U
    c                     @   sB  d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZ ddlZddlmZmZ ddlmZ dd	lmZmZ dd
lmZ ddlm Z  ddl!m"Z" ddl#m$Z$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z,m-Z- ddl.m/Z/ ddl0m1Z1 ddl2m3Z3 ddl4m5Z5m6Z6 ddl7m8Z8m9Z9 ddl:m;Z;m<Z< ddl=m>Z> ddl?m@Z@ ddlAmBZBmCZC ddlDmEZEmFZFmGZGmHZHmIZI ddlJmKZKmLZLmMZMmNZNmOZOmPZPmQZQ ddlRmSZSmTZTmUZUmVZV ddlWmXZX ddlYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZa dd lbmcZcmdZdmeZe d!d"lfmgZgmhZhmiZimjZj d#d$d%d&d'd(d)gZkelemZned*e^d+Zoed,d-G d.d' d'ZpeG d/d0 d0Zqdddeafejreiesee1 ee( ee
ete	f  eeo epd1d2d&Zuejve5eeejw d3d4d5Zxdeafejre"esee
ete	f  eeo epd6d7d8Zyezesepd9d:d;Z{ejre^e"ee" ee d<d=d>Z|eie1e(d?d@dAZ}ddddde`fejreiee1 ees ee( ee ee
ete	f  eeo epdB	dCd#Z~ejre"e"ee" eXees ee ee
ete	f  eeo eepeqf dD
dEdFZed,d-G dGd( d(epZeeGjeFjeFjeFjeFjhZddddde`fejreiee1 ees ee( ee ee
ete	f  eeo edB	dHd$ZG dIdJ dJe9Ze>ee,dKdLdMZe@ee,dNdOdPZeje(ee6dQdRdSZdqeje'e(ee ee3ef dTdUdVZejreie,eeF ee ezdWdXdYZdrejreie,eeF ee eIdZd[d\Zed,d-G d]d^ d^Zejrd_d`daZejredbdcddZeCezeec dedfdgZdsee eiee1 e,dhdidjZeeGjeFjeFjeFjeFjeFjeFjhZeeFjeFjeFjeFjeFjhZed,d-G dkd) d)eZeTeie,ee1 eep dldmdnZdteTehee1 ee edodpd%ZdS )ua  
This module contains a number of functions to handle AdES signature validation.


.. danger::
    This API is incubating, and not all features of the spec have been fully
    implemented at this stage. There will be bugs, and API changes may still
    occur.
    N)copy)	dataclass)datetime)AnyDict	FrozenSetIterableIteratorListOptionalSetTupleTypeTypeVarUnion)cmskeys)pdf)tspx509)CertificateList)OCSPResponse)ValidationContext)CertTrustAnchorTrustAnchor)CertValidationPolicySpecValidationDataHandlers)past_validate)
POEManagerdigest_for_poe)ades_gather_prima_facie_revinfo)ValidationTimingInfo)ValidationPath)AlgorithmUsagePolicyRevocationCheckingRule)PathBuilderTrustManager)CRLContainerOCSPContainer)CRLOfInterest)OCSPResponseOfInterest)HistoricalResolverPdfFileReader)AdESFailureAdESIndeterminate
AdESPassed
AdESStatusAdESSubIndic)CMSExtractionErrorCMSStructuralErrorMultivaluedAttributeErrorNonexistentAttributeErrorextract_certificate_infofind_cms_attributefind_unique_cms_attribute)DocumentSecurityStoreEmbeddedPdfSignatureerrorsgeneric_cms)KeyUsageConstraints)DocumentTimestampStatusPdfSignatureStatusRevocationDetailsSignatureCoverageLevelSignatureStatusSignerAttributeStatusStandardCMSSignatureStatusTimestampSignatureStatus   )
DiffPolicy
DiffResultSuspiciousModification   )LocalKnowledgePdfSignatureValidationSpecSignatureValidationSpec"bootstrap_validation_data_handlersades_basic_validationades_with_time_validationades_lta_validationades_timestamp_validationAdESBasicValidationResultAdESWithTimeValidationResultAdESLTAValidationResult
StatusType)boundT)frozenc                   @   s2   e Zd ZU dZeed< ee ed< ee ed< dS )rS   uR   
    Result of validation of basic signatures.

