U
    gH                    @   s>	  d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZmZ ddl	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlZddlmZmZ ddlmZ dd	lmZm Z  dd
l!m"Z" ddl#m$Z$ ddl%m&Z& ddl'm(Z(m)Z) ddl*m+Z+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7 ddl8m9Z9 ddl:m;Z; ddl<m=Z= ddl>m?Z?m@Z@mAZA ddlBmCZCmDZD ddlEmFZFmGZG ddlHmIZI ddlJmKZK ddlLmMZMmNZN ddlOmPZPmQZQmRZRmSZSmTZT ddlUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\ ddl]m^Z^m_Z_m`Z`maZa ddlbmcZc ddldmeZemfZfmgZgmhZhmiZimjZjmkZkmlZl d d!lmmnZn d"d#lompZp d"d$l`mqZq d"d%lrmsZsmtZtmuZumvZvmwZwmxZx d"d&lymzZz d'd(d)d*d+d,d-d.d/g	Z{e|e}Z~ed0eid1d2Ze5ee d3d4d5Ze5ee d3d6d/ZG d7d8 d8Zed1d9G d:d, d,ee ZeG d;d< d<Zedddd=ejeweee ee; ee, eeee
f  ed>d?d*Zedddd=ejeweee; ee, eeee
f  ed@dAd*Zdddelfejeweee; ee, eeee
f  ed@dBd*Zeje?eeej dCdDdEZee& ee5ddf dFdGdHZeeiedf dIdJdKZdelfeje&eeeee
f  edLdMdNZeeedOdPdQZejeie&ee& ee dRdSdTZewe;e,dUdVdWZeddddddXejewee ee; ee ee, ee eeee
f  edY	dZd'ZeddddddXejewee; ee ee, ee eeee
f  ed[d\d'Zdddddekfejewee; ee ee, ee eeee
f  ed[d]d'Zeje&e&ee& ecee ee eeee
f  eez ee eeef d^d_d`Zed1d9G dad- d-eZeeRjeQjeQjeQjeQjeQjhZeddddddXejewee; ee ee, ee eeee
f  ed[dbd(ZeddddddXejewee ee; ee ee, ee eeee
f  edY	dcd(Zdddddekfejewee; ee ee, ee eeee
f  ed[ddd(ZG dedf dfeDZeIee3dgdhdiZeKee3djdkdlZe je,eeAdmdndoZe je+e,ee=ef dpdqdrZejewe3eeQ eee=dsdtduZdejewe3eeQ ee eTdvdwdxZed1d9G dydz dzZed1d9G d{d| d|Zejeeddf d}d~dZejed}ddZejeeddf dddZe^eeddf dddZeNeeen ee dddZdee ewee; e3dddZeeRjeQjeQjeQjeQjeQjeQjeQjhZeeQjeQjeQjeQjeQjhZed1d9G dd. d.eZe_ewe3e;ee dddZeNdddZde_etee; ee eddd)Zde_eteee eddd+ZdS )a  
This module contains a number of functions to handle AdES signature validation.


