
    <Bh-                       S r SSKJr  SSKrSSKrSSKrSSKrSSKJr  SSK	J
r
  SSKJr   SSKJrJr  SSKJrJrJr  SS	KJr  SSKJr  SSKJrJr  SSKJr  SSKJ r   SSK!J"r"  SSK#J$r$  SSK%J&r&J'r'  SSK(J)r)  SSK*J+r+J,r,  \(       a  SSK-J.r.  \$R^                  " SSSS9  \
" \05      r1\Rd                  " S5      r3 " S S5      r4\4" 5       r5g! \ a     " S
 S\5      r Nf = f)z0Interface between conda-content-trust and conda.    )annotationsN)cache)	getLogger)Path)verify_delegationverify_root)SignatureErrorload_metadata_from_filewrite_metadata_to_file)wrap_as_signablec                      \ rS rSrSrg)r	       N)__name__
__module____qualname____firstlineno____static_attributes__r       Blib/python3.13/site-packages/conda/trust/signature_verification.pyr	   r	      s    r   r	   )TYPE_CHECKING   )CONDA_PACKAGE_EXTENSION_V1CONDA_PACKAGE_EXTENSION_V2)context)join_url)
SubdirData)
deprecated)	HTTPErrorInsecureRequestWarning)get_session   )INITIAL_TRUST_ROOTKEY_MGR_FILE)PackageRecordz25.9z26.3z1This module will be moved to conda-content-trust.)addendumz(?P<number>\d+)\.root\.jsonc                      \ rS rSr\\SS j5       5       r\\SS j5       5       r\\SS j5       5       r S     SS jjr	SS jr
        SS jr\SS	 j5       rS
rg)_SignatureVerification:   c                   [         R                  (       d  g[         R                  (       d  [        R	                  S5        g SS Kn[        [         R                  5      R                  SSS9  U R                  c  [        R	                  S5        gU R                  c  [        R	                  S5        gg! [         a    [        R	                  S5         gf = f)	NFz[metadata signature verification requested, but no metadata URL base has not been specified.r   zVmetadata signature verification requested, but `conda-content-trust` is not installed.T)parentsexist_okzDcould not find trusted_root data for metadata signature verificationz?could not find key_mgr data for metadata signature verification)r   extra_safety_checkssigning_metadata_url_baselogwarningconda_content_trustImportErrorr   av_data_dirmkdirtrusted_rootkey_mgr)selfr1   s     r   enabled_SignatureVerification.enabled;   s     ** 00KKC 	& 	W  !''t'D $KKV  <<KKQ  3  	KK> 	s   B5 5CCc                   S n [         R                  " [        R                  5      Vs0 s HF  n[        R                  UR                  5      =n(       d  M+  [        UR                  S5      5      U_MH     nn[        UR                  5       SS9 H*  u  pR[        R                  SU S35         [        U5      n  O    U(       d-  [        R%                  S[        R                   S35        [&        n US   S	   S
-    S3n[)        [        R                  U5      n U R+                  [        R,                  U5      n[/        X5        [1        U=o5        Mc  s  snf ! [        [        [         4 a     M  f = f! [        ["        [         4 a     Nf = f! [2         a:  n	U	R4                  R6                  S:w  a  [        R9                  U	5         S n	A	U$ S n	A	f[:         a   n	[        R9                  U	5         S n	A	U$ S n	A	ff = f)NnumberT)reversezLoading root metadata from .zNo root metadata in z. Using built-in root metadata.signedversionr"   z
.root.jsoni  )osscandirr   r3   RE_ROOT_METADATAmatchnameintgroupsorteditemsr/   infor
   IsADirectoryErrorFileNotFoundErrorPermissionErrorNotADirectoryErrordebugr#   r   _fetch_channel_signing_datar.   r   r   r   responsestatus_codeerror	Exception)
r7   trustedentrympaths_fnamepath	untrustederrs
             r   r5   #_SignatureVerification.trusted_rooth   s     $	  ZZ(;(;<<E)//