    ETSI EN 319 102-1, § 5.3
    ades_subindic
api_statusfailure_msgN)	__name__
__module____qualname____doc__r1   __annotations__r   rV   str rb   rb   @/tmp/pip-unpacked-wheel-0kb_yl26/pyhanko/sign/validation/ades.pyrS   t   s
   
c                   @   s   e Zd ZU eed< ee ed< ee ed< dZee ed< dZ	ee ed< dZ
ee ed< dZee ed< dZee ed	< d
d ZdS )_InternalBasicValidationResultrY   signature_poe_timesignature_not_before_timeNstatus_kwargstrust_subindic_updatesignature_ts_validitycontent_ts_validitysigner_attr_statusc                 C   sv   | j }| jr| j|d< |r*| jr*| j|d< |r>| jr>| j|d< |rl| jrl| jj|d< | jj|d< | jj|d< |f |S )Ntrust_problem_indicZtimestamp_validityZcontent_timestamp_validityac_attrscades_signer_attrsac_validation_errs)rg   rh   ri   rj   rk   rm   rn   ro   )self
status_clswith_ts
with_attrsrg   rb   rb   rc   update   s    




z%_InternalBasicValidationResult.update)r\   r]   r^   r1   r`   r   r   rg   dictrh   ri   rE   rj   rk   rC   rt   rb   rb   rb   rc   rd      s   
rd   )tst_signed_datavalidation_specexpected_tst_imprinttiming_infovalidation_data_handlersextra_status_kwargsrq   returnc           	         sR   |p
t  }|jp|j}|dkr,t||d}|j||d}t| ||||dI dH S )uW  
    Validate a timestamp token according to ETSI EN 319 102-1 § 5.4.

    :param tst_signed_data:
        The ``SignedData`` value of the timestamp.
    :param validation_spec:
        Validation settings to apply.
    :param expected_tst_imprint:
        The expected message imprint in the timestamp token.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nspecry   ry   handlers)r{   rq   )r!   nowts_cert_validation_policycert_validation_policyrN   build_validation_context'_ades_timestamp_validation_from_context)	rv   rw   rx   ry   rz   r{   rq   r   validation_contextrb   rb   rc   rR      s(    !   )signer_infoalgo_policycontrol_time
public_keyc                 C   sT   | d }|j |||d}|sPd|j d| d}tj||jd krFtjntjdd S )NZsignature_algorithm)r   zSignature algorithm z not allowed as of z:, which is the time of the earliest PoE for the signature.ades_subindication)Zsignature_algorithm_allowedZsignature_algor;   SignatureValidationErrorZnot_allowed_afterr.   ZCRYPTO_CONSTRAINTS_FAILURE!CRYPTO_CONSTRAINTS_FAILURE_NO_POE)r   r   r   r   Zsig_algoZsig_allowedmsgrb   rb   rc   #_ades_signature_crypto_policy_check   s      r   )rv   r   rx   r{   rq   r|   c           	         s   t |pi }tj| ||dI d H }|| |f |}|jsLttj|d dS |jsbttj	|d dS t
| ||d d dI d H }||_t|j|j|dddd dS )N)r   rx   rY   rZ   r[   ac_validation_contextrf   Frr   rs   )ru   r<   Zvalidate_tst_signed_datart   intactrS   r-   HASH_FAILUREvalidSIG_CRYPTO_FAILURE_process_basic_validationrg   rY   )	rv   r   rx   r{   rq   rg   status_kwargs_from_validationstatusinterm_resultrb   rb   rc   r      sJ     