.. danger::
    This API is incubating, and not all features of the spec have been fully
    implemented at this stage. There will be bugs, and API changes may still
    occur.
    N)copy)	dataclass)datetimetimezone)AnyDict	FrozenSet	GeneratorGenericIterableIteratorListOptionalSetTupleTypeTypeVarUnionoverload)cmskeys)pdf)tspx509)CertificateList)OCSPResponse)ValidationContext)CertTrustAnchorTrustAnchor)CertValidationPolicySpecValidationDataHandlers)	PathError)past_validate)KnownPOE
POEManagerPOETypeValidationObjectValidationObjectTypedigest_for_poe)ades_gather_prima_facie_revinfo)ValidationTimingInfo)ValidationPath)AlgorithmUsagePolicyNonRevokedStatusAssertionRevocationCheckingRule)PathBuilderTrustManager)CRLContainerOCSPContainer)CRLOfInterest)OCSPResponseOfInterest)HistoricalResolverPdfFileReader)AdESFailureAdESIndeterminate
AdESPassed
AdESStatusAdESSubIndic)CMSExtractionErrorCMSStructuralErrorMultivaluedAttributeErrorNonexistentAttributeErrorextract_certificate_infofind_cms_attributefind_unique_cms_attribute)DocumentSecurityStoreEmbeddedPdfSignatureerrorsgeneric_cms)KeyUsageConstraints)DocumentTimestampStatusPdfSignatureStatusRevocationDetailsSignatureCoverageLevelSignatureStatusSignerAttributeStatusStandardCMSSignatureStatusTimestampSignatureStatus   )
DiffPolicy   )enumerate_ocsp_certs)NoDSSFoundError)LocalKnowledgePdfSignatureValidationSpecRevinfoOnlineFetchingRuleRevocationInfoGatheringSpecSignatureValidationSpec"bootstrap_validation_data_handlers)CMSAlgorithmUsagePolicyades_basic_validationades_with_time_validationades_lta_validationades_timestamp_validation#simulate_future_ades_lta_validationAdESBasicValidationResultAdESWithTimeValidationResultAdESLTAValidationResult#derive_validation_object_identifier
StatusTypeT)bound	covariant)voreturnc                 C   st   | j tjkr| j S | j tjkr.| jj S | j tjkrF| jj S | j tj	tj
fkrl| jd d d jS d S d S )Nsigner_infosr   	signature)object_typer'   CERTIFICATEvaluedumpCRLcrl_dataOCSP_RESPONSEocsp_response_dataSIGNED_DATA	TIMESTAMPnative)rh    rw   @/tmp/pip-unpacked-wheel-owvgwkas/pyhanko/sign/validation/ades.py$derive_validation_object_binary_data   s    
ry   c                 C   s   | j tjkr t| j  }nx| j tjkrBt| jj  }nV| j tj	krdt| jj
  }n4| j tjtjfkrt| jd d d j }nd S d| j j d| S )Nrj   r   rk   zvo--)rl   r'   rm   r(   rn   ro   hexrp   rq   rr   rs   rt   ru   rv   )rh   markerrw   rw   rx   rd      s    
c                   @   s<   e Zd Zee dddZee dddZedd Z	d	S )
ValidationObjectSetobject_collectionsc                    s"    fdd}dd | D | _ d S )Nc                  3   s*   t j  D ]} t| }|r
|| fV  q
d S N)	itertoolschainrd   )objidentr~   rw   rx   _pairs   s    z,ValidationObjectSet.__init__.<locals>._pairsc                 S   s   i | ]\}}||qS rw   rw   ).0kvrw   rw   rx   
<dictcomp>   s      z0ValidationObjectSet.__init__.<locals>.<dictcomp>)_things)selfr   r   rw   r~   rx   __init__   s    zValidationObjectSet.__init__)ri   c                 C   s   t | j S r   )iterr   values)r   rw   rw   rx   __iter__   s    zValidationObjectSet.__iter__c                   C   s   t dS Nrw   )r}   rw   rw   rw   rx   empty   s    zValidationObjectSet.emptyN)
__name__
__module____qualname__r   r&   r   r   r   staticmethodr   rw   rw   rw   rx   r}      s   	r}   )frozenc                   @   s:   e Zd ZU dZeed< ee ed< ee ed< e	ed< dS )ra   uR   
    Result of validation of basic signatures.

    ETSI EN 319 102-1, § 5.3
    ades_subindic
api_statusfailure_msgvalidation_objectsN)
r   r   r   __doc__r;   __annotations__r   re   strr}   rw   rw   rw   rx   ra      s   
c                   @   s   e Zd ZU eed< ee ed< ee ed< ee ed< ej	e
dZe
ed< dZee ed< dZee ed	< dZee ed
< dZee ed< dd ZdS )_InternalBasicValidationResultr   signature_poe_timesignature_not_before_timevalidation_path)default_factorystatus_kwargsNtrust_subindic_updatesignature_ts_validitycontent_ts_validitysigner_attr_statusc                 C   s   | j }| j|d< | jr | j|d< |r4| jr4| j|d< |rH| jrH| j|d< |rv| jrv| jj|d< | jj|d< | jj|d< |f |S )Nr   trust_problem_indictimestamp_validitycontent_timestamp_validityac_attrscades_signer_attrsac_validation_errs)	r   r   r   r   r   r   r   r   r   )r   
status_clswith_ts
with_attrsr   rw   rw   rx   update   s     





z%_InternalBasicValidationResult.update)r   r   r   r;   r   r   r   r+   dataclassesfielddictr   r   r   rO   r   r   rM   r   rw   rw   rw   rx   r      s   
r   )timing_infovalidation_data_handlersextra_status_kwargs)tst_signed_datavalidation_specexpected_tst_imprintr   r   r   r   ri   c                   s   d S r   rw   )r   r   r   r   r   r   r   rw   rw   rx   r_     s    
)r   r   r   r   r   r   ri   c                   s   d S r   rw   )r   r   r   r   r   r   rw   rw   rx   r_     s    	c           	         sR   |p
t  }|jp|j}|dkr,t||d}|j||d}t| ||||dI dH S )uW  
    Validate a timestamp token according to ETSI EN 319 102-1 § 5.4.

    :param tst_signed_data:
        The ``SignedData`` value of the timestamp.
    :param validation_spec:
        Validation settings to apply.
    :param expected_tst_imprint:
        The expected message imprint in the timestamp token.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nspecr   r   handlers)r   r   )r*   nowts_cert_validation_policycert_validation_policyrZ   build_validation_context'_ades_timestamp_validation_from_context)	r   r   r   r   r   r   r   r   validation_contextrw   rw   rx   r_   !  s(    !  )signer_infoalgo_policycontrol_time
public_keyc                 C   sT   | d }|j |||d}|sPd|j d| d}tj||jd krFtjntjdd S )NZsignature_algorithm)r   zSignature algorithm z not allowed as of z:, which is the time of the earliest PoE for the signature.ades_subindication)Zsignature_algorithm_allowedZsignature_algorE   SignatureValidationErrorZnot_allowed_afterr8   ZCRYPTO_CONSTRAINTS_FAILURE!CRYPTO_CONSTRAINTS_FAILURE_NO_POE)r   r   r   r   Zsig_algoZsig_allowedmsgrw   rw   rx   #_ades_signature_crypto_policy_checkY  s      r   )r   ri   c                 c   st   | d krd S | j D ]>}t|D ]}ttj|V  q t|D ]}ttj|V  q<q| jD ]}ttj	t
|V  qXd S r   )ocspsr2   
load_multir&   r'   rr   rS   rm   crlsrp   r1   )r   ocspcontcertcrlrw   rw   rx   _enumerate_validation_objectss  s    

