+
    i  c                  s  a  0 t $ ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	H
t ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ RIHtHtHtHtHt ^ RIHt ^ R	IHtHtHtHt ^ R
I H!t!H"t"H#t#H$t$H%t%H&t&  ^ RI'H(t) Rt*Rt,Rt-Rt.Rt/Rt0Rt1Rt2Rt3Rt4Rt5Rt6]Pn                  ! R4      t8Rt9Rt:Rt;Rt<R t=R!t>^t?]Pn                  ! ]:R",           ];,           ]P                  4      tA]B! ]C! ]D! ^^4      4      4      tE] ! R# R$4      4       tFR!]F! ]P                  ^ ]P                  ^^RRR%7      R&]F! ]P                  ^ ]P                  ^^RRR%7      R']F! ]P                  ^ ]P                  ^^^RR%7      /tKR(]LR)&   R*]/R+]0R,]1/tMR- R. ltNR/ R0 ltO]:R1,           ];R1,           3R2 R3 lltPR4 R5 ltQR6 R7 ltRR8 R9 ltSR: R; ltTR< R= ltUR> R? ltVR@ RA ltWRB RC ltX ! RD RE4      tY ! RF RG4      tZ ! RH RI4      t[ ! RJ RK4      t\ ! RL RM4      t]RN RO lt^ ! RP RQ4      t_ ! RR RS4      t`]-]Z! 4       ].][! 4       ],]]! 4       ]/]\! RT]P                  ! 4       4      ]0]\! RU]P                  ! 4       4      ]1]\! RV]P                  ! 4       4      ]3]_! 4       ]4]`! 4       /tdRW RX lte]P                  ]P                  ]P                  ]P                  ]P                  3,          tkRtRYR/RZ R[ llltlR\ R] ltm]P                  ]P                  ]P                  ]P                  ]P                  3,          tr]P                  ]P                  ]P                  ]P                  3,          ts ! R^ R_]P                  4      tu ! R` Ra4      tvRb Rc ltwRsRd Re lltxRf Rg ltyRh Ri ltzRj Rk lt{RtRl Rm llt|Rn Ro lt}]P                  ]P                  ]P                  ]P                  3,          t~Rpt ! Rq Rr4      tR#   ]+ d    Rt*RsR R llt) ELwi ; i)u    )annotationsN)encodebytes)	dataclass)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)AEADDecryptionContextCipher
algorithmsmodes)EncodingKeySerializationEncryptionNoEncryptionPrivateFormatPublicFormat_KeySerializationEncryption)kdfTFc               s0    V ^8  d   QhRRRRRRRRRRR	R/# )
   passwordbytessaltdesired_key_bytesintroundsignore_few_roundsboolreturn Zformat   "W/usr/lib64/python3.14/site-packages/cryptography/hazmat/primitives/serialization/ssh.py__annotate__r&   1   sD     9 999 9 	9
  9 
9    c                    \        R 4      h)zNeed bcrypt moduler   )r   r   r   r   r   s   &&&&&r%   _bcrypt_kdfr)   1   s     ##788r'   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   sk-ssh-ed25519@openssh.coms"   sk-ecdsa-sha2-nistp256@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   nones
   aes256-ctrs   (.*?)c                  s^    ] tR t^\t$ R]R&   R]R&   R]R&   R]R&   R]R&   R	]R
&   R]R&   RtR# )
_SSHCipherztype[algorithms.AES]algr   key_lenz3type[modes.CTR] | type[modes.CBC] | type[modes.GCM]mode	block_leniv_len
int | Nonetag_lenr    is_aeadr"   N)__name__
__module____qualname____firstlineno____annotations____static_attributes__r"   r'   r%   r*   r*   \   s(    	L
==NKMr'   r*   )r+   r,   r-   r.   r/   r1   r2   s
   aes256-cbcs   aes256-gcm@openssh.comzdict[bytes, _SSHCipher]_SSH_CIPHERSZ	secp256r1Z	secp384r1Z	secp521r1c                    V ^8  d   QhRRRR/# )r   keyz&SSHPrivateKeyTypes | SSHPublicKeyTypesr!   r   r"   r#   r$   r%   r&   r&      s      A e r'   c                s8   \        V \        P                  4      '       d   \        V P	                  4       4      pV# \        V \        P
                  4      '       d   \        V 4      pV# \        V \        P                  \        P                  34      '       d	   \        pV# \        V \        P                  \        P                  34      '       d	   \        pV# \        V \        P                  \        P                   34      '       d	   \"        pV# \%        R 4      h)Unsupported key type)
isinstancer	   EllipticCurvePrivateKey_ecdsa_key_type
public_keyEllipticCurvePublicKeyr   RSAPrivateKeyRSAPublicKey_SSH_RSAr   DSAPrivateKeyDSAPublicKey_SSH_DSAr
   Ed25519PrivateKeyEd25519PublicKey_SSH_ED25519
ValueError)r;   key_type   & r%   _get_ssh_key_typerN      s    #r1122"3>>#34 O 
C22	3	3"3' O 
C#++S-=-=>	?	? O 
C#++S-=-=>	?	? O 
g'')A)AB
 
   O /00r'   c               r:   )r   r@   ec.EllipticCurvePublicKeyr!   r   r"   r#   r$   r%   r&   r&      s     ' ' 9 'e 'r'   c                s    V P                   pVP                  \        9  d   \        RVP                  : 24      h\        VP                  ,          # )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPErK   )r@   rP   rM   r%   r?   r?      sE    Ezz(5ejj^D
 	
 5::&&r'   s   
c               s(    V ^8  d   QhRRRRRRRR/# )r   datautils.Bufferprefixr   suffixr!   r"   r#   r$   r%   r&   r&      s0     < <
<< < 	<r'   c                s<    R P                  V\        V 4      V.4      # )r'   )join_base64_encode)rS   rU   rV      &&&r%   _ssh_pem_encoderZ      s    
 88V^D16:;;r'   c               $    V ^8  d   QhRRRRRR/# )r   rS   rT   r.   r   r!   Noner"   r#   r$   r%   r&   r&      s!     : :L :S :T :r'   c                sZ    V '       d   \        V 4      V,          ^ 8w  d   \        R4      hR# )zRequire data to be full blockszCorrupt data: missing paddingN)lenrK   )rS   r.      &&r%   _check_block_sizer_      s&    3t9y(A-899 .r'   c               r:   )r   rS   rT   r!   r\   r"   r#   r$   r%   r&   r&      s     8 8| 8 8r'   c                s,    V '       d   \        R4      hR# )z!All data should have been parsed.zCorrupt data: unparsed dataN)rK   rS      &r%   _check_emptyrb      s    677 r'   c          
     s,    V ^8  d   QhRRRRRRRRRR	/# )
r   
ciphernamer   r   bytes | Noner   r   r   r!   z)Cipher[modes.CBC | modes.CTR | modes.GCM]r"   r#   r$   r%   r&   r&      s:        	
 /r'   c                s   V'       g   \        R4      h\        V ,          p\        WVP                  VP                  ,           VR4      p\        VP                  VRVP                   4      VP                  WTP                  R 4      4      # )z$Generate key + iv and return cipher.z9Key is password-protected, but password was not provided.TN)	TypeErrorr9   r)   r,   r/   r   r+   r-   )rc   r   r   r   ciphZseeds   &&&&  r%   _init_cipherrg      s~     G
 	