    r   )signed
tst_digestr|   c                    s8   t j| |d}|d k	r(t|||I d H S ttjd d dS )Nr   rY   r[   rZ   )r<   extract_tst_datar   rS   r.   ZGENERIC)r   r   r   r   rv   rb   rb   rc   _ades_process_attached_ts*  s      
 r   )signed_datatemp_statusts_validation_contextr   rf   c                    s   |j }t| }d }|tjtjfkrt||dt|d djdI d H }|j	t
jkr|j}|d k	rpt|j|}n|j}|tjkr|j}	|	j}
tj}n|jj}
tj}||
kr|}t| }tj|j|j||d dI d H }|pt
j}t||||tf |d dS )NTsigned_attrsZmessage_digestr   r   )Zsd_attr_certificatessigner_certr   Zsd_signed_attrs)rY   rh   rj   rf   rk   re   )rl   r<   extract_signer_infor.   REVOKED_NO_POEOUT_OF_BOUNDS_NO_POEr   r8   nativerY   r/   OKrZ   max	timestamprevocation_detailsrevocation_dater-   ZREVOKEDsigning_certnot_valid_afterZEXPIREDr6   Zcollect_signer_attr_statusZattribute_certsr   rd   rC   )r   r   r   r   rf   Zades_trust_statusr   	ts_statusZcontent_ts_resultrevo_detailscutoffZperm_status	cert_infoZattr_status_kwargsrY   rb   rb   rc   r   8  s^    
    


r   )rw   ry   rz   c                 C   sZ   | j j||d}| jd k	r,| jj||d}n|}| jd k	rL| jj||d}nd }|||fS )Nr   )r   r   r   Zac_validation_policy)rw   ry   rz   r   r   r   rb   rb   rc   	_init_vcs~  s"    

r   )	r   rw   ry   
raw_digestrz   rf   r{   rq   r|   c                    s~   |p
t  }|dkr t||d}t|||\}}	}
t| ||	|
|j||||d	I dH }t|trb|S t|j|j	t
dddddS )u  
    Validate a CMS signature according to ETSI EN 319 102-1 § 5.3.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param raw_digest:
        The expected message digest attribute value.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nr}   )	r   r   r   r   key_usage_settingsr   rf   r{   rq   FTr   r   )r!   r   rN   r   _ades_basic_validationr   
isinstancerS   rY   rt   rD   )r   rw   ry   r   rz   rf   r{   rq   r   r   r   r   rb   rb   rc   rO     s<    $

 )
r   r   r   r   r   r   rf   r{   rq   r|   c	              
      s   t |pi }	z&tj| |||dI d H }
|	|
 W n: tjk
rl } zt|j|jd d W Y S d }~X Y nX |f |	}|j	stt
j|d dS |jstt
j|d dS t| ||||dI d H }|	|_|S )N)r   r   r   r   r   r   )ru   r<   Zcms_basic_validationrt   r;   r   rS   r   failure_messager   r-   r   r   r   r   rg   )r   r   r   r   r   r   rf   r{   rq   rg   r   er   r   rb   rb   rc   r     sJ      
  r   c                   @   s"   e Zd ZU eed< ee ed< dS )rT   best_signature_timerf   N)r\   r]   r^   r   r`   r   rb   rb   rb   rc   rT     s   
c                    s  |p
t  }|dkr t||d}t|||\}}	}
| d d d j}|j| }t| ||	|
|j||||d	I dH }t|t	rt
|j|j|j||dS |jtkrt|tst|j}|j|ddd	}t
|j|d||dS t| }t||d
t|dI dH }|j|d
dd	}|jtjkr,t
|j|d||dS |j}|dk	rJt|j|}n|j}||_||_|jtjkr|j}||j krt
|j|d||dS n0|jtj!kr||j"j#k rt
tj$|d||dS |dk	r||krt
tj%|d||dS d|_&d|j'd< |j|ddd	}t
tj|d||dS )u  
    Validate a CMS signature with time according to ETSI EN 319 102-1 § 5.5.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param raw_digest:
        The expected message digest attribute value.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param validation_data_handlers:
        Data handlers to manage validation data.
    :param extra_status_kwargs:
        Extra keyword arguments to pass to the signature status object's
        ``__init__`` function.
    :param status_cls:
        The class of the resulting status object in pyHanko's internal
        validation API.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A :class:`.AdESBasicValidationResult`.
    Nr}   signer_infosr   	signature)r   r   r   r   r   rf   r{   rq   )rY   rZ   r[   r   rf   Tr   Fr   rl   )(r!   r   rN   r   r   poe_managerr   r   r   rS   rT   rY   rZ   r[   _WITH_TIME_FURTHER_PROCrd   AssertionErrorrf   rt   r<   r   r   Zcompute_signature_tst_digestr/   r   minr   ri   re   r.   r   r   r   r   r   not_valid_beforeNOT_YET_VALIDZTIMESTAMP_ORDER_FAILURErh   rg   )r   rw   ry   r   rz   rf   r{   rq   r   r   r   	sig_bytesre   r   rZ   r   Zsig_ts_resultr   r   r   r   rb   rb   rc   rP   (  s    $