r   statusc                 c   s   | d krd S | j }|r6|jddD ]}ttj|V  q"t| tr`t| jE d H  t| j	E d H  t| t
rt| jE d H  t| jE d H  d S )NT)Zinclude_root)r   Z
iter_certsr&   r'   rm   
isinstancerN   _enumerate_certs_in_pathsr   r   r   r   r   )r   pathr   rw   rw   rx   r     s    

r   )r   r   r   r   ri   c           
         s   t t|}t|pi }tj| ||dI d H }|| |f |}|jsZttj	|d |dS |j
srttj|d |dS t| ||d d dI d H }	||	_t t|t|	}t|	j|	j|dddd |dS )N)r   r   r   r   r   r   ac_validation_contextr   Fr   r   )r}   r   r   rF   Zvalidate_tst_signed_datar   intactra   r7   HASH_FAILUREvalidSIG_CRYPTO_FAILURE_process_basic_validationr   r   r   r   )
r   r   r   r   r   vosr   status_kwargs_from_validationr   interm_resultrw   rw   rx   r     sZ    

   r   )signed
tst_digestri   c                    s>   t j| |d}|d k	r(t|||I d H S ttjd d t dS )Nr   r   r   r   r   )rF   extract_tst_datar   ra   r8   GENERICr}   r   )r   r   r   r   r   rw   rw   rx   _ades_process_attached_ts  s    
r   )signed_datatemp_statusts_validation_contextr   r   c              
      s2  |j }|j}t| }d }|tjtjfkrt||dt|d dj	dI d H }	|	j
tjkr|	j}|d k	slt|d k	rt|j|}n|j}|tjkr|j}
|
d k	st|
j}tj}n|jj}tj}|d k	st||kr|}t| }tj|j|j||d dI d H }|ptj}t||||tf |d |jd|idS )NTsigned_attrsZmessage_digestr   r   )Zsd_attr_certificatessigner_certr   Zsd_signed_attrsvalidation_time)r   r   r   r   r   r   r   r   )r   r   rF   extract_signer_infor8   REVOKED_NO_POEOUT_OF_BOUNDS_NO_POEr   rB   rv   r   r9   OKr   AssertionErrormax	timestamprevocation_detailsrevocation_dater7   ZREVOKEDsigning_certnot_valid_afterZEXPIREDr@   Zcollect_signer_attr_statusZattribute_certsr   r   rM   r   )r   r   r   r   r   r   Zades_trust_statusr   	ts_statusZcontent_ts_resultrevo_detailscutoffZperm_status	cert_infoZattr_status_kwargsr   rw   rw   rx   r     sl    
	  

r   )r   r   r   c                 C   sZ   | j j||d}| jd k	r,| jj||d}n|}| jd k	rL| jj||d}nd }|||fS )Nr   )r   r   r   Zac_validation_policy)r   r   r   r   r   r   rw   rw   rx   	_init_vcs-  s(     
 
 r  )r   
raw_digestr   r   r   )	r   r   r   r   r  r   r   r   ri   c                   s   d S r   rw   r   r   r   r   r  r   r   r   rw   rw   rx   r\   O  s    )r   r   r   r  r   r   r   ri   c                   s   d S r   rw   r   r   r   r  r   r   r   rw   rw   rx   r\   ]  s    
c                    s   |p
t  }|dkr t||d}t|||\}}	}
t| ||	|
|j|||||jd
I dH }t|trf|S |j	t
ddd}tt|t|
t|	t|}t|j|d|dS )u  
    Validate a CMS signature according to ETSI EN 319 102-1 § 5.3.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param raw_digest:
        The expected message digest attribute value.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nr   )
r   r   r   r   key_usage_settingsr  r   r   r   algorithm_policyFTr   r   )r*   r   rZ   r  _ades_basic_validationr	  signature_algorithm_policyr   ra   r   rN   r}   r   r   r   )r   r   r   r  r   r   r   r   r   r   r   r   r   r   rw   rw   rx   r\   j  sT    $ 

