
    IiRn                       S r SSKJrJrJrJr  SSKJr  SSKJ	r	  SSK
r
SSKrSSKrSSKrSSKrSSKrSSKJr  SSKJrJr  SS	KJr  SS
KJrJrJr  SSKJrJrJrJr  SSK J!r!J"r"J#r#J$r$J%r%J&r&J'r'J(r(J)r)J*r*J+r+J,r,J-r-J.r.J/r/J0r0J1r1J2r2J3r3J4r4J5r5J6r6J7r7J8r8J9r9J:r:J;r;J<r<  SSK=J>r>  SSK?J@r@JArAJBrBJCrC   " S S\*5      rD " S S\*5      rE " S S\*5      rF " S S\05      rG " S S\35      rH " S S\45      rI " S S\"5      rJ " S S\35      rK " S S \75      rL\S! 5       rM " S" S#\%5      rN " S$ S%\.5      rO " S& S'\35      rP " S( S)\65      rQ " S* S+\45      rR " S, S-\%5      rS " S. S/\35      rT " S0 S1\%5      rU " S2 S3\%5      rV " S4 S5\%5      rW " S6 S7\55      rX " S8 S9\55      rY " S: S;\45      rZ " S< S=\45      r[ " S> S?\35      r\ " S@ SA\35      r] " SB SC\45      r^ " SD SE\35      r_ " SF SG\45      r` " SH SI\%5      ra " SJ SK\%5      rb " SL SM\55      rc " SN SO\45      rd " SP SQ\55      re " SR SS\35      rf " ST SU\65      rg " SV SW\35      rh " SX SY\%5      ri " SZ S[\+5      rj " S\ S]\+5      rk " S^ S_\35      rl " S` Sa\45      rm " Sb Sc\35      rn " Sd Se\35      ro " Sf Sg\%5      rp " Sh Si\45      rq " Sj Sk\%5      rr " Sl Sm\35      rs " Sn So\35      rt " Sp Sq\35      ru " Sr Ss\%5      rv " St Su\"5      rw " Sv Sw\35      rx " Sx Sy\45      ry " Sz S{\35      rz " S| S}\35      r{ " S~ S\45      r| " S S\%5      r} " S S\45      r~ " S S\35      r " S S\35      r " S S\.5      r " S S\35      r " S S\45      r " S S\.5      r " S S\35      r " S S\45      r " S S\35      r " S S\45      r " S S\35      r " S S\.5      r " S S\45      r " S S\.5      r " S S\35      r " S S\45      r " S S\45      r " S S\45      r " S S\35      r " S S\"5      r " S S\+5      r " S S\35      r " S S\65      r " S S\35      r " S S\35      r " S S\65      r " S S\'5      r " S S\'5      r " S S\'5      r " S S\'5      r " S S\'5      r " S S\'5      r " S S\35      r " S S\35      r " S S\'5      r " S S\35      r " S S\35      r " S S\65      r " S S\.5      r " S S\65      r " S S\65      r " S S\65      r " S S\35      r " S S\65      r " S S\35      r " S S\45      r " S S\.5      r " S S\35      r " S S\45      r " S S\35      r " S S\35      r " S S\45      r " S S\45      r " S S\35      r " S S\&5      rg)z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcat
EnumeratedGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc                   .    \ rS rSrSrSrS rS rS rSr	g)	DNSNameG   r         c                     X:X  + $ N selfothers     5/venv/lib/python3.13/site-packages/asn1crypto/x509.py__ne__DNSName.__ne__L             c                     [        U[        5      (       d  gU R                  5       R                  5       UR                  5       R                  5       :H  $ )z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

:param other:
    Another DNSName object

:return:
    A boolean
F)
isinstancer7   __unicode__lowerr?   s     rB   __eq__DNSName.__eq__O   sC     %))!'')U->->-@-F-F-HHHrF   c           	      z   [        U[        5      (       d(  [        [        S[	        U 5      [	        U5      5      5      eUR                  S5      (       a"  SUSS R                  U R                  5      -   nOUR                  U R                  5      nXl        X l	        SU l
        U R                  S:w  a  SU l        gg)zD
Sets the value of the DNS name

