                }||j0        vrt          d|z            |t,          j3        z  rT|j4        pg }| p|dgk    }|5                    d          }|r|t          d          |s||vrt          d |d!          d S d S d S )"NznThe seed value dictionary requires a trusted timestamp, but none was found, or the timestamp did not validate.r   rC   Fc                     | rdndS )Nza certificationzan approvalr   )certifys    r@   _typez'_validate_sv_constraints.<locals>._typeu  s    ,3F((Fr   zPThe seed value dictionary's /MDP entry specifies that this field should contain z signature, but z appears to have been used.zaThe seed value dictionary specified that this certification signature should use the MDP policy 'z', but 'z' was used in the signature.
/SubFilterzPThe signature encodings mandated by the seed value dictionary are not supported.r   z.The seed value dictionary mandates subfilter 'zThe signature's seed value dictionary specifies the /AppearanceFilter entry as mandatory, but this constraint is impossible to validate.zpyHanko does not support legal attestations, but the seed value dictionary mandates that they be restricted to a specific subset.z<Document must be locked, but some changes are still allowed.zGDocument must not be locked, but the DocMDP level is set to NO_CHANGES.)retrieve_adobe_revocation_infoTz2The seed value dict mandates that revocation info  znot zbe added, but it was zfound in the signature.zdThe seed value dict mandates that Adobe-style revocation info be added; this requires subfilter '%s'zKThe selected message digest %s is not allowed by the seed value dictionary..z/Reasonz@The seed value dictionary prohibits giving a reason for signing.zThe reason for signing "z/" is not accepted by the seed value dictionary.)6r   r   certsatisfied_byr   r"   timestamp_requiredrK   seed_signature_typecertification_signaturerY   r   get_value_as_referencecontainer_refr:   r   IndirectObjectExpectedAttributeErrormdp_permr   flagsr   r   	SUBFILTER
subfiltersNotImplementedErrorr   APPEARANCE_FILTER
appearanceloggerwarningLEGAL_ATTESTATIONlegal_attestationsLOCK_DOCUMENTlock_documentr   LOCKr   
NO_CHANGESDO_NOT_LOCKrk   ADD_REV_INFOadd_rev_infopyhanko.sign.validation.ltvr  r#   ADOBE_PKCS7_DETACHEDDIGEST_METHODdigest_methodsro   rn   REASONSreasonsr   )r   validation_pathtimestamp_foundsv_specsigning_certrI   sig_obj
sv_certifypermscert_sig_refwas_certifiedr  sv_mdp_permr   r  selected_sf_strselected_sfmandated_sfrk   r  revinfo_foundselected_mdr(  	must_omitreason_givens                            r@   _validate_sv_constraintsr:  V  s    %G&L|	8L%%lODDDD& 	8 	8 	8-a00a7	8  
w9 
)A
 
 	

  G".0HHJJ
	".5n.A(.KE 77	BBL(G,AAMM'8.I 	" 	" 	"!MMM	"&&G G G .--2U:->->- -"'%"6"6- - -    		!5>K*Gg%%1-#- --4- - -   ME l+O"?33K)) w/A/M! 	%0  
 )0(:1(="{k'A'A-- $$$k&7&7&79   	11



()	
 	
 	
 	11


$
0!P
 
 	
 	--


+&!%5%:::7----N   !%5%AAA7----   %K,,


*NNNNNN	"**;777 MM) 	" 	" 	"!MMM	" =00-- ".:BBF::'3BBV33	    	/DDD->#8>@   	--

 
,*0022g444-)+67  
 &&  /'RK37se#3	{{9-- 	1-    	\88--,8LL;   	 	88s9   7 
AAA2C C-,C-K! !K0/K0embedded_sigr)  r*  c                     	 t          | ||           d}n5# t          $ r(}t                              d|           |}Y d}~nd}~ww xY w| j        du|dS )a  
    Internal API function to enforce seed value constraints (if present)
    and report on the result(s).

    :param embedded_sig:
        The embedded signature.
    :param validation_path:
        The validation path for the signer's certificate.
    :param timestamp_found:
        Flag indicating whether a valid timestamp was found or not.
    :return:
        A ``status_kwargs`` dict.
    )r*  NzError in seed value validation.)exc_info)has_seed_valuesseed_value_constraint_error)r:  r"   r  r  r   )r;  r)  r*  sv_errrI   s        r@   r6   r6      s    & /?	
 	
 	
 	
 &   81EEE (7tC'-  s    
A	AA	c                 |    	 ddl m}  ||           |v }n# t          $ r d}Y nw xY w|st          || z            d S )Nr   )r   F)pyhanko.sign.fieldsr   rG   r!   )subfilter_strpermitted_subfilterserr_msgr   subfilter_oks        r@   _validate_subfilterrG  !  s    888888''66:NN     @&w'>???@ @s    %%Fsigner_validation_contextts_validation_contextac_validation_contextr   key_usage_settingsr   algorithm_policyc           	        K   | j         }| j        dk    rt          d          |                    dd          }	t	          |	t
          j        t
          j        fd           ||}|                     ||           | 	                                }
t          | j        ||                                            d{V }|
                    |           d|
vr| j        }|||
d<   t          j        |          }t#          | j        | j        ||
||	           d{V }
|
                    d
d          }|duo|j        o|j        }t-          | |
d         |          }|
                    |           ||j                            | j                   |
                    t5          | j        | j        || j        d                    d{V            t          di |
S )a  
    .. versionadded:: 0.9.0

    .. versionchanged: 0.11.0
        Added ``ac_validation_context`` param.