  )r   r   r   r   r	  r  r   r   r
  r   ri   c
              
      s   t |pi }
tt|t|t|}z(tj| ||||dI d H }|
| W nB tjk
r } z"t|j	plt
j|jd |d W Y S d }~X Y nX |	f |
}|jsttj|d |dS |jsttj|d |dS t| ||||dI d H }|
|_|S )N)r  r   r	  r
  r   r   r   )r   r}   r   rF   Zcms_basic_validationr   rE   r   ra   r   r8   r   failure_messager   r7   r   r   r   r   r   )r   r   r   r   r	  r  r   r   r
  r   r   r   r   er   r   rw   rw   rx   r    s\    

r  c                   @   s"   e Zd ZU eed< ee ed< dS )rb   best_signature_timer   N)r   r   r   r   r   r   rw   rw   rw   rx   rb     s   
c                   s   d S r   rw   r  rw   rw   rx   r]     s    
c                   s   d S r   rw   r  rw   rw   rx   r]     s    c                    s*  |p
t  }|dkr t||d}t|||\}}	}
| d d d j}|j| }t| ||	|
|j|||||jd
I dH }t	|t
rtt|t|	t|
t|j}t|j|j|j|||dS |jtkrt	|tst|j}|j|ddd	}tt|t|	t|
t|}t|j|d|||dS t| }|j|d
dd	}t|}|dkrtt|t|	t|
t|}ttj|d|j||dS t||d
|dI dH }tt|t|	t|
t|t|j}|jtjkrt|j|d|||dS |j}t	|t st|dk	rt!|j"|}n|j"}||_#||_$|jtj%krX|j&}||j'krt|j|d|||dS nr|jtj(kr||j)j*k rttj+|d|||dS n>|jtj,ks|jtj-kr||j.krt|j|d|||dS |dk	r||krttj/|d|||dS d|_0d|j1d< |j|ddd	}ttj|d|||dS )u  
    Validate a CMS signature with time according to ETSI EN 319 102-1 § 5.5.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param raw_digest:
        The expected message digest attribute value.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nr   rj   r   rk   )	r   r   r   r	  r  r   r   r   r
  )r   r   r   r  r   r   Tr   FzNo signature timestamp presentr   r   )2r*   r   rZ   r  rv   poe_managerr  r	  r  r   ra   r}   r   r   r   rb   r   r   _WITH_TIME_FURTHER_PROCr   r   r   r   rF   r   Zcompute_signature_tst_digestr8   ZSIG_CONSTRAINTS_FAILUREr  r   r9   r   rO   minr   r   r   r   r   r   r   r   not_valid_beforeNOT_YET_VALIDr   	TRY_LATERZerror_time_horizonZTIMESTAMP_ORDER_FAILUREr   r   )r   r   r   r  r   r   r   r   r   r   r   	sig_bytesr   r   r   r   r   r   r   Zsig_ts_resultr  r  r   rw   rw   rx   r]   &  sX   $ 


  	
  

   	
	
	
c                   @   s4   e Zd ZejedddZejee dddZ	dS )_TrustNoOne)r   ri   c                 C   s   dS )NFrw   r   r   rw   rw   rx   is_root  s    z_TrustNoOne.is_rootc                 C   s   t dS r   )r   r  rw   rw   rx   find_potential_issuers  s    z"_TrustNoOne.find_potential_issuersN)
r   r   r   r   Certificateboolr  r   r   r  rw   rw   rw   rx   r  
  s   r  r   r  r  c                    s   t  fdd| jD S )Nc                 3   s   | ]}|j j  kV  qd S r   )r   leaf)r   	prov_pathr  r  rw   rx   	<genexpr>  s   z0_crl_issuer_cert_poe_boundary.<locals>.<genexpr>)anyZ
prov_pathsr  rw   r   rx   _crl_issuer_cert_poe_boundary  s    r#  r   r  r  c                 C   s   || j j |kS r   )r  r  r$  rw   rw   rx   _ocsp_issuer_cert_poe_boundary  s    r%  )r   r   r   revocation_checking_rulec                    s  j }|jt d}tjdfdd t fdd|D }j}g }g }	t }
|D ]}|I d H \}}|D ]8}t	|j
|r|| qv|jj }|
t| qv|D ]8}t|j
|r|	| q|jj }|
t| qq`|s|	rj|
 j|
 ||	fS )N)r   trust_manager)issc                    s$   t t| g  d}t|jdS )N)Ztrust_anchorZintermr  )r   revinfo_managerr   r&  )r+   r   r)   r)  )r(  Ztruncated_path)r   r   r&  r   rw   rx   _for_candidate_issuer6  s      zB_find_revinfo_data_for_leaf_in_past.<locals>._for_candidate_issuerc                    s   g | ]} |qS rw   rw   )r   r(  )r*  rw   rx   
<listcomp>B  s     z7_find_revinfo_data_for_leaf_in_past.<locals>.<listcomp>)cert_registryr  r  r   r  asyncioZas_completedr  setr#  r   appendr   rq   ro   addr(   r%  Zocsp_responsers   r)  Z
evict_crlsZevict_ocsps)r   r   r   r&  registryZcandidate_issuersZjob_futuresr  r   r   Zto_evictZfut_resultsZnew_crlsZ	new_ocspsZcrl_oiZrevinfo_dataZocsp_oirw   )r*  r   r   r&  r   rx   #_find_revinfo_data_for_leaf_in_past#  sJ         
r2  )r   validation_policy_specr   ri   c           
   	      s   t |j|jd}d }|| }zd|2 zX3 d H W }tt|||d dI d H }|j}|j	}|d kr$|d k	slt
||f  W 
S q$6 W 5 | I d H  X d}	|d k	rtj|	|dntj|	 dtjdd S )N)r'  r1  )r   r3  r   init_control_timez2Unable to construct plausible past validation pathr  r   z": no prima facie paths constructed)r/   r'  r,  Zasync_build_paths_lazycancelrF   Zhandle_certvalidator_errorsr"   Zerror_subindicZsuccess_resultr   rE   r   r8   ZNO_CERTIFICATE_CHAIN_FOUND)
r   r3  r   Zpath_builderZcurrent_subindicationpathsZ	cand_pathpast_resultr   r   rw   rw   rx   _build_and_past_validate_certj  s@    

