+ h4"cs^RIHt^RIt^RIHt^RIHtHt^RIH t ^RI H t H t H t ^RIHt^RIHt^R IHt^R IHtHtHt^R IHtHt!R R ]4t!RR]4t!RR]4t!RR]4t!RR]4t ]!RR]44t!]!RR44t"Rt#]#RRl4t$!RR]PJ4t&!RR ]&4t'!R!R"]&4t(R#t)R$t*!R%R&]PJ4t+R#)'i) annotationsN) dataclass)IntEnumuniquewraps)AnyMappingSequence)x509)InvalidSignature)default_backend)ecpaddingrsa)AttestationObjectAuthenticatorDatacs]tRt^,tRtRtR#)InvalidAttestationz.Base exception for attestation-related errors.N__name__ __module__ __qualname____firstlineno____doc____static_attributes__r;/usr/lib/python3.14/site-packages/fido2/attestation/base.pyrr,s8rrcs]tRt^0tRtRtR#) InvalidDataz"Attestation contains invalid data.rNrrrrrr0s,rrcs]tRt^4tRtRtR#)r z7The signature of the attestation could not be verified.rNrrrrr r 4sArr cs]tRt^8tRtRtR#)UntrustedAttestationz)The CA of the attestation is not trusted.rNrrrrrr8s3rrcs0a]tRt^.inner_s9 !d%f% %Hj1 !a.  !s 1 ,1r)r/r0sf rcatch_builtinsr1\s" 1X!! Lrc V^8dQhRRRR/#)chainr*returnNonerZformat"r __annotate__r9js%%[%T%rcsVUu.uF"p\P!V\44NK$ ppVP^4pV'EdTpVP^4pVP 4p\ V\ P4'dXVPfQhVPVPVP\P!4VP4K\ V\P4'dYVPfQhVPVPVP\P !VP44EK\#R4hR#uupi \$d \'4hi;i)zVerifies a chain of certificates. Checks that the first item in the chain is signed by the next, and so on. The first item is the leaf, the last is the root. NzUnsupported signature key type)r Zload_der_x509_certificater ZpopZ public_keyZ isinstancerZ RSAPublicKeyZsignature_hash_algorithmverifyZ signatureZtbs_certificate_bytesr ZPKCS1v15r ZEllipticCurvePublicKeyZECDSAr,_InvalidSignaturer )r4ZderZcertscertZchildZpubs& rverify_x509_chainr=is=PU UuT + +C1B CuE U 99Q.TypedUnsupportedAttestationc s&<\SV`S4R#r%)rr )r#r$r"s&rr ZBAttestation.for_type..TypedUnsupportedAttestation.__init__s %rr)rrrrr rr&)r$r"s@rTypedUnsupportedAttestationrFs  & &rrG)r>__subclasses__getattrUnsupportedAttestation)r"clsrGsf rfor_typeZAttestation.for_typesC--/CsHd+s2 0 &*@ &+*rrN) rrrrrabcabstractmethodr:Z staticmethodrLrrrrr>r>s1A     + +rr>cs&]tRt^tRRltRtRtR#)rJNc sWnR#r%r")r#r"&&rr ZUnsupportedAttestation.__init__src s,\W P4hr%)rr"rCrDrr:ZUnsupportedAttestation.verifysi22rrOr%)rrrrr r:rrrrrJrJs 3rrJcs ]tRt^tRtRtRtR#)NoneAttestationnonec sZV/8wd \R4h\\P.4#)z*None Attestation requires empty statement.)rr)r'r(rCrDrr:ZNoneAttestation.verifys( ?JK K !5!5r::rrN)rrrrrEr:rrrrrQrQs F;rrQcsXVP\PP8wd \ R4hVP P \P4pVPP'd \ R4hR# \Pd \ R4hi;i)z+Attestation certificate must use version 3!z+Attestation certificate must have CA=false!z4Attestation certificate must have Basic Constraints!N) Zversionr ZVersionZv3rZ extensionsZget_extension_for_classZBasicConstraintsZvaluecaZExtensionNotFound)r<Zbcs& r_validate_cert_commonrTs ||t||&GHHR __ 4 4T5J5J K 88;;;KL L   ! !RPQQRsAB; B!B)cs\P4Uu.uFp\VRR4R8wgKV!4NK up#uupi)rErR)r>rHrI)rKs r_default_attestationsrUsG--/ /C 3& )V 3 /  s> >csf]tRt^tRtR RRllt]PRRl4tRRlt R t R t R#) AttestationVerifierzBase class for verifying attestation. Override the ca_lookup method to provide a trusted root certificate used to verify the trust path from the attestation. NcsV^8dQhRR/#)r3attestation_typeszSequence[Attestation] | Nonerr7r8rr9 AttestationVerifier.__annotate__sOO*FOrc s8T;'g \4VnR#r%)rU_attestation_types)r#rWrPrr ZAttestationVerifier.__init__s"3"N"N7L7Nrc$V^8dQhRRRRRR/#)r3attestation_resultr)r!rr5z bytes | Nonerr7r8rr9rXs$$$"3$@Q$ $rc s\4h)zLookup a CA certificate to be used to verify a trust path. :param attestation_result: The result of the attestation :param auth_data: The AuthenticatorData from the registration )ZNotImplementedError)r#r[r!s&&&r ca_lookupZAttestationVerifier.ca_lookups "##rcrZ)r3attestation_objectrr@rAr5r6rr7r8rr9rXs$**"3*GL* *rc s\VP4pVPF#p\VRR4VP8XgK!TpM VP VP VP V4pVPWQP 4pV'g \R4h\VPV.,4R# \dp\T4hRp?ii;i)zVerify attestation. :param attestation_object: dict containing attestation data. :param client_data_hash: SHA256 hash of the ClientData bytes. rENzNo root found for Authenticator) rJr"rYrIr:Zatt_stmtr!r\rr=r+r )r#r]r@Z att_verifierZatZresultrSr.s&&& rverify_attestationZ&AttestationVerifier.verify_attestations%;;M;Q;Q$R ))Br8T*.@.D.DD! *$$  ' '  ( (  ^^F$@$@ A&'HI I * f//2$6 7 *&q) ) *sB>> C CCc s&VP!V!R#)z?Allows passing an instance to Fido2Server as verify_attestationN)r^)r#r-s&*r__call__ZAttestationVerifier.__call__s &r)rYr%) rrrrrr rMrNr\r^r_rrrrrVrVs2 O $$*B'rrV),Z __future__rrMZ dataclassesrZenumrrZ functoolsrZtypingrrrZ cryptographyr Zcryptography.exceptionsr r;Zcryptography.hazmat.backendsr Z)cryptography.hazmat.primitives.asymmetricr r rZwebauthnrrZ Exceptionrrrrr'r)r1r=ZABCr>rJrQrTrUrVrrrr`s8# ! ))I8FF;99-$-B)B4-4 (  g     %%D+#''+:3[3;k; R8'#''8'r