+
    i                      a  0 t $ ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	H
t ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ RIHtHtHtHtHt ^ RIHt ^ R	IHtHtHtHt ^ R
I H!t!H"t"H#t#H$t$H%t%H&t&  ^ RI'H(t) Rt*Rt,Rt-Rt.Rt/Rt0Rt1Rt2Rt3Rt4Rt5Rt6]Pn                  ! R4      t8Rt9Rt:Rt;Rt<R t=R!t>^t?]Pn                  ! ]:R",           ];,           ]P                  4      tA]B! ]C! ]D! ^^4      4      4      tE] ! R# R$4      4       tFR!]F! ]P                  ^ ]P                  ^^RRR%7      R&]F! ]P                  ^ ]P                  ^^RRR%7      R']F! ]P                  ^ ]P                  ^^^RR%7      /tKR(]LR)&   R*]/R+]0R,]1/tMR- R. ltNR/ R0 ltO]:R1,           ];R1,           3R2 R3 lltPR4 R5 ltQR6 R7 ltRR8 R9 ltSR: R; ltTR< R= ltUR> R? ltVR@ RA ltWRB RC ltX ! RD RE4      tY ! RF RG4      tZ ! RH RI4      t[ ! RJ RK4      t\ ! RL RM4      t]RN RO lt^ ! RP RQ4      t_ ! RR RS4      t`]-]Z! 4       ].][! 4       ],]]! 4       ]/]\! RT]P                  ! 4       4      ]0]\! RU]P                  ! 4       4      ]1]\! RV]P                  ! 4       4      ]3]_! 4       ]4]`! 4       /tdRW RX lte]P                  ]P                  ]P                  ]P                  ]P                  3,          tkRtRYR/RZ R[ llltlR\ R] ltm]P                  ]P                  ]P                  ]P                  ]P                  3,          tr]P                  ]P                  ]P                  ]P                  3,          ts ! R^ R_]P                  4      tu ! R` Ra4      tvRb Rc ltwRsRd Re lltxRf Rg ltyRh Ri ltzRj Rk lt{RtRl Rm llt|Rn Ro lt}]P                  ]P                  ]P                  ]P                  3,          t~Rpt ! Rq Rr4      tR#   ]+ d    Rt*RsR R llt) ELwi ; i)u    )annotationsN)encodebytes)	dataclass)utilsUnsupportedAlgorithm)hashes)dsaeced25519paddingrsa)AEADDecryptionContextCipher
algorithmsmodes)EncodingKeySerializationEncryptionNoEncryptionPrivateFormatPublicFormat_KeySerializationEncryption)kdfTFc               0    V ^8  d   QhRRRRRRRRRRR	R/# )
   passwordbytessaltdesired_key_bytesintroundsignore_few_roundsboolreturn )formats   "w/home/wkmabra/.openclaw/workspace/venv/lib/python3.14/site-packages/cryptography/hazmat/primitives/serialization/ssh.py__annotate__r(   1   sD     9 999 9 	9
  9 
9    c                    \        R 4      h)zNeed bcrypt moduler   )r   r   r   r!   r"   s   &&&&&r'   _bcrypt_kdfr+   1   s     ##788r)   s   ssh-ed25519s   ssh-rsas   ssh-dsss   ecdsa-sha2-nistp256s   ecdsa-sha2-nistp384s   ecdsa-sha2-nistp521s   -cert-v01@openssh.coms   sk-ssh-ed25519@openssh.coms"   sk-ecdsa-sha2-nistp256@openssh.coms   rsa-sha2-256s   rsa-sha2-512s   \A(\S+)[ \t]+(\S+)s   openssh-key-v1 s#   -----BEGIN OPENSSH PRIVATE KEY-----s!   -----END OPENSSH PRIVATE KEY-----s   bcrypts   nones
   aes256-ctrs   (.*?)c                  ^    ] tR t^\t$ R]R&   R]R&   R]R&   R]R&   R]R&   R	]R
&   R]R&   RtR# )
_SSHCipherztype[algorithms.AES]algr    key_lenz3type[modes.CTR] | type[modes.CBC] | type[modes.GCM]mode	block_leniv_len
int | Nonetag_lenr#   is_aeadr%   N)__name__
__module____qualname____firstlineno____annotations____static_attributes__r%   r)   r'   r-   r-   \   s(    	L
==NKMr)   r-   )r.   r/   r0   r1   r2   r4   r5   s
   aes256-cbcs   aes256-gcm@openssh.comzdict[bytes, _SSHCipher]_SSH_CIPHERS	secp256r1	secp384r1	secp521r1c                    V ^8  d   QhRRRR/# )r   keyz&SSHPrivateKeyTypes | SSHPublicKeyTypesr$   r   r%   )r&   s   "r'   r(   r(      s      A e r)   c                8   \        V \        P                  4      '       d   \        V P	                  4       4      pV# \        V \        P
                  4      '       d   \        V 4      pV# \        V \        P                  \        P                  34      '       d	   \        pV# \        V \        P                  \        P                  34      '       d	   \        pV# \        V \        P                  \        P                   34      '       d	   \"        pV# \%        R 4      h)Unsupported key type)
isinstancer   EllipticCurvePrivateKey_ecdsa_key_type
public_keyEllipticCurvePublicKeyr   RSAPrivateKeyRSAPublicKey_SSH_RSAr
   DSAPrivateKeyDSAPublicKey_SSH_DSAr   Ed25519PrivateKeyEd25519PublicKey_SSH_ED25519
ValueError)rA   key_types   & r'   _get_ssh_key_typerT      s    #r1122"3>>#34 O 
C22	3	3"3' O 
C#++S-=-=>	?	? O 
C#++S-=-=>	?	? O 
g'')A)AB
 
   O /00r)   c                    V ^8  d   QhRRRR/# )r   rG   ec.EllipticCurvePublicKeyr$   r   r%   )r&   s   "r'   r(   r(      s     ' ' 9 'e 'r)   c                    V P                   pVP                  \        9  d   \        RVP                  : 24      h\        VP                  ,          # )z3Return SSH key_type and curve_name for private key.z'Unsupported curve for ssh private key: )curvename_ECDSA_KEY_TYPErR   )rG   rX   s   & r'   rF   rF      sE    Ezz(5ejj^D
 	
 5::&&r)      
c               (    V ^8  d   QhRRRRRRRR/# )r   datautils.Bufferprefixr   suffixr$   r%   )r&   s   "r'   r(   r(      s0     < <
<< < 	<r)   c                <    R P                  V\        V 4      V.4      # )r)   )join_base64_encode)r]   r_   r`   s   &&&r'   _ssh_pem_encoderd      s    
 88V^D16:;;r)   c               $    V ^8  d   QhRRRRRR/# )r   r]   r^   r1   r    r$   Noner%   )r&   s   "r'   r(   r(      s!     : :L :S :T :r)   c                Z    V '       d   \        V 4      V,          ^ 8w  d   \        R4      hR# )zRequire data to be full blockszCorrupt data: missing paddingN)lenrR   )r]   r1   s   &&r'   _check_block_sizeri      s&    3t9y(A-899 .r)   c                    V ^8  d   QhRRRR/# )r   r]   r^   r$   rf   r%   )r&   s   "r'   r(   r(      s     8 8| 8 8r)   c                ,    V '       d   \        R4      hR# )z!All data should have been parsed.zCorrupt data: unparsed dataN)rR   r]   s   &r'   _check_emptyrm      s    677 r)   c          
     ,    V ^8  d   QhRRRRRRRRRR	/# )
r   
ciphernamer   r   bytes | Noner   r!   r    r$   z)Cipher[modes.CBC | modes.CTR | modes.GCM]r%   )r&   s   "r'   r(   r(      s:        	
 /r)   c                   V'       g   \        R4      h\        V ,          p\        WVP                  VP                  ,           VR4      p\        VP                  VRVP                   4      VP                  WTP                  R 4      4      # )z$Generate key + iv and return cipher.z9Key is password-protected, but password was not provided.TN)	TypeErrorr<   r+   r/   r2   r   r.   r0   )ro   r   r   r!   ciphseeds   &&&&  r'   _init_cipherru      s~     G
 	