 r9  )r   r   r  current_time_sub_indicr4  is_timestampri   c                    sb  t |d|d}| d d d j}|| }z t| }	|	j}
|j|	j W n$ tk
rl   tj	dt
jdY nX |r|jp||j}n|j}t|
|||jjjdI d H \ t|
||d	I d H \}} fd
d}||krP|t
jks|t
jkr|  |S |t
jt
jfkr
|S |t
jt
jfkrP||
jk r:tj	dtjdn||
jkrP|  |S tjd|dd S )NT)Zis_historicalpoe_manager_overriderj   r   rk   z,signer certificate not included in signaturer   )r   r&  )r3  r   c                     s$   t  ps tj} tjd| dd S )N)zoPOE for signature available, but could not obtain sufficient POE for the issuance of the revocation informationr5  )r  r8   REVOCATION_OUT_OF_BOUNDS_NO_POErE   r   r   Z	leaf_crlsZ
leaf_ocspsrw   rx   (_pass_contingent_on_revinfo_issuance_poe  s    zQ_ades_past_signature_validation.<locals>._pass_contingent_on_revinfo_issuance_poez'Signature predates cert validity periodr5  zHPast signature validation did not manage to improve current time result.)rZ   rv   r@   r   r,  Zregister_multipleZother_certsr<   rE   r   r8   ZNO_SIGNING_CERTIFICATE_FOUNDr   r   r2  Zrevinfo_policyZrevocation_checking_policyZee_certificate_ruler9  r   r  REVOKED_CA_NO_POEr   r   OUT_OF_BOUNDS_NOT_REVOKEDr  r7   r  r   ZSigSeedValueValidationError)r   r   r  r:  r4  r;  r   signature_bytesr  r  r   r   Z	cert_pathr   r?  rw   r>  rx   _ades_past_signature_validation  s~      
rC  )r   r   r  r:  r4  ri   c              
      s   | d }|d j dk}|dkr.tjt d}z"t| |||||dI dH  tjW S  tj	k
r } zt
| |jpxtj W Y S d}~X Y n6 tk
r } zt
| tj W Y S d}~X Y nX dS )u  
    Validate a CMS signature in the past according
    to ETSI EN 319 102-1 § 5.6.2.4.

    This is internal API.

    .. danger::
        The notion of "past validation" used here is only valid in the
        narrow technical sense in which it is used within AdES.
        It should _never_ be relied upon as a standalone validation routine.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param poe_manager:
        The POE manager from which to source existence proofs.
    :param current_time_sub_indic:
        The AdES subindication from validating the signature
        at the current time with the relevant settings.
    :param init_control_time:
        Initial value for the control time parameter.
    :return:
        An AdES subindication indicating the validation result
        after going through the past validation process.
    encap_content_infocontent_typetst_infoNtzr   r   r  r:  r4  r;  )rv   r   r   tzlocalget_localzonerC  r9   r   rE   r   loggerwarningr   r8   r   r!   Z!CERTIFICATE_CHAIN_GENERAL_FAILURE)r   r   r  r:  r4  Zecir;  r  rw   rw   rx   ades_past_signature_validation  s(    "
 
rN  c                   @   s   e Zd ZU eed< eed< dS )_PrimaFaciePOEItemdigestvalidation_objectN)r   r   r   bytesr   r&   rw   rw   rw   rx   rO  7  s   
rO  c                   @   sR   e Zd ZU eed< eed< ee ed< ej	ed< e
ed< eed< eddd	Zd
S )_PrimaFaciePOEFromTimeStamppdf_revisiontimestamp_dtpoes_impliedtimestamp_token_signed_data
doc_digestforensic_info)managerc              	   C   s.   | j D ]"}|ttj|j| j|jd qd S N)poe_typerP  Zpoe_timerQ  )rV  Zregister_known_poer#   r%   
VALIDATIONrP  rU  rQ  )r   rZ  thingrw   rw   rx   add_to_poe_managerG  s    
z._PrimaFaciePOEFromTimeStamp.add_to_poe_managerN)r   r   r   intr   r   r   rO  r   
SignedDatarR  r   r$   r_  rw   rw   rw   rx   rS  =  s   

