a Mf-@sddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z m Z mZmZddlmZmZddlmZmZddlmZdd lmZdd lmZddlZeeZd Z dd d Z!ddZ"ddZ#Gdddej$j%Z&Gdddej'j(Z)Gddde)Z*dS))absolute_importN)six)record_body_position_for_rewind rewind_body,back_up_body_calculate_stream_content_lengthread_stream_for_signing) httpsig_cffirequests)InvalidPrivateKeyMissingPrivateKeyPassphrase)UnsupportedAlgorithm)default_backend) serialization1cCsPtj|}tj|dd}|}Wdn1s<0Yt||S)Nrb)mode)ospath expanduserioopenreadstripload_private_key)filename pass_phrasefprivate_key_datarn/sparta/input/_build_configuration/image_build+validate/lib/bmcenv/lib64/python3.9/site-packages/oci/signer.pyload_private_key_from_files *r!c Cst|tjr|d}t|tjr,|d}t}ztj|||dWSty||durdtdntj|d|dYSYn`t ytj tj tj fD]4}z|||dWnt t fyYq0tdqtdYn0dS)zLoads a private key that may use a pass_phrase. Tries to correct or diagnose common errors: - provided pass_phrase but didn't need one - provided a public key ascii)backendNz'The provided key requires a passphrase.zEAuthentication requires a private key, but a public key was provided.zOThe provided key is not a private key, or the provided passphrase is incorrect.) isinstancer text_typeencoderrload_pem_private_key TypeErrorr ValueErrorload_der_public_keyload_pem_public_keyload_ssh_public_keyr r )secretrr#loaderrrr r$s,        rc Cs|jdtjjdd|jdtjjj |j j t |j dsNt |j dr\|jdd|jdd |rd |jvr|r|j pd }t}t|tjr|d }|jd tt|||nt|ttfr||nt |dst |drt|\}}|rVt||}|dkr*td|jd t|t||}|stdnFtdt|} | d|_ || d|jd t| d|rt !|"} | #d } | |jd <dS)NdateT)usegmthostbufferr content-typezapplication/octet-streamzapplication/jsonx-content-sha256zutf-8content-lengthznUnable to read stream for signing! Please sign the stream yourself by using the custom header x-content-sha256z,Unable to rewind request body while signing!z=Stream cannot be rewound, trying to backup and sign the body! byte_contentcontent_length)$headers setdefaultemailutils formatdatermovesurllibparseurlparseurlnetlochasattrbodyhashlibsha256r$ string_typesr&strlenupdatebytes bytearrayrrIOErrorrloggerwarningrgetbase64 b64encodedigestdecode) request sign_bodyenforce_content_headersrFmis_body_rewindableoriginal_positionr9is_rewind_successstream base64digest base64stringrrr inject_missing_headersYsL             rac@s eZdZdZddZddZdS)_PatchedHeaderSignerzTSignature algorithm="rsa-sha256",headers="{}",keyId="{}",signature="%s",version="{}"cCsVd|_d|_d|_tjj|j|_||_|j|_ ||_ |j d ||t|_dS)NrsarH )sign_algorithmhash_algorithm_hashr r=HASHES_rsahash _rsa_private public_key _rsa_publicr:HEADER_SIGNER_TEMPLATEformatjoinSIGNATURE_VERSIONsignature_template)selfkey_id private_keyr:rrr __init__s z_PatchedHeaderSigner.__init__cCs6d|_||_|j|_|jd|j|t|_ dS)Nrd) rgrjrkrlrmrnror:rprq)rrrsrtrrr reset_signers z!_PatchedHeaderSigner.reset_signerN)__name__ __module__ __qualname__rmrurvrrrr rbsrbc@s<eZdZddZddZd ddZddd Zed d Zd S)AbstractBaseSignercCs(t|||d|_t||||d|_dS)N)rsrtr:)rb _basic_signer _body_signer)rrapi_keyrtgeneric_headers body_headersrrr create_signerssz!AbstractBaseSigner.create_signerscCs$|j}|dvr td|dS)N)rRheaddeleteputpostpatchz&Don't know how to sign request verb {})methodlowerr)rn)rrrWverbrrr validate_requests z#AbstractBaseSigner.validate_requestTcCsz|j}|dv}|r"|r"|j}n|j}|jddt||||j|jtj j j |j j|j|jd}|j||S)N)rrrzTransfer-Encoding)r1rr)rrr|r{r:poprasignrr?r@rArBrCrDpath_urlrL)rrrWrYrrXsignersigned_headersrrr do_request_signs   z"AbstractBaseSigner.do_request_signcCs|||||S)N)rr)rrrWrYrrr __call__s zAbstractBaseSigner.__call__cCstj|ddS)NF)rY) functoolspartial)rrrrr without_content_headerssz*AbstractBaseSigner.without_content_headersN)T)T) rwrxryrrrrpropertyrrrrr rzs    rzc@s&eZdZdZdddZeddZdS)Signera A requests auth instance that can be reused across requests. This signer is intended to be used when signing requests for a given user and it requires that user's ID, their private key and cerificate fingerprint. The private key can be sourced from a file (private_key_file_location) or the PEM string can be provided directly (private_key_content). The headers to be signed by this signer are not customizable. You can manually sign calls by creating an instance of the signer, and providing it as the ``auth`` argument to Requests functions: .. code-block:: python import requests from oci import Signer auth = Signer(...) resp = requests.get("https://...", auth=auth) Nc Cs\|d|d||_|r(t|||_n t|||_gd}gd}||j|j||dS)N/)r/z(request-target)r1)r6r3r4)r}rrtr!r) rrtenancyuser fingerprintprivate_key_file_locationrprivate_key_contentr~rrrr rus zSigner.__init__c CsDddlm}||t|d|d|d|d|d|dd S) Nr)validate_configrrrkey_filer key_content)rrr)configrrrR)rrrrr from_configs zSigner.from_config)NN)rwrxry__doc__ru staticmethodrrrrr rs r)N)+ __future__rrS email.utilsr<rGrrr oci._vendorroci.utilrrrr_vendorr r exceptionsr r cryptography.exceptionsr cryptography.hazmat.backendsrcryptography.hazmat.primitivesrlogging getLoggerrwrPrpr!rrar HeaderSignerrbauthAuthBaserzrrrrr s,       55!1