 
#Dt{{2FDD n%&		$||~&' r)   c                    V ^8  d   QhRRRR/# r   r]   
memoryviewr$   ztuple[int, memoryview]r%   )r&   s   "r'   r(   r(           ? ?: ?"8 ?r)   c                    \        V 4      ^8  d   \        R4      h\        P                  V R,          RR7      V R,          3# )Uint32Invalid data:N   Nbig	byteorder:r}   NNrh   rR   r    
from_bytesrl   s   &r'   _get_u32r      8    
4y1}((>>$r(e>4d2h>>r)   c                    V ^8  d   QhRRRR/# rw   r%   )r&   s   "r'   r(   r(      ry   r)   c                    \        V 4      ^8  d   \        R4      h\        P                  V R,          RR7      V R,          3# )Uint64r|   :N   Nr~   r   :r   NNr   rl   s   &r'   _get_u64r      r   r)   c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   tuple[memoryview, memoryview]r%   )r&   s   "r'   r(   r(      s      j %B r)   c                d    \        V 4      w  rV\        V 4      8  d   \        R4      hV RV WR 3# )zBytes with u32 length prefixr|   N)r   rh   rR   )r]   ns   & r'   _get_sshstrr      s8    tnGA3t9}((8T"Xr)   c                    V ^8  d   QhRRRR/# rw   r%   )r&   s   "r'   r(   r(      s     , ,Z ,$: ,r)   c                    \        V 4      w  rV'       d   V^ ,          ^8  d   \        R4      h\        P                  VR4      V 3# )zBig integer.r|   r~   )r   rR   r    r   )r]   vals   & r'   
_get_mpintr      s<    D!IC
s1v}((>>#u%t++r)   c                    V ^8  d   QhRRRR/# )r   r   r    r$   r   r%   )r&   s   "r'   r(   r(      s     + +3 +5 +r)   c                    V ^ 8  d   \        R4      hV '       g   R# V P                  4       ^,           ^,          p\        P                  ! W4      # )z!Storage format for signed bigint.znegative mpint not allowedr)   )rR   
bit_lengthr   int_to_bytes)r   nbytess   & r'   	_to_mpintr      sB    
Qw566nn"q(Fc**r)   c                      ] tR t^t$ RtR]R&   RR R lltR R ltR	 R
 ltR R lt	R R lt
R R ltR R ltRR R lltR R ltRtR# )	_FragListz,Build recursive structure without data copy.zlist[utils.Buffer]flistNc                    V ^8  d   QhRRRR/# )r   initzlist[utils.Buffer] | Noner$   rf   r%   )r&   s   "r'   r(   _FragList.__annotate__  s     $ $6 $$ $r)   c                	^    . V n         V'       d   V P                   P                  V4       R # R # N)r   extend)selfr   s   &&r'   __init___FragList.__init__  s#    
JJd# r)   c                    V ^8  d   QhRRRR/# )r   r   r^   r$   rf   r%   )r&   s   "r'   r(   r     s      < D r)   c                <    V P                   P                  V4       R# )zAdd plain bytesN)r   appendr   r   s   &&r'   put_raw_FragList.put_raw  s    

#r)   c                    V ^8  d   QhRRRR/# r   r   r    r$   rf   r%   )r&   s   "r'   r(   r          C C3 C4 Cr)   c                ^    V P                   P                  VP                  ^RR7      4       R# )zBig-endian uint32r~   lengthr   Nr   r   to_bytesr   s   &&r'   put_u32_FragList.put_u32  !    

#,,a5,ABr)   c                    V ^8  d   QhRRRR/# r   r%   )r&   s   "r'   r(   r     r   r)   c                ^    V P                   P                  VP                  ^RR7      4       R# )zBig-endian uint64r~   r   Nr   r   s   &&r'   put_u64_FragList.put_u64  r   r)   c                    V ^8  d   QhRRRR/# )r   r   zbytes | _FragListr$   rf   r%   )r&   s   "r'   r(   r     s     ) )/ )D )r)   c                >   \        V\        \        \        34      '       d8   V P	                  \        V4      4       V P                  P                  V4       R# V P	                  VP                  4       4       V P                  P                  VP                  4       R# )zBytes prefixed with u32 lengthN)
rD   r   rx   	bytearrayr   rh   r   r   sizer   r   s   &&r'   
put_sshstr_FragList.put_sshstr  s`    cE:y9::LLS"JJc"LL$JJcii(r)   c                    V ^8  d   QhRRRR/# r   r%   )r&   s   "r'   r(   r     s     ( (S (T (r)   c                :    V P                  \        V4      4       R# )z*Big-endian bigint prefixed with u32 lengthN)r   r   r   s   &&r'   	put_mpint_FragList.put_mpint  s    	#'r)   c                   V ^8  d   QhRR/# r   r$   r    r%   )r&   s   "r'   r(   r      s     ) )c )r)   c                H    \        \        \        V P                  4      4      # )zCurrent number of bytes)summaprh   r   r   s   &r'   r   _FragList.size   s    3sDJJ'((r)   c               $    V ^8  d   QhRRRRRR/# )r   dstbufrx   posr    r$   r%   )r&   s   "r'   r(   r   $  s!      Z c # r)   c                Z    V P                    F  p\        V4      pY"V,           r%W1WR% K  	  V# )zWrite into bytearray)r   rh   )r   r   r   fragflenstarts   &&&   r'   render_FragList.render$  s1    JJDt9DDj3 $5  
r)   c                   V ^8  d   QhRR/# r   r$   r   r%   )r&   s   "r'   r(   r   ,  s       r)   c                    \        \        V P                  4       4      4      pV P                  V4       VP	                  4       # )zReturn as bytes)rx   r   r   r   tobytes)r   bufs   & r'   r   _FragList.tobytes,  s/    499;/0C{{}r)   )r   r   r   )r6   r7   r8   r9   __doc__r:   r   r   r   r   r   r   r   r   r   r;   r%   r)   r'   r   r      s?    6$
CC)() r)   r   c                  V    ] tR tRtRtR R ltR R ltR R ltR	 R
 ltR R lt	Rt
R# )_SSHFormatRSAi3  zTFormat for RSA keys.

Public:
    mpint e, n
Private:
    mpint n, e, d, iqmp, p, q
c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   z"tuple[tuple[int, int], memoryview]r%   )r&   s   "r'   r(   _SSHFormatRSA.__annotate__<  s      	+r)   c                @    \        V4      w  r!\        V4      w  r1W#3V3# )zRSA public fieldsr   )r   r]   er   s   &&  r'   
get_public_SSHFormatRSA.get_public<  s(     T"T"vt|r)   c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   z#tuple[rsa.RSAPublicKey, memoryview]r%   )r&   s   "r'   r(   r   D  s         	, r)   c                    V P                  V4      w  w  r#p\        P                  ! W#4      pVP                  4       pWQ3# )zMake RSA public key from data.)r   r   RSAPublicNumbersrG   )r   r]   r   r   public_numbersrG   s   &&    r'   load_public_SSHFormatRSA.load_publicD  s?     t,--a3#..0
r)   c               $    V ^8  d   QhRRRRRR/# )r   r]   rx   unsafe_skip_rsa_key_validationr#   r$   z$tuple[rsa.RSAPrivateKey, memoryview]r%   )r&   s   "r'   r(   r   M  s$     ! !!KO!	-!r)   c           	        \        V4      w  rA\        V4      w  rQ\        V4      w  ra\        V4      w  rq\        V4      w  r\        V4      w  rWT3V8w  d   \        R4      h\        P                  ! Wh4      p
\        P                  ! Wi4      p\        P
                  ! WT4      p\        P                  ! WWjWV4      pVP                  VR7      pW3# )zMake RSA private key from data.z Corrupt data: rsa field mismatchr   )r   rR   r   rsa_crt_dmp1rsa_crt_dmq1r   RSAPrivateNumbersprivate_key)r   r]   	pubfieldsr   r   r   diqmppqdmp1dmq1r   private_numbersr   s   &&&&           r'   load_private_SSHFormatRSA.load_privateM  s     T"T"T"%
T"T"6Y?@@%%--a3//!4~
 &11+I 2 
   r)   c               $    V ^8  d   QhRRRRRR/# )r   rG   zrsa.RSAPublicKeyf_pubr   r$   rf   r%   )r&   s   "r'   r(   r   e  s$        * 3< 	 r)   c                    VP                  4       pVP                  VP                  4       VP                  VP                  4       R# )zWrite RSA public keyN)r   r   r   r   )r   rG   r   pubns   &&& r'   encode_public_SSHFormatRSA.encode_publice  s2     ((*r)   c               $    V ^8  d   QhRRRRRR/# )r   r   zrsa.RSAPrivateKeyf_privr   r$   rf   r%   )r&   s   "r'   r(   r   m  s$     , ,,,6?,	,r)   c                   VP                  4       pVP                  pVP                  VP                  4       VP                  VP                  4       VP                  VP
                  4       VP                  VP                  4       VP                  VP                  4       VP                  VP                  4       R# )zWrite RSA private keyN)	r   r   r   r   r   r   r   r   r   )r   r   r  r   r   s   &&&  r'   encode_private_SSHFormatRSA.encode_privatem  s     &557(77))*))***+--.**+**+r)   r%   Nr6   r7   r8   r9   r   r   r   r   r  r  r;   r%   r)   r'   r   r   3  s%     !0 , ,r)   r   c                  b    ] tR tRtRtR R ltR R ltR R ltR	 R
 ltR R lt	R R lt
RtR# )_SSHFormatDSAi}  zTFormat for DSA keys.