rS  )sdri   c                 c   sd   | d D ]V}|j }| }|jdkr,tj}n|jdkrtj}nqt|}t|t||ddV  qd S )NZcertificatesZcertificateZv2_attr_certrl   rn   rP  rQ  )	Zchosenro   namer'   rm   OTHERr(   rO  r&   )rb  Zcert_choicer   dataZvo_typerP  rw   rw   rx   &_extract_cert_digests_from_signed_dataS  s    


rh  c                 C   s   | d d j }|d jS )NrD  contentgen_time)parsedrv   )rb  rF  rw   rw   rx   _get_tst_timestampm  s    rl  )revinfo_archivalri   c                 c   sh   | d D ](}t t| ttjt|ddV  q| d D ](}t t| ttjt|ddV  q:d S )Nr   rc  rd  r   )	rO  r(   ro   r&   r'   rp   r1   rr   r2   )rm  r   r   rw   rw   rx   ._read_validation_objects_from_revinfo_archivalr  s     


rn  )dssri   c              	   c   s   | j D ]4}| j}tt|ttjtt	
|ddV  q| jD ]4}| j}tt|ttjtt
|ddV  qB| j D ]2}| j}tt|ttjtj
|ddV  qd S )Nrc  rd  )r   
get_objectrg  rO  r(   r&   r'   rp   r1   r   loadr   rr   r2   r   certsr   rm   r   r  )ro  Zcrl_objrg  Zocsp_objZcert_objrw   rw   rx   !_read_validation_objects_from_dss  s6    







rs  )rinclude_content_tsdiff_policyri   c                 C   sZ  t  }t  }g }t| jD ]8\}}|j||d kd t| |jd}|j}	d }
d}|jdkrf|	}
d}n|rztj	|j
dd}
|
d k	rzt|}|t| W n tk
r   Y nX || | }| tjk}|r
|t|jt|
t||
|| d t  }|t|
 |t|	 |j
d }|snzt|d	}|t| W n ttfk
rl   Y nX |j
d
 j}|t t!|t"t#j$|jdd zt%|d}W n tt&fk
r   d}Y nX zt%|j
d d}W n tt&fk
r   d}Y nX t'(||D ]H}|d }|d D ]0}|d
 j}|t t!|t"t#j)|dd qq
q|S )N)Z	skip_diff)revisionFz/DocTimeStampTr   )rT  rU  rV  rW  rX  rY  r   Zadobe_revocation_info_archivalrk   rc  rd  Zcontent_time_stamprw   Zunsigned_attrsZsignature_time_stampri  rj   )*r.  	enumerateZembedded_signaturesZcompute_integrity_infor5   signed_revisionr   Zsig_object_typerF   r   r   rC   read_dssr   rs  rT   compute_digestZevaluate_signature_coveragerK   ZENTIRE_REVISIONr/  rS  rl  	frozensetsummarise_integrity_inforh  rB   rn  r>   r?   rv   r0  rO  r(   r&   r'   rt   rA   r=   r   r   ru   )rt  ru  rv  Zcollected_so_farZfor_next_tsprima_facie_poe_setsixembedded_sigZhist_handlerr   Zts_signed_dataZ	is_doc_tsro  rX  Zcoverage_normalr   Zrevinfo_attrr  Zcontent_tsesZsignature_tsesZts_dataZts_data_contentZts_signer_infoZts_sig_bytesrw   rw   rx   0_build_prima_facie_poe_index_from_pdf_timestamps  s     
 



  


r  )r~  r   cur_timing_infori   c              
      s6  t | dd d}|p"tjt d}t }|j| t|D ]\}}t	|}|t
|d k rt||d  }|| t|||d}	t|j|||j|	|jtdI d H }
|
j}|jtjkr|| q>|jtjkrtjd|d	q>t|tstt|j||||jd
I d H }|jtjkr"|| q>tjd|d	q>|S )Nc                 S   s   | j S r   rT  )prw   rw   rx   <lambda>h      z+_validate_prima_facie_poe.<locals>.<lambda>)keyrG  rR   r   r<  )r   r   r   r   r   r   r   z9Permanent failure while evaluating timestamp in PoE chainr   )r   r   r  r:  r4  zZCould not validate timestamp in PoE chain at current time, and past validation also failed)sortedr*   r   rJ  rK  r$   local_knowledger_  rx  r   lenrZ   r_   rW  rX  rY  rH   r   r   r:   ZPASSEDZFAILEDrE   r   r   r8   r   rN  r   )r~  r   r  Zcandidate_poesZresulting_poesr  poeZtemporary_poesZnext_poer   Zcur_time_resultZ	sub_indicr8  rw   rw   rx   _validate_prima_facie_poe^  s`    