 
#Dt{{2FDD n%&		$||~&' r'   c               r:   r   rS   
memoryviewr!   ztuple[int, memoryview]r"   r#   r$   r%   r&   r&           ? ?: ?"8 ?r'   c                s    \        V 4      ^8  d   \        R4      h\        P                  V R,          RR7      V R,          3# )ZUint32Invalid data:N   Nbig	byteorder:rl   NNr]   rK   r   
from_bytesr`   ra   r%   _get_u32rr      8    
4y1}((>>$r(e>4d2h>>r'   c               r:   rh   r"   r#   r$   r%   r&   r&      rj   r'   c                s    \        V 4      ^8  d   \        R4      h\        P                  V R,          RR7      V R,          3# )ZUint64rk   :N   Nrm   rn   :rt   NNrp   r`   ra   r%   _get_u64ru      rs   r'   c               r:   )r   rS   ri   r!   tuple[memoryview, memoryview]r"   r#   r$   r%   r&   r&      s      j %B r'   c                sd    \        V 4      w  rV\        V 4      8  d   \        R4      hV RV WR 3# )zBytes with u32 length prefixrk   N)rr   r]   rK   )rS   nrM   r%   _get_sshstrrx      s8    tnGA3t9}((8T"Xr'   c               r:   rh   r"   r#   r$   r%   r&   r&      s     , ,Z ,$: ,r'   c                s    \        V 4      w  rV'       d   V^ ,          ^8  d   \        R4      h\        P                  VR4      V 3# )zBig integer.rk   rm   )rx   rK   r   rq   )rS   valrM   r%   
_get_mpintrz      s<    D!IC
s1v}((>>#u%t++r'   c               r:   )r   ry   r   r!   r   r"   r#   r$   r%   r&   r&      s     + +3 +5 +r'   c                s    V ^ 8  d   \        R4      hV '       g   R# V P                  4       ^,           ^,          p\        P                  ! W4      # )z!Storage format for signed bigint.znegative mpint not allowedr'   )rK   
bit_lengthr   Zint_to_bytes)ry   ZnbytesrM   r%   	_to_mpintr|      sB    
Qw566nn"q(Fc**r'   c                  s    ] tR t^t$ RtR]R&   RR R lltR R ltR	 R
 ltR R lt	R R lt
R R ltR R ltRR R lltR R ltRtR# )	_FragListz,Build recursive structure without data copy.zlist[utils.Buffer]flistNc               r:   )r   initzlist[utils.Buffer] | Noner!   r\   r"   r#   r$   r%   r&   _FragList.__annotate__  s     $ $6 $$ $r'   c                	s^    . V n         V'       d   V P                   P                  V4       R # R # N)r~   extend)selfr   r^   r%   __init__Z_FragList.__init__  s#    
JJd# r'   c               r:   )r   ry   rT   r!   r\   r"   r#   r$   r%   r&   r     s      < D r'   c                s<    V P                   P                  V4       R# )zAdd plain bytesN)r~   appendr   ry   r^   r%   put_rawZ_FragList.put_raw  s    

#r'   c               r:   r   ry   r   r!   r\   r"   r#   r$   r%   r&   r          C C3 C4 Cr'   c                s^    V P                   P                  VP                  ^RR7      4       R# )zBig-endian uint32rm   Zlengthro   Nr~   r   Zto_bytesr   r^   r%   put_u32Z_FragList.put_u32  !    

#,,a5,ABr'   c               r:   r   r"   r#   r$   r%   r&   r     r   r'   c                s^    V P                   P                  VP                  ^RR7      4       R# )zBig-endian uint64rm   r   Nr   r   r^   r%   put_u64Z_FragList.put_u64  r   r'   c               r:   )r   ry   zbytes | _FragListr!   r\   r"   r#   r$   r%   r&   r     s     ) )/ )D )r'   c                s>   \        V\        \        \        34      '       d8   V P	                  \        V4      4       V P                  P                  V4       R# V P	                  VP                  4       4       V P                  P                  VP                  4       R# )zBytes prefixed with u32 lengthN)
r=   r   ri   	bytearrayr   r]   r~   r   sizer   r   r^   r%   
put_sshstrZ_FragList.put_sshstr  s`    cE:y9::LLS"JJc"LL$JJcii(r'   c               r:   r   r"   r#   r$   r%   r&   r     s     ( (S (T (r'   c                s:    V P                  \        V4      4       R# )z*Big-endian bigint prefixed with u32 lengthN)r   r|   r   r^   r%   	put_mpintZ_FragList.put_mpint  s    	#'r'   c                   V ^8  d   QhRR/# r   r!   r   r"   r#   r$   r%   r&   r      s     ) )c )r'   c                sH    \        \        \        V P                  4      4      # )zCurrent number of bytes)ZsumZmapr]   r~   r   ra   r%   r   Z_FragList.size   s    3sDJJ'((r'   c               s$    V ^8  d   QhRRRRRR/# )r   dstbufri   posr   r!   r"   r#   r$   r%   r&   r   $  s!      Z c # r'   c                sZ    V P                    F  p\        V4      pY"V,           r%W1WR% K  	  V# )zWrite into bytearray)r~   r]   )r   r   r   ZfragZflenstarts   &&&   r%   renderZ_FragList.render$  s1    JJDt9DDj3 $5  
r'   c               r   r   r!   r   r"   r#   r$   r%   r&   r   ,  s       r'   c                s    \        \        V P                  4       4      4      pV P                  V4       VP	                  4       # )zReturn as bytes)ri   r   r   r   tobytes)r   bufrM   r%   r   Z_FragList.tobytes,  s/    499;/0C{{}r'   )r~   r   r    )r3   r4   r5   r6   __doc__r7   r   r   r   r   r   r   r   r   r   r8   r"   r'   r%   r}   r}      s?    6$
CC)() r'   r}   c                  V    ] tR tRtRtR R ltR R ltR R ltR	 R
 ltR R lt	Rt
R# )_SSHFormatRSAi3  zTFormat for RSA keys.

Public:
    mpint e, n
Private:
    mpint n, e, d, iqmp, p, q
c               r:   )r   rS   ri   r!   z"tuple[tuple[int, int], memoryview]r"   r#   r$   r%   r&   _SSHFormatRSA.__annotate__<  s      	+r'   c                s@    \        V4      w  r!\        V4      w  r1W#3V3# )zRSA public fieldsrz   )r   rS   erw      &&  r%   
get_publicZ_SSHFormatRSA.get_public<  s(     T"T"vt|r'   c               r:   )r   rS   ri   r!   z#tuple[rsa.RSAPublicKey, memoryview]r"   r#   r$   r%   r&   r   D  s         	, r'   c                s    V P                  V4      w  w  r#p\        P                  ! W#4      pVP                  4       pWQ3# )zMake RSA public key from data.)r   r   RSAPublicNumbersr@   )r   rS   r   rw   public_numbersr@      &&    r%   load_publicZ_SSHFormatRSA.load_publicD  s?     t,--a3#..0
r'   c               r[   )r   rS   ri   unsafe_skip_rsa_key_validationr    r!   z$tuple[rsa.RSAPrivateKey, memoryview]r"   r#   r$   r%   r&   r   M  s$     ! !!KO!	-!r'   c           	     s   \        V4      w  rA\        V4      w  rQ\        V4      w  ra\        V4      w  rq\        V4      w  r\        V4      w  rWT3V8w  d   \        R4      h\        P                  ! Wh4      p
\        P                  ! Wi4      p\        P
                  ! WT4      p\        P                  ! WWjWV4      pVP                  VR7      pW3# )zMake RSA private key from data.z Corrupt data: rsa field mismatchr   )rz   rK   r   Zrsa_crt_dmp1Zrsa_crt_dmq1r   ZRSAPrivateNumbersprivate_key)r   rS   	pubfieldsr   rw   r   diqmppqZdmp1Zdmq1r   private_numbersr   s   &&&&           r%   load_privateZ_SSHFormatRSA.load_privateM  s     T"T"T"%
T"T"6Y?@@%%--a3//!4~
 &11+I 2 
   r'   c               r[   )r   r@   zrsa.RSAPublicKeyf_pubr}   r!   r\   r"   r#   r$   r%   r&   r   e  s$        * 3< 	 r'   c                s    VP                  4       pVP                  VP                  4       VP                  VP                  4       R# )zWrite RSA public keyN)r   r   r   rw   )r   r@   r   Zpubn   &&& r%   encode_publicZ_SSHFormatRSA.encode_publice  s2     ((*r'   c               r[   )r   r   zrsa.RSAPrivateKeyf_privr}   r!   r\   r"   r#   r$   r%   r&   r   m  s$     , ,,,6?,	,r'   c                s   VP                  4       pVP                  pVP                  VP                  4       VP                  VP                  4       VP                  VP
                  4       VP                  VP                  4       VP                  VP                  4       VP                  VP                  4       R# )zWrite RSA private keyN)	r   r   r   rw   r   r   r   r   r   )r   r   r   r   r      &&&  r%   encode_privateZ_SSHFormatRSA.encode_privatem  s     &557(77))*))***+--.**+**+r'   r"   Nr3   r4   r5   r6   r   r   r   r   r   r   r8   r"   r'   r%   r   r   3  s%     !0 , ,r'   r   c                  b    ] tR tRtRtR R ltR R ltR R ltR	 R
 ltR R lt	R R lt
RtR# )_SSHFormatDSAi}  zTFormat for DSA keys.