Public:
    mpint p, q, g, y
Private:
    mpint p, q, g, y, x
c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   ztuple[tuple, memoryview]r%   )r&   s   "r'   r(   _SSHFormatDSA.__annotate__  s     " "z ".F "r)   c                v    \        V4      w  r!\        V4      w  r1\        V4      w  rA\        V4      w  rQW#WE3V3# )zDSA public fieldsr   )r   r]   r   r   gys   &&    r'   r   _SSHFormatDSA.get_public  sA    T"T"T"T"a|T!!r)   c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   z#tuple[dsa.DSAPublicKey, memoryview]r%   )r&   s   "r'   r(   r    s     	  	 	 	,	 r)   c                    V P                  V4      w  w  r#rEp\        P                  ! W#V4      p\        P                  ! WV4      pV P	                  V4       VP                  4       pW3# )zMake DSA public key from data.)r   r
   DSAParameterNumbersDSAPublicNumbers	_validaterG   )	r   r]   r   r   r  r  parameter_numbersr   rG   s	   &&       r'   r   _SSHFormatDSA.load_public  sa     "__T2qd33A!<--aC~&#..0
r)   c               $    V ^8  d   QhRRRRRR/# )r   r]   rx   r   r#   r$   z$tuple[dsa.DSAPrivateKey, memoryview]r%   )r&   s   "r'   r(   r    s$     ! !!KO!	-!r)   c                @   V P                  V4      w  w  rErgp\        V4      w  rWEWg3V8w  d   \        R4      h\        P                  ! WEV4      p	\        P
                  ! Wy4      p
V P                  V
4       \        P                  ! W4      pVP                  4       pW3# )zMake DSA private key from data.z Corrupt data: dsa field mismatch)	r   r   rR   r
   r  r  r  DSAPrivateNumbersr   )r   r]   r   r   r   r   r  r  xr  r   r   r   s   &&&&         r'   r   _SSHFormatDSA.load_private  s     "__T2qdT"!<9$?@@33A!<--aC~&//B%113  r)   c               $    V ^8  d   QhRRRRRR/# )r   rG   zdsa.DSAPublicKeyr   r   r$   rf   r%   )r&   s   "r'   r(   r    s$     * ***3<*	*r)   c                8   VP                  4       pVP                  pV P                  V4       VP                  VP                  4       VP                  VP
                  4       VP                  VP                  4       VP                  VP                  4       R# )zWrite DSA public keyN)r   r  r  r   r   r   r  r  )r   rG   r   r   r  s   &&&  r'   r  _SSHFormatDSA.encode_public  su     $224*<<~&)++,)++,)++,(()r)   c               $    V ^8  d   QhRRRRRR/# )r   r   zdsa.DSAPrivateKeyr  r   r$   rf   r%   )r&   s   "r'   r(   r    s$     : :,:6?:	:r)   c                    V P                  VP                  4       V4       VP                  VP                  4       P                  4       R# )zWrite DSA private keyN)r  rG   r   r   r  )r   r   r  s   &&&r'   r  _SSHFormatDSA.encode_private  s:     	;113V<446889r)   c                    V ^8  d   QhRRRR/# )r   r   zdsa.DSAPublicNumbersr$   rf   r%   )r&   s   "r'   r(   r    s     D D(< D Dr)   c                	r    VP                   pVP                  P                  4       R 8w  d   \        R4      hR# )i   z#SSH supports only 1024 bit DSA keysN)r  r   r   rR   )r   r   r  s   && r'   r  _SSHFormatDSA._validate  s6    *<<))+t3BCC 4r)   r%   N)r6   r7   r8   r9   r   r   r   r   r  r  r  r;   r%   r)   r'   r
  r
  }  s,    "	 ! *:D Dr)   r
  c                  b    ] tR tRtRtR R ltR R ltR R ltR	 R
 ltR R lt	R R lt
RtR# )_SSHFormatECDSAi  zvFormat for ECDSA keys.

Public:
    str curve
    bytes point
Private:
    str curve
    bytes point
    mpint secret
c                    V ^8  d   QhRRRR/# )r   ssh_curve_namer   rX   ec.EllipticCurver%   )r&   s   "r'   r(   _SSHFormatECDSA.__annotate__  s      u 5E r)   c                	    Wn         W n        R # r   )r)  rX   )r   r)  rX   s   &&&r'   r   _SSHFormatECDSA.__init__  s    ,
r)   c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   z0tuple[tuple[memoryview, memoryview], memoryview]r%   )r&   s   "r'   r(   r+    s     
$ 
$
$	9
$r)   c                    \        V4      w  r!\        V4      w  r1W P                  8w  d   \        R4      hV^ ,          ^8w  d   \        R4      hW#3V3# )zECDSA public fieldszCurve name mismatchzNeed uncompressed point)r   r)  rR   NotImplementedError)r   r]   rX   points   &&  r'   r   _SSHFormatECDSA.get_public  sX     "$'!$''''2338q=%&?@@~t##r)   c                    V ^8  d   QhRRRR/# r   r]   rx   r$   z,tuple[ec.EllipticCurvePublicKey, memoryview]r%   )r&   s   "r'   r(   r+    s         	5 r)   c                    V P                  V4      w  w  r#p\        P                  P                  V P                  VP                  4       4      pWA3# z Make ECDSA public key from data.)r   r   rH   from_encoded_pointrX   r   )r   r]   _r1  rG   s   &&   r'   r   _SSHFormatECDSA.load_public  sI      ??40
D..AAJJ

 r)   c               $    V ^8  d   QhRRRRRR/# )r   r]   rx   r   r#   r$   z-tuple[ec.EllipticCurvePrivateKey, memoryview]r%   )r&   s   "r'   r(   r+    s$     
! 
!
!KO
!	6
!r)   c                    V P                  V4      w  w  rEp\        V4      w  raWE3V8w  d   \        R4      h\        P                  ! W`P
                  4      pWq3# )z!Make ECDSA private key from data.z"Corrupt data: ecdsa field mismatch)r   r   rR   r   derive_private_keyrX   )r   r]   r   r   
curve_namer1  secretr   s   &&&&    r'   r   _SSHFormatECDSA.load_private  sZ     %)OOD$9!T!$')+ABB++FJJ?  r)   c               $    V ^8  d   QhRRRRRR/# )r   rG   rV   r   r   r$   rf   r%   )r&   s   "r'   r(   r+    s$        3 <E 	 r)   c                    VP                  \        P                  \        P                  4      pVP                  V P                  4       VP                  V4       R# )zWrite ECDSA public keyN)public_bytesr   X962r   UncompressedPointr   r)  )r   rG   r   r1  s   &&& r'   r  _SSHFormatECDSA.encode_public  sG     ''MM<99
 	,,-r)   c               $    V ^8  d   QhRRRRRR/# )r   r   zec.EllipticCurvePrivateKeyr  r   r$   rf   r%   )r&   s   "r'   r(   r+    s$     8 858?H8	8r)   c                    VP                  4       pVP                  4       pV P                  W24       VP                  VP                  4       R# )zWrite ECDSA private keyN)rG   r   r  r   private_value)r   r   r  rG   r   s   &&&  r'   r  _SSHFormatECDSA.encode_private  sB     !++-
%557:.667r)   )rX   r)  N)r6   r7   r8   r9   r   r   r   r   r   r  r  r;   r%   r)   r'   r'  r'    s*    	
$ 
! 8 8r)   r'  c                  V    ] tR tRtRtR R ltR R ltR R ltR	 R
 ltR R lt	Rt
R# )_SSHFormatEd25519i
  zfFormat for Ed25519 keys.