 


  
    
  
 
 c                   @   s4   e Zd ZejedddZejee dddZ	dS )_TrustNoOne)certr|   c                 C   s   dS )NFrb   rp   r   rb   rb   rc   is_root  s    z_TrustNoOne.is_rootc                 C   s   t dS )Nrb   )iterr   rb   rb   rc   find_potential_issuers  s    z"_TrustNoOne.find_potential_issuersN)
r\   r]   r^   r   Certificateboolr   r	   r   r   rb   rb   rb   rc   r     s   r   crlr   r   c                    s   t  fdd| jD S )Nc                 3   s   | ]}|j j  kV  qd S N)pathleaf).0	prov_pathr   r   rb   rc   	<genexpr>  s   z0_crl_issuer_cert_poe_boundary.<locals>.<genexpr>)anyZ
prov_pathsr   rb   r   rc   _crl_issuer_cert_poe_boundary  s    r   ocspr   r   c                 C   s   || j j |kS r   )r   r   r   rb   rb   rc   _ocsp_issuer_cert_poe_boundary  s    r   )r   rz   r   revocation_checking_rulec                    s  j }|jt d}tjdfdd t fdd|D }j}g }g }	t }
|D ]}|I d H \}}|D ]8}t	|j
|r|| qv|jj }|
t| qv|D ]8}t|j
|r|	| q|jj }|
t| qq`|s|	rj|
 j|
 ||	fS )N)r   trust_manager)issc                    s$   t t| g  d}t|jdS )N)Ztrust_anchorZintermr   )r   revinfo_managerr   r   )r"   r   r    r   )r   Ztruncated_path)r   r   r   rz   rb   rc   _for_candidate_issuer  s    zB_find_revinfo_data_for_leaf_in_past.<locals>._for_candidate_issuerc                    s   g | ]} |qS rb   rb   )r   r   )r   rb   rc   
<listcomp>  s     z7_find_revinfo_data_for_leaf_in_past.<locals>.<listcomp>)cert_registryr   r   r   r   asyncioZas_completedr   setr   r   appendr   crl_datadumpaddr   r   Zocsp_responseZocsp_response_datar   Z
evict_crlsZevict_ocsps)r   rz   r   r   registryZcandidate_issuersZjob_futuresr   crlsocspsZto_evictZfut_resultsZnew_crlsZ	new_ocspsZcrl_oiZrevinfo_dataZocsp_oirb   )r   r   r   r   rz   rc   #_find_revinfo_data_for_leaf_in_past  sJ         
r   )r   validation_policy_specrz   init_control_timer|   c              	      s   t |j|jd}d }|| }zR|2 zF3 d H W }tt||||dI d H \}}}	|d kr$||	f  W 
S q$6 W 5 | I d H  X d}
|d k	rtj	|
|dntj	|
 dt
jdd S )N)r   r   )r   r   rz   r   z2Unable to construct plausible past validation pathr   r   z": no prima facie paths constructed)r%   r   r   Zasync_build_paths_lazycancelr<   Zhandle_certvalidator_errorsr   r;   r   r.   ZNO_CERTIFICATE_CHAIN_FOUND)r   r   rz   r   Zpath_builderZcurrent_subindicationpathsZ	cand_pathr   validation_timer   rb   rb   rc   _build_and_past_validate_cert&  s<    
	r   r   rw   r   current_time_sub_indicr   is_timestampc                    sH  t |d|d}| d d d j}|| }zt| }	|	j}
W n$ tk
r^   tjdtjdY nX |rr|j	pn|j
}n|j
}t|
|||jjjdI d H \ t|
||d	I d H \}} fd
d}||kr6|tjkr|  d S |tjtjfkrd S |tjtjfkr6||
jk r tjdtjdn||
jkr6|  d S tjd|dd S )NT)Zis_historicalpoe_manager_overrider   r   r   z,signer certificate not included in signaturer   )r   r   )r   rz   c                     s$   t  ps tj} tjd| dd S )N)zoPOE for signature available, but could not obtain sufficient POE for the issuance of the revocation informationr   )r   r.   REVOCATION_OUT_OF_BOUNDS_NO_POEr;   r   )r   Z	leaf_crlsZ
leaf_ocspsrb   rc   (_pass_contingent_on_revinfo_issuance_poe  s    zQ_ades_past_signature_validation.<locals>._pass_contingent_on_revinfo_issuance_poez'Signature predates cert validity periodr   zHPast signature validation did not manage to improve current time result.)rN   r   r6   r   r2   r;   r   r.   ZNO_SIGNING_CERTIFICATE_FOUNDr   r   r   Zrevinfo_policyZrevocation_checking_policyZee_certificate_ruler   r   REVOKED_CA_NO_POEr   r   OUT_OF_BOUNDS_NOT_REVOKEDr   r-   r   r   ZSigSeedValueValidationError)r   rw   r   r   r   r   rz   signature_bytesr   r   r   r   Z	cert_pathr   r   rb   r   rc   _ades_past_signature_validationQ  sr     
  