:param value:
    A unicode string
K
                %s value must be a unicode string, not %s
                .   .r	   NrF   )rH   r   	TypeErrorr
   r   
startswithencode	_encoding_unicodecontents_header_trailer)r@   valueencoded_values      rB   setDNSName.set_   s     %))F $%    C   59#3#3DNN#CCM!LL8M%==CDM  rF   rW   rX   rU   rV   N)
__name__
__module____qualname____firstlineno__rT   _bad_tagrC   rK   r[   __static_attributes__r>   rF   rB   r7   r7   G   s    IH!I  rF   r7   c                   ,    \ rS rSrS rS rS rS rSrg)URI|   c           	          [        U[        5      (       d(  [        [        S[	        U 5      [	        U5      5      5      eXl        [        U5      U l        SU l        U R                  S:w  a  SU l	        gg)B
Sets the value of the string

:param value:
    A unicode string
rN   NrF   )
rH   r   rQ   r
   r   rU   r   rV   rW   rX   r@   rY   s     rB   r[   URI.set~   sm     %))F $%    "5)==CDM  rF   c                     X:X  + $ r=   r>   r?   s     rB   rC   
URI.__ne__   rE   rF   c                     [        U[        5      (       d  g[        U R                  S5      [        UR                  S5      :H  $ )z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

:param other:
    Another URI object

:return:
    A boolean
FT)rH   re   r   nativer?   s     rB   rK   
URI.__eq__   s5     %%%$++t,
5<<0NNNrF   c                     U R                   c  gU R                  c  [        U R                  5       5      U l        U R                  $ 
:return:
    A unicode string
 )rV   rU   r   _merge_chunksr@   s    rB   rI   URI.__unicode__   s:     == == &t'9'9';<DM}}rF   r]   N)	r^   r_   r`   ra   r[   rC   rK   rI   rc   r>   rF   rB   re   re   |   s     .!O 
rF   re   c                   l    \ rS rSrSrSrSr\S 5       r\R                  S 5       rS r
S rS	 rS
 rSrg)EmailAddress   NFr9   c                     U R                   $ )zH
:return:
    A byte string of the DER-encoded contents of the sequence
)	_contentsru   s    rB   rV   EmailAddress.contents   s     ~~rF   c                     SU l         Xl        g)zM
:param value:
    A byte string of the DER-encoded contents of the sequence
FN)_normalizedr{   ri   s     rB   rV   r|      s     !rF   c           	         [        U[        5      (       d(  [        [        S[	        U 5      [	        U5      5      5      eUR                  S5      S:w  a;  UR                  SS5      u  p#UR                  S5      S-   UR                  S5      -   nOUR                  S5      nSU l        Xl	        X@l
        S	U l        U R                  S
:w  a  S
U l        g	g	)rh   rN   @r	   ascii   @r   TNrF   )rH   r   rQ   r
   r   findrsplitrS   r~   rU   rV   rW   rX   )r@   rY   mailboxhostnamerZ   s        rB   r[   EmailAddress.set   s     %))F $%    ::c?b  %S! 4G#NN73d:X__V=TTM!LL1M%==CDM  rF   c                 @   U R                   c  U R                  5       nUR                  S5      S:X  a"  UR                  S5      U l         U R                   $ UR	                  SS5      u  p#UR                  S5      S-   UR                  S5      -   U l         U R                   $ )rr   r   r   cp1252r	   r   r   )rU   rt   r   decoder   )r@   rV   r   r   s       rB   rI   EmailAddress.__unicode__   s     == ))+H}}T"b( ( 9 }} %-OOD!$<! 'x 83 >QWAX X}}rF   c                     X:X  + $ r=   r>   r?   s     rB   rC   EmailAddress.__ne__  rE   rF   c                 X   [        U[        5      (       d  gU R                  (       d  U R                  U R                  5        UR                  (       d  UR                  UR                  5        U R
                  R                  S5      S:X  d  UR
                  R                  S5      S:X  a  U R
                  UR
                  :H  $ UR
                  R                  SS5      u  p#U R
                  R                  SS5      u  pEXB:w  a  gUR                  5       UR                  5       :w  a  gg)z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