Public:
    bytes point
Private:
    bytes point
    bytes secret_and_point
c                    V ^8  d   QhRRRR/# )r   r]   rx   r$   z$tuple[tuple[memoryview], memoryview]r%   )r&   s   "r'   r(   _SSHFormatEd25519.__annotate__  s      	-r)   c                &    \        V4      w  r!V3V3# )zEd25519 public fields)r   )r   r]   r1  s   && r'   r   _SSHFormatEd25519.get_public  s     "$'x~r)   c                    V ^8  d   QhRRRR/# r   r]   rx   r$   z+tuple[ed25519.Ed25519PublicKey, memoryview]r%   )r&   s   "r'   r(   rM    s         	4 r)   c                    V P                  V4      w  w  r!\        P                  P                  VP	                  4       4      pW13# z"Make Ed25519 public key from data.)r   r   rP   from_public_bytesr   )r   r]   r1  rG   s   &&  r'   r   _SSHFormatEd25519.load_public  s@     .--??MMO

 r)   c               $    V ^8  d   QhRRRRRR/# )r   r]   rx   r   r#   r$   z,tuple[ed25519.Ed25519PrivateKey, memoryview]r%   )r&   s   "r'   r(   rM  %  s$     ! !!KO!	5!r)   c                    V P                  V4      w  w  rA\        V4      w  rQVR,          pVR,          pWG8w  g	   V3V8w  d   \        R4      h\        P                  P                  V4      pW3# )z#Make Ed25519 private key from data.:N    N:rX  NNz$Corrupt data: ed25519 field mismatch)r   r   rR   r   rO   from_private_bytes)	r   r]   r   r   r1  keypairr>  point2r   s	   &&&&     r'   r   _SSHFormatEd25519.load_private%  sm     .#D)?uh)3CDD//BB6J  r)   c               $    V ^8  d   QhRRRRRR/# )r   rG   zed25519.Ed25519PublicKeyr   r   r$   rf   r%   )r&   s   "r'   r(   rM  3  s$     ) )2);D)	)r)   c                    VP                  \        P                  \        P                  4      pVP	                  V4       R# )zWrite Ed25519 public keyN)rB  r   Rawr   r   )r   rG   r   raw_public_keys   &&& r'   r  _SSHFormatEd25519.encode_public3  s3     $00LL,**
 	(r)   c               $    V ^8  d   QhRRRRRR/# )r   r   zed25519.Ed25519PrivateKeyr  r   r$   rf   r%   )r&   s   "r'   r(   rM  <  s$     % %4%>G%	%r)   c                L   VP                  4       pVP                  \        P                  \        P                  \        4       4      pVP                  \        P                  \        P                  4      p\        WE.4      pV P                  W24       VP                  V4       R# )zWrite Ed25519 private keyN)rG   private_bytesr   r_  r   r   rB  r   r   r  r   )r   r   r  rG   raw_private_keyr`  	f_keypairs   &&&    r'   r   _SSHFormatEd25519.encode_private<  s     !++-
%33LL-++\^
 $00LL,**
 ?@	:.)$r)   r%   Nr  r%   r)   r'   rK  rK  
  s%     !)% %r)   rK  c                   V ^8  d   QhRR/# )r   r$   r   r%   )r&   s   "r'   r(   r(   M  s     
 
; 
r)   c                    \        V 4      w  rVP                  4       P                  R4      '       g   \        RV R24      hW3# )z
U2F application strings
s   ssh:z4U2F application string does not start with b'ssh:' ())r   r   
startswithrR   )r]   applications   & r'   load_applicationrm  M  sT     $D)K ++G44}A
 	
 r)   c                  2    ] tR tRtRtR R ltR R ltRtR# )	_SSHFormatSKEd25519iZ  z
The format of a sk-ssh-ed25519@openssh.com public key is:

    string          "sk-ssh-ed25519@openssh.com"
    string          public key
    string          application (user-specified, but typically "ssh:")
c                    V ^8  d   QhRRRR/# rQ  r%   )r&   s   "r'   r(    _SSHFormatSKEd25519.__annotate__c  s         	4 r)   c                b    \        \        4      P                  V4      w  r!\        V4      w  r1W!3# rS  )_lookup_kformatrQ   r   rm  r   r]   rG   r8  s   &&  r'   r   _SSHFormatSKEd25519.load_publicc  s1     +<8DDTJ
"4(r)   c                    V ^8  d   QhRRRR/# r   r]   rx   r$   ztyping.NoReturnr%   )r&   s   "r'   r(   rq  k       
 
z 
o 
r)   c                	    \        R 4      h)z,sk-ssh-ed25519 private keys cannot be loadedr   r   r]   s   &&r'   r   _SSHFormatSKEd25519.get_publick  s     #:
 	
r)   r%   Nr6   r7   r8   r9   r   r   r   r;   r%   r)   r'   ro  ro  Z  s     
 
r)   ro  c                  2    ] tR tRtRtR R ltR R ltRtR# )	_SSHFormatSKECDSAis  z
The format of a sk-ecdsa-sha2-nistp256@openssh.com public key is:

    string          "sk-ecdsa-sha2-nistp256@openssh.com"
    string          curve name
    ec_point        Q
    string          application (user-specified, but typically "ssh:")
c                    V ^8  d   QhRRRR/# r4  r%   )r&   s   "r'   r(   _SSHFormatSKECDSA.__annotate__}  s         	5 r)   c                b    \        \        4      P                  V4      w  r!\        V4      w  r1W!3# r6  )rs  _ECDSA_NISTP256r   rm  rt  s   &&  r'   r   _SSHFormatSKECDSA.load_public}  s1     +?;GGM
"4(r)   c                    V ^8  d   QhRRRR/# rw  r%   )r&   s   "r'   r(   r    rx  r)   c                	    \        R 4      h)z4sk-ecdsa-sha2-nistp256 private keys cannot be loadedr   rz  s   &&r'   r   _SSHFormatSKECDSA.get_public  s     #B
 	