Public:
    mpint p, q, g, y
Private:
    mpint p, q, g, y, x
c               r:   )r   rS   ri   r!   ztuple[tuple, memoryview]r"   r#   r$   r%   r&   _SSHFormatDSA.__annotate__  s     " "z ".F "r'   c                sv    \        V4      w  r!\        V4      w  r1\        V4      w  rA\        V4      w  rQW#WE3V3# )zDSA public fieldsr   )r   rS   r   r   gyr   r%   r   Z_SSHFormatDSA.get_public  sA    T"T"T"T"a|T!!r'   c               r:   )r   rS   ri   r!   z#tuple[dsa.DSAPublicKey, memoryview]r"   r#   r$   r%   r&   r     s     	  	 	 	,	 r'   c                s    V P                  V4      w  w  r#rEp\        P                  ! W#V4      p\        P                  ! WV4      pV P	                  V4       VP                  4       pW3# )zMake DSA public key from data.)r   r   DSAParameterNumbersDSAPublicNumbers	_validater@   )	r   rS   r   r   r   r   parameter_numbersr   r@   s	   &&       r%   r   Z_SSHFormatDSA.load_public  sa     "__T2qd33A!<--aC~&#..0
r'   c               r[   )r   rS   ri   r   r    r!   z$tuple[dsa.DSAPrivateKey, memoryview]r"   r#   r$   r%   r&   r     s$     ! !!KO!	-!r'   c                s@   V P                  V4      w  w  rErgp\        V4      w  rWEWg3V8w  d   \        R4      h\        P                  ! WEV4      p	\        P
                  ! Wy4      p
V P                  V
4       \        P                  ! W4      pVP                  4       pW3# )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r   rz   rK   r   r   r   r   ZDSAPrivateNumbersr   )r   rS   r   r   r   r   r   r   xr   r   r   r   s   &&&&         r%   r   Z_SSHFormatDSA.load_private  s     "__T2qdT"!<9$?@@33A!<--aC~&//B%113  r'   c               r[   )r   r@   zdsa.DSAPublicKeyr   r}   r!   r\   r"   r#   r$   r%   r&   r     s$     * ***3<*	*r'   c                s8   VP                  4       pVP                  pV P                  V4       VP                  VP                  4       VP                  VP
                  4       VP                  VP                  4       VP                  VP                  4       R# )zWrite DSA public keyN)r   r   r   r   r   r   r   r   )r   r@   r   r   r   r   r%   r   Z_SSHFormatDSA.encode_public  su     $224*<<~&)++,)++,)++,(()r'   c               r[   )r   r   zdsa.DSAPrivateKeyr   r}   r!   r\   r"   r#   r$   r%   r&   r     s$     : :,:6?:	:r'   c                s    V P                  VP                  4       V4       VP                  VP                  4       P                  4       R# )zWrite DSA private keyN)r   r@   r   r   r   )r   r   r   rY   r%   r   Z_SSHFormatDSA.encode_private  s:     	;113V<446889r'   c               r:   )r   r   zdsa.DSAPublicNumbersr!   r\   r"   r#   r$   r%   r&   r     s     D D(< D Dr'   c                	sr    VP                   pVP                  P                  4       R 8w  d   \        R4      hR# )i   z#SSH supports only 1024 bit DSA keysN)r   r   r{   rK   )r   r   r      && r%   r   Z_SSHFormatDSA._validate  s6    *<<))+t3BCC 4r'   r"   N)r3   r4   r5   r6   r   r   r   r   r   r   r   r8   r"   r'   r%   r   r   }  s,    "	 ! *:D Dr'   r   c                  r   )_SSHFormatECDSAi  zvFormat for ECDSA keys.

Public:
    str curve
    bytes point
Private:
    str curve
    bytes point
    mpint secret
c               r:   )r   ssh_curve_namer   rP   ec.EllipticCurver"   r#   r$   r%   r&   _SSHFormatECDSA.__annotate__  s      u 5E r'   c                	s    Wn         W n        R # r   )r   rP   )r   r   rP   rY   r%   r   Z_SSHFormatECDSA.__init__  s    ,
r'   c               r:   )r   rS   ri   r!   z0tuple[tuple[memoryview, memoryview], memoryview]r"   r#   r$   r%   r&   r     s     
$ 
$
$	9
$r'   c                s    \        V4      w  r!\        V4      w  r1W P                  8w  d   \        R4      hV^ ,          ^8w  d   \        R4      hW#3V3# )zECDSA public fieldszCurve name mismatchzNeed uncompressed point)rx   r   rK   ZNotImplementedError)r   rS   rP   pointr   r%   r   Z_SSHFormatECDSA.get_public  sX     "$'!$''''2338q=%&?@@~t##r'   c               r:   r   rS   ri   r!   z,tuple[ec.EllipticCurvePublicKey, memoryview]r"   r#   r$   r%   r&   r     s         	5 r'   c                s    V P                  V4      w  w  r#p\        P                  P                  V P                  VP                  4       4      pWA3# z Make ECDSA public key from data.)r   r	   rA   Zfrom_encoded_pointrP   r   )r   rS   _r   r@   s   &&   r%   r   Z_SSHFormatECDSA.load_public  sI      ??40
D..AAJJ

 r'   c               r[   )r   rS   ri   r   r    r!   z-tuple[ec.EllipticCurvePrivateKey, memoryview]r"   r#   r$   r%   r&   r     s$     
! 
!
!KO
!	6
!r'   c                s    V P                  V4      w  w  rEp\        V4      w  raWE3V8w  d   \        R4      h\        P                  ! W`P
                  4      pWq3# )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r   rz   rK   r	   Zderive_private_keyrP   )r   rS   r   r   Z
curve_namer   secretr   s   &&&&    r%   r   Z_SSHFormatECDSA.load_private  sZ     %)OOD$9!T!$')+ABB++FJJ?  r'   c               r[   )r   r@   rO   r   r}   r!   r\   r"   r#   r$   r%   r&   r     s$        3 <E 	 r'   c                s    VP                  \        P                  \        P                  4      pVP                  V P                  4       VP                  V4       R# )zWrite ECDSA public keyN)public_bytesr   ZX962r   ZUncompressedPointr   r   )r   r@   r   r   r   r%   r   Z_SSHFormatECDSA.encode_public  sG     ''MM<99
 	,,-r'   c               r[   )r   r   zec.EllipticCurvePrivateKeyr   r}   r!   r\   r"   r#   r$   r%   r&   r     s$     8 858?H8	8r'   c                s    VP                  4       pVP                  4       pV P                  W24       VP                  VP                  4       R# )zWrite ECDSA private keyN)r@   r   r   r   Zprivate_value)r   r   r   r@   r   r   r%   r   Z_SSHFormatECDSA.encode_private  sB     !++-
%557:.667r'   )rP   r   N)r3   r4   r5   r6   r   r   r   r   r   r   r   r8   r"   r'   r%   r   r     s*    	
$ 
! 8 8r'   r   c                  r   )_SSHFormatEd25519i
  zfFormat for Ed25519 keys.