	r  c                   @   s*   e Zd ZU dZee ed< ee ed< dS )rc   u   
    Result of a PAdES validation for a signature providing long-term
    availability and integrity of validation material.
    See ETSI EN 319 102-1, § 5.6.3.
     oldest_evidence_record_timestampsignature_timestamp_statusN)r   r   r   r   r   r   r   ra   rw   rw   rw   rx   rc     s   
	)r  r   r  r   ri   c              
      sX  | j d j}| j}|jp|j}|j}|d kr0d S |  }|d k	sDtt||||t	|||ddI d H }	|	j
}
t|
tr|
tkrz@t||||
|jddI d H }ttjtj|	j|dd |	jd}W nB tjk
r } z t|jp|
|j|	j|	jd}W 5 d }~X Y nX n|	}|d	 d
 j}|d k	rT|j|d d |jdrT|d j}||| |S )Nrk   r  )r   r   r   r   r   TrI  )r   r   r   rD  ri  Zmessage_imprintZhash_algorithm)Zmomentrj  )r   rv   Zattached_timestamp_datar   r   algorithm_usage_policyZcompute_tst_digestr   r_   rZ   r   r   r8   _LTA_TS_FURTHER_PROCrC  r   ra   r9   r   r   replacer   r   rE   r   r   r  rk  Zdigest_algorithm_allowedregister)r  r   r  r   rB  Zsignature_tsr   r   r   Zsignature_ts_prelim_resultZts_current_time_sub_indicr   signature_ts_resultr  rF  Zsignature_ts_dtrw   rw   rx   _process_signature_ts  sx    



r  readerc                 C   sh   zHt | }dd |jD }dd |jD }t| }t|||d}W n tk
rb   t }Y nX |S )Nc                 S   s,   g | ]$}t t| jD ]}|qqS rw   )r2   r   r   rq  rp  rg  )r   respr   rw   rw   rx   r+  +  s    z+_dss_to_local_knowledge.<locals>.<listcomp>c                 S   s"   g | ]}t t| jd qS ))rq   )r1   r   rq  rp  rg  )r   r   rw   rw   rx   r+  2  s   )known_ocsps
known_crlsknown_certs)rC   rz  r   r   listZ
load_certsrU   rT   )r  ro  Z	dss_ocspsZdss_crlsZ	dss_certsr  rw   rw   rx   _dss_to_local_knowledge&  s"    

r  )r  pdf_validation_specr   r   ri   c                    s  |pt jt d}t jd|jd}|j}|j}t	 jd}t
|j|j |j|j |j|j |j|jd}tj||d}	d}
d}zXt||	|dI dH }
tt fd	d
|dd
 dd}|dk	r|j}n|jstd W n4 tjk
r } ztjd|d W 5 d}~X Y nX |dkr*t }
||
 |
dk	s8tt|	|t|
d}t j |	|| ! | " t#dI dH }|j$}|t%krd| d}t&||j'||j(|j)|d|j*dS  j+d j,}|
j-|t.j/|j(d t0 |	t|
|dI dH }t1|t2r~t|
}z&t3 j |	|||j4ddI dH  |}
W nZ tjk
r| } z8|| }t&|j5pL||j6|j'||j)|||j*d W Y S d}~X Y nX |
| }|	j7j8}z2 j9}|dk	rt: j+|||j;d t<j=}d}W n8 tjk
r } z|j5p|}|j6}W 5 d}~X Y nX t&||j'|||j)|||j*dS )u  
    Validate a PAdES signature providing long-term availability and integrity
    of validation material. See ETSI EN 319 102-1, § 5.6.3.

    For the purposes of PAdES validation, the chain of document time stamps
    in the document serves as the unique Evidence Record (ER).

    :param embedded_sig:
        The PDF signature to validate.
    :param pdf_validation_spec:
        PDF signature validation settings.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A validation result.
    rG  Tru  rv  r  )r  r  r  
known_poesnonrevoked_assertions)r  N)r   r  c                    s   | j  jkS r   )rT  ry  r  r  rw   rx   r    r  z%ades_lta_validation.<locals>.<lambda>c                 S   s   | j S r   r  r  rw   rw   rx   r    r  )r  defaultzRNo document timestamps after signature; proceeding without past proof of existencezXDocument timestamp chain failed to validate; proceeding without past proof of existence.)exc_info)r   r   r<  )r   r   r   r   r  r   r   r   z?Validation of signature at current time failed with indication z!. Past validation not applicable.)r   r   r   r  r   r  r  r   rk   )r\  dt)r   r  r   FrI  )r   r   r   r  r   r  r  r   )r   r   r   )r   r   r   r  r   r  r  r   )>r*   r   rJ  rK  r  r  rv  signature_validation_specr  r  rU   r  r  r  r  r  r   r  r  r  filterrU  rL  rM  rE   r   r$   r_  r   rZ   r   r]   r   r{  r}  rI   r   _LTA_FURTHER_PROCrc   r   r  r   r   r   rv   r  r%   r]  r  r   r8   rC  r   r   r  r   r  r   r   r   r9   r   )r  r  r   r   Zpoe_listr   Zinit_local_knowledgeZ	dss_factsr  Zaugmented_validation_specZupdated_poe_managerr  Zoldest_docts_recordr  Zwith_time_data_handlersZsignature_prelim_resultr:  r   rB  r  Zpast_sig_poe_managerZsig_poer   r   r   r   rw   r  rx   r^   A  s"   


 






)r  r  future_validation_timecurrent_reference_timeri   c                    s   |pt jtjdt|d|d}t| jddd|j}|jt	| j t
j}z&| jjd }|t|jj|d W n tk
r   Y nX  fdd	}tjt
| |d
}	tj|tj|ttj|	dd}
t| |
|dI dH S )a  
    .. versionadded:: 0.21.0

    Simulate a future LTA validation of a PDF signature, assuming
    perfect timestamp maintenance until the specified point in time.

