
    wBf,                       d Z ddlmZ ddlZddlZddlZddlZddlmZ ddl	m
Z
 ddlmZ 	 ddlmZmZ ddlmZmZmZ dd	lmZ ddlmZ ddlmZmZ ddlmZ ddlm Z  ddl!m"Z" ddl#m$Z$m%Z% ddl&m'Z' ddl(m)Z)m*Z* erddl+m,Z,  e
e-      Z. ej^                  d      Z0 G d d      Z1 e1       Z2y# e$ r  G d
 de      ZY |w xY w)z0Interface between conda-content-trust and conda.    )annotationsN)	lru_cache)	getLogger)Path)verify_delegationverify_root)SignatureErrorload_metadata_from_filewrite_metadata_to_file)wrap_as_signablec                      e Zd Zy)r	   N)__name__
__module____qualname__     Blib/python3.12/site-packages/conda/trust/signature_verification.pyr	   r	      s    r   r	   )TYPE_CHECKING   )CONDA_PACKAGE_EXTENSION_V1CONDA_PACKAGE_EXTENSION_V2)context)join_url)
SubdirData)	HTTPErrorInsecureRequestWarning)get_session   )INITIAL_TRUST_ROOTKEY_MGR_FILE)PackageRecordz(?P<number>\d+)\.root\.jsonc                      e Zd Ze ed      d
d              Ze ed      dd              Ze ed      dd              Z	 d	 	 	 	 	 ddZddZ		 	 	 	 	 	 	 	 ddZ
edd	       Zy)_SignatureVerificationN)maxsizec                   t         j                  syt         j                  st        j	                  d       y	 dd l}t        t         j                        j                  dd       | j                  t        j	                  d       y| j                  t        j	                  d       yy# t        $ r t        j	                  d       Y yw xY w)	NFz[metadata signature verification requested, but no metadata URL base has not been specified.r   zVmetadata signature verification requested, but `conda-content-trust` is not installed.T)parentsexist_okzDcould not find trusted_root data for metadata signature verificationz?could not find key_mgr data for metadata signature verification)r   extra_safety_checkssigning_metadata_url_baselogwarnconda_content_trustImportErrorr   av_data_dirmkdirtrusted_rootkey_mgr)selfr,   s     r   enabledz_SignatureVerification.enabled2   s     ** 00HHC 	& 	W  !''t'D $HHV  <<HHVW /  	HH> 	s   B, ,CCc                   d }	 t        j                  t        j                        D ci c]>  }t        j                  |j                        x}rt        |j                  d            |@ }}t        |j                         d      D ]+  \  }}t        j                  d| d       	 t        |      } n 	 |s-t        j%                  dt        j                   d       t&        }	 |d   d	   d
z    d}t)        t        j                  |      }	 | j+                  t        j,                  |      }t/        ||       t1        |x}|       dc c}w # t        t        t         f$ r Y w xY w# t        t"        t         f$ r Y w xY w# t2        $ r9}	|	j4                  j6                  dk7  rt        j9                  |	       Y d }	~	|S d }	~	wt:        $ r }	t        j9                  |	       Y d }	~	|S d }	~	ww xY w)NnumberT)reversezLoading root metadata from .zNo root metadata in z. Using built-in root metadata.signedversionr   z
.root.jsoni  )osscandirr   r.   RE_ROOT_METADATAmatchnameintgroupsorteditemsr*   infor
   IsADirectoryErrorFileNotFoundErrorPermissionErrorNotADirectoryErrordebugr   r   _fetch_channel_signing_datar)   r   r   r   responsestatus_codeerror	Exception)
r2   trustedentrympaths_fnamepath	untrustederrs
             r   r0   z#_SignatureVerification.trusted_root^   s     $	  ZZ(;(;<)//

;;A; AGGH%&-E  #5;;=$? 