Public:
    bytes point
Private:
    bytes point
    bytes secret_and_point
c               r:   )r   rS   ri   r!   z$tuple[tuple[memoryview], memoryview]r"   r#   r$   r%   r&   _SSHFormatEd25519.__annotate__  s      	-r'   c                s&    \        V4      w  r!V3V3# )zEd25519 public fields)rx   )r   rS   r   r   r%   r   Z_SSHFormatEd25519.get_public  s     "$'x~r'   c               r:   r   rS   ri   r!   z+tuple[ed25519.Ed25519PublicKey, memoryview]r"   r#   r$   r%   r&   r     s         	4 r'   c                s    V P                  V4      w  w  r!\        P                  P                  VP	                  4       4      pW13# z"Make Ed25519 public key from data.)r   r
   rI   Zfrom_public_bytesr   )r   rS   r   r@   r   r%   r   Z_SSHFormatEd25519.load_public  s@     .--??MMO

 r'   c               r[   )r   rS   ri   r   r    r!   z,tuple[ed25519.Ed25519PrivateKey, memoryview]r"   r#   r$   r%   r&   r   %  s$     ! !!KO!	5!r'   c                s    V P                  V4      w  w  rA\        V4      w  rQVR,          pVR,          pWG8w  g	   V3V8w  d   \        R4      h\        P                  P                  V4      pW3# )z#Make Ed25519 private key from data.:N    N:r   NNz$Corrupt data: ed25519 field mismatch)r   rx   rK   r
   rH   Zfrom_private_bytes)	r   rS   r   r   r   Zkeypairr   Zpoint2r   s	   &&&&     r%   r   Z_SSHFormatEd25519.load_private%  sm     .#D)?uh)3CDD//BB6J  r'   c               r[   )r   r@   zed25519.Ed25519PublicKeyr   r}   r!   r\   r"   r#   r$   r%   r&   r   3  s$     ) )2);D)	)r'   c                s    VP                  \        P                  \        P                  4      pVP	                  V4       R# )zWrite Ed25519 public keyN)r   r   Rawr   r   )r   r@   r   raw_public_keyr   r%   r   Z_SSHFormatEd25519.encode_public3  s3     $00LL,**
 	(r'   c               r[   )r   r   zed25519.Ed25519PrivateKeyr   r}   r!   r\   r"   r#   r$   r%   r&   r   <  s$     % %4%>G%	%r'   c                sL   VP                  4       pVP                  \        P                  \        P                  \        4       4      pVP                  \        P                  \        P                  4      p\        WE.4      pV P                  W24       VP                  V4       R# )zWrite Ed25519 private keyN)r@   Zprivate_bytesr   r   r   r   r   r   r}   r   r   )r   r   r   r@   Zraw_private_keyr   Z	f_keypairs   &&&    r%   r   Z _SSHFormatEd25519.encode_private<  s     !++-
%33LL-++\^
 $00LL,**
 ?@	:.)$r'   r"   Nr   r"   r'   r%   r   r   
  s%     !)% %r'   r   c               r   )r   r!   rv   r"   r#   r$   r%   r&   r&   M  s     
 
; 
r'   c                s    \        V 4      w  rVP                  4       P                  R4      '       g   \        RV R24      hW3# )z
U2F application strings
s   ssh:z4U2F application string does not start with b'ssh:' (Z))rx   r   
startswithrK   )rS   ZapplicationrM   r%   load_applicationr   M  sT     $D)K ++G44}A
 	
 r'   c                  2    ] tR tRtRtR R ltR R ltRtR# )	_SSHFormatSKEd25519iZ  z
The format of a sk-ssh-ed25519@openssh.com public key is:

    string          "sk-ssh-ed25519@openssh.com"
    string          public key
    string          application (user-specified, but typically "ssh:")
c               r:   r   r"   r#   r$   r%   r&    _SSHFormatSKEd25519.__annotate__c  s         	4 r'   c                b    \        \        4      P                  V4      w  r!\        V4      w  r1W!3# r   )_lookup_kformatrJ   r   r   r   rS   r@   r   r   r%   r   Z_SSHFormatSKEd25519.load_publicc  s1     +<8DDTJ
"4(r'   c               r:   r   rS   ri   r!   ztyping.NoReturnr"   r#   r$   r%   r&   r   k       
 
z 
o 
r'   c                	r(   )z,sk-ssh-ed25519 private keys cannot be loadedr   r   rS   r^   r%   r   Z_SSHFormatSKEd25519.get_publick  s     #:
 	
r'   r"   Nr3   r4   r5   r6   r   r   r   r8   r"   r'   r%   r   r   Z  s     
 
r'   r   c                  r   )	_SSHFormatSKECDSAis  z
The format of a sk-ecdsa-sha2-nistp256@openssh.com public key is:

    string          "sk-ecdsa-sha2-nistp256@openssh.com"
    string          curve name
    ec_point        Q
    string          application (user-specified, but typically "ssh:")
c               r:   r   r"   r#   r$   r%   r&   _SSHFormatSKECDSA.__annotate__}  s         	5 r'   c                r   r   )r   _ECDSA_NISTP256r   r   r   r   r%   r   Z_SSHFormatSKECDSA.load_public}  s1     +?;GGM
"4(r'   c               r:   r   r"   r#   r$   r%   r&   r     r   r'   c                	r(   )z4sk-ecdsa-sha2-nistp256 private keys cannot be loadedr   r   r^   r%   r   Z_SSHFormatSKECDSA.get_public  s     #B
 	
