+ Ii׆cs$^RIt^RIt^RIt^RIt^RIt^RIt^RIHtHt^RI H t H t ^RI H t HtHtHt^RIHt^RIHtHtHt!RR4t!R R 4tR tR tRR ltRRltRRltRRlt!RR4tRt RRlt!Rt"RRlt#Rt$R#)iN)create_request_objectprepare_request_dict) OrderedDictget_current_datetime)ParamValidationErrorUnknownClientMethodErrorUnknownSignatureVersionError UnsupportedSignatureVersionError)FrozenAuthToken) ArnParserdatetime2timestamp fix_s3_hostcsa]tRt^$toRtRRlt]R4t]R4t]R4t RRlt RRlt R t R t RR lt]tRR ltR tVtR#) RequestSignera An object to sign requests before they go out over the wire using one of the authentication mechanisms defined in ``auth.py``. This class fires two events scoped to a service and operation name: * choose-signer: Allows overriding the auth signer name. * before-sign: Allows mutating the request before signing. Together these events allow for customization of the request signing pipeline, including overrides, request path manipulation, and disabling signing per operation. :type service_id: botocore.model.ServiceId :param service_id: The service id for the service, e.g. ``S3`` :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type signature_version: string :param signature_version: Signature name like ``v4``. :type credentials: :py:class:`~botocore.credentials.Credentials` :param credentials: User credentials with which to sign requests. :type event_emitter: :py:class:`~botocore.hooks.BaseEventHooks` :param event_emitter: Extension mechanism to fire events. NcsW nW0nW@nWPnWpnWn\ P!V4VnR#N) _region_name _signing_name_signature_version _credentials _auth_token _service_idweakrefZproxy_event_emitter)selfZ service_id region_name signing_namesignature_version credentialsZ event_emitterZ auth_tokens&&&&&&&&5/usr/lib/python3.14/site-packages/botocore/signers.py__init__ZRequestSigner.__init__Gs;()"3'%%&mmM:cVP#r )rr&rrZRequestSigner.region_name[s   rcrr )rrr rrZRequestSigner.signature_version_s&&&rcrr )rrr rrZRequestSigner.signing_namecs!!!rc s$VPW4#r )sign)roperation_namerequestkwargss&&&,rhandlerZRequestSigner.handlergs yy11rc  s~TpVf VPpVf VPpVPWVP4pVPP RVP P4 RV 2VVVPVVVR7V\P8wdRVRVRV/p VeWYR&VPPR /4p V'g$V PR 4'd V R ,V R&V PR4'd V R,V R&V PR 4'd V R ,V R &V PR 4e"VPV V R ,V R ,4VP!R/V Bp T PT4R#R# \dp TR8wd \TR7hT hRp ? ii;i)aSign a request before it goes out over the wire. :type operation_name: string :param operation_name: The name of the current operation, e.g. ``ListBuckets``. :type request: AWSRequest :param request: The request object to be sent over the wire. :type region_name: str :param region_name: The region to sign the request for. :type signing_type: str :param signing_type: The type of signing to perform. This can be one of three possible values: * 'standard' - This should be used for most requests. * 'presign-url' - This should be used when pre-signing a request. * 'presign-post' - This should be used when pre-signing an S3 post. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. This parameter is only valid for signing type 'presign-url'. :type signing_name: str :param signing_name: The name to use for the service when signing. Nz before-sign..)r#rrrrequest_signerr"rrrZexpiressigningregionrequest_credentialsidentity_cache cache_keystandardr)rr_choose_signercontextrZemitr hyphenizebotocoreUNSIGNEDget_resolve_identity_cacheget_auth_instancerrZadd_auth) rr"r#r signing_type expires_inrZexplicit_region_namerr$Zsigning_contextauthes &&&&&&& rr!ZRequestSigner.signnsF +  ++K  --L // '//    4++5578.9I J%))/) !   