
    si-                       S r SSKJr  SSKrSSKrSSKrSSKJr  SSKJ	r	  SSK
Jr  SSKJr   SS	KJrJr  SS
KJrJrJr  SSKJr  SSKJr  SSKJrJr  SSKJr  SSK J!r!  SSK"J#r#  SSK$J%r%  SSK&J'r'J(r(  SSK)J*r*  SSK+J,r,J-r-  \(       a  SSK.J/r/  \%R`                  " SSSS9  \	" \15      r2\Rf                  " S5      r4 " S S5      r5\5" 5       r6g! \ a     " S S\5      r Nf = f) z0Interface between conda-content-trust and conda.    )annotationsN)cache)	getLogger)Path   )json)verify_delegationverify_root)SignatureErrorload_metadata_from_filewrite_metadata_to_file)wrap_as_signablec                      \ rS rSrSrg)r       N)__name__
__module____qualname____firstlineno____static_attributes__r       Blib/python3.13/site-packages/conda/trust/signature_verification.pyr   r      s    r   r   )TYPE_CHECKING)CONDA_PACKAGE_EXTENSION_V1CONDA_PACKAGE_EXTENSION_V2)context)join_url)
SubdirData)
deprecated)	HTTPErrorInsecureRequestWarning)get_session   )INITIAL_TRUST_ROOTKEY_MGR_FILE)PackageRecordz25.9z26.3z1This module will be moved to conda-content-trust.)addendumz(?P<number>\d+)\.root\.jsonc                      \ rS rSr\\SS j5       5       r\\SS j5       5       r\\SS j5       5       r S     SS jjr	SS jr
        SS jr\SS	 j5       rS
rg)_SignatureVerification;   c                   [         R                  (       d  g[         R                  (       d  [        R	                  S5        g SS Kn[        [         R                  5      R                  SSS9  U R                  c  [        R	                  S5        gU R                  c  [        R	                  S5        gg! [         a    [        R	                  S5         gf = f)	NFz[metadata signature verification requested, but no metadata URL base has not been specified.r   zVmetadata signature verification requested, but `conda-content-trust` is not installed.T)parentsexist_okzDcould not find trusted_root data for metadata signature verificationz?could not find key_mgr data for metadata signature verification)r   extra_safety_checkssigning_metadata_url_baselogwarningconda_content_trustImportErrorr   av_data_dirmkdirtrusted_rootkey_mgr)selfr2   s     r   enabled_SignatureVerification.enabled<   s     ** 00KKC 	& 	W  !''t'D $KKV  <<KKQ  3  	KK> 	s   B5 5CCc                   S n [         R                  " [        R                  5       Vs0 s HF  n[        R                  UR                  5      =n(       d  M+  [        UR                  S5      5      U_MH     nn[        UR                  5       SS9 H*  u  pR[        R                  SU S35         [        U5      n  O    U(       d-  [        R%                  S[        R                   S35        [&        n US   S	   S
-    S3n[)        [        R                  U5      n U R+                  [        R,                  U5      n[/        X5        [1        U=o5        Mc  s  snf ! [        [        [         4 a     M  f = f! [        ["        [         4 a     Nf = f! [2         a:  n	U	R4                  R6                  S:w  a  [        R9                  U	5         S n	A	U$ S n	A	f[:         a   n	[        R9                  U	5         S n	A	U$ S n	A	ff = f)NnumberT)reversezLoading root metadata from .zNo root metadata in z. Using built-in root metadata.signedversionr#   z
.root.jsoni  )osscandirr   r4   RE_ROOT_METADATAmatchnameintgroupsorteditemsr0   infor   IsADirectoryErrorFileNotFoundErrorPermissionErrorNotADirectoryErrordebugr$   r   _fetch_channel_signing_datar/   r
   r   r    responsestatus_codeerror	Exception)
r8   trustedentrympaths_fnamepath	untrustederrs
             r   r6   #_SignatureVerification.trusted_rooti   s     $	  ZZ(;(;<<E)//