r'   r"   Nr   r"   r'   r%   r   r   s  s     
 
r'   r   s   nistp256s   nistp384s   nistp521c               r   )r   rL   rT   r"   r#   r$   r%   r&   r&     s     F Fl Fr'   c                s    \        V \        4      '       g   \        V 4      P                  4       p V \        9   d   \        V ,          # \        RV : 24      h)z"Return valid format or throw errorzUnsupported key type: )r=   r   ri   r   _KEY_FORMATSr   )rL   ra   r%   r   r     sH    h&&h'//1<H%%
!7|D
EEr'   r   c          
     s,    V ^8  d   QhRRRRRRRRR	R
/# )r   rS   rT   r   rd   backend
typing.Anyr   r    r!   SSHPrivateKeyTypesr"   r#   r$   r%   r&   r&     sA     o o
oo o
 %)o or'   c               s   \         P                  ! RV 4       Ve   \         P                  ! RV4       \        P	                  V 4      pV'       g   \        R4      hVP                  ^4      pVP                  ^4      p\        P                  ! \        V 4      WV 4      p V P                  \        4      '       g   \        R4      h\        V 4      \        \        4      R p \        V 4      w  rp\        V 4      w  r\        V 4      w  r\        V 4      w  rV
^8w  d   \        R4      h\        V 4      w  r\        V4      w  r\!        V4      pVP#                  V4      w  r\%        V4       V\&        8w  g   V\&        8w  Ed   VP)                  4       pV\*        9  d   \-        RV: 24      hV\.        8w  d   \-        RV: 24      h\*        V,          P0                  p\*        V,          P2                  p\        V 4      w  pp \*        V,          P4                  '       d(   \7        V 4      p\        V4      V8w  d   \        R4      hM\%        V 4       \9        VV4       \        V	4      w  pp\        V4      w  pp\%        V4       \;        WVP)                  4       V4      pVP=                  4       p\        VP?                  V4      4      p\*        V,          P4                  '       d4   \A        V\B        4      '       g   Q h\%        VPE                  X4      4       MT\%        VPG                  4       4       M:V'       d   \I        R	4      h\        V 4      w  pp \%        V 4       ^p\9        VV4       \        V4      w  pp\        V4      w  ppVV8w  d   \        R
4      h\        V4      w  ppVV8w  d   \        R4      hVPK                  VVVR7      w  pp\        V4      w  ppV\L        R\        V4       8w  d   \        R4      h\A        V\N        PP                  4      '       d(   \R        PT                  ! R\         PV                  ^R7       V# )z.Load private key from OpenSSH custom encoding.rS   Nr   zNot OpenSSH private key formatzOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherz4Password was given but private key is not encrypted.zCorrupt data: broken checksumzCorrupt data: key type mismatchr   zCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release.Z
stacklevel),r   _check_byteslike_check_bytes_PEM_RCZsearchrK   r   Zendbinascii
a2b_base64ri   r   	_SK_MAGICr]   rx   rr   r   r   rb   _NONEr   r9   r   _BCRYPTr.   r1   r2   r   r_   rg   Z	decryptorupdater=   r   Zfinalize_with_tagfinalizere   r   _PADDINGr   rE   warningswarnDeprecatedIn40)rS   r   r   r   mZp1Zp2rc   kdfnameZ
kdfoptionsnkeysZpubdataZpub_key_typekformatr   Zciphername_bytesblklenr1   ZedataZtagr   Zkbufr   rf   ZdecZck1Zck2rL   r   r   s   &&&$                          r%   load_ssh_private_keyr     s    
64(:x0tA9::	
B	
qBz$/67D??9%%9::dC	N,-D #4(J%MG"4(J4.KEz122  %MG'0Ll+G ++G4IUg.%--/</&&'7&:;  g&):7+'FGG./99/088!$'t ()111+C3x7" !NOO # %( ,
d~T,Onn3::e,-()111c#89999..s34 (F  "$'tT%(%JC%JC
cz899 "%(OHe<:;; --'E . K 5!HAu 3u:&&899+s0011  		
 r'   c               s(    V ^8  d   QhRRRRRRRR/# )r   r   r   r   r   encryption_algorithmr   r!   r"   r#   r$   r%   r&   r&     s6     J' J'#J'J' 5J' 	J'r'   c                s   \         P                  ! RV4       \        V \        P                  4      '       d(   \
        P                  ! R\         P                  ^R7       \        V 4      p\        V4      p\        4       pV'       d   \        p\        V,          P                  p\        p\        p	\        V\         4      '       d   VP"                  e   VP"                  p	\$        P&                  ! ^4      p
VP)                  V
4       VP+                  V	4       \-        WaW4      pM\.        ;rh^pRp^p\$        P&                  ! ^4      pRp\        4       pVP)                  V4       VP1                  V P3                  4       V4       \        W.4      pVP)                  V4       VP5                  V V4       VP)                  V4       VP7                  \8        RVVP;                  4       V,          ,
           4       \        4       pVP7                  \<        4       VP)                  V4       VP)                  V4       VP)                  V4       VP+                  V4       VP)                  V4       VP)                  V4       VP;                  4       pVP;                  4       p\?        \A        VV,           4      4      pVPC                  V4       VV,
          pVe'   VPE                  4       PG                  VVV VVR 4       \I        VRV 4      # )z3Serialize private key with OpenSSH custom encoding.r   ISSH DSA key support is deprecated and will be removed in a future releaser   Nr'   )%r   r   r=   r   rE   r   r   r   rN   r   r}   _DEFAULT_CIPHERr9   r.   r   _DEFAULT_ROUNDSr   Z_kdf_roundsosurandomr   r   rg   r   r   r@   r   r   r   r   r   ri   r   r   Z	encryptorZupdate_intorZ   )r   r   r   rL   r   Zf_kdfoptionsrc   r   r   r   r   rf   r   ZcheckvalZcommentZf_public_keyZ	f_secretsZf_mainZslenZmlenr   Zofss   &&&                   r%   _serialize_ssh_private_keyr    s}    
z8,+s0011*  		
 !-Hh'G ;L$
j)33 +-HII$00<)55Fzz"~%V$J$?$$
Ezz!}HG ;LH%+002LA8./I";	2!hE9>>+;f+D!EFG [F
NN9
j!
g
l#
NN5
l#
i  >>D;;=D
Ytf}-
.C
MM#
+C $$ST]CI>3u:&&r'   c                  s    ] tR tRt^t^tRtR# )SSHCertificateTypeiw  r"   N)r3   r4   r5   r6   ZUSERZHOSTr8   r"   r'   r%   r  r  w  s    DDr'   r  c                  s   ] tR tRtR R lt]R R l4       tR R lt]R R	 l4       t]R
 R l4       t	]R R l4       t
]R R l4       t]R R l4       t]R R l4       t]R R l4       t]R R l4       tR R ltR R ltR R ltRtR# ) SSHCertificatei|  c          "     s\    V ^8  d   QhRRRRRRRRRRR	R
RRRRRRRRRRRRRRRRRRRRRR/# )r   _nonceri   _public_keySSHPublicKeyTypes_serialr   _cctype_key_id_valid_principalslist[bytes]_valid_after_valid_before_critical_optionsdict[bytes, bytes]_extensions	_sig_type_sig_key_inner_sig_type
_signature_tbs_cert_body_cert_key_typer   
_cert_bodyr"   r#   r$   r%   r&   SSHCertificate.__annotate__}  s     '- '-'- ''- 	'-
 '- '- ''- '- '- .'- ('- '- '- $'- '-  #!'-" #'-$ %'-r'   c                	s    Wn         W n        W0n         \        V4      V n        YPn        Y`n        Ypn        Yn	        Yn
        Yn        Yn        Yn        Yn        Yn        TT n        TT n        Yn        R#   \
         d    \        R 4      hi ; i)zInvalid certificate typeN)r	  r
  r  r  _typerK   r  r  r  r  r  r  r  r  r  r  r  r  r  )r   r	  r
  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  s   &&&&&&&&&&&&&&&&&&r%   r   ZSSHCertificate.__init__}  s    ( &	9+G4DJ !2(*!2&" .$,$,  	9788	9s   A6 6Bc               r   r   r"   r#   r$   r%   r&   r    s     " "u "r'   c                	,    \        V P                  4      # r   )r   r	  r   ra   r%   nonceZSSHCertificate.nonce  s    T[[!!r'   c               r   r   r!   SSHCertPublicKeyTypesr"   r#   r$   r%   r&   r    s     D D1 Dr'   c                	sL    \         P                  ! \        V P                  4      # r   )typingcastr"  r
  r   ra   r%   r@   ZSSHCertificate.public_key  s     {{0$2B2BCCr'   c               r   r   r"   r#   r$   r%   r&   r    s       r'   c                	    V P                   # r   )r  r   ra   r%   serialZSSHCertificate.serial  s    ||r'   c               r   )r   r!   r  r"   r#   r$   r%   r&   r    s      ( r'   c                	r%  r   )r  r   ra   r%   typeZSSHCertificate.type  s    zzr'   c               r   r   r"   r#   r$   r%   r&   r    s     # # #r'   c                	r  r   )r   r  r   ra   r%   key_idZSSHCertificate.key_id  s    T\\""r'   c               r   )r   r!   r  r"   r#   r$   r%   r&   r    s     & &+ &r'   c                	r%  r   )r  r   ra   r%   valid_principalsZSSHCertificate.valid_principals      %%%r'   c               r   r   r"   r#   r$   r%   r&   r    s     " "c "r'   c                	r%  r   )r  r   ra   r%   valid_beforeZSSHCertificate.valid_before  s    !!!r'   c               r   r   r"   r#   r$   r%   r&   r    s     ! !S !r'   c                	r%  r   )r  r   ra   r%   valid_afterZSSHCertificate.valid_after  s       r'   c               r   r   r!   r  r"   r#   r$   r%   r&   r    s     & &"4 &r'   c                	r%  r   )r  r   ra   r%   critical_optionsZSSHCertificate.critical_options  r*  r'   c               r   r-  r"   r#   r$   r%   r&   r    s        .  r'   c                	r%  r   )r  r   ra   r%   
extensionsZSSHCertificate.extensions  s    r'   c               r   r!  r"   r#   r$   r%   r&   r    s      4 r'   c                	s    \        V P                  4      pVP                  V P                  4      w  r#\	        V4       V# r   )r   r  r   r  rb   )r   Z	sigformatsignature_keyZsigkey_rests   &   r%   r0  ZSSHCertificate.signature_key  s5    #DNN3	%.%:%:4==%I"[!r'   c               r   r   r"   r#   r$   r%   r&   r    s     
 