:param other:
    Another EmailAddress object

:return:
    A boolean
Fr   r   r	   T)	rH   rx   r~   r[   rn   r{   r   r   rJ   )r@   rA   other_mailboxother_hostnamer   r   s         rB   rK   EmailAddress.__eq__  s     %..HHT[[!  IIell#>>t$*eoo.B.B4.HB.N>>U__44(-(>(>tQ(G% NN11$:#>>~3355rF   )r{   rW   r~   rX   rU   rV   )r^   r_   r`   ra   r{   r~   rb   propertyrV   setterr[   rI   rC   rK   rc   r>   rF   rB   rx   rx      sS    I K H  __  <"!rF   rx   c                   @    \ rS rSrS	S jrS r\S 5       rS rS r	Sr
g)
	IPAddressi&  Nc                 *    [        [        S5      5      e)z/
This method is not applicable to IP addresses
z=
            IP address values can not be parsed
            )
ValueErrorr
   )r@   specspec_paramss      rB   parseIPAddress.parse'  s    
 
  	rF   c           	         [        U[        5      (       d(  [        [        S[	        U 5      [	        U5      5      5      eUnUR                  S5      S:g  nSnU(       aI  UR                  SS5      nUS   n[        US   5      nUS:  a  [        [        S[	        U 5      5      5      eUR                  S5      S:w  a7  [        R                  nUS:  a  [        [        S	[	        U 5      5      5      eSnO6[        R                  nUS
:  a  [        [        S[	        U 5      5      5      eS
nSnU(       aE  SU-  n	U	SU[        U	5      -
  -  -  n	[        [        U	S5      5      nSUS-  [        U5      -
  -  U-   nX l        [        Xa5      U-   U l        U R                   U l        SU l        U R&                  S:w  a  SU l        gg)z
Sets the value of the object

:param value:
    A unicode string containing an IPv4 address, IPv4 address with CIDR,
    an IPv6 address or IPv6 address with CIDR
rN   /r   r   r	   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rF   10          N)rH   r   rQ   r
   r   r   splitintr   socketAF_INET6AF_INETlenr2   _nativer5   rV   _bytesrW   rX   )
r@   rY   original_valuehas_cidrcidrpartsfamily	cidr_size
cidr_bytes	cidr_masks
             rB   r[   IPAddress.set2  s    %))F $%    ::c?b(KKQ'E!HEuQx=Dax  dO	"   ::c?b __Fcz  dO"   I^^Fby  dO"   I
d
I	C	N :;;I%c)Q&78J!i1nJ%GHJVJ%!&0:=mm==CDM  rF   c                 "   U R                   c  gU R                  c  U R                  5       n[        U5      nSnSnU[	        SS/5      ;   a2  [        [        R                  USS 5      nUS:  a  [        USS 5      nOBU[	        SS/5      ;   a1  [        [        R                  USS 5      nUS:  a  [        USS 5      nUb<  SR                  U5      n[        UR                  S5      5      nUS	-   [        U5      -   nX0l        U R                  $ )
z`
The native Python datatype representation of this value

:return:
    A unicode string or None
Nr      r   r      z{0:b}r   r   )rV   r   	__bytes__r   r[   r4   r   r   r3   r   formatrstripr   )r@   byte_stringbyte_lenrY   cidr_int	cidr_bitsr   s          rB   rn   IPAddress.nativey  s    == <<..*K;'HEH3Bx=(!&//;q3DEb=-k"#.>?HS!Q[(!&..+a2BCa<-k!"o>H##NN84	9++C01gdm3 L||rF   c                     X:X  + $ r=   r>   r?   s     rB   rC   IPAddress.__ne__  rE   rF   c                 p    [        U[        5      (       d  gU R                  5       UR                  5       :H  $ )zD
:param other:
    Another IPAddress object