;;A; .AGGH%&-<   #5;;=$?6ugQ?@5e<G  @ II&w':':&; <0 0 )G x(3a78
CE++U3DC <<55	
 G/ ')';wB3 A *+<oN  	 "#5G 	 		P   <<++s2IIcN   		#
 s^   %E8 *EE6E8 /E+F E8 E54E58FF
G?/GG?G::G?c                F   S n[         n[        [        R                  U5      n U R	                  [        R
                  U5      n[        SX@R                  5        [        U=o5        U(       d   UR%                  5       (       a  ['        U5      nU$ ! [         a  n[        R                  U5         S nANMS nAf[         a_  n[        R                  [        U5      =(       d0    UR                  R                   SUR                   R"                   S35         S nANS nAff = f)Nr6   z ())r$   r   r   r3   rO   r.   r   r5   r   ConnectionErrorr/   r0   r   str	__class__r   rP   rQ   existsr
   )r7   rT   rY   rZ   r[   r\   s         r   r6   _SignatureVerification.key_mgr   s      $ G''/	?8811I
 i4E4EF #i#77> 4;;==-d3G!  	KK 	 KKCTs}}556b9Q9Q8RRST 	s$   6B 
D B44D ADD Nc                T   [        U5      n[        R                  (       d  [        R                  " S[
        5        SSS.nU(       a  X6S'   U(       a  XFS'   [        R                  n S[        l        UR                  [        X5      UUR                  S [        R                  [        R                  4S9nUR                  5         U[        l         UR                  5       $ ! U[        l        f = f! [        R                  R                   a  n	[!        S	U S
U 35      eS n	A	ff = f)Nignorez!gzip, deflate, compress, identityzapplication/json)zAccept-EncodingzContent-TypezIf-None-MatchzIf-Modified-SinceF)headersproxiesauthtimeoutzInvalid JSON returned from /)r!   r   
ssl_verifywarningssimplefilterr    add_anaconda_tokengetr   rh   remote_connect_timeout_secsremote_read_timeout_secsraise_for_statusjsondecoderJSONDecodeError
ValueError)
r7   signing_data_urlfilenameetag	mod_stampsessionrg   saved_token_settingrespr\   s
             r   rO   2_SignatureVerification._fetch_channel_signing_data   s    ./!!!!(,BC  C.
 '+O$+4'(%88	= */G&;;)47744  	D !!#)<G&	99; *=G& ||++ 	-.>-?q
K 	s%   (AC# C3 #C03D'D""D'c                   [        UR                  US9R                  R                  5       u  p4SU;  a4  UR                  R                  SUR                  R                   S35        g US   nUR                  U;  a*  UR                  R                  SUR                   S35        g XRR                     nUR                  R                  [        5      (       a  US   UR                     nOBUR                  R                  [        5      (       a  US   UR                     nO[        S5      e[        U5      nXhS'    [        SXR                  5        [        R!                  S	UR                   35        UR                  R                  S
5        g ! ["         a@    [        R%                  SUR                   35        UR                  R                  S5         g f = f)N)repodata_fn
signaturesz(no signatures found for r_   packageszpackages.condazunknown package extensionpkg_mgrzvalid signature for z(package metadata is TRUSTED)zinvalid signature for z(package metadata is UNTRUSTED))r   channel
repo_fetchfetch_latest_parsedmetadataaddcanonical_namefnendswithr   r   rw   r   r   r6   r/   rI   r	   r0   )	r7   r   recordrepodatarX   r   	signaturerI   envelopes	            r   verify_SignatureVerification.verify  s    NN#
 *((* 	 x'OO+FNN,I,I+J!L l+
 99J&OO";FII;a HIyy)	 99899J'		2DYY :;;,-fii8D899 $D)!*	Ai<<@
 HH+FII;78OO ?@  	CKK0<=OO AB	Cs   ?F AGGc                \    U R                   (       d  g U H  nU R                  X5        M     g N)r8   r   )r7   r   unlink_precs
link_precsprecs        r   __call___SignatureVerification.__call__0  s$     ||DKK* r   c                    U R                   R                  R                  5         U R                  R                  R                  5         U R                  R                  R                  5         g r   )r8   fgetcache_clearr5   r6   )clss    r   r   "_SignatureVerification.cache_clear<  sF    $$&))+$$&r   r   )returnbool)r   dict)r   zdict | None)NN)rx   ra   ry   ra   r   r   )r   ra   r   r%   )r   ra   r   tuple[PackageRecord, ...]r   r   r   None)r   r   )r   r   r   r   propertyr   r8   r5   r6   rO   r   r   classmethodr   r   r   r   r   r(   r(   :   s    
)  )V 
A  AF 
  B JN6 #6/26	6p'AR
+
+ 0
+ .	
+
 

+ ' 'r   r(   )6__doc__
__future__r   rt   r@   rerm   	functoolsr   loggingr   pathlibr   "conda_content_trust.authenticationr   r   conda_content_trust.commonr	   r
   r   conda_content_trust.signingr   r2   rS   typingr   base.constantsr   r   base.contextr   
common.urlr   core.subdir_datar   deprecationsr   gateways.connectionr   r    gateways.connection.sessionr!   	constantsr#   r$   models.recordsr%   moduler   r/   compilerB   r(   signature_verificationr   r   r   <module>r      s    7 "  	 	    Q 
 = ! S " ! ) % C 5 7.   

@  ::<= F' F'T 01 [	   s   C CC