e 
r'   c                	s    \        V P                  4      R ,           \        P                  ! \        V P                  4      RR7      ,           # )    F)Znewline)r   r  r   
b2a_base64r  r   ra   r%   r   ZSSHCertificate.public_bytes  s<    $%%&!!%"8%HI	
r'   c               r   )r   r!   r\   r"   r#   r$   r%   r&   r    s      t r'   c                	s(   V P                  4       p\        V\        P                  4      '       d;   VP	                  \        V P                  4      \        V P                  4      4       R # \        V\        P                  4      '       d   \        V P                  4      w  r#\        V4      w  rC\        V4       \        P                  ! W$4      p\        VP                  4      pVP	                  V\        V P                  4      \        P                   ! V4      4       R # \        V\"        P$                  4      '       g   Q hV P&                  \(        8X  d   \*        P,                  ! 4       pMWV P&                  \.        8X  d   \*        P0                  ! 4       pM,V P&                  \2        8X  g   Q h\*        P4                  ! 4       pVP	                  \        V P                  4      \        V P                  4      \6        P8                  ! 4       V4       R # r   )r0  r=   r
   rI   Zverifyr   r  r  r	   rA   rz   rb   
asym_utilsZencode_dss_signature_get_ec_hash_algrP   ECDSAr   rC   r  rD   r   ZSHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r   PKCS1v15)r   r0  rrS   sZcomputed_sighash_alg   &      r%   verify_cert_signatureZ$SSHCertificate.verify_cert_signature  so   **,mW%=%=>>  doo&d.A.A(B r'@'@AA 1GA &GA%::1@L'(;(;<H  eD$7$78"((8:L mS-=-=>>>>##x/!;;=%%8!==?++>>>!==?  doo&d))*  "	r'   )r  r  r  r  r  r  r	  r
  r  r  r  r  r  r  r  r  r  N)r3   r4   r5   r6   r   Zpropertyr   r@   r&  r'  r(  r)  r+  r,  r.  r/  r0  r   r?  r8   r"   r'   r%   r  r  |  s    '-R " "D
     # # & & " " ! ! & &    
 r'   r  c               r:   )r   rP   r   r!   zhashes.HashAlgorithmr"   r#   r$   r%   r&   r&     s      , 1E r'   c                sD   \        V \        P                  4      '       d   \        P                  ! 4       # \        V \        P
                  4      '       d   \        P                  ! 4       # \        V \        P                  4      '       g   Q h\        P                  ! 4       # r   )	r=   r	   	SECP256R1r   r7  	SECP384R1ZSHA384	SECP521R1r9  )rP   ra   r%   r4  r4    s_    %&&}}	E2<<	(	(}}%....}}r'   c               r:   r   rS   rT   r!   z"SSHCertificate | SSHPublicKeyTypesr"   r#   r$   r%   r&   r&     s"     \ \
\ (\r'   c                s*   \         P                  ! R V 4       \        P                  V 4      pV'       g   \	        R4      hVP                  ^4      ;r4VP                  ^4      pRpVP                  \        4      '       d   RpVR\        \        4      )  pV\        8X  d   V'       g   \        R4      h\        V4      p \        \        P                  ! V4      4      pT'       d   Tp	\#        T4      w  rY8w  d   \	        R4      hT'       d   \#        T4      w  rTP%                  T4      w  rT'       Ed   \'        T4      w  r\)        T4      w  r\#        T4      w  r\#        T4      w  pp. pT'       d+   \#        T4      w  ppTP+                  \-        T4      4       K2  \'        T4      w  pp\'        T4      w  pp\#        T4      w  pp\/        T4      p\#        T4      w  pp\/        T4      p\#        T4      w  pp\#        T4      w  pp\#        T4      w  ppT\        8X  d   T'       g   \        R4      hX	R\        T4      )  p\#        T4      w  pp\1        T4       \#        T4      w  pp T\2        8X  d   T\4        \6        \2        39  g   T\2        8w  d   TT8w  d   \	        R	4      h\#        T 4      w  p!p \1        T 4       \9        XTTTTTTTTTTTTT!TTT	4      # \1        T4       T#   \        \        P                   3 d    \	        R4      hi ; i)
rS   zInvalid line formatFTNz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r   _SSH_PUBKEY_RCZmatchrK   ZgroupZendswith_CERT_SUFFIXr]   rG   r   r   ri   r   r   re   ZErrorrx   r   ru   rr   r   r   _parse_exts_optsrb   rD   r6  r8  r  )"rS   _legacy_dsa_allowedr   rL   Zorig_key_typeZkey_bodyZ	with_certr   ZrestZ	cert_bodyZinner_key_typer   r@   r&  Zcctyper(  Z
principalsr)  Z	principalr,  r+  Zcrit_optionsr.  Zextsr/  r   Zsig_key_rawZsig_typeZsig_keyZtbs_cert_bodyZsignature_rawZinner_sig_typeZsig_rest	signatures"   &&                                r%   _load_ssh_public_identityrI    s    
64(T"A.// wwqz)HwwqzHI&&	0s<0018$7";
 	
 h'G+(--h78 	&t,N&-..!$'**40Jy~~"4(&t,
D$/
$;!Iz##E)$45$TNT%d^d(.d+L9 &
d%d+
d#4'-T'4'x(;&E  ",SYJ/)$/tT#.}#=   #_h?@("~'A@AA)(3	8X#
 	
( 	TK x~~& +)**+s   ?K+ +'Lc               r:   rC  r"   r#   r$   r%   r&   r&   f  s     + +
+'+r'   c                s    \        V 4      # r   )rI  r`   ra   r%   load_ssh_public_identityrJ  f  s     %T**r'   c               r:   )r   	exts_optsri   r!   r  r"   r#   r$   r%   r&   r&   l  s      
 /A r'   c                sF   / pR pV '       d   \        V 4      w  r0\        V4      pWA9   d   \        R4      hVe   WB8  d   \        R4      h\        V 4      w  rP\        V4      ^ 8  d)   \        V4      w  rV\        V4      ^ 8  d   \        R4      h\        V4      W&   TpK  V# )NzDuplicate namezFields not lexically sortedz!Unexpected extra data after value)rx   r   rK   r]   )rK  ZresultZ	last_namerQ   ZbnamevalueZextrar>  r%   rF  rF  l  s    !#FI
%i0T{?-.. U%6:;;&y1u:>&u-LE5zA~ !DEEe	Mr'   c               r[   )r   r;   r  hash_algorithmzhashes.MD5 | hashes.SHA256r!   r   r"   r#   r$   r%   r&   r&     s&      	. r'   c                s   \        V\        P                  \        P                  34      '       g   \	        R 4      h\        V 4      p\        V4      p\        4       pVP                  V4       VP                  W4       VP                  4       p\        P                  ! V4      pVP                  V4       VP                  4       # )z+hash_algorithm must be either MD5 or SHA256)r=   r   ZMD5r7  re   rN   r   r}   r   r   r   ZHashr   r   )r;   rM  rL   r   r   Zssh_binary_dataZhash_objs   &&     r%   ssh_key_fingerprintrN    s     nvzz6==&ABBEFF %Hh'GKE	X#%mmoO {{>*HOOO$r'   c               r[   )r   rS   rT   r   r   r!   r  r"   r#   r$   r%   r&   r&     s$      
!+r'   c                s    \        V R R7      p\        V\        4      '       d   VP                  4       pMTp\        V\        P
                  4      '       d(   \        P                  ! R\        P                  ^R7       V# )T)rG  r   r   )
rI  r=   r  r@   r   rF   r   r   r   r   )rS   r   Zcert_or_keyr@   r   r%   load_ssh_public_keyrO    sh     ,DdKK+~.. ++-
 