1 1 1 {#%6F %$.y!%oo11)R@O'O,?,?,I,I(7(A}%"">22)8)H~&""#8990?)1,-""#34@,,#$45#K0  --77 MM' "C 220 :-:*;G  s0F F<"F77F<csW!R&W1R&R#)r+r,Nr/)rr$cacher,&&&&rr6Z%RequestSigner._resolve_identity_caches#( '{rc slRRRR/pVPVR4pVPR4;'g VPpVPR/4pVPRVP4pVPR VP4p V\P Jd VP V4'g We, pVPPR VPP4 R V 2VV VVR 7wrV e6T pV\P Jd VP V4'g We, pV#) a1 Allow setting the signature version via the choose-signer event. A value of `botocore.UNSIGNED` means no signing will be performed. :param operation_name: The operation to sign. :param signing_type: The type of signing that the signer is to be used for. :return: The signature version to sign with. presign-postz -presign-post presign-urlz-queryZ auth_typer(rr)zchoose-signer.r&)rrrr1) r5rrrr3r4endswithrZemit_until_responserr2) rr"r8r1Zsigning_type_suffix_mapZsuffixrr(rrr%Zresponses &&&& rr0ZRequestSigner._choose_signers7 O 8# ),,\2>$KK 4OO8O8O++i,{{>43E3EF kk(D,=,=> X%6%6 6%..v66  '  //CCT--779:!N;K L%#/ D    ( "):)::)226::!+!  rc sVf VPp\PPP V4pVf \ VR7hVP RJddVP'd<\VP\4'gVPP4pM VPpV!V4pV#T;'g VPp \VRR4RJd'VR,p VR,p V PV 4p VRRp V eV P4p WR&VP'd5VP f\P"P%4hW%R&WR &V!R /VBpV#) aA Get an auth instance which can be used to sign a request using the given signature version. :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signature_version: string :param signature_version: Signature name like ``v4``. :rtype: :py:class:`~botocore.auth.BaseSigner` :return: Auth instance to sign a request. Nr.TZREQUIRES_IDENTITY_CACHEr+r,rrZ service_namer/)rr3r:ZAUTH_TYPE_MAPSr5rZREQUIRES_TOKENr isinstancerZget_frozen_tokenrZgetattrZget_credentialsZget_frozen_credentialsZREQUIRES_REGIONrZ exceptionsZ NoRegionError) rrrrr*r$ZclsZ frozen_tokenr:rr<keyZfrozen_credentialss &&&&&, rr7ZRequestSigner.get_auth_instancesm4  $ $ 7 7 mm**../@A ;."3     %   /)) $//@@B #// |$DK)>>T->-> 314 8D @+,E%C//4K{# "  "!,!C!C!E  2}      ())7799$/= !%1> "}V} rc s|\V4pVPVVVRVV4VP4VP#)a]Generates a presigned url :type request_dict: dict :param request_dict: The prepared request dictionary returned by ``botocore.awsrequest.prepare_request_dict()`` :type operation_name: str :param operation_name: The operation being signed. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type region_name: string :param region_name: The region name to sign the presigned url. :type signing_name: str :param signing_name: The name to use for the service when signing. :returns: The presigned url r?)rr!Zprepareurl)r request_dictr"r9rrr#s&&&&&& rgenerate_presigned_urlZ$RequestSigner.generate_presigned_urlEsB:( 5         {{r)rrrrrrrr NN)Nr-NN)NN)__name__ __module__ __qualname____firstlineno____doc__rZpropertyrrrr%r!r6r0r7Zget_authrF__static_attributes____classdictcell__Z __classdict__@rr r $s{ D;(!!''""2Z#x(.!