r)   r%   Nr|  r%   r)   r'   r~  r~  s  s     
 
r)   r~  s   nistp256s   nistp384s   nistp521c                   V ^8  d   QhRR/# )r   rS   r^   r%   )r&   s   "r'   r(   r(     s     F Fl Fr)   c                    \        V \        4      '       g   \        V 4      P                  4       p V \        9   d   \        V ,          # \        RV : 24      h)z"Return valid format or throw errorzUnsupported key type: )rD   r   rx   r   _KEY_FORMATSr   )rS   s   &r'   rs  rs    sH    h&&h'//1<H%%
!7|D
EEr)   r   c          
     ,    V ^8  d   QhRRRRRRRRR	R
/# )r   r]   r^   r   rp   backend
typing.Anyr   r#   r$   SSHPrivateKeyTypesr%   )r&   s   "r'   r(   r(     sA     o o
oo o
 %)o or)   c                  \         P                  ! RV 4       Ve   \         P                  ! RV4       \        P	                  V 4      pV'       g   \        R4      hVP                  ^4      pVP                  ^4      p\        P                  ! \        V 4      WV 4      p V P                  \        4      '       g   \        R4      h\        V 4      \        \        4      R p \        V 4      w  rp\        V 4      w  r\        V 4      w  r\        V 4      w  rV
^8w  d   \        R4      h\        V 4      w  r\        V4      w  r\!        V4      pVP#                  V4      w  r\%        V4       V\&        8w  g   V\&        8w  Ed   VP)                  4       pV\*        9  d   \-        RV: 24      hV\.        8w  d   \-        RV: 24      h\*        V,          P0                  p\*        V,          P2                  p\        V 4      w  pp \*        V,          P4                  '       d(   \7        V 4      p\        V4      V8w  d   \        R4      hM\%        V 4       \9        VV4       \        V	4      w  pp\        V4      w  pp\%        V4       \;        WVP)                  4       V4      pVP=                  4       p\        VP?                  V4      4      p\*        V,          P4                  '       d4   \A        V\B        4      '       g   Q h\%        VPE                  X4      4       MT\%        VPG                  4       4       M:V'       d   \I        R	4      h\        V 4      w  pp \%        V 4       ^p\9        VV4       \        V4      w  pp\        V4      w  ppVV8w  d   \        R
4      h\        V4      w  ppVV8w  d   \        R4      hVPK                  VVVR7      w  pp\        V4      w  ppV\L        R\        V4       8w  d   \        R4      h\A        V\N        PP                  4      '       d(   \R        PT                  ! R\         PV                  ^R7       V# )z.Load private key from OpenSSH custom encoding.r]   Nr   zNot OpenSSH private key formatzOnly one key supportedzUnsupported cipher: zUnsupported KDF: z+Corrupt data: invalid tag length for cipherz4Password was given but private key is not encrypted.zCorrupt data: broken checksumzCorrupt data: key type mismatchr   zCorrupt data: invalid paddingDSSH DSA keys are deprecated and will be removed in a future release.
stacklevel),r   _check_byteslike_check_bytes_PEM_RCsearchrR   r   endbinascii
a2b_base64rx   rk  	_SK_MAGICrh   r   r   rs  r   rm   _NONEr   r<   r   _BCRYPTr1   r4   r5   r   ri   ru   	decryptorupdaterD   r   finalize_with_tagfinalizerr   r   _PADDINGr
   rL   warningswarnDeprecatedIn40)r]   r   r  r   mp1p2ro   kdfname
kdfoptionsnkeyspubdatapub_key_typekformatr   ciphername_bytesblklenr4   edatatagr   kbufr!   rs   decck1ck2rS   r   r8  s   &&&$                          r'   load_ssh_private_keyr    s    
64(:x0tA9::	
B	
qBz$/67D??9%%9::dC	N,-D #4(J%MG"4(J4.KEz122  %MG'0Ll+G ++G4IUg.%--/</&&'7&:;  g&):7+'FGG./99/088!$'t ()111+C3x7" !NOO # %( ,
d~T,Onn3::e,-()111c#89999..s34 (F  "$'tT%(%JC%JC
cz899 "%(OHe<:;; --'E . K 5!HAu 3u:&&899+s0011  		
 r)   c               (    V ^8  d   QhRRRRRRRR/# )r   r   r  r   r   encryption_algorithmr   r$   r%   )r&   s   "r'   r(   r(     s6     J' J'#J'J' 5J' 	J'r)   c                   \         P                  ! RV4       \        V \        P                  4      '       d(   \
        P                  ! R\         P                  ^R7       \        V 4      p\        V4      p\        4       pV'       d   \        p\        V,          P                  p\        p\        p	\        V\         4      '       d   VP"                  e   VP"                  p	\$        P&                  ! ^4      p
VP)                  V
4       VP+                  V	4       \-        WaW4      pM\.        ;rh^pRp^p\$        P&                  ! ^4      pRp\        4       pVP)                  V4       VP1                  V P3                  4       V4       \        W.4      pVP)                  V4       VP5                  V V4       VP)                  V4       VP7                  \8        RVVP;                  4       V,          ,
           4       \        4       pVP7                  \<        4       VP)                  V4       VP)                  V4       VP)                  V4       VP+                  V4       VP)                  V4       VP)                  V4       VP;                  4       pVP;                  4       p\?        \A        VV,           4      4      pVPC                  V4       VV,
          pVe'   VPE                  4       PG                  VVV VVR 4       \I        VRV 4      # )z3Serialize private key with OpenSSH custom encoding.r   ISSH DSA key support is deprecated and will be removed in a future releaser  Nr)   )%r   r  rD   r
   rL   r  r  r  rT   rs  r   _DEFAULT_CIPHERr<   r1   r  _DEFAULT_ROUNDSr   _kdf_roundsosurandomr   r   ru   r  r  rG   r  r   r  r   r  rx   r   r   	encryptorupdate_intord   )r   r   r  rS   r  f_kdfoptionsro   r  r  r!   r   rs   r  checkvalcommentf_public_key	f_secretsf_mainslenmlenr   ofss   &&&                   r'   _serialize_ssh_private_keyr    s}    
z8,+s0011*  		
 !-Hh'G ;L$
j)33 +-HII$00<)55Fzz"~%V$J$?$$
Ezz!}HG ;LH%+002LA8./I";	2!hE9>>+;f+D!EFG [F
NN9
j!
g
l#
NN5
l#
i  >>D;;=D
Ytf}-
.C
MM#
+C $$ST]CI>3u:&&r)   c                      ] tR tRt^t^tRtR# )SSHCertificateTypeiw  r%   N)r6   r7   r8   r9   USERHOSTr;   r%   r)   r'   r  r  w  s    DDr)   r  c                     ] tR tRtR R lt]R R l4       tR R lt]R R	 l4       t]R
 R l4       t	]R R l4       t
]R R l4       t]R R l4       t]R R l4       t]R R l4       t]R R l4       tR R ltR R ltR R ltRtR# ) SSHCertificatei|  c          "     \    V ^8  d   QhRRRRRRRRRRR	R
RRRRRRRRRRRRRRRRRRRRRR/# )r   _noncerx   _public_keySSHPublicKeyTypes_serialr    _cctype_key_id_valid_principalslist[bytes]_valid_after_valid_before_critical_optionsdict[bytes, bytes]_extensions	_sig_type_sig_key_inner_sig_type
_signature_tbs_cert_body_cert_key_typer   
_cert_bodyr%   )r&   s   "r'   r(   SSHCertificate.__annotate__}  s     '- '-'- ''- 	'-
 '- '- ''- '- '- .'- ('- '- '- $'- '-  #!'-" #'-$ %'-r)   c                	    Wn         W n        W0n         \        V4      V n        YPn        Y`n        Ypn        Yn	        Yn
        Yn        Yn        Yn        Yn        Yn        TT n        TT n        Yn        R#   \
         d    \        R 4      hi ; i)zInvalid certificate typeN)r  r  r  r  _typerR   r  r  r  r  r  r  r  r  r  r  r  r  r  )r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  s   &&&&&&&&&&&&&&&&&&r'   r   SSHCertificate.__init__}  s    ( &	9+G4DJ !2(*!2&" .$,$,  	9788	9s   A6 6Bc                   V ^8  d   QhRR/# r   r%   )r&   s   "r'   r(   r    s     " "u "r)   c                	,    \        V P                  4      # r   )r   r  r   s   &r'   nonceSSHCertificate.nonce  s    T[[!!r)   c                   V ^8  d   QhRR/# r   r$   SSHCertPublicKeyTypesr%   )r&   s   "r'   r(   r    s     D D1 Dr)   c                	L    \         P                  ! \        V P                  4      # r   )typingcastr  r  r   s   &r'   rG   SSHCertificate.public_key  s     {{0$2B2BCCr)   c                   V ^8  d   QhRR/# r   r%   )r&   s   "r'   r(   r    s       r)   c                	    V P                   # r   )r  r   s   &r'   serialSSHCertificate.serial  s    ||r)   c                   V ^8  d   QhRR/# )r   r$   r  r%   )r&   s   "r'   r(   r    s      ( r)   c                	    V P                   # r   )r  r   s   &r'   typeSSHCertificate.type  s    zzr)   c                   V ^8  d   QhRR/# r   r%   )r&   s   "r'   r(   r    s     # # #r)   c                	,    \        V P                  4      # r   )r   r  r   s   &r'   key_idSSHCertificate.key_id  s    T\\""r)   c                   V ^8  d   QhRR/# )r   r$   r  r%   )r&   s   "r'   r(   r    s     & &+ &r)   c                	    V P                   # r   )r  r   s   &r'   valid_principalsSSHCertificate.valid_principals      %%%r)   c                   V ^8  d   QhRR/# r   r%   )r&   s   "r'   r(   r    s     " "c "r)   c                	    V P                   # r   )r  r   s   &r'   valid_beforeSSHCertificate.valid_before  s    !!!r)   c                   V ^8  d   QhRR/# r   r%   )r&   s   "r'   r(   r    s     ! !S !r)   c                	    V P                   # r   )r  r   s   &r'   valid_afterSSHCertificate.valid_after  s       r)   c                   V ^8  d   QhRR/# r   r$   r  r%   )r&   s   "r'   r(   r    s     & &"4 &r)   c                	    V P                   # r   )r  r   s   &r'   critical_optionsSSHCertificate.critical_options  r  r)   c                   V ^8  d   QhRR/# r  r%   )r&   s   "r'   r(   r    s        .  r)   c                	    V P                   # r   )r  r   s   &r'   
extensionsSSHCertificate.extensions  s    r)   c                   V ^8  d   QhRR/# r  r%   )r&   s   "r'   r(   r    s      4 r)   c                	    \        V P                  4      pVP                  V P                  4      w  r#\	        V4       V# r   )rs  r  r   r  rm   )r   	sigformatsignature_keysigkey_rests   &   r'   r  SSHCertificate.signature_key  s5    #DNN3	%.%:%:4==%I"[!r)   c                   V ^8  d   QhRR/# r   r%   )r&   s   "r'   r(   r    s     
 