r  )r   rw   r   r   r   r|   c              
      sv   | d }|d j dk}z"t| |||||dI dH  tjW S  tjk
rp } zt| |j W Y S d}~X Y nX dS )u  
    Validate a CMS signature in the past according
    to ETSI EN 319 102-1 § 5.6.2.4.

    This is internal API.

    .. danger::
        The notion of "past validation" used here is only valid in the
        narrow technical sense in which it is used within AdES.
        It should _never_ be relied upon as a standalone validation routine.

    :param signed_data:
        The ``SignedData`` value.
    :param validation_spec:
        Validation settings to apply.
    :param poe_manager:
        The POE manager from which to source existence proofs.
    :param current_time_sub_indic:
        The AdES subindication from validating the signature
        at the current time with the relevant settings.
    :param init_control_time:
        Initial value for the control time parameter.
    :return:
        An AdES subindication indicating the validation result
        after going through the past validation process.
    encap_content_infocontent_typetst_infor   N)	r   r  r/   r   r;   r   loggerwarningr   )r   rw   r   r   r   Zecir   r   rb   rb   rc   ades_past_signature_validation  s    !
r  c                   @   s\   e Zd ZU eed< eed< ee ed< ej	ed< eed< e
eedf ed< edd	d
ZdS )PrimaFaciePOEpdf_revisiontimestamp_dtdigests_coveredtimestamp_token_signed_data
doc_digestNdiff_result)managerc                 C   s    | j D ]}|j|| jd qd S )N)digestdt)r  Zregister_by_digestr
  )rp   r  thingrb   rb   rc   add_to_poe_manager  s    
z PrimaFaciePOE.add_to_poe_manager)r\   r]   r^   intr`   r   r   bytesr   
SignedDatar   rH   rI   r   r  rb   rb   rb   rc   r    s   

