+ :iQc s ^RIt^RIHt^RIt^RIHt^RIHtHtH t ^RI H t ^RI H t^RI HtHtHtHt^RIHtHtHt^R IHtHt^R IHtHtHtHtHtHtH t H!t!H"t"H#t#]PH!]%4t&!R R ]4t R t']!] .R7]PP]R444t]PS4]PPR44t*]PS4]]PPR444t+Rt,]P[R4R4t.].PSR4]P^!R]P`!^^c4RR7]P^!R]P`!^^c4RR7]P^!R]P`!^^c4RR7]Pb!RRRR 7]]PPR!4444444t2].PSR"4]Pb!R#R$R%R 7]Pb!R&R'R(R 7]PPR)4444t3].PSR*4]Pb!RRR+R 7]Pb!R,R-R.R 7]PPR/4444t4].PSR04]Pb!RRR1R 7]Pb!R&R2R3R 7]PPR44444t5].PSR54]Pb!RRR6R 7]Pb!R,R-R7R 7]Pb!R&R'R(R 7]PPR844444t6].PSR94]P^!R:R;]!]4R<7]Pb!RRR=R 7]PPR>4444t7]P[R?4R@4t8]8PSRA4]PP]P^!RBRC]!] 4R<7RD444t9]8PSRE4]P^!RBRC]!] 4R<7]P^!R:R;]!]4R<7]Pb!RRR=R 7]]PPRF444444t:]8PSRG4]Pb!RRR=R 7]PP]P^!RBRC]!] 4R<7]P^!RH]Pv!RI4RJR7RK44444t<]8PS4]PP]Pb!R#R$RLR 7]]P^!RBRC]!] ] Pz.RM7R<7]P^!RN]Pv!RO4RPR7RQ444444t>]P[RR4RS4t?]?PSRT4]PP]P^!RBRC]!] 4R<7]]P^!RN]Pv!RO4RPR7RU44444t@]?PSRV4]Pb!RRR=R 7]PP]P^!RBRC]!] 4R<7RW4444tA]?PSRG4]Pb!RRR=R 7]PP]P^!RBRC]!] 4R<7]P^!RX]Pv!RI4RPR7RY44444tBR#)ZN)IntEnum) TRANSPORT)SW ApduErrorSmartCardConnection) CAPABILITY)KEY_REF) KEY_STATUS PIN_POLICYUIFOpenPgpSession) get_key_infoget_openpgp_info safe_reset)parse_certificatesparse_private_key) CliFail EnumChoiceclick_force_optionclick_format_option click_groupclick_postpone_execution click_promptget_scp_params log_or_echo pretty_printcsFa]tRt^@to^t^t^t^t^tV3RlRlt Rt Vt R#)rcs <V^8dQhRS[/#)iname)Zstr)format __classdict__s"7/usr/lib/python3.14/site-packages/ykman/_cli/openpgp.pyZ __annotate__ZKEY_REF.__annotate__Gs55S5cs6\V4PV4#)N)_KEY_REF__getattribute__)Zselfr&&rr!ZKEY_REF.__getattribute__Gs~..t44rN) __name__Z __module__Z __qualname__Z__firstlineno__ZSIGZDECZAUTATTZENCr!Z__static_attributes__Z__classdictcell__)rs@rrr@s( C C C C C55rrcs\VRV4#)r)Zgetattr)Zfobjs&r_fnamer&Ks 4 &&r)Z connectionscs\VPR,pVP\4pVPVP4\ V\ PV4p\W#4VPR&R# \dpTP\P8Xd3T'g+TP\P8Xd \!R4hTP\P"8Xd1TP$R8XdY PR&Rp?R#\!R4hhRp?ii;i)z Manage the OpenPGP application. Examples:  Set the retries for PIN, Reset Code and Admin PIN to 10: $ ykman openpgp access set-retries 10 10 10  Require touch to use the authentication key: $ ykman openpgp keys set-touch aut on Zdevicesessionz-Unable to manage OpenPGP over NFC without SCPresetconnzQMemory corruption detected, OpenPGP needs to be reset using 'ykman openpgp reset'N)objZopen_connectionrZ call_on_closeZcloserrOPENPGPr rswrCONDITIONS_NOT_SATISFIEDZ transportrZNFCrZMEMORY_FAILUREZinvoked_subcommand)ctxZdevr)Z scp_paramses& ropenpgpr0Os" ''( C   2 3Ddjj!Z%7%7>J+D=   DDB// / .IJ J TTR&& &%%0"&, !s% A:: D+&D&,A(D& D&&D+cs>VPR,p\VPR,4p\PVP9d!\PVP 9VR&\ P!RP\V444R#)z4 Display general status of the OpenPGP application. infor'z FIPS approved N) r*r rr+Z fips_capableZ fips_approvedclickechojoinr)r.r1Zdatas& rr1r1{sm 776?D CGGI. /DT... * 2 2d6H6H H_ JJtyyd+,-rcs|V'g\P!RRRR7\P!R4RVP9d#VPR,P 4M\ VPR,4\ PR4\P!R4\4R #) z Reset all OpenPGP data. This action will wipe all OpenPGP data, and set all PINs to their default values. The attestation key and certificate will NOT be reset. zaWARNING! This will delete all stored OpenPGP keys and data and restore factory settings. Proceed?TZabortZerrz3Resetting OpenPGP data, don't remove the YubiKey...r'r)zOpenPGP application data resetzGReset complete. OpenPGP data has been cleared and default PINs are set.N) r3confirmr4r*r(rloggerr1echo_default_pins)r.forcer"rr(r(s   )   JJDECGG    "3776?