e 
r)   c                	    \        V P                  4      R ,           \        P                  ! \        V P                  4      RR7      ,           # )    F)newline)r   r  r  
b2a_base64r  r   s   &r'   rB  SSHCertificate.public_bytes  s<    $%%&!!%"8%HI	
r)   c                   V ^8  d   QhRR/# )r   r$   rf   r%   )r&   s   "r'   r(   r    s      t r)   c                	(   V P                  4       p\        V\        P                  4      '       d;   VP	                  \        V P                  4      \        V P                  4      4       R # \        V\        P                  4      '       d   \        V P                  4      w  r#\        V4      w  rC\        V4       \        P                  ! W$4      p\        VP                  4      pVP	                  V\        V P                  4      \        P                   ! V4      4       R # \        V\"        P$                  4      '       g   Q hV P&                  \(        8X  d   \*        P,                  ! 4       pMWV P&                  \.        8X  d   \*        P0                  ! 4       pM,V P&                  \2        8X  g   Q h\*        P4                  ! 4       pVP	                  \        V P                  4      \        V P                  4      \6        P8                  ! 4       V4       R # r   )r  rD   r   rP   verifyr   r  r  r   rH   r   rm   
asym_utilsencode_dss_signature_get_ec_hash_algrX   ECDSAr   rJ   r  rK   r	   SHA1_SSH_RSA_SHA256SHA256_SSH_RSA_SHA512SHA512r   PKCS1v15)r   r  rr]   scomputed_sighash_algs   &      r'   verify_cert_signature$SSHCertificate.verify_cert_signature  so   **,mW%=%=>>  doo&d.A.A(B r'@'@AA 1GA &GA%::1@L'(;(;<H  eD$7$78"((8:L mS-=-=>>>>##x/!;;=%%8!==?++>>>!==?  doo&d))*  "	r)   )r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  N)r6   r7   r8   r9   r   propertyr  rG   r  r  r  r  r  r  r  r  r  rB  r4  r;   r%   r)   r'   r  r  |  s    '-R " "D
     # # & & " " ! ! & &    
 r)   r  c                    V ^8  d   QhRRRR/# )r   rX   r*  r$   zhashes.HashAlgorithmr%   )r&   s   "r'   r(   r(     s      , 1E r)   c                D   \        V \        P                  4      '       d   \        P                  ! 4       # \        V \        P
                  4      '       d   \        P                  ! 4       # \        V \        P                  4      '       g   Q h\        P                  ! 4       # r   )	rD   r   	SECP256R1r	   r,  	SECP384R1SHA384	SECP521R1r.  )rX   s   &r'   r(  r(    s_    %&&}}	E2<<	(	(}}%....}}r)   c                    V ^8  d   QhRRRR/# r   r]   r^   r$   z"SSHCertificate | SSHPublicKeyTypesr%   )r&   s   "r'   r(   r(     s"     \ \
\ (\r)   c                *   \         P                  ! R V 4       \        P                  V 4      pV'       g   \	        R4      hVP                  ^4      ;r4VP                  ^4      pRpVP                  \        4      '       d   RpVR\        \        4      )  pV\        8X  d   V'       g   \        R4      h\        V4      p \        \        P                  ! V4      4      pT'       d   Tp	\#        T4      w  rY8w  d   \	        R4      hT'       d   \#        T4      w  rTP%                  T4      w  rT'       Ed   \'        T4      w  r\)        T4      w  r\#        T4      w  r\#        T4      w  pp. pT'       d+   \#        T4      w  ppTP+                  \-        T4      4       K2  \'        T4      w  pp\'        T4      w  pp\#        T4      w  pp\/        T4      p\#        T4      w  pp\/        T4      p\#        T4      w  pp\#        T4      w  pp\#        T4      w  ppT\        8X  d   T'       g   \        R4      hX	R\        T4      )  p\#        T4      w  pp\1        T4       \#        T4      w  pp T\2        8X  d   T\4        \6        \2        39  g   T\2        8w  d   TT8w  d   \	        R	4      h\#        T 4      w  p!p \1        T 4       \9        XTTTTTTTTTTTTT!TTT	4      # \1        T4       T#   \        \        P                   3 d    \	        R4      hi ; i)
r]   zInvalid line formatFTNz-DSA keys aren't supported in SSH certificateszInvalid formatzInvalid key formatz3DSA signatures aren't supported in SSH certificatesz!Signature key type does not match)r   r  _SSH_PUBKEY_RCmatchrR   groupendswith_CERT_SUFFIXrh   rN   r   rs  rx   r  r  rr   Errorr   r   r   r   r   r   _parse_exts_optsrm   rK   r+  r-  r  )"r]   _legacy_dsa_allowedr  rS   orig_key_typekey_body	with_certr  rest	cert_bodyinner_key_typer  rG   r  cctyper  
principalsr  	principalr  r  crit_optionsr  extsr  r8  sig_key_rawsig_typesig_keytbs_cert_bodysignature_rawinner_sig_typesig_rest	signatures"   &&                                r'   _load_ssh_public_identityr[    s    
64(T"A.// wwqz)HwwqzHI&&	0s<0018$7";
 	
 h'G+(--h78 	&t,N&-..!$'**40Jy~~"4(&t,
D$/
$;!Iz##E)$45$TNT%d^d(.d+L9 &
d%d+
d#4'-T'4'x(;&E  ",SYJ/)$/tT#.}#=   #_h?@("~'A@AA)(3	8X#
 	
( 	TK x~~& +)**+s   ?K+ +'Lc                    V ^8  d   QhRRRR/# r>  r%   )r&   s   "r'   r(   r(   f  s     + +
+'+r)   c                    \        V 4      # r   )r[  rl   s   &r'   load_ssh_public_identityr^  f  s     %T**r)   c                    V ^8  d   QhRRRR/# )r   	exts_optsrx   r$   r  r%   )r&   s   "r'   r(   r(   l  s      
 /A r)   c                F   / pR pV '       d   \        V 4      w  r0\        V4      pWA9   d   \        R4      hVe   WB8  d   \        R4      h\        V 4      w  rP\        V4      ^ 8  d)   \        V4      w  rV\        V4      ^ 8  d   \        R4      h\        V4      W&   TpK  V# )NzDuplicate namezFields not lexically sortedz!Unexpected extra data after value)r   r   rR   rh   )r`  result	last_namerY   bnamevalueextras   &      r'   rF  rF  l  s    !#FI
%i0T{?-.. U%6:;;&y1u:>&u-LE5zA~ !DEEe	Mr)   c               $    V ^8  d   QhRRRRRR/# )r   rA   r  hash_algorithmzhashes.MD5 | hashes.SHA256r$   r   r%   )r&   s   "r'   r(   r(     s&      	. r)   c                   \        V\        P                  \        P                  34      '       g   \	        R 4      h\        V 4      p\        V4      p\        4       pVP                  V4       VP                  W4       VP                  4       p\        P                  ! V4      pVP                  V4       VP                  4       # )z+hash_algorithm must be either MD5 or SHA256)rD   r	   MD5r,  rr   rT   rs  r   r   r  r   Hashr  r  )rA   rh  rS   r  r   ssh_binary_datahash_objs   &&     r'   ssh_key_fingerprintrn    s     nvzz6==&ABBEFF %Hh'GKE	X#%mmoO {{>*HOOO$r)   c               $    V ^8  d   QhRRRRRR/# )r   r]   r^   r  r  r$   r  r%   )r&   s   "r'   r(   r(     s$      
!+r)   c                    \        V R R7      p\        V\        4      '       d   VP                  4       pMTp\        V\        P
                  4      '       d(   \        P                  ! R\        P                  ^R7       V# )T)rG  r  r  )
r[  rD   r  rG   r
   rM   r  r  r   r  )r]   r  cert_or_keyrG   s   &&  r'   load_ssh_public_keyrr    sh     ,DdKK+~.. ++-
 