:return:
    A boolean
F)rH   r   r   r?   s     rB   rK   IPAddress.__eq__  s-     %++~~5??#444rF   )r   rW   r   rX   rV   )NN)r^   r_   r`   ra   r   r[   r   rn   rC   rK   rc   r>   rF   rB   r   r   &  s,    	E N  >!5rF   r   c                   *    \ rS rSrS\4S\S\04/rSrg)	Attributei  typevaluesr   r>   N)	r^   r_   r`   ra   r"   r*   r   _fieldsrc   r>   rF   rB   r   r     s     	!"	563-(GrF   r   c                       \ rS rSr\rSrg)
Attributesi  r>   N)r^   r_   r`   ra   r   _child_specrc   r>   rF   rB   r   r         KrF   r   c            
       ,    \ rS rSrSSSSSSSS	S
S.	rSrg)KeyUsagei  digital_signaturenon_repudiationkey_enciphermentdata_enciphermentkey_agreementkey_cert_signcrl_signencipher_onlydecipher_only	r   r	   r      r            r   r>   Nr^   r_   r`   ra   _maprc   r>   rF   rB   r   r     s$    
DrF   r   c                   4    \ rS rSrS\SSS.4S\SSS.4/rSrg	)
PrivateKeyUsagePeriodi  
not_beforer   Timplicitoptional	not_afterr	   r>   N)r^   r_   r`   ra   r   r   rc   r>   rF   rB   r   r     s'    	QD(IJ	oA4'HIGrF   r   c                   "    \ rS rSrSrSrS rSrg)NotReallyTeletexStringi  a  
OpenSSL (and probably some other libraries) puts ISO-8859-1
into TeletexString instead of ITU T.61. We use Windows-1252 when
decoding since it is a superset of ISO-8859-1, and less likely to
cause encoding issues, but we stay strict with encoding to prevent
us from creating bad data.
r   c                     U R                   c  gU R                  c.  U R                  5       R                  U R                  5      U l        U R                  $ rq   )rV   rU   rt   r   _decoding_encodingru   s    rB   rI   "NotReallyTeletexString.__unicode__  sF     == ==  ..0778O8OPDM}}rF   )rU   N)r^   r_   r`   ra   __doc__r   rI   rc   r>   rF   rB   r   r     s     "
rF   r   c               #   b   #     S[         l        S v   S[         l        g ! S[         l        f = f7f)Nteletexr   )r   r   r>   rF   rB   strict_teletexr     s(     =4=14<1H1s   / /,/c                   <    \ rS rSrS\4S\4S\4S\4S\4S\	4/r
Srg	)
DirectoryStringi  teletex_stringprintable_stringuniversal_stringutf8_string
bmp_string
ia5_stringr>   N)r^   r_   r`   ra   r   r&   r,   r.   r   r   _alternativesrc   r>   rF   rB   r   r     s:    	12	_-	_-	
#	y!	y!MrF   r   c                      \ rS rSr0 SS_SS_SS_SS	_S
S_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_S S!_S"S#_0 S$S%_S&S'_S(S)_S*S+_S,S-_S.S/_S0S1_S2S3_S4S5_S6S7_S8S9_S:S;_S<S=_S>S?_S@SA_SBSC_SDSE_Er/ SFQr\SG 5       r\SH 5       r	SIr
gJ)KNameTypei  z2.5.4.3common_namez2.5.4.4surnamez2.5.4.5serial_numberz2.5.4.6country_namez2.5.4.7locality_namez2.5.4.8state_or_province_namez2.5.4.9street_addressz2.5.4.10organization_namez2.5.4.11organizational_unit_namez2.5.4.12titlez2.5.4.15business_categoryz2.5.4.17postal_codez2.5.4.20telephone_numberz2.5.4.41namez2.5.4.42
given_namez2.5.4.43initialsz2.5.4.44generation_qualifierz2.5.4.45unique_identifierz2.5.4.46dn_qualifierz2.5.4.65	pseudonymz2.5.4.97organization_identifierz2.23.133.2.1tpm_manufacturerz2.23.133.2.2	tpm_modelz2.23.133.2.3tpm_versionz2.23.133.2.4platform_manufacturerz2.23.133.2.5platform_modelz2.23.133.2.6platform_versionz1.2.840.113549.1.9.1email_addressz1.3.6.1.4.1.311.60.2.1.1incorporation_localityz1.3.6.1.4.1.311.60.2.1.2incorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3incorporation_countryz0.9.2342.19200300.100.1.1user_idz0.9.2342.19200300.100.1.25domain_componentz0.2.262.1.10.7.20name_distinguisher)!r  r  r  r  r   r   r  r  r  r  r  r  r  r   r  r  r  r   r  r
  r  r  r	  r  r  r  r  r  r  r  r  r  r  c                     U R                  U5      nXR                  ;   a  U R                  R                  U5      nX!4$ [        U R                  5      nX!4$ )z
Returns an ordering value for a particular attribute key.

Unrecognized attributes and OIDs will be sorted lexically at the end.

:return:
    An orderable value.