    .. warning::
        This is experimental API.

    The purpose of this utility function is to act as a sanity check
    for signers and signature archivists.
    It takes validation spec, a future validation time and
    a current reference time (defaults to the current time), and, by fiat,
    generates proofs of existence for all relevant objects in the PDF for that
    reference time. It then executes the PAdES LTA validation algorithm
    with that set of PoEs against the future validation time, with all
    remote fetching functionality disabled.

    The idea is that this allows the caller to assess whether a signature is
    "LTA maintainable", i.e. whether it contains the necessary information for
    the signature to remain validatable if the timestamp chain is extended
    properly. If this check fails but the signature validates at the current
    time, it may indicate a lack of contemporaneous revocation information.

    :param embedded_sig:
        The signature under scrutiny.
    :param pdf_validation_spec:
        The validation spec against which the simulated validation
        should be executed.
    :param future_validation_time:
        The future validation time at which the validation should be simulated.
    :param current_reference_time:
        The reference time at which all relevant objects in the PDF are
        presumed to have been proven to exist for the purposes of
        the (future) validation being simulated. Defaults to the current time.
    :return:
        An AdES LTA validation result.
    rG  T)r   Zpoint_in_time_validationr  Nr  )atc                  3   sR    E d H    E d H  D ](} | jD ]}ttj|j|jdV  q.q$d S r[  )Zassert_existence_known_atrV  r#   r%   ZPROVIDEDrP  rQ  )Zprima_facie_poeitemZdss_knowledger   Zorig_local_knowledgeZprima_facie_poesrw   rx   _poesc  s    
z2simulate_future_ades_lta_validation.<locals>._poes)r  r  )Zrevinfo_gathering_policyr  )r  )r   )r   r   r   utcr*   r  r  r  r  r  r  r  Zembedded_timestamp_signaturesr/  r-   r   sha256
IndexErrorr   r  rX   rW   Z
LOCAL_ONLYr^   )r  r  r  r  r   Zorig_sig_validation_specZnew_nonrevoked_assertionsZlast_tsr  Zupdated_local_knowledgeZupdated_pdf_validation_specrw   r  rx   r`     s\    ,  

 
)N)N)NN)N)r   r-  r   r   loggingr   r   r   r   typingr   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   rJ  Z
asn1cryptor   r   r   Zasn1_pdfr   r   Zasn1crypto.crlr   Zasn1crypto.ocspr   Zpyhanko_certvalidatorr   Zpyhanko_certvalidator.authorityr   r   Zpyhanko_certvalidator.contextr   r    Zpyhanko_certvalidator.errorsr!   Z#pyhanko_certvalidator.ltv.ades_pastr"   Zpyhanko_certvalidator.ltv.poer#   r$   r%   r&   r'   r(   Z$pyhanko_certvalidator.ltv.time_slider)   Zpyhanko_certvalidator.ltv.typesr*   Zpyhanko_certvalidator.pathr+   Z!pyhanko_certvalidator.policy_declr,   r-   r.   Zpyhanko_certvalidator.registryr/   r0   Z&pyhanko_certvalidator.revinfo.archivalr1   r2   Z*pyhanko_certvalidator.revinfo.validate_crlr3   Z+pyhanko_certvalidator.revinfo.validate_ocspr4   Zpyhanko.pdf_utils.readerr5   r6   Zpyhanko.sign.ades.reportr7   r8   r9   r:   r;   Zpyhanko.sign.generalr<   r=   r>   r?   r@   rA   rB   Zpyhanko.sign.validationrC   rD   rE   rF   Z pyhanko.sign.validation.settingsrG   Zpyhanko.sign.validation.statusrH   rI   rJ   rK   rL   rM   rN   rO   Zdiff_analysisrQ   ro  rS   rT   Zpolicy_declrU   rV   rW   rX   rY   rZ   utilsr[   __all__	getLoggerr   rL  re   rR  ry   r   rd   r}   ra   r   ra  r_   Z
SignerInfoZPublicKeyInfor   r   r   r   r  r   r   r  r\   r  rb   r|  r   r   r   r@  r  r   r  r]   r  r#  r%  r  r2  r9  rC  rN  rO  rS  rh  rl  ZRevocationInfoArchivalrn  rs  r  r  rA  r=  r  r  rc   r  r  r^   r`   rw   rw   rw   rx   <module>   s  
D $	( 
$96 U"Q
? e  
  H
,o 8! > IQ   b 