*c..//  		
 r'   c               r:   )r   r@   r  r!   r   r"   r#   r$   r%   r&   r&     s     + +): +u +r'   c                s   \        V \        P                  4      '       d(   \        P                  ! R\
        P                  ^R7       \        V 4      p\        V4      p\        4       pVP                  V4       VP                  W4       \        P                  ! VP                  4       4      P                  4       pRP!                  VRV.4      # )z&One-line public key format for OpenSSHr  r   r'   r1  )r=   r   rF   r   r   r   r   rN   r   r}   r   r   r   r2  r   striprW   )r@   rL   r   r   Zpubs   &    r%   serialize_ssh_public_keyrQ    s    *c..//*  		
 !,Hh'GKE	X*,


emmo
.
4
4
6C88XtS)**r'   i   c            
      s    ] tR tRtRRRR. RRR. . 3
R R lltR R ltR R	 ltR
 R ltR R ltR R lt	R t
R R ltR R ltR R ltR R ltR R ltRtR# )SSHCertificateBuilderi  NFc               s@    V ^8  d   QhRRRRRRRRR	R
RRRRRRRRRR/
# )r   r
  zSSHCertPublicKeyTypes | Noner  r0   r  zSSHCertificateType | Noner  rd   r  r  _valid_for_all_principalsr    r  r  r  zlist[tuple[bytes, bytes]]r  r"   r#   r$   r%   r&   "SSHCertificateBuilder.__annotate__  sn     ' '1' ' )	'
 ' '' $(' "' !' 5' /'r'   c                	s~    Wn         W n        W0n        W@n        WPn        W`n        Wpn        Wn        Wn        Wn	        R # r   
r
  r  r  r  r  rS  r  r  r  r  )r   r
  r  r  r  r  rS  r  r  r  r  s   &&&&&&&&&&&r%   r   ZSSHCertificateBuilder.__init__  s=     '
!2)B&*(!2&r'   c               r:   )r   r@   r"  r!   rR  r"   r#   r$   r%   r&   rT    s     
 
/
	
r'   c                	s   \        V\        P                  \        P                  \
        P                  34      '       g   \        R 4      hV P                  e   \        R4      h\        VV P                  V P                  V P                  V P                  V P                  V P                   V P"                  V P$                  V P&                  R7
      # )r<   zpublic_key already setrU  )r=   r	   rA   r   rC   r
   rI   re   r
  rK   rR  r  r  r  r  rS  r  r  r  r  )r   r@   r^   r%   r@   Z SSHCertificateBuilder.public_key  s     ))  ((
 
 233'566$"LL**LL"44&*&D&D,,**"44((
 	
r'   c               r:   )r   r&  r   r!   rR  r"   r#   r$   r%   r&   rT    s     
 
S 
%: 
r'   c                	s   \        V\        4      '       g   \        R 4      h^ Tu;8:  d   R8  g   M \        R4      hV P                  e   \        R4      h\        V P                  VV P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  R7
      # )zserial must be an integerz"serial must be between 0 and 2**64zserial already setrU              )r=   r   re   rK   r  rR  r
  r  r  r  rS  r  r  r  r  )r   r&  r^   r%   r&  ZSSHCertificateBuilder.serial  s    &#&&788F"U"ABB<<#122$((**LL"44&*&D&D,,**"44((
 	
r'   c               r:   )r   r'  r  r!   rR  r"   r#   r$   r%   r&   rT    s     
 
+ 
0E 
r'   c                	sT   \        V\        4      '       g   \        R 4      hV P                  e   \	        R4      h\        V P                  V P                  VV P                  V P                  V P                  V P                  V P                  V P                  V P                  R7
      # )z"type must be an SSHCertificateTypeztype already setrU  )r=   r  re   r  rK   rR  r
  r  r  r  rS  r  r  r  r  )r   r'  r^   r%   r'  ZSSHCertificateBuilder.type  s    $ 233@AA::!/00$((LLLL"44&*&D&D,,**"44((
 	
r'   c               r:   )r   r(  r   r!   rR  r"   r#   r$   r%   r&   rT  '  s     
 
U 
'< 
r'   c                	sT   \        V\        4      '       g   \        R 4      hV P                  e   \	        R4      h\        V P                  V P                  V P                  VV P                  V P                  V P                  V P                  V P                  V P                  R7
      # )zkey_id must be byteszkey_id already setrU  )r=   r   re   r  rK   rR  r
  r  r  r  rS  r  r  r  r  )r   r(  r^   r%   r(  ZSSHCertificateBuilder.key_id'  s    &%((233<<#122$((LL**"44&*&D&D,,**"44((
 	
r'   c               r:   )r   r)  r  r!   rR  r"   r#   r$   r%   r&   rT  :  s     "
 "
 +"
	"
r'   c                	s,   V P                   '       d   \        R 4      h\        ;QJ d    R V 4       F  '       d   K   RM	  RM! R V 4       4      '       d	   V'       g   \        R4      hV P                  '       d   \        R4      h\        V4      \        8  d   \        R4      h\        V P                  V P                  V P                  V P                  VV P                   V P                  V P                  V P                  V P                  R7
      # )zDPrincipals can't be set because the cert is valid for all principalsc              3  sB   "   T F  p\        V\        4      x  K  	  R # 5ir   )r=   r   )Z.0r   rM   r%   Z	<genexpr>Z9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>C  s     C2BQJq%((2Bs   FTz5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsrU  )rS  rK   Zallre   r  r]   _SSHKEY_CERT_MAX_PRINCIPALSrR  r
  r  r  r  r  r  r  r  )r   r)  r^   r%   r)  Z&SSHCertificateBuilder.valid_principals:  s     )))% 
 C2BCC2BCCC#G  !!!;<< #>>L  %((LL**LL.&*&D&D,,**"44((
 	
r'   c                	sT   V P                   '       d   \        R 4      hV P                  '       d   \        R4      h\        V P                  V P
                  V P                  V P                  V P                   RV P                  V P                  V P                  V P                  R7
      # )z@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTrU  )r  rK   rS  rR  r
  r  r  r  r  r  r  r  r   ra   r%   valid_for_all_principalsZ.SSHCertificateBuilder.valid_for_all_principals^  s    !!!+  )))CDD$((LL**LL"44&*,,**"44((
 	
r'   c               r:   )r   r+  int | floatr!   rR  r"   r#   r$   r%   r&   rT  t  s     
 
 
9N 
r'   c                	s   \        V\        \        34      '       g   \        R 4      h\        V4      pV^ 8  g   VR8  d   \	        R4      hV P
                  e   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  VV P                  V P                  V P                  R7
      # )z$valid_before must be an int or floatzvalid_before must [0, 2**64)zvalid_before already setrU  rV  )r=   r   floatre   rK   r  rR  r
  r  r  r  r  rS  r  r  r  )r   r+  r^   r%   r+  Z"SSHCertificateBuilder.valid_beforet  s    ,e55BCC<(!|u4;<<)788$((LL**LL"44&*&D&D&**"44((
 	
r'   c               r:   )r   r,  rY  r!   rR  r"   r#   r$   r%   r&   rT    s     
 
{ 
7L 
r'   c                	s   \        V\        \        34      '       g   \        R 4      h\        V4      pV^ 8  g   VR8  d   \	        R4      hV P
                  e   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  V P                  VV P                  V P                  R7
      # )z#valid_after must be an int or floatzvalid_after must [0, 2**64)zvalid_after already setrU  rV  )r=   r   rZ  re   rK   r  rR  r
  r  r  r  r  rS  r  r  r  )r   r,  r^   r%   r,  Z!SSHCertificateBuilder.valid_after  s    +U|44ABB+&?kU2:;;(677$((LL**LL"44&*&D&D,,$"44((
 	
r'   c               $    V ^8  d   QhRRRRRR/# r   rQ   r   rL  r!   rR  r"   r#   r$   r%   r&   rT    $     
 