)mappreferred_orderindexr   )cls	attr_nameordinals      rB   preferred_ordinalNameType.preferred_ordinalK  sZ     GGI&	+++))//	:G ## #--.G##rF   c                    0 SS_SS_SS_SS_S	S
_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS _S!S"_0 S#S$_S%S&_S'S(_S)S*_S+S,_S-S._S/S0_S1S2_S3S4_S5S6_S7S8_S9S:_S;S<_S=S>_S?S@_SASB_SCSD_ER                  U R                  U R                  5      $ )EzB
:return:
    A human-friendly unicode string to display to users
r   zCommon Namer   Surnamer   zSerial Numberr   Countryr  Localityr  zState/Provincer  zStreet Addressr  Organizationr  zOrganizational Unitr  Titler  zBusiness Categoryr  zPostal Coder	  zTelephone Numberr
  Namer  z
Given Namer  Initialsr  zGeneration Qualifierr  zUnique Identifierr  zDN Qualifierr  	Pseudonymr  zEmail Addressr  zIncorporation Localityr  zIncorporation State/Provincer  zIncorporation Countryr  zDomain Componentr  zName Distinguisherr  zOrganization Identifierr  zTPM Manufacturerr  z	TPM Modelr  zTPM Versionr  zPlatform Manufacturerr  zPlatform Modelr  zPlatform Versionr  zUser ID)getrn   ru   s    rB   human_friendlyNameType.human_friendly_  s   #
=#
y#
 _#
 I	#

 Z#
 %&6#
 .#
  #
 '(=#
 W#
  !4#
 =#
  2#
 F#
 ,#
  
!#
" #$:##
$  !4%#
& N'#
( )#
* _+#
, %&>-#
. ./M/#
0 $%<1#
2  23#
4 !"65#
6 &'@7#
8  29#
: ;#
< ==#
> $%<?#
@ .A#
B  2C#
D yE#
F #dkk4;;
'G#	(rF   r>   N)r^   r_   r`   ra   r   r!  classmethodr&  r   r2  rc   r>   rF   rB   r   r     s   )=)9) 	?) 	>	)
 	?) 	+) 	#) 	') 	.) 	G) 	') 	M) 	&) 	F) 	L)  	J!)" 	*#)$ 	'%)& 	N')( 	K))* 	-+). 	*/)0 	1)2 	3)4 	/5)6 	(7)8 	*9)< 	=)@ 	#$<A)B 	#$EC)D 	#$;E)H 	$YI)L 	%&8M)P 	1Q)D\"OH $ $& )( )(rF   r   c                   "   \ rS rSrS\4S\4/rSr0 S\_S\_S\_S\_S	\_S
\_S\_S\_S\_S\_S\_S\_S\	_S\_S\_S\_S\_0 S\
_S\_S\_S\_S\_S\_S\_S\_S\_S\_S \_S!\_S"\_S#\_S$\_S%\_S&\_ErS'r\S( 5       rS) rS* rS+ rS,rg')-NameTypeAndValuei  r   rY   r   rY   r   r   r   r   r  r  r  r  r  r  r  r  r	  r
  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  Nc                 z    U R                   c#  U R                  U S   R                  5      U l         U R                   $ )z
Returns the value after being processed by the internationalized string
preparation as specified by RFC 5280

:return:
    A unicode string
rY   )_prepped_ldap_string_preprn   ru   s    rB   prepped_valueNameTypeAndValue.prepped_value  s4     ==  224=3G3GHDM}}rF   c                     X:X  + $ r=   r>   r?   s     rB   rC   NameTypeAndValue.__ne__  rE   rF   c                     [        U[        5      (       d  gUS   R                  U S   R                  :w  a  gUR                  U R                  :H  $ )z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

:param other:
    Another NameTypeAndValue object

:return:
    A boolean
Fr   )rH   r6  rn   r;  r?   s     rB   rK   NameTypeAndValue.__eq__  sK     %!122=4<#6#66""d&8&888rF   c                    [         R                  " SSU5      n[         R                  " SSU5      n[        R                  S:X  a  [         R                  " SSU5      nO[         R                  " SSU5      n[         R                  " SSU5      nUR	                  S	S5      n[         R                  " S
SU5      nSR                  [        [        R                  U5      5      n[        R                  " SU5      nU GH  n[        R                  " U5      (       a  [        [        S5      5      e[        R                  " U5      (       a  [        [        S5      5      e[        R                  " U5      (       a  [        [        S5      5      e[        R                   " U5      (       a  [        [        S5      5      e[        R"                  " U5      (       a  [        [        S5      5      eUS:X  d  M  [        [        S5      5      e   SnSnU HA  n[        R$                  " U5      (       a  SnM"  [        R&                  " U5      (       d  M?  SnMC     U(       a[  [        R$                  " US   5      n[        R$                  " US   5      nU(       d  U(       a  U(       d  [        [        S5      5      eS[         R                  " SSU5      R)                  5       -   S-   nU$ )z
Implements the internationalized string preparation algorithm from
RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

