
    ki#,                    `   S r SSKJr  SSKrSSKrSSKrSSKrSSKJr  SSK	J
r
  SSKJr  SSKJr  SSKJrJr  SS	KJr  SS
KJr  SSKJr  SSKJrJr  SSKJr  SSKJrJr  SSK J!r!J"r"J#r#  SSK$J%r%  SSK&J'r'  \(       a  SSKJ(r(  \
" \)5      r*\RV                  " S5      r, " S S5      r-\-" 5       r.g)a'  Signature verification for conda packages.

This module provides the signature verification functionality that integrates
with conda's post-solve hook system to verify package signatures during
installation.

Note: This module was migrated from conda.trust.signature_verification in conda 26.3.
    )annotationsN)cached_property)	getLogger)Path)TYPE_CHECKING)CONDA_PACKAGE_EXTENSION_V1CONDA_PACKAGE_EXTENSION_V2)context)join_url)
SubdirData)	HTTPErrorInsecureRequestWarning)get_session   )verify_delegationverify_root)SignatureErrorload_metadata_from_filewrite_metadata_to_file)KEY_MGR_FILE)wrap_as_signable)Anyz(?P<number>\d+)\.root\.jsonc                      \ rS rSrSr\SS j5       r\SS j5       r\SS j5       r S     SS jjr	SS jr
        SS	 jrSS
 jrSrg)_SignatureVerification.   zSignature verification for conda packages.

This class provides caching signature verification that checks package
metadata signatures against the trusted root and key manager metadata.
c                `   [         R                  (       d  g[         R                  (       d  [        R	                  S5        g[        [         R                  5      R                  SSS9  U R                  c  [        R	                  S5        gU R                  c  [        R	                  S5        gg)NFzWmetadata signature verification requested, but no metadata URL base has been specified.T)parentsexist_okzDcould not find trusted_root data for metadata signature verificationz?could not find key_mgr data for metadata signature verification)
r
   extra_safety_checkssigning_metadata_url_baselogwarningr   av_data_dirmkdirtrusted_rootkey_mgr)selfs    @lib/python3.13/site-packages/conda_content_trust/verification.pyenabled_SignatureVerification.enabled5   s     ** 00KK?  	W  !''t'D $KKV  <<KKQ      c                   S n [         R                  " [        R                  5       Vs0 s HF  n[        R                  UR                  5      =n(       d  M+  [        UR                  S5      5      U_MH     nn[        UR                  5       SS9 H*  u  pR[        R                  SU S35         [        U5      n  O    U(       d(  [        R%                  S[        R                   S35        g  US   S	   S
-    S3n['        [        R                  U5      n U R)                  [        R*                  U5      n[-        X5        [/        U=o5        Mc  s  snf ! [        [        [         4 a     M  f = f! [        ["        [         4 a     Nf = f! [0         a:  n	U	R2                  R4                  S:w  a  [        R7                  U	5         S n	A	U$ S n	A	f[8         a   n	[        R7                  U	5         S n	A	U$ S n	A	ff = f)NnumberT)reversezLoading root metadata from .zNo root metadata found in zE. Install conda-anaconda-trust-root to enable signature verification.signedversionr   z
.root.jsoni  )osscandirr
   r#   RE_ROOT_METADATAmatchnameintgroupsorteditemsr!   infor   IsADirectoryErrorFileNotFoundErrorPermissionErrorNotADirectoryErrordebugr   _fetch_channel_signing_datar    r   r   r   responsestatus_codeerror	Exception)
r'   trustedentrympaths_fnamepath	untrustederrs
             r(   r%   #_SignatureVerification.trusted_rootW   s     $	  ZZ(;(;<<E)//

;;A; .AGGH%&-<   #5;;=$?6ugQ?@5e<G  @ II,W-@-@,A BV V  x(3a78
CE++U3DC <<55	
 G/ ')';wB3 A *+<oN  	 "#5G 	 		P   <<++s2IIcN   		#
 s^   &E4 *EE7E4 0E+F E4 E10E14FF
G;/GG;G66G;c                F   S n[         n[        [        R                  U5      n U R	                  [        R
                  U5      n[        SX@R                  5        [        U=o5        U(       d   UR%                  5       (       a  ['        U5      nU$ ! [         a  n[        R                  U5         S nANMS nAf[         a_  n[        R                  [        U5      =(       d0    UR                  R                   SUR                   R"                   S35         S nANS nAff = f)Nr&   z ())r   r   r
   r#   rA   r    r   r%   r   ConnectionErrorr!   r"   r   str	__class____name__rB   rC   existsr   )r'   rF   rK   rL   rM   rN   s         r(   r&   _SignatureVerification.key_mgr   s    # G''/	?8811I
 i4E4EF #i#77> 4;;==-d3G!  	KK 	 KKCTs}}556b9Q9Q8RRST 	s$   6B 
D B44D ADD Nc           	     P   [        U5      n[        R                  nU(       d  [        R                  " S[
        5        SSS.nU(       a  X7S'   U(       a  XGS'   [        X5      n[        R                  n	S[        l         [        R                  [        R                  4n
UR                  UU[        USS 5      S U
US	9nUR                  5         U	[        l         UR                  5       $ ! U	[        l        f = f! [        R                   a  n[        S
U SU 35      eS nAff = f)Nignorez!gzip, deflate, compress, identityzapplication/json)zAccept-EncodingzContent-TypezIf-None-MatchzIf-Modified-SinceFproxies)headersrZ   authtimeoutverifyzInvalid JSON returned from /)r   r
   