*c..//  		
 r)   c                    V ^8  d   QhRRRR/# )r   rG   r  r$   r   r%   )r&   s   "r'   r(   r(     s     + +): +u +r)   c                   \        V \        P                  4      '       d(   \        P                  ! R\
        P                  ^R7       \        V 4      p\        V4      p\        4       pVP                  V4       VP                  W4       \        P                  ! VP                  4       4      P                  4       pRP!                  VRV.4      # )z&One-line public key format for OpenSSHr  r  r)   r  )rD   r
   rM   r  r  r   r  rT   rs  r   r   r  r  r!  r   striprb   )rG   rS   r  r   pubs   &    r'   serialize_ssh_public_keyrw    s    *c..//*  		
 !,Hh'GKE	X*,


emmo
.
4
4
6C88XtS)**r)      c            
          ] tR tRtRRRR. RRR. . 3
R R lltR R ltR R	 ltR
 R ltR R ltR R lt	R t
R R ltR R ltR R ltR R ltR R ltRtR# )SSHCertificateBuilderi  NFc               @    V ^8  d   QhRRRRRRRRR	R
RRRRRRRRRR/
# )r   r  zSSHCertPublicKeyTypes | Noner  r3   r  zSSHCertificateType | Noner  rp   r  r  _valid_for_all_principalsr#   r  r  r  zlist[tuple[bytes, bytes]]r  r%   )r&   s   "r'   r(   "SSHCertificateBuilder.__annotate__  sn     ' '1' ' )	'
 ' '' $(' "' !' 5' /'r)   c                	~    Wn         W n        W0n        W@n        WPn        W`n        Wpn        Wn        Wn        Wn	        R # r   
r  r  r  r  r  r|  r  r  r  r  )r   r  r  r  r  r  r|  r  r  r  r  s   &&&&&&&&&&&r'   r   SSHCertificateBuilder.__init__  s=     '
!2)B&*(!2&r)   c                    V ^8  d   QhRRRR/# )r   rG   r  r$   rz  r%   )r&   s   "r'   r(   r}    s     
 
/
	
r)   c                	   \        V\        P                  \        P                  \
        P                  34      '       g   \        R 4      hV P                  e   \        R4      h\        VV P                  V P                  V P                  V P                  V P                  V P                   V P"                  V P$                  V P&                  R7
      # )rC   zpublic_key already setr  )rD   r   rH   r   rJ   r   rP   rr   r  rR   rz  r  r  r  r  r|  r  r  r  r  )r   rG   s   &&r'   rG    SSHCertificateBuilder.public_key  s     ))  ((
 
 233'566$"LL**LL"44&*&D&D,,**"44((
 	
r)   c                    V ^8  d   QhRRRR/# )r   r  r    r$   rz  r%   )r&   s   "r'   r(   r}    s     
 
S 
%: 
r)   c                	   \        V\        4      '       g   \        R 4      h^ Tu;8:  d   R8  g   M \        R4      hV P                  e   \        R4      h\        V P                  VV P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  R7
      # )zserial must be an integerz"serial must be between 0 and 2**64zserial already setr              )rD   r    rr   rR   r  rz  r  r  r  r  r|  r  r  r  r  )r   r  s   &&r'   r  SSHCertificateBuilder.serial  s    &#&&788F"U"ABB<<#122$((**LL"44&*&D&D,,**"44((
 	
r)   c                    V ^8  d   QhRRRR/# )r   r  r  r$   rz  r%   )r&   s   "r'   r(   r}    s     
 
+ 
0E 
r)   c                	T   \        V\        4      '       g   \        R 4      hV P                  e   \	        R4      h\        V P                  V P                  VV P                  V P                  V P                  V P                  V P                  V P                  V P                  R7
      # )z"type must be an SSHCertificateTypeztype already setr  )rD   r  rr   r  rR   rz  r  r  r  r  r|  r  r  r  r  )r   r  s   &&r'   r  SSHCertificateBuilder.type  s    $ 233@AA::!/00$((LLLL"44&*&D&D,,**"44((
 	
r)   c                    V ^8  d   QhRRRR/# )r   r  r   r$   rz  r%   )r&   s   "r'   r(   r}  '  s     
 
U 
'< 
r)   c                	T   \        V\        4      '       g   \        R 4      hV P                  e   \	        R4      h\        V P                  V P                  V P                  VV P                  V P                  V P                  V P                  V P                  V P                  R7
      # )zkey_id must be byteszkey_id already setr  )rD   r   rr   r  rR   rz  r  r  r  r  r|  r  r  r  r  )r   r  s   &&r'   r  SSHCertificateBuilder.key_id'  s    &%((233<<#122$((LL**"44&*&D&D,,**"44((
 	
r)   c                    V ^8  d   QhRRRR/# )r   r  r  r$   rz  r%   )r&   s   "r'   r(   r}  :  s     "
 "
 +"
	"
r)   c                	,   V P                   '       d   \        R 4      h\        ;QJ d    R V 4       F  '       d   K   RM	  RM! R V 4       4      '       d	   V'       g   \        R4      hV P                  '       d   \        R4      h\        V4      \        8  d   \        R4      h\        V P                  V P                  V P                  V P                  VV P                   V P                  V P                  V P                  V P                  R7
      # )zDPrincipals can't be set because the cert is valid for all principalsc              3  B   "   T F  p\        V\        4      x  K  	  R # 5ir   )rD   r   ).0r  s   & r'   	<genexpr>9SSHCertificateBuilder.valid_principals.<locals>.<genexpr>C  s     C2BQJq%((2Bs   FTz5principals must be a list of bytes and can't be emptyzvalid_principals already setz:Reached or exceeded the maximum number of valid_principalsr  )r|  rR   allrr   r  rh   _SSHKEY_CERT_MAX_PRINCIPALSrz  r  r  r  r  r  r  r  r  )r   r  s   &&r'   r  &SSHCertificateBuilder.valid_principals:  s     )))% 
 C2BCC2BCCC#G  !!!;<< #>>L  %((LL**LL.&*&D&D,,**"44((
 	
r)   c                	T   V P                   '       d   \        R 4      hV P                  '       d   \        R4      h\        V P                  V P
                  V P                  V P                  V P                   RV P                  V P                  V P                  V P                  R7
      # )z@valid_principals already set, can't set valid_for_all_principalsz$valid_for_all_principals already setTr  )r  rR   r|  rz  r  r  r  r  r  r  r  r  r   s   &r'   valid_for_all_principals.SSHCertificateBuilder.valid_for_all_principals^  s    !!!+  )))CDD$((LL**LL"44&*,,**"44((
 	
r)   c                    V ^8  d   QhRRRR/# )r   r  int | floatr$   rz  r%   )r&   s   "r'   r(   r}  t  s     
 
 
9N 
r)   c                	   \        V\        \        34      '       g   \        R 4      h\        V4      pV^ 8  g   VR8  d   \	        R4      hV P
                  e   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  VV P                  V P                  V P                  R7
      # )z$valid_before must be an int or floatzvalid_before must [0, 2**64)zvalid_before already setr  r  )rD   r    floatrr   rR   r  rz  r  r  r  r  r  r|  r  r  r  )r   r  s   &&r'   r  "SSHCertificateBuilder.valid_beforet  s    ,e55BCC<(!|u4;<<)788$((LL**LL"44&*&D&D&**"44((
 	
r)   c                    V ^8  d   QhRRRR/# )r   r  r  r$   rz  r%   )r&   s   "r'   r(   r}    s     
 
{ 
7L 
r)   c                	   \        V\        \        34      '       g   \        R 4      h\        V4      pV^ 8  g   VR8  d   \	        R4      hV P
                  e   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  V P                  VV P                  V P                  R7
      # )z#valid_after must be an int or floatzvalid_after must [0, 2**64)zvalid_after already setr  r  )rD   r    r  rr   rR   r  rz  r  r  r  r  r  r|  r  r  r  )r   r  s   &&r'   r  !SSHCertificateBuilder.valid_after  s    +U|44ABB+&?kU2:;;(677$((LL**LL"44&*&D&D,,$"44((
 	
r)   c               $    V ^8  d   QhRRRRRR/# r   rY   r   re  r$   rz  r%   )r&   s   "r'   r(   r}    $     
 