:param string:
    A unicode string to prepare

:return:
    A prepared unicode string, ready for comparison
u   [­᠆͏᠋-᠍️-＀￼]+rs   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]NFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   r   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  )resubsys
maxunicodereplacejoinr   
stringprepmap_table_b2unicodedata	normalizein_table_a1r   r
   in_table_c8in_table_c3in_table_c4in_table_c5in_table_d1in_table_d2strip)r@   stringcharhas_r_and_al_cat	has_l_catfirst_is_r_and_allast_is_r_and_als          rB   r:  "NameTypeAndValue._ldap_string_prep  s    OQSU[\@#vN>>V# VVTVXZ`aFVVTVXZ`aFK	
 "-TVY[abZ44f=> &&vv6 D%%d++ "   %%d++ "   %%d++ "   %%d++ "   %%d++ "   x "  M \ !	D%%d++#' ''-- 		   * 6 6vay A)55fRjA 19I "   rvvdD&17799C?rF   )r9  )r^   r_   r`   ra   r   r   r   	_oid_pairr   r&   r#   rx   r7   r.   
_oid_specsr9  r   r;  rC   rK   r:  rc   r>   rF   rB   r6  r6    s   		#G
 "I%%?% 	% 		%
 	% 	!/% 	/% 	_% 	#O% 	% 	_% 	% 	O% 	% 	o%  	O!%" 	#%$ 	^%%& 	'%( 	_)%, 	-%0 	!/1%2 	*?3%4 	 5%6 	G7%8 	o9%: 	"?;%< 	J=%> 	Z?%@ 	zA%B 	 C%D 	*E%F 	JG%H 	?I%JN H !9&jrF   r6  c                   @    \ rS rSr\r\S 5       rS rS r	S r
S rSrg)	RelativeDistinguishedNameiM  c                     / nU R                  U 5      n[        UR                  5       5       H  nUR                  U< SX#   < 35        M     SR	                  U5      $ )J
:return:
    A unicode string that can be used as a dict key or in a set
: )_get_valuessortedkeysappendrI  )r@   outputr   keys       rB   hashable"RelativeDistinguishedName.hashableP  sR     !!$'&++-(CMMc6;78 )
 {{6""rF   c                     X:X  + $ r=   r>   r?   s     rB   rC    RelativeDistinguishedName.__ne__`  rE   rF   c                     [        U[        5      (       d  g[        U 5      [        U5      :w  a  gU R                  U 5      nU R                  U5      nX#:w  a  gU R	                  U 5      nU R	                  U5      nU H  nXF   XV   :w  d  M    g   g)z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

:param other:
    Another RelativeDistinguishedName object

:return:
    A boolean
FT)rH   r`  r   
_get_typesre  )r@   rA   
self_typesother_typesself_valuesother_values
type_name_s          rB   rK    RelativeDistinguishedName.__eq__c  s     %!:;;t9E
"__T*
ooe,$&&t,''.$J&,*BB % rF   c                 \    [        U Vs/ s H  o"S   R                  PM     sn5      $ s  snf )z
Returns a set of types contained in an RDN

:param rdn:
    A RelativeDistinguishedName object

:return:
    A set object with unicode strings of NameTypeAndValue type field
    values
r   )r[   rn   )r@   rdnntvs      rB   rp  $RelativeDistinguishedName._get_types  s)     #6#3K&&#6776s   )c                     0 nU Vs/ s H-  o2R                  US   R                  UR                  4/5      PM/       nU$ s  snf )z
Returns a dict of prepped values contained in an RDN