"'
	
r'   c                	s   \        V\        4      '       d   \        V\        4      '       g   \        R 4      hYP                   UUu. uF  w  rVNK	  	  upp9   d   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  . V P                  OXV3NV P                  R7
      # u uppi )name and value must be byteszDuplicate critical option namerU  )r=   r   re   r  rK   rR  r
  r  r  r  r  rS  r  r  r  r   rQ   rL  r   r   r%   add_critical_optionZ)SSHCertificateBuilder.add_critical_option  s     $&&j.F.F:;;(>(>?(>WTD(>??=>>$((LL**LL"44&*&D&D,,**F 6 6FuF((
 	
 @   C&c               r[  r\  r"   r#   r$   r%   r&   rT    r]  r'   c                	s   \        V\        4      '       d   \        V\        4      '       g   \        R 4      hYP                   UUu. uF  w  rVNK	  	  upp9   d   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  . V P                  OXV3NR7
      # u uppi )r^  zDuplicate extension namerU  )r=   r   re   r  rK   rR  r
  r  r  r  r  rS  r  r  r  r_  r   r%   add_extensionZ#SSHCertificateBuilder.add_extension  s     $&&j.F.F:;;(8(89(8WTD(899788$((LL**LL"44&*&D&D,,**"44:$**:T5M:
 	
 :ra  c               r:   )r   r   SSHCertPrivateKeyTypesr!   r  r"   r#   r$   r%   r&   rT    s     G
 G
 6 G
> G
r'   c           
     	s   \        V\        P                  \        P                  \
        P                  34      '       g   \        R 4      hV P                  f   \        R4      hV P                  f   ^ MV P                  pV P                  f   \        R4      hV P                  f   RMV P                  pV P                  '       g   V P                  '       g   \        R4      hV P                  f   \        R4      hV P                   f   \        R4      hV P                   V P                  8  d   \        R4      hV P"                  P%                  R R	7       V P&                  P%                  R
 R	7       \)        V P                  4      pV\*        ,           p\,        P.                  ! ^ 4      p\1        V4      p\3        4       pVP5                  V4       VP5                  V4       VP7                  V P                  V4       VP9                  V4       VP;                  V P                  P<                  4       VP5                  V4       \3        4       p	V P                   F  p
V	P5                  V
4       K  	  VP5                  V	P?                  4       4       VP9                  V P                   4       VP9                  V P                  4       \3        4       pV P"                   Fs  w  rVP5                  V4       \A        V4      ^ 8  d=   \3        4       pVP5                  V4       VP5                  VP?                  4       4       Kb  VP5                  V4       Ku  	  VP5                  VP?                  4       4       \3        4       pV P&                   Fs  w  rVP5                  V4       \A        V4      ^ 8  d=   \3        4       pVP5                  V4       VP5                  VP?                  4       4       Kb  VP5                  V4       Ku  	  VP5                  VP?                  4       4       VP5                  R4       \)        V4      p\1        V4      p\3        4       pVP5                  V4       VP7                  VPC                  4       V4       VP5                  VP?                  4       4       \        V\
        P                  4      '       dm   VPE                  VP?                  4       4      p\3        4       pVP5                  V4       VP5                  V4       VP5                  VP?                  4       4       EM\        V\        P                  4      '       d   \G        VPH                  4      pVPE                  VP?                  4       \        PJ                  ! V4      4      p\L        PN                  ! V4      w  pp\3        4       pVP5                  V4       \3        4       pVPQ                  V4       VPQ                  V4       VP5                  VP?                  4       4       VP5                  VP?                  4       4       M\        V\        P                  4      '       g   Q h\3        4       pVP5                  \R        4       VPE                  VP?                  4       \T        PV                  ! 4       \X        PZ                  ! 4       4      pVP5                  V4       VP5                  VP?                  4       4       \\        P^                  ! VP?                  4       4      Pa                  4       p\b        Pd                  ! \f        \i        RPk                  VRV.4      4      4      # )zUnsupported private key typezpublic_key must be setztype must be setr'   zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                    V ^ ,          # r   r"   r   ra   r%   <lambda>,SSHCertificateBuilder.sign.<locals>.<lambda>  s    !A$r'   )r;   c                rd  r   r"   re  ra   r%   rf  rg    s    AaDr'   r1  )6r=   r	   r>   r   rB   r
   rH   re   r
  rK   r  r  r  r  rS  r  r  r  Zsortr  rN   rE  r  r  r   r}   r   r   r   r   rL  r   r]   r@   signr4  rP   r5  r3  Zdecode_dss_signaturer   r8  r   r:  r   r9  r   r2  rP  r#  r$  r  rJ  rW   )r   r   r&  r(  rL   Zcert_prefixr   r   ZfZfprincipalsr   ZfcritrQ   rL  ZfoptvalZfextZfextvalZca_typeZcaformatZcafrH  Zfsigr=  r;  r<  ZfsigblobZ	cert_datas   &&                         r%   rh  ZSSHCertificateBuilder.sign  si   **!!))
 
 :;;#566 ll*::/00 ,$,, %%%d.L.L.L 
 %788$677t111LMM 	###7.1$T%5%56- 

2!(+K	[!	Ud..2			&			$**""#	Vk''A""1% (	[((*+			$##$			$$$%11KDT"5zA~#+""5)  !23  ' 2 	
U]]_%{++KDOOD!5zA~#+""5) 12& , 	
T\\^$	S#K0"7+kw{557=	S[[]# k7#<#<==#((5I;DOOG$OOI&LL(R%?%?@@'(9(9:H#((bhhx6HII229=DAq;DOOG$ {Hq!q!OOH,,./LL( k3+<+<====
 ;DOOO,#((		W--/I OOI&LL(''		4::<	 {{$SXX{D).L%MN
 	
r'   )
r  r  r  r
  r  r  r  r  rS  r  )r3   r4   r5   r6   r   r@   r&  r'  r(  r)  rX  r+  r,  r`  rb  rh  r8   r"   r'   r%   rR  rR    sf     59"+/ $)+*/$(#'7913'0
8
*
&
&"
H
,
,
,
,
,G
 G
r'   rR  )Fr   )__conditional_annotations__Z
__future__r   r   Zenumr  Zrer#  r   Zbase64r   rX   Zdataclassesr   Zcryptographyr   Zcryptography.exceptionsr   Zcryptography.hazmat.primitivesr   Z)cryptography.hazmat.primitives.asymmetricr   r	   r
   r   r   r3  Z&cryptography.hazmat.primitives.ciphersr   r   r   r   Z,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   Zbcryptr   r)   Z_bcrypt_supportedZImportErrorrJ   rD   rG   r   Z_ECDSA_NISTP384Z_ECDSA_NISTP521rE  Z_SK_SSH_ED25519Z_SK_SSH_ECDSA_NISTP256r6  r8  ZcompilerD  r   Z	_SK_STARTZ_SK_ENDr   r   r  r  ZDOTALLr   ri   r   Zranger   r*   ZAESZCTRZCBCZGCMr9   r7   rR   rN   r?   rZ   r_   rb   rg   rr   ru   rx   rz   r|   r}   r   r   r   r   r   r   r   r@  rA  rB  r   r   ZUnionr>   rB   rE   rH   r   r   r  rA   rC   rF   rI   r  r"  ZEnumr  r  r4  rI  rJ  rF  rN  rO  rQ  rc  rW  rR  )ri  s   @r%   <module>rj     sB  
 # "   	 	   0 !  8 1  J  9) (((' 0>  "!23	2	
.
 **Y)G3RYY
? ia 012    :NNYY :NNYY zNNYY ')% @ &' %eO<:8,??,+3 3lG, G,TCD CDLD8 D8N@% @%F

 
2
 
6 momo#%_[",,.A_[",,.A_[",,.A(*-/	F \\ o
 ,1o odJ'Z LL    
~ ~B\~+(,(+(    " I
 I
y$  
99 9
9s   2O O21O2