# KK01 JJQrcs\P!R4\P!R4\P!R4R#)zPIN: 123456zReset code: NOT SETzAdmin PIN: 12345678N)r3r4r#rrr9r9s) JJ$% JJ%& JJ&'raccesscR#)z&Manage PIN, Reset Code, and Admin PIN.Nr#r#rrr;r;rz set-retrieszuser-pin-retriesz PIN-RETRIES)typemetavarzreset-code-retrieszRESET-CODE-RETRIESzadmin-pin-retrieszADMIN-PIN-RETRIESz-az --admin-pinzadmin PIN for OpenPGP)Zhelpc sVPR,pVf\RRR7pVPR 8pV'd\P!R4V'g*\P !RV RV RV R 2RRR 7'dfVP V4VPW#V4\P!R 4V'd#\P!R 4\4R#R#R#)zO Set the number of retry attempts for the User PIN, Reset Code, and Admin PIN. r'NEnter Admin PINT hide_inputzBWARNING: Setting PIN retries will reset the values for all 3 PINs!zSet PIN retry counters to: Z ?r6z/Number of PIN/Reset Code/Admin PIN retries set.z"Default values have been restored:)irr) r*rZversionr3r4r7 verify_adminZset_pin_attemptsr9)r. admin_pinZuser_pin_retriesZreset_code_retriesZadmin_pin_retriesr:r'Z resets_pinss&&&&&& rset_pin_retriesrFs"ggi G !2tD //I-K WX  %&6%7q9K8LA  Q    Y'  2C   DE  JJ; <   rz change-pinz-Pz--pinzcurrent PIN codez-nz --new-pinz a new PINc>VPR,pVf\RRR7pVf\RRRR7pVPW4\P!R4R# \ d1pTP \P8Xd \R 4hhRp?ii;i) z Change the User PIN. The PIN has a minimum length of 6 (or 8, for YubiKey 5.7+ FIPS when not using KDF), and supports any type of alphanumeric characters. r'N Enter PINTrANew PINrBZconfirmation_promptUser PIN has been changed.z)PIN does not meet complexity requirement.) r*r change_pinr3r4rr,rr-r)r.pinnew_pinr'r/&&& rrLrLsggi G {;48  $  3( /0  442.. .EF F 'A!! B,+BBzchange-reset-codez Admin PINz-rz --reset-codeza new Reset Codecs`VPR,pVf\RRR7pVf\RRRR7pVPV4VPV4\P !R4R# \ d1pTP\P8Xd \R 4hhRp?ii;i) zu Change the Reset Code. The Reset Code has a minimum length of 6, and supports any type of alphanumeric characters. r'Nr@TrAzNew Reset CoderJzReset Code has been changed.z0Reset Code does not meet complexity requirement.) r*rrDZset_reset_coder3r4rr,rr-r)r.rE reset_coder'r/rOrchange_reset_coderRsggi G !2tD !  $  #z* 12  442.. .LM M s 'A22 B-=+B((B-zchange-admin-pinzcurrent Admin PINz--new-admin-pinz new Admin PINcrG) zs Change the Admin PIN. The Admin PIN has a minimum length of 8, and supports any type of alphanumeric characters. r'Nr@TrAz New Admin PINrJzAdmin PIN has been changed.z/Admin PIN does not meet complexity requirement.) r*r change_adminr3r4rr,rr-r)r.rEZ new_admin_pinr'r/rOrrSrS!sggi G !2tD $  $ Y6 01  442.. .KL L rPz unblock-pinz2Admin PIN (use "-" as a value to prompt for input)z Reset CodecsVPR,pVeVe \R4hVR8Xd\RRR7pVfVf\RRR7pVf\R RRR 7pV'dVPV4VP W24\ P !R 4R# \d1pTP\P8Xd \R 4hhRp?ii;i) aJ Unblock the PIN (using Reset Code or Admin PIN). If the PIN is lost or blocked you can reset it to a new value using the Reset Code. Alternatively, the Admin PIN can be used (using the "-a, --admin-pin" option) instead of the Reset Code. The new PIN has a minimum length of 6, and supports any type of alphanumeric characters. r'NzFInvalid options: Only one of --reset-code and --admin-pin may be used.