`BJ!H((rr csJa]tRtRtoRtRtR RltRtR RltRt R t Vt R#) CloudFrontSigneripaA signer to create a signed CloudFront URL. First you create a cloudfront signer based on a normalized RSA signer:: import rsa def rsa_signer(message): private_key = open('private_key.pem', 'r').read() return rsa.sign( message, rsa.PrivateKey.load_pkcs1(private_key.encode('utf8')), 'SHA-1') # CloudFront requires SHA-1 hash cf_signer = CloudFrontSigner(key_id, rsa_signer) To sign with a canned policy:: signed_url = cf_signer.generate_signed_url( url, date_less_than=datetime(2015, 12, 1)) To sign with a custom policy:: signed_url = cf_signer.generate_signed_url(url, policy=my_policy) c sWnW nR#)aVCreate a CloudFrontSigner. :type key_id: str :param key_id: The CloudFront Key Pair ID :type rsa_signer: callable :param rsa_signer: An RSA signer. Its only input parameter will be the message to be signed, and its output will be the signed content as a binary string. The hash algorithm needed by CloudFront is SHA-1. Nkey_id rsa_signer)rrTrUs&&&rrZCloudFrontSigner.__init__s $rNc s<VRJ;'dVRJpVRJ;'dVRJpV'g V'dRp\V4hVeVPW4p\V\4'dVP R4pVeR\ \ V44 2.pM$RVPV4PR4 2.pVPV4pVPRVPV4PR4 2RVP 2.4VPW4#)a\Creates a signed CloudFront URL based on given parameters. :type url: str :param url: The URL of the protected object :type date_less_than: datetime :param date_less_than: The URL will expire after that date and time :type policy: str :param policy: The custom policy, possibly built by self.build_policy() :rtype: str :return: The signed URL. Nz=Need to provide either date_less_than or policy, but not bothZutf8zExpires=zPolicy=z Signature=z Key-Pair-Id=) Z ValueError build_policyrBZstrZencodeintr _url_b64encodeZdecoderUZextendrT _build_url) rrDdate_less_thanpolicyZboth_args_suppliedZneither_arg_suppliedr;paramsZ signatures &&&& rrFZ'CloudFrontSigner.generate_presigned_urls,47NNF$?F,;V+DI' (&1K3KL${?'C&DE zz-J??rcs\P!V4PRR4PRR4PRR4#)s+s-s=s_s/s~)base64Z b64encodeZreplace)rZdata&&rrXZCloudFrontSigner._url_b64encodes;   T " WT4 WT4 WT4  rrSrG) rIrJrKrLrMrrFrYrVrXrNrOrPrQrrRrRps+. %$,L=(@T  rrRc \VR&R#)generate_db_auth_tokenN)reZclass_attributesr$&,radd_generate_db_auth_tokenrh1G-.rc s*\VR&\VR&R#)Zgenerate_db_connect_auth_tokenZ$generate_db_connect_admin_auth_tokenN)#dsql_generate_db_connect_auth_token)dsql_generate_db_connect_admin_auth_tokenrfrgr'add_dsql_generate_db_auth_token_methodsrls +56 2;rDfields) rdatetimeZ timedeltaZstrftimer3r:ZISO8601appendrr1rxr!rD) rrErrr9rr[Z datetime_nowZ expire_daterar#s &&&&&& rgenerate_presigned_postZ'S3PostPresigner.generate_presigned_postsn >F  J,- "X%7%7 %KK *33HMM4I4IJ| "|#I < ' ' 2$( 54:014:01 !! ~ w{{Hf55rr)NNrHN)rIrJrKrLrrrNrOrPrQrrrs.S6S6rrc rd)rFN)rFrfrgradd_generate_presigned_urlrrirc sTpTpVf/pTpTpRRR\V4/p VPp VPV,p TP P PT 4p TPTT T R7p\P!TPRR44p TPT TT T '*R7wpppTPTT TT TR R 7pTeTTR &T PTTT R 7# \d\ TR7hi;i) aDGenerate a presigned url given a client, its method, and arguments :type ClientMethod: string :param ClientMethod: The client method to presign for :type Params: dict :param Params: The parameters normally passed to ``ClientMethod``. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type HttpMethod: string :param HttpMethod: The http method to use on the generated url. By default, the http method is whatever is used in the method's model. :returns: The presigned url is_presign_requestTuse_global_endpoint)Z method_name api_paramsoperation_modelr1Bucketr@Zignore_signing_regionFrrr|r1rpZset_user_agent_headerrr)rEr9r")_should_use_global_endpointrxZ_PY_TO_OP_NAMEZKeyErrorrrw service_modelr_emit_api_paramsr is_arnr5_resolve_endpoint_ruleset_convert_to_request_dictrF)rZ ClientMethodZParamsrZ HttpMethodZ client_methodr\r9Z http_methodr1r'r"r bucket_is_arnr|additional_headers propertiesrEs&&&&& rrFrFsb,!M F ~JKd:4@G ))NB,,];ii--==nMO  " "'#F $$VZZ"%=>M &&#00 '  00'!"