ssl_verifywarningssimplefilterr   r   add_anaconda_tokenremote_connect_timeout_secsremote_read_timeout_secsgetgetattrraise_for_statusjsonJSONDecodeError
ValueError)r'   signing_data_urlfilenameetag	mod_stampsession
verify_sslr[   urlsaved_token_settingr]   resprN   s                r(   rA   2_SignatureVerification._fetch_channel_signing_data   s1    ./ ''
!!(,BC  C.
 '+O$+4'('2 &88%*"	=3300G
 ;;D9!  D !!#)<G&	99; *=G& ## 	-.>-?q
K 	s%    AC+ C; +C8;D%D  D%c                   [        UR                  US9nUR                  R                  5       u  pESU;  a4  UR                  R                  SUR                  R                   S35        gUS   nUR                  U;  a*  UR                  R                  SUR                   S35        gXbR                     nUR                  R                  [        5      (       a  US   UR                     nOBUR                  R                  [        5      (       a  US   UR                     nO[        S5      e[        U5      n	XyS'    [        S	XR                  5        [        R!                  S
UR                   35        UR                  R                  S5        g! ["         a@    [        R%                  SUR                   35        UR                  R                  S5         gf = f)zVerify the signature for a package record.

Args:
    repodata_fn: The repodata filename (e.g., 'repodata.json')
    record: A PackageRecord from conda
)repodata_fn
signaturesz(no signatures found for rQ   Npackageszpackages.condazunknown package extensionpkg_mgrzvalid signature for z(package metadata is TRUSTED)zinvalid signature for z(package metadata is UNTRUSTED))r   channel
repo_fetchfetch_latest_parsedmetadataaddcanonical_namefnendswithr   r	   rk   r   r   r&   r!   r;   r   r"   )
r'   rw   recordsubdir_datarepodatarJ   rx   	signaturer;   envelopes
             r(   r^   _SignatureVerification.verify   s    ![I!,,@@B x'OO+FNN,I,I+J!L l+
 99J&OO";FII;a HIyy)	 99899J'		2DYY :;;,-fii8D899 $D)!*	Ai<<@
 HH+FII;78OO ?@  	CKK0<=OO AB	Cs   F AGGc                \    U R                   (       d  gU H  nU R                  X5        M     g)zPost-solve hook callback.

Args:
    repodata_fn: The repodata filename
    unlink_precs: Package records to unlink (unused)
    link_precs: Package records to link (verified)
N)r)   r^   )r'   rw   unlink_precs
link_precsprecs        r(   __call___SignatureVerification.__call__#  s$     ||DKK* r+   c                N    S H  nU R                   R                  US5        M!     g)zClear all cached properties.)r)   r%   r&   N)__dict__pop)r'   attrs     r(   cache_clear"_SignatureVerification.cache_clear6  s     :DMMdD) ;r+    )returnbool)r   zdict | None)NN)rl   rS   rm   rS   r   dict)rw   rS   r   r   r   None)rw   rS   r   tupler   r   r   r   )r   r   )rU   
__module____qualname____firstlineno____doc__r   r)   r%   r&   rA   r^   r   r   __static_attributes__r   r+   r(   r   r   .   s      B A AF  B JN8 #8/28	8t+AZ++ + 	+
 
+&*r+   r   )/r   
__future__r   ri   r2   rera   	functoolsr   loggingr   pathlibr   typingr   conda.base.constantsr   r	   conda.base.contextr
   conda.common.urlr   conda.core.subdir_datar   conda.gateways.connectionr   r   !conda.gateways.connection.sessionr   authenticationr   r   commonr   r   r   	constantsr   signingr   r   rU   r!   compiler4   r   signature_verificationr   r+   r(   <module>r      s    #  	 	  %     ' % - G 9 : S S # %::<= K* K*^ 01 r+   