-r@TrAzEnter Reset CoderIrJrKz-New PIN does not meet complexity requirement.) r*rrrDZ reset_pinr3r4rr,rr-)r.rErQrNr'r/&&&& r unblock_pinrVBs&ggi G)"7 T  C !2tD i/!"4F   $  Y''. /0  442.. .IJ J s<'B%% C 0+CC zset-signature-policypolicyZPOLICY)r?r>zAdmin PIN for OpenPGPcsVPR,pVf\RRR7pVPV4VPV4\P !R4R# \ d \R4hi;i)z Set the Signature PIN policy. The Signature PIN policy is used to control whether the PIN is always required when using the Signature key, or if it is required only once per session.  POLICY signature PIN policy to set (always, once) r'Nr@TrAz"Signature PIN policy has been set.z'Failed to set new Signature PIN policy.)r*rrDZset_signature_pin_policyr3r4 Exceptionr)r.rWrEr'&&& rset_signature_policyrZusqggi G !2tD AY'((0 78 A?@@As 8A A7keyscr<)zManage private keys.Nr#r#rrr[r[r=rr1keyZKEYcsfVPR,pVP4PpVPP V4pV\ P 8Xd\RVP R24h\W1V4p\P!RP\V444R#)a  Show metadata about a private key. This will show what type of key is stored in a specific slot, whether it was imported into the YubiKey, or generated on-chip, and what the Touch policy is for using the key.  KEY key slot to set (sig, dec, aut or att) r'zNo key stored in slot .r2N)r*Zget_application_related_data discretionaryZkey_informationZgetrZNONErrr r3r4r5r)r.r\r'r^Zstatusr1s&& rmetadatar_sggi G88:HHM  * * . .s 3F  .sxxj:;;  F 3D JJtyyd+,-rz set-touchcsnVPR,pVPP4PRR4pVf\ RRR7pRVP R V R 2pVP 'd RV,pV'g \ P!VRRR 7'dJVPV4VPW4\ P!R VP R 24R#R# \d;pTP\P8Xd \R4h\R4hRp?ii;i)au Set the touch policy for OpenPGP keys. The touch policy is used to require user interaction for all operations using the private key on the YubiKey. The touch policy is set individually for each key slot. To see the current touch policy, run the "openpgp info" subcommand. WARNING: Setting the touch policy of the attestation key to "fixed" cannot be undone without replacing the attestation private key. Touch policies:  Off (default) no touch required On touch required Fixed touch required, can't be disabled without deleting the private key Cached touch required, cached for 15s after use Cached-Fixed touch required, cached for 15s after use, can't be disabled without deleting the private key  KEY key slot to set (sig, dec, aut or att) POLICY touch policy to set (on, off, fixed, cached or cached-fixed) r'Z_rTNr@TrAzSet touch policy of z key to rCr6zTouch policy for slot z set.zTouch policy not allowed.zFailed to set touch policy.zZWARNING: This touch policy cannot be changed without deleting the corresponding key slot! )r*rZlowerZreplacerZis_fixedr3r7rDZset_uifr4rr,rZ SECURITY_CONDITION_NOT_SATISFIEDr) r.r\rWrEr:r'Z policy_nameZpromptr/s &&&&& r set_touchr`s>ggi G++##%--c37K !2tD #CHH:Xk]! DF  *     fDd;; 9   + OOC ( JJ/z? @ <  9ttr:::9::78 8 9s%AC// D4:5D//D4Zimportz private-keyZrbz PRIVATE-KEYcsVPR,pV\P8wdVPR4Vf\ RRR7p\ VP 4RR7pTPT4TPY4\P!R TP R 24R# \d \R4hi;i \d \R 4hi;i) a^ Import a private key for OpenPGP attestation. The attestation key is by default pre-generated during production with a Yubico-issued key and certificate. WARNING: This private key cannot be recovered once overwritten!  