r  )sdc                 c   s,   | d D ]}|j dkrt|j V  qd S )NZcertificates)ZcertificateZv2_attr_set)namer   Zchosenr   )r  Zcert_choicerb   rb   rc   &_extract_cert_digests_from_signed_data  s    
r  )r  r|   c                 C   s   | d d j }|d jS )Nr  contentgen_time)parsedr   )r  r  rb   rb   rc   _get_tst_timestamp  s    r  )rinclude_content_tsdiff_policyc                 C   sD  t  }t  }g }t| jD ]"\}}|j||d kd t| |jd}|j}	d }
d}|jdkrf|	}
d}n|rztj	|j
dd}
|
d k	rt|}|dd t|j|j|j D  || | }| tjk}|r|t|jt|
t||
||jd	 t  }|t|
 |t|	 |j
d
 }|sz2t|d}|dd t|d |d D  W n tt fk
r   Y nX |j
d j!}|"t#| zt$|d}W n t t%fk
r   d}Y nX zt$|j
d d}W n t t%fk
r   d}Y nX t||D ]2}|d d D ]}|d j!}|"t#| qq
q|S )N)Z	skip_diff)revisionFz/DocTimeStampTr   c                 s   s   | ]}t | jV  qd S r   )r   
get_objectdatar   itemrb   rb   rc   r   Q  s   zC_build_prima_facie_poe_index_from_pdf_timestamps.<locals>.<genexpr>)r	  r
  r  r  r  r  r   Zadobe_revocation_info_archivalc                 s   s   | ]}t | V  qd S r   )r   r   r$  rb   rb   rc   r   }  s   r   r   r   Zcontent_time_stamprb   Zunsigned_attrsZsignature_time_stampr  r   )&r   	enumerateZembedded_signaturesZcompute_integrity_infor+   signed_revisionr   Zsig_object_typer<   r   r   r9   read_dssrt   	itertoolschainr   r   certsvaluescompute_digestZevaluate_signature_coveragerA   ZENTIRE_REVISIONr   r  r  	frozensetr  r  r8   r4   r5   r   r   r   r7   r3   )r  r  r   Zcollected_so_farZfor_next_tsprima_facie_poe_setsixembedded_sigZhist_handlerr   Zts_signed_dataZ	is_doc_tsdssr  Zcoverage_normalr   Zrevinfo_attrr   Zcontent_tsesZsignature_tsesZts_dataZts_signer_infoZts_sig_bytesrb   rb   rc   0_build_prima_facie_poe_index_from_pdf_timestamps  s      
 


  


  


r3  )r/  rw   cur_timing_infor|   c              
      s:  t | dd d}|p"tjt d}t }|j| t|D ]\}}t	|}|t
|d k rt||d  }|| t|||d}	t|j|||j|	d|jitdI d H }
|
j}|jtjkr|| q>|jtjkrtjd	|d
q>t|tstt|j||||jdI d H }|jtjkr&|| q>tjd|d
q>|S )Nc                 S   s   | j S r   r	  )prb   rb   rc   <lambda>      z+_validate_prima_facie_poe.<locals>.<lambda>)keytzrJ   ry   r   r  )rv   rw   ry   rx   rz   r{   rq   z9Permanent failure while evaluating timestamp in PoE chainr   )r   rw   r   r   r   zZCould not validate timestamp in PoE chain at current time, and past validation also failed)sortedr!   r   tzlocalget_localzoner   local_knowledger  r&  r   lenrN   rR   r  r  r  r>   rY   r   r0   ZPASSEDZFAILEDr;   r   r   r.   r   r  r   )r/  rw   r4  Zcandidate_poesZresulting_poesr0  poeZtemporary_poesZnext_poerz   Zcur_time_resultZ	sub_indicZpast_resultrb   rb   rc   _validate_prima_facie_poe  sf    
 