"'
	
r)   c                	   \        V\        4      '       d   \        V\        4      '       g   \        R 4      hYP                   UUu. uF  w  rVNK	  	  upp9   d   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  . V P                  OXV3NV P                  R7
      # u uppi )name and value must be byteszDuplicate critical option namer  )rD   r   rr   r  rR   rz  r  r  r  r  r  r|  r  r  r  r   rY   re  r8  s   &&& r'   add_critical_option)SSHCertificateBuilder.add_critical_option  s     $&&j.F.F:;;(>(>?(>WTD(>??=>>$((LL**LL"44&*&D&D,,**F 6 6FuF((
 	
 @   C&c               $    V ^8  d   QhRRRRRR/# r  r%   )r&   s   "r'   r(   r}    r  r)   c                	   \        V\        4      '       d   \        V\        4      '       g   \        R 4      hYP                   UUu. uF  w  rVNK	  	  upp9   d   \	        R4      h\        V P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  V P                  . V P                  OXV3NR7
      # u uppi )r  zDuplicate extension namer  )rD   r   rr   r  rR   rz  r  r  r  r  r  r|  r  r  r  r  s   &&& r'   add_extension#SSHCertificateBuilder.add_extension  s     $&&j.F.F:;;(8(89(8WTD(899788$((LL**LL"44&*&D&D,,**"44:$**:T5M:
 	
 :r  c                    V ^8  d   QhRRRR/# )r   r   SSHCertPrivateKeyTypesr$   r  r%   )r&   s   "r'   r(   r}    s     G
 G
 6 G
> G
r)   c           
     	   \        V\        P                  \        P                  \
        P                  34      '       g   \        R 4      hV P                  f   \        R4      hV P                  f   ^ MV P                  pV P                  f   \        R4      hV P                  f   RMV P                  pV P                  '       g   V P                  '       g   \        R4      hV P                  f   \        R4      hV P                   f   \        R4      hV P                   V P                  8  d   \        R4      hV P"                  P%                  R R	7       V P&                  P%                  R
 R	7       \)        V P                  4      pV\*        ,           p\,        P.                  ! ^ 4      p\1        V4      p\3        4       pVP5                  V4       VP5                  V4       VP7                  V P                  V4       VP9                  V4       VP;                  V P                  P<                  4       VP5                  V4       \3        4       p	V P                   F  p
V	P5                  V
4       K  	  VP5                  V	P?                  4       4       VP9                  V P                   4       VP9                  V P                  4       \3        4       pV P"                   Fs  w  rVP5                  V4       \A        V4      ^ 8  d=   \3        4       pVP5                  V4       VP5                  VP?                  4       4       Kb  VP5                  V4       Ku  	  VP5                  VP?                  4       4       \3        4       pV P&                   Fs  w  rVP5                  V4       \A        V4      ^ 8  d=   \3        4       pVP5                  V4       VP5                  VP?                  4       4       Kb  VP5                  V4       Ku  	  VP5                  VP?                  4       4       VP5                  R4       \)        V4      p\1        V4      p\3        4       pVP5                  V4       VP7                  VPC                  4       V4       VP5                  VP?                  4       4       \        V\
        P                  4      '       dm   VPE                  VP?                  4       4      p\3        4       pVP5                  V4       VP5                  V4       VP5                  VP?                  4       4       EM\        V\        P                  4      '       d   \G        VPH                  4      pVPE                  VP?                  4       \        PJ                  ! V4      4      p\L        PN                  ! V4      w  pp\3        4       pVP5                  V4       \3        4       pVPQ                  V4       VPQ                  V4       VP5                  VP?                  4       4       VP5                  VP?                  4       4       M\        V\        P                  4      '       g   Q h\3        4       pVP5                  \R        4       VPE                  VP?                  4       \T        PV                  ! 4       \X        PZ                  ! 4       4      pVP5                  V4       VP5                  VP?                  4       4       \\        P^                  ! VP?                  4       4      Pa                  4       p\b        Pd                  ! \f        \i        RPk                  VRV.4      4      4      # )zUnsupported private key typezpublic_key must be setztype must be setr)   zAvalid_principals must be set if valid_for_all_principals is Falsezvalid_before must be setzvalid_after must be setz-valid_after must be earlier than valid_beforec                    V ^ ,          # r   r%   r  s   &r'   <lambda>,SSHCertificateBuilder.sign.<locals>.<lambda>  s    !A$r)   )rA   c                    V ^ ,          # r   r%   r  s   &r'   r  r    s    AaDr)   r  )6rD   r   rE   r   rI   r   rO   rr   r  rR   r  r  r  r  r|  r  r  r  sortr  rT   rD  r  r  rs  r   r   r  r   r   re  r   rh   rG   signr(  rX   r)  r&  decode_dss_signaturer   r-  r   r/  r	   r.  r  r!  ru  r  r  r  r^  rb   )r   r   r  r  rS   cert_prefixr  r  ffprincipalsr   fcritrY   re  foptvalfextfextvalca_typecaformatcafrZ  fsigr3  r0  r1  fsigblob	cert_datas   &&                         r'   r  SSHCertificateBuilder.sign  si   **!!))
 
 :;;#566 ll*::/00 ,$,, %%%d.L.L.L 
 %788$677t111LMM 	###7.1$T%5%56- 

2!(+K	[!	Ud..2			&			$**""#	Vk''A""1% (	[((*+			$##$			$$$%11KDT"5zA~#+""5)  !23  ' 2 	
U]]_%{++KDOOD!5zA~#+""5) 12& , 	
T\\^$	S#K0"7+kw{557=	S[[]# k7#<#<==#((5I;DOOG$OOI&LL(R%?%?@@'(9(9:H#((bhhx6HII229=DAq;DOOG$ {Hq!q!OOH,,./LL( k3+<+<====
 ;DOOO,#((		W--/I OOI&LL(''		4::<	 {{$SXX{D).L%MN
 	
r)   )
r  r  r  r  r  r  r  r  r|  r  )r6   r7   r8   r9   r   rG   r  r  r  r  r  r  r  r  r  r  r;   r%   r)   r'   rz  rz    sf     59"+/ $)+*/$(#'7913'0
8
*
&
&"
H
,
,
,
,
,G
 G
r)   rz  )Fr   )__conditional_annotations__
__future__r   r  enumr  rer  r  base64r   rc   dataclassesr   cryptographyr   cryptography.exceptionsr   cryptography.hazmat.primitivesr	   )cryptography.hazmat.primitives.asymmetricr
   r   r   r   r   r&  &cryptography.hazmat.primitives.ciphersr   r   r   r   ,cryptography.hazmat.primitives.serializationr   r   r   r   r   r   bcryptr   r+   _bcrypt_supportedImportErrorrQ   rK   rN   r  _ECDSA_NISTP384_ECDSA_NISTP521rD  _SK_SSH_ED25519_SK_SSH_ECDSA_NISTP256r+  r-  compiler@  r  	_SK_START_SK_ENDr  r  r  r  DOTALLr  rx   r   ranger  r-   AESCTRCBCGCMr<   r:   rZ   rT   rF   rd   ri   rm   ru   r   r   r   r   r   r   r   r
  r'  rK  rm  ro  r~  r9  r:  r<  r  rs  UnionrE   rI   rL   rO   r  r  r  rH   rJ   rM   rP   r  r  Enumr  r  r(  r[  r^  rF  rn  rr  rw  r  r  rz  )r  s   @r'   <module>r     sB  
 # "   	 	   0 !  8 1  J  9) (((' 0>  "!23	2	
.
 **Y)G3RYY
? ia 012    :NNYY :NNYY zNNYY ')% @ &' %eO<:8,??,+3 3lG, G,TCD CDLD8 D8N@% @%F

 
2
 
6 momo#%_[",,.A_[",,.A_[",,.A(*-/	F \\ o
 ,1o odJ'Z LL    
~ ~B\~+(,(+(    " I
 I
y$  
99 9
9s   2O O21O2