KEY key slot to import to (only 'att' supported) PRIVATE-KEY file containing the private key (use '-' to use stdin) r'z:Importing keys is only supported for the Attestation slot.Nr@TrAZpasswordzFailed to parse private key.zPrivate key imported for slot r]z!Failed to import attestation key.)r*rr%ZfailrrreadrXrrDZput_keyr3r4r)r.r\Z private_keyrEr's&&&& r import_keyrcs$ggi G gkk MN !2tD 6' (8(8(:TJ ;Y') 3CHH:Q?@ 64556 ;9::;s B0(AC 0C C!zPIN code)Zhidden certificateZwbZ CERTIFICATEcsVPR,pV'g\RRR7pVPV4pV'd+\P !RVP R24'dVP\P4pV\P\P39d\P!R4VPV4VPV4pVP!VP#VR 74\%R VP& R \)V4 2\*V4R#R# \dRpELi;i \,d \/R 4hi;i) a2 Generate an attestation certificate for a key. Attestation is used to show that an asymmetric key was generated on the YubiKey and therefore doesn't exist outside the device.  KEY key slot to attest (sig, dec, aut) CERTIFICATE file to write attestation certificate to (use '-' to use stdout) r'rHTrANz9There is already data stored in the certificate slot for z, do you want to overwrite it?zTouch the YubiKey sensor...Zencodingz!Attestation certificate for slot z written to zAttestation failed.)r*rget_certificate ValueErrorr3r7ZvalueZget_uifrr%r ZONZFIXEDr4Z verify_pinZ attest_keywrite public_bytesrrr&r8rXr)r.r\rdrMrr'certZ touch_policys&&&&& rattestrk s8$ggi G ;48&&s+ 5== CCII;O' 'w{{3 CFFCII. . JJ4 5 1   s #%%c*D   d///@ A 3CHH:\+&')   ( 1/0 0 1sD9A-E 9 E  E  E$ certificatescr<)z Manage certificates. Nr#r#rrrlrl<r=rZexportcs6VPR,pVPV4pTP TP TR74\RTP R\T4 2\T4R# \d\RTP R24hi;i)z Export an OpenPGP certificate.  KEY key slot to read from (sig, dec, aut, or att) CERTIFICATE file to write certificate to (use '-' to use stdout) r'z%Failed to read certificate from slot r]reCertificate for slot z exported to N) r*rfrgrrrhrirr&r8)r.r\rrdr'rjrUrexport_certificaternCsggi GK&&s+d'''89 zvk7J6KL K=chhZqIJJKs A33%BZdeletecsVPR,pVf\RRR7pVPV4VPV4\P !RVP R24R# \d \R4hi;i) zd Delete an OpenPGP certificate.  KEY key slot to delete certificate from (sig, dec, aut, or att) r'Nr@TrArmz deleted.zFailed to delete certificate.) r*rrDdelete_certificater3r4rrXr)r.r\rEr'rYrroro^s{ggi G !2tD 7Y'""3' *388*I>? 75667s AA..BrjcsVPR,pVf\RRR7p\VP4RR7p\ T4^8wd \ R4hTPT4TPY^,4\P!R TP 24R# \d \ R4hi;i \d \ R 4hi;i) z Import an OpenPGP certificate.  KEY key slot to import certificate to (sig, dec, aut, or att) CERTIFICATE file containing the certificate (use '-' to use stdin) r'Nr@TrArazFailed to parse certificate.z Can only import one certificate.zCertificate imported into slot zFailed to import certificate.) r*rrrbrXrZlenrDZput_certificater3r4r)r.r\rjrEr'ZcertsrUrimport_certificaterpusggi G !2tD 6"499;> 5zQ8997Y'1X. 4SXXJ?@ 64556 75667sB+A C+CC)CZloggingZenumrr3Z yubikit.corerZyubikit.core.smartcardrrrZyubikit.managementrZyubikit.openpgprr rr r r r0r r rZutilrrrrrrrrrrrrZ getLoggerr$r8r&Z pass_contextZcommandr1r(r9Zgroupr;ZargumentZIntRangeZoptionrFrLrRrSrVrZr[r_r`ZFilercr%rkrlrnrorpr#rrrqs8 "EE)A@8      8 $5g5' -./&0&R  . . :(  x11 "2)> Vu~~a4>RennQ3=PdM(?@ AW > dG"45dKk236:#$dM 4dN);<=5%<"#dM(;<d%O<==$: -RdN6dKk2)37)X&'(J1GHdM(?@AAI(A0 vfu:g+>?.@.*ku:g+>?(CAdM(?@/9AB@ /9dhdM(?@u:g+>? EJJt$4mL;M@A ;@dG*-u:gw{{m+TU EJJt$4mL(1MV. (1V ~ hu:g+>? EJJt$4mLM@ ,hdM(?@u:g+>?7@A 7&hdM(?@u:g+>?UZZ-}E7F@A 7r