 	rC  c                   @   s*   e Zd ZU dZee ed< ee ed< dS )rU   u   
    Result of a PAdES validation for a signature providing long-term
    availability and integrity of validation material.
    See ETSI EN 319 102-1, § 5.6.3.
     oldest_evidence_record_timestampsignature_timestamp_statusN)r\   r]   r^   r_   r   r   r`   rS   rb   rb   rb   rc   rU      s   
	)r1  rw   r   ry   r|   c              
      s"  | j d j}| j}|jp|j}|j}|d kr0d S t||||  t|||ddI d H }|j	}	t
|	tr|	tkrz2t||||	|jddI d H  ttj|jd d}
W q tjk
r } zt|j|j|jd}
W 5 d }~X Y qX n|}
|d d	 j}|j|d
 d |jdr|d j}||| |
S )Nr   r<  )rv   rw   ry   rx   rz   Tr   r   r   r  r  Zmessage_imprintZhash_algorithm)Zmomentr  )r   r   Zattached_timestamp_datar   r   algorithm_usage_policyrR   Zcompute_tst_digestrN   rY   r   r.   _LTA_TS_FURTHER_PROCr  r   rS   r/   r   rZ   r;   r   r   r   r  Zdigest_algorithm_allowedregister)r1  rw   r   ry   r   Zsignature_tsr   r   Zsignature_ts_prelim_resultZts_current_time_sub_indicsignature_ts_resultr   r  Zsignature_ts_dtrb   rb   rc   _process_signature_ts  sn     



 rJ  )r1  pdf_validation_specry   rf   r|   c                    s  |pt jt d}t jd|jd}|j}|j}t	
 j}dd |jD }dd |jD }	t| }
t|j| |j|	 |j|
 |jd}tj||d}d	}d	}zRt|||d
I d	H }tt fdd|dd d	d}|d	k	r|j}n
td W n4 tjk
r* } ztjd|d W 5 d	}~X Y nX |d	krFt }|| |d	k	sTt t!|||d}t" j#||| $ |d j%it&dI d	H }|j'}|t(krd| d}t)||j*||j+|j,|d	dS  j-d j.}|/||j+ t0 |||dI d	H }t1|t2rtz"t3 j#||||j4ddI d	H  W nP tjk
rr } z.|| }t)|j5|j6|j*||j,||d W Y S d	}~X Y nX || }|j7j8}z( j9}t: j-|||j;d t<j=}d	}W n2 tjk
r } z|j5}|j6}W 5 d	}~X Y nX t)||j*|||j,||dS )u  
    Validate a PAdES signature providing long-term availability and integrity
    of validation material. See ETSI EN 319 102-1, § 5.6.3.

    For the purposes of PAdES validation, the chain of document time stamps
    in the document serves as the unique Evidence Record (ER).