    Validate a PDF signature.

    :param embedded_sig:
        Embedded signature to evaluate.
    :param signer_validation_context:
        Validation context to use to validate the signature's chain of trust.
    :param ts_validation_context:
        Validation context to use to validate the timestamp's chain of trust
        (defaults to ``signer_validation_context``).
    :param ac_validation_context:
        Validation context to use to validate attribute certificates.
        If not supplied, no AC validation will be performed.

        .. note::
            :rfc:`5755` requires attribute authority trust roots to be specified
            explicitly; hence why there's no default.
    :param diff_policy:
        Policy to evaluate potential incremental updates that were appended
        to the signed revision of the document.
        Defaults to
        :const:`~pyhanko.sign.diff_analysis.DEFAULT_DIFF_POLICY`.
    :param key_usage_settings:
        A :class:`.KeyUsageConstraints` object specifying which key usages
        must or must not be present in the signer's certificate.
    :param skip_diff:
        If ``True``, skip the difference analysis step entirely.
    :param algorithm_policy:
        The algorithm usage policy for the signature validation.

        .. warning::
            This is distinct from the algorithm usage policy used for
            certificate validation, but the latter will be used as a fallback
            if this parameter is not specified.

            It is nonetheless recommended to align both policies unless
            there is a clear reason to do otherwise.
    :return:
        The status of the PDF signature in question.
    r   z"Signature object type must be /Sigr  Nz4%s is not a recognized SubFilter type in signatures.r   r   )
raw_digestsigner_reported_dt)rO  validation_contextr   rK  rL  timestamp_validityr)  signed_attrs)sd_attr_certificatesr   rQ  sd_signed_attrsr   )rK   r   r!   r   rG  r   r$  PADESr   r   r&   rk   r   updater   r.   default_usage_constraintsr$   rX   rw   validtrustedr6   certificate_registryregister_multipler   r%   r   r   )r;  rH  rI  rJ  r   rK  r   rL  rK   rC  r   ts_status_kwargsrP  tst_validityr*  	sv_updates                   r@   r4   r4   -  s     r (J#v--&'KLLL NN<66M		.0@0FG>   $ 9''9 (    !99;;M0 ..00        
 )***=00)A)2DM./+E  / /4#-)        M !$$%94@@LD P\%7PL<P  -m$56 I ###(2DD-	
 	
 	
 (!-!A$04(4^D	
 
 
 	
 	
 	
 	
 	
 	
   .....r   rQ  c                 r  K   | j         dk    rt          d          | j                            dd          }t	          |t
          j        fd           |                     ||           t          | j	        || 
                                           d{V }| j        |d<   | j        |d<   t          d	i |S )
a{  
    .. versionadded:: 0.9.0

    Validate a PDF document timestamp.

    :param embedded_sig:
        Embedded signature to evaluate.
    :param validation_context:
        Validation context to use to validate the timestamp's chain of trust.
    :param diff_policy:
        Policy to evaluate potential incremental updates that were appended
        to the signed revision of the document.
        Defaults to
        :const:`~pyhanko.sign.diff_analysis.DEFAULT_DIFF_POLICY`.
    :param skip_diff:
        If ``True``, skip the difference analysis step entirely.
    :return:
        The status of the PDF timestamp in question.
    z/DocTimeStampz+Signature object type must be /DocTimeStampr  Nz5%s is not a recognized SubFilter type for timestamps.rN  rv   r~   r   )r   r!   rK   r   rG  r   ETSI_RFC3161r   r+   rX   r   rv   r~   r-   )r;  rQ  r   r   rC  r   s         r@   r5   r5     s     4 #66&9
 
 	

 !+//dCCM		&(?   ''9 (    3 ##%%       M !- 5M*#/#;M- "33]333r   )NNNNNFN)NNF)Qloggingr   collectionsr   r   typingr   r   r   
asn1cryptor   r	   pyhanko_certvalidatorr
   pyhanko_certvalidator.pathr   pyhanko.pdf_utilsr   r   pyhanko.pdf_utils.genericr   pyhanko.pdf_utils.readerr   r   pyhanko.sign.diff_analysisr   r   r   r   r   rB  r   r   r   r   r   r   pyhanko.sign.generalr   r   r   r   errorsr!   r"   r#   generic_cmsr$   r%   r&   r'   r(   r)   r*   r+   settingsr,   statusr-   r.   r/   utilsr0   __all__	getLoggerr   r  rf   rA   rJ   r   r7   r1   r2   r3   r:  boolr6   rG  r4   r5   r   r   r@   <module>ru     s    				 " " " " " "       ( ( ( ( ( ( ( ( ( (                 3 3 3 3 3 3 5 5 5 5 5 5 + + + + + + + + . . . . . . G G G G G G G G                                                
	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 * ) ) ) ) )         
 + * * * * *   
	8	$	$g&'   
hw.? 
 
 
 
&!9 &e & & & &8z
 z
 z
 z
 z
 z
 z
 z
z Z|\&BCC
/M /hz6J / / / /$g!g g g gT&#    B	@ 	@ 	@ >B9=9=(,8<:>x/ x/&x/'(9:x/ $$56x/ $$56	x/
 *%x/ !!45x/ x/ 67x/ x/ x/ x/ x/z 7;(,	34 34&34 !2334 *%34 	34
 34 34 34 34 34 34r   