# 1L!, X  0 0!% 1 G B&=AABs C//Dc rd)rN)rrfrgradd_generate_presigned_postrCs2I./rc sTpTpTpTp Tp Vf/pMVP4pV f.p RRR\V4/p \VP4p VPP P R4p VPRV/V V R7p\P!VPRR44pVPV VV V'*R 7wpppVPVV VV VR R 7pV PR V/4VPR 4'd#V PRRVR\R 4).4MV PRV/4WxR&V P!VVV V R7#)a Builds the url and the form fields used for a presigned s3 post :type Bucket: string :param Bucket: The name of the bucket to presign the post to. Note that bucket related conditions should not be included in the ``conditions`` parameter. :type Key: string :param Key: Key name, optionally add ${filename} to the end to attach the submitted filename. Note that key related conditions and fields are filled out for you and should not be included in the ``Fields`` or ``Conditions`` parameter. :type Fields: dict :param Fields: A dictionary of prefilled form fields to build on top of. Elements that may be included are acl, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and x-amz-meta-. Note that if a particular element is included in the fields dictionary it will not be automatically added to the conditions list. You must specify a condition for the element as well. :type Conditions: list :param Conditions: A list of conditions to include in the policy. Each element can be either a list or a structure. For example: .. code:: python [ {"acl": "public-read"}, ["content-length-range", 2, 5], ["starts-with", "$success_action_redirect", ""] ] Conditions that are included may pertain to acl, content-length-range, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and/or x-amz-meta-. Note that if you include a condition, you must specify a valid value in the fields dictionary as well. A value will not be added automatically to the fields dictionary based on the conditions. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned post is valid for. :rtype: dict :returns: A dictionary with two elements: ``url`` and ``fields``. Url is the url to post to. Fields is a dictionary filled with the form fields and respective values to use when submitting the post. For example: .. code:: python { 'url': 'https://amzn-s3-demo-bucket.s3.amazonaws.com', 'fields': { 'acl': 'public-read', 'key': 'mykey', 'signature': 'mysignature', 'policy': 'mybase64 encoded policy' } } NrTrZ CreateBucketrrr@rFrbucketz ${filename}z starts-withz$keyrC)rErrr9)Zcopyrrrxrwrrrr rr5rrrrAryr)rrZKeyZFieldsZ ConditionsrrrCrrr9r1Zpost_presignerrr\rr|rrrEs&&&&&& rrrGsPF C FJJ ~  d:4@G %T%9%9:Nii--==nMO  " "f%'#F $$VZZ"%=>M &&#00 '  00'!"# 1Lx() ||M""=K]9K8K2LMN5#,'5M  1 1! 2 rcsnVPPR8wdR#VPPPpV'dpVP RR4'dR#VP R4R8Xd(VPPP R8XdR#VP R4R8XdR#R#) ZawsFZuse_dualstack_endpointZus_east_1_regional_endpointZregionalz us-east-1Zaddressing_styleZvirtualT)rwZ partitionZconfigZs3r5r)ZclientZ s3_configs& rrrs {{% ""%%I ==15 9 9 MM7 8J F ""..+= ==+ , 9 rr )Nru)NrHN)NNrH)%rbrr`rr3Z botocore.authZbotocore.awsrequestrrZbotocore.compatrrZbotocore.exceptionsrrrrZbotocore.tokensrZbotocore.utilsr r r r rRrhrlrerrjrkrrrFrrrr/rrrs K= ,IIX C C LH3(l0(f**W6W6tHL^JL^r