    :param embedded_sig:
        The PDF signature to validate.
    :param pdf_validation_spec:
        PDF signature validation settings.
    :param timing_info:
        Data object describing the timing of the validation.
        Defaults to :meth:`.ValidationTimingInfo.now`.
    :param signature_not_before_time:
        Time when the signature was known _not_ to exist.
    :return:
        A validation result.
    r:  T)r  r   c                 S   s,   g | ]$}t t| jD ]}|qqS rb   )r(   Z
load_multir   loadr"  r#  )r   respZcontrb   rb   rc   r     s    z'ades_lta_validation.<locals>.<listcomp>c                 S   s"   g | ]}t t| jd qS ))r   )r'   r   rL  r"  r#  )r   r   rb   rb   rc   r     s   )known_ocsps
known_crlsknown_certs
known_poes)r@  N)rw   r4  c                    s   | j  jkS r   )r	  r'  rB  r1  rb   rc   r7    r8  z%ades_lta_validation.<locals>.<lambda>c                 S   s   | j S r   r5  rR  rb   rb   rc   r7    r8  )r9  defaultzRNo document timestamps after signature; proceeding without past proof of existencezXDocument timestamp chain failed to validate; proceeding without past proof of existence.)exc_info)r~   ry   r   r  )r   rw   ry   rz   r   rf   r{   rq   z?Validation of signature at current time failed with indication z!. Past validation not applicable.)rY   rZ   r[   r   rf   rD  rE  r   )rw   r   ry   Fr   )rY   r[   rZ   r   rf   rE  rD  )r   r   r   )rY   rZ   r[   r   rf   rE  rD  )>r!   r   r>  r?  r3  readerr   Zsignature_validation_specr@  r9   r(  r   r   listZ
load_certsrK   rN  rO  rP  rQ  dataclassesreplacerC  r   filterr
  r  r  r;   r   r   r  r   rN   rP   r   r-  r  r?   rY   _LTA_FURTHER_PROCrU   rZ   r   rf   r   r   rH  rJ  r   r.   r  r   r   r   r   rF  r   r   r   r/   r   )r1  rK  ry   rf   Zpoe_listrw   Zinit_local_knowledger2  Z	dss_ocspsZdss_crlsZ	dss_certsr@  Zaugmented_validation_specZupdated_poe_managerrD  Zoldest_docts_recordr   Zwith_time_data_handlersZsignature_prelim_resultr   r[   r   rI  Zsig_poere   r   r   rY   rb   rS  rc   rQ   ^  s     




 )N)N)N)NN)r_   r   rX  r)  loggingr   r   r   typingr   r   r   r   r	   r
   r   r   r   r   r   r   r>  Z
asn1cryptor   r   r   Zasn1_pdfr   r   Zasn1crypto.crlr   Zasn1crypto.ocspr   Zpyhanko_certvalidatorr   Zpyhanko_certvalidator.authorityr   r   Zpyhanko_certvalidator.contextr   r   Z#pyhanko_certvalidator.ltv.ades_pastr   Zpyhanko_certvalidator.ltv.poer   r   Z$pyhanko_certvalidator.ltv.time_slider    Zpyhanko_certvalidator.ltv.typesr!   Zpyhanko_certvalidator.pathr"   Z!pyhanko_certvalidator.policy_declr#   r$   Zpyhanko_certvalidator.registryr%   r&   Z&pyhanko_certvalidator.revinfo.archivalr'   r(   Z*pyhanko_certvalidator.revinfo.validate_crlr)   Z+pyhanko_certvalidator.revinfo.validate_ocspr*   Zpyhanko.pdf_utils.readerr+   r,   Zpyhanko.sign.ades.reportr-   r.   r/   r0   r1   Zpyhanko.sign.generalr2   r3   r4   r5   r6   r7   r8   Zpyhanko.sign.validationr9   r:   r;   r<   Z pyhanko.sign.validation.settingsr=   Zpyhanko.sign.validation.statusr>   r?   r@   rA   rB   rC   rD   rE   Zdiff_analysisrG   rH   rI   Zpolicy_declrK   rL   rM   rN   __all__	getLoggerr\   r  rV   rS   rd   r  r  ra   rR   Z
SignerInfoZPublicKeyInfor   r   r   r   r   r   rO   r   rT   r.  r   r   r   r   r   r   rP   r   r   r   r   r   r   r  r  r  r  r  r3  rC  r   r   r[  rG  rU   rJ  rQ   rb   rb   rb   rc   <module>   s  	8$	(

#8+  G&F
1   
  L 
,j  3 '  J
	J  