56ugQ?@5e<G 
 II&w':':&; <0 0 )G x(3a78
CE++U3DC <<55	
 GY/ ')';wTB3 A *+<oN  	 "#5G 	 		P   <<++s2IIcN   		#
 sY   %E+ AE,E+ )E,F E+ E('E(+FF	G..GG.G))G.c                (   d }t         }t        t        j                  |      }	 | j	                  t        j
                  |      }t        d|| j                         t        |x}|       |s|j%                         rt'        |      }|S # t        $ r}t        j                  |       Y d }~Bd }~wt        $ rZ}t        j                  t        |      xs0 |j                  j                   d|j                   j"                   d       Y d }~d }~ww xY w)Nr1   z ())r    r   r   r.   rI   r)   r   r0   r   ConnectionErrorr*   r+   r   str	__class__r   rJ   rK   existsr
   )r2   rN   rS   rT   rU   rV   s         r   r1   z_SignatureVerification.key_mgr   s      $ G''/	?8811I
 iD4E4EF #i#77> 4;;=-d3G!  	HHSMM 	 HHCTs}}556b9Q9Q8RRST 	s$   7B 	DB++D7ADDc                >   t        |      }t        j                  st        j                  dt
               ddd}|r||d<   |r||d<   t        j                  }	 dt        _        |j                  t        ||      ||j                  d t        j                  t        j                  f      }|j                          |t        _        	 |j                         S # |t        _        w xY w# t        j                  j                  $ r}	t!        d	| d
|       d }	~	ww xY w)Nignorez!gzip, deflate, compress, identityzapplication/json)zAccept-EncodingzContent-TypezIf-None-MatchzIf-Modified-SinceF)headersproxiesauthtimeoutzInvalid JSON returned from /)r   r   
ssl_verifywarningssimplefilterr   add_anaconda_tokengetr   r`   remote_connect_timeout_secsremote_read_timeout_secsraise_for_statusjsondecoderJSONDecodeError
ValueError)
r2   signing_data_urlfilenameetag	mod_stampsessionr_   saved_token_settingresprV   s
             r   rI   z2_SignatureVerification._fetch_channel_signing_data   s     ./!!!!(,BC  C.
 '+GO$+4G'(%88	= */G&;;)847744  	D !!#)<G&	99; *=G& ||++ 	-.>-?q
K 	s%   A#C 	C) C&)DDDc                   t        |j                  |      j                  j                         \  }}d|vr4|j                  j                  d|j                  j                   d       y |d   }|j                  |vr*|j                  j                  d|j                   d       y ||j                     }|j                  j                  t              r|d   |j                     }n=|j                  j                  t              r|d   |j                     }nt        d      t        |      }||d<   	 t        d|| j                         t        j!                  d	|j                          |j                  j                  d
       y # t"        $ r@ t        j%                  d|j                          |j                  j                  d       Y y w xY w)N)repodata_fn
signaturesz(no signatures found for rX   packageszpackages.condazunknown package extensionpkg_mgrzvalid signature for z(package metadata is TRUSTED)zinvalid signature for z(package metadata is UNTRUSTED))r   channel
repo_fetchfetch_latest_parsedmetadataaddcanonical_namefnendswithr   r   ro   r   r   r1   r*   rC   r	   warning)	r2   rx   recordrepodatarR   ry   	signaturerC   envelopes	            r   verifyz_SignatureVerification.verify   s    NN#
 *((* 	! x'OO+FNN,I,I+J!L l+
 99J&OO";FII;a HIvyy)	 9989J'		2DYY :;,-fii8D899 $D)!*	Ai4<<@
 HH+FII;78OO ?@  	CKK0<=OO AB	Cs   7F AGGc                P    | j                   sy |D ]  }| j                  ||        y N)r3   r   )r2   rx   unlink_precs
link_precsprecs        r   __call__z_SignatureVerification.__call__'  s+     || 	+DKKT*	+r   c                    | j                   j                  j                          | j                  j                  j                          | j                  j                  j                          y r   )r3   fgetcache_clearr0   r1   )clss    r   r   z"_SignatureVerification.cache_clear3  sF    $$&))+$$&r   )returnbool)r   dict)r   zdict | None)NN)rp   rZ   rq   rZ   r   r   )rx   rZ   r   r!   )rx   rZ   r   tuple[PackageRecord, ...]r   r   r   None)r   r   )r   r   r   propertyr   r3   r0   r1   rI   r   r   classmethodr   r   r   r   r#   r#   0   s    t'  'T tA  AH t  B JN6 #6/26	6p'AR
+
+ 0
+ .	
+
 

+ ' 'r   r#   )3__doc__
__future__r   rl   r:   rere   	functoolsr   loggingr   pathlibr   "conda_content_trust.authenticationr   r   conda_content_trust.commonr	   r
   r   conda_content_trust.signingr   r-   rM   typingr   base.constantsr   r   base.contextr   
common.urlr   core.subdir_datar   gateways.connectionr   r   gateways.connection.sessionr   	constantsr   r    models.recordsr!   r   r*   compiler<   r#   signature_verificationr   r   r   <module>r      s    7 "  	 	    Q 
 = ! S " ! ) C 5 7. 2::<= G' G'V 01 I	   s   B. .C C