;;A; .AGGH%&-<   #5;;=$?6ugQ?@5e<G  @ II&w':':&; <0 0 )G x(3a78
CE++U3DC <<55	
 G/ ')';wB3 A *+<oN  	 "#5G 	 		P   <<++s2IIcN   		#
 s^   &E9 *EE7E9 0E+F E9 E65E69FF
H /GH  G;;H c                F   S n[         n[        [        R                  U5      n U R	                  [        R
                  U5      n[        SX@R                  5        [        U=o5        U(       d   UR%                  5       (       a  ['        U5      nU$ ! [         a  n[        R                  U5         S nANMS nAf[         a_  n[        R                  [        U5      =(       d0    UR                  R                   SUR                   R"                   S35         S nANS nAff = f)Nr7   z ())r%   r   r   r4   rP   r/   r	   r6   r   ConnectionErrorr0   r1   r    str	__class__r   rQ   rR   existsr   )r8   rU   rZ   r[   r\   r]   s         r   r7   _SignatureVerification.key_mgr   s      $ G''/	?8811I
 i4E4EF #i#77> 4;;==-d3G!  	KK 	 KKCTs}}556b9Q9Q8RRST 	s$   6B 
D B44D ADD Nc                @   [        U5      n[        R                  (       d  [        R                  " S[
        5        SSS.nU(       a  X6S'   U(       a  XFS'   [        R                  n S[        l        UR                  [        X5      UUR                  S [        R                  [        R                  4S9nUR                  5         U[        l         UR                  5       $ ! U[        l        f = f! [        R                   a  n	[        S	U S
U 35      eS n	A	ff = f)Nignorez!gzip, deflate, compress, identityzapplication/json)zAccept-EncodingzContent-TypezIf-None-MatchzIf-Modified-SinceF)headersproxiesauthtimeoutzInvalid JSON returned from /)r"   r   
ssl_verifywarningssimplefilterr!   add_anaconda_tokengetr   ri   remote_connect_timeout_secsremote_read_timeout_secsraise_for_statusr   JSONDecodeError
ValueError)
r8   signing_data_urlfilenameetag	mod_stampsessionrh   saved_token_settingrespr]   s
             r   rP   2_SignatureVerification._fetch_channel_signing_data   s    ./!!!!(,BC  C.
 '+O$+4'(%88	= */G&;;)47744  	D !!#)<G&	99; *=G& ## 	-.>-?q
K 	s%   (AC# C3 #C03DDDc                   [        UR                  US9R                  R                  5       u  p4SU;  a4  UR                  R                  SUR                  R                   S35        g US   nUR                  U;  a*  UR                  R                  SUR                   S35        g XRR                     nUR                  R                  [        5      (       a  US   UR                     nOBUR                  R                  [        5      (       a  US   UR                     nO[        S5      e[        U5      nXhS'    [        SXR                  5        [        R!                  S	UR                   35        UR                  R                  S
5        g ! ["         a@    [        R%                  SUR                   35        UR                  R                  S5         g f = f)N)repodata_fn
signaturesz(no signatures found for r`   packageszpackages.condazunknown package extensionpkg_mgrzvalid signature for z(package metadata is TRUSTED)zinvalid signature for z(package metadata is UNTRUSTED))r   channel
repo_fetchfetch_latest_parsedmetadataaddcanonical_namefnendswithr   r   rv   r   r	   r7   r0   rJ   r   r1   )	r8   r   recordrepodatarY   r   	signaturerJ   envelopes	            r   verify_SignatureVerification.verify  s    NN#
 *((* 	 x'OO+FNN,I,I+J!L l+
 99J&OO";FII;a HIyy)	 99899J'		2DYY :;;,-fii8D899 $D)!*	Ai<<@
 HH+FII;78OO ?@  	CKK0<=OO AB	Cs   ?F AGGc                \    U R                   (       d  g U H  nU R                  X5        M     g N)r9   r   )r8   r   unlink_precs
link_precsprecs        r   __call___SignatureVerification.__call__1  s$     ||DKK* r   c                    U R                   R                  R                  5         U R                  R                  R                  5         U R                  R                  R                  5         g r   )r9   fgetcache_clearr6   r7   )clss    r   r   "_SignatureVerification.cache_clear=  sF    $$&))+$$&r   r   )returnbool)r   dict)r   zdict | None)NN)rw   rb   rx   rb   r   r   )r   rb   r   r&   )r   rb   r   tuple[PackageRecord, ...]r   r   r   None)r   r   )r   r   r   r   propertyr   r9   r6   r7   rP   r   r   classmethodr   r   r   r   r   r)   r)   ;   s    
)  )V 
A  AF 
  B JN6 #6/26	6p'AR
+
+ 0
+ .	
+
 

+ ' 'r   r)   )7__doc__
__future__r   rA   rern   	functoolsr   loggingr   pathlibr   common.serializer   "conda_content_trust.authenticationr	   r
   conda_content_trust.commonr   r   r   conda_content_trust.signingr   r3   rT   typingr   base.constantsr   r   base.contextr   
common.urlr   core.subdir_datar   deprecationsr   gateways.connectionr    r!   gateways.connection.sessionr"   	constantsr$   r%   models.recordsr&   moduler   r0   compilerC   r)   signature_verificationr   r   r   <module>r      s    7 " 	 	     #Q 
 = ! S " ! ) % C 5 7.   

@  ::<= F' F'T 01 [	   s   C C! C!