:param rdn:
    A RelativeDistinguishedName object

:return:
    A dict object with unicode strings of NameTypeAndValue value field
    values that have been prepped for comparison
r   )updatern   r;  )r@   rx  ri  ry  s       rB   re  %RelativeDistinguishedName._get_values  sE     MPQScV++S->->?@	ASQ 	Rs   4?r>   N)r^   r_   r`   ra   r6  r   r   rk  rC   rK   rp  re  rc   r>   rF   rB   r`  r`  M  s.    "K# #!@8rF   r`  c                   4    \ rS rSr\r\S 5       rS rS r	Sr
g)RDNSequencei  c                 2    SR                  S U  5       5      $ )rb  c              3   8   #    U  H  oR                   v   M     g 7fr=   )rk  ).0rx  s     rB   	<genexpr>'RDNSequence.hashable.<locals>.<genexpr>  s     84C<<4s   )rI  ru   s    rB   rk  RDNSequence.hashable  s     {{84888rF   c                     X:X  + $ r=   r>   r?   s     rB   rC   RDNSequence.__ne__  rE   rF   c                     [        U[        5      (       d  g[        U 5      [        U5      :w  a  g[        U 5       H  u  p#X   U:w  d  M    g   g)z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

:param other:
    Another RDNSequence object

:return:
    A boolean
FT)rH   r  r   	enumerate)r@   rA   r"  self_rdns       rB   rK   RDNSequence.__eq__  sI     %--t9E
"(OE|x'  / rF   r>   N)r^   r_   r`   ra   r`  r   r   rk  rC   rK   rc   r>   rF   rB   r  r    s#    +K	9 	9!rF   r  c                       \ rS rSrS\4/rSrSrSr\	SS j5       r
\S 5       rS rS rS r\S	 5       r\S
 5       rS r\S 5       r\S 5       rSrg)r.  i  rs   Nc           
         / nU(       d	  Sn[         nOSn[        n[        [        UR	                  5       S S95      nUR	                  5        H  u  pg[
        R                  U5      nUS:X  a  [        U5      nOGUS:X  a  [        U5      nO5U[        / SQ5      ;   a  [        S[        U5      S9nO[        UU" U5      S9nUR                  [        [        UUS	.5      /5      5        M     U " S
[        U5      S9$ )a  
Creates a Name object from a dict of unicode string keys and values.
The keys should be from NameType._map, or a dotted-integer OID unicode
string.

:param name_dict:
    A dict of name information, e.g. {"common_name": "Will Bond",
    "country_name": "US", "organization_name": "Codex Non Sufficit LC"}

:param use_printable:
    A bool - if PrintableString should be used for encoding instead of
    UTF8String. This is for backwards compatibility with old software.

:return:
    An x509.Name object
r   r   c                 2    [         R                  U S   5      $ )Nr   )r   r&  )items    rB   <lambda>Name.build.<locals>.<lambda>  s    !;!;DG!DrF   )rj  r  r  )r  r   r   )r
  rY   r7  rs   )r.   r&   r   rf  itemsr   r   rx   r7   r[   r   rh  r`  r6  r  )	r#  	name_dictuse_printablerdnsencoding_nameencoding_classattribute_nameattribute_valuerY   s	            rB   build
Name.build  s   & )M'N.M,N  !D
	 09/@+N%\\.9N0$_5#5503'X#YY'+)/:
 (&(9
 KK1 *"" 3  # 0A0 +d"344rF   c                 .    U R                   R                  $ )rb  )chosenrk  ru   s    rB   rk  Name.hashable  s     {{###rF   c                 ,    [        U R                  5      $ r=   )r   r  ru   s    rB   __len__Name.__len__  s    4;;rF   c                     X:X  + $ r=   r>   r?   s     rB   rC   Name.__ne__  rE   rF   c                 `    [        U[        5      (       d  gU R                  UR                  :H  $ )z
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

:param other:
    Another Name object

:return:
    A boolean
F)rH   r.  r  r?   s     rB   rK   Name.__eq__!  s'     %&&{{ell**rF   c                    U R                   c  [        5       U l         U R                  R                   H}  nU Ht  nUS   nX0R                   ;   aK  U R                   U   n[	        U[
        5      (       d  U/=o@R                   U'   UR                  US   5        Mb  US   U R                   U'   Mv     M     U R                   $ )Nr   rY   )r   r   r  rn   rH   listrh  )r@   rx  type_val
field_nameexistings        rB   rn   Name.native0  s    <<&=DL{{)) #H!)&!1J!\\1#'<<
#;)(D99CK*LH||J'? (9:3;G3DZ0 !$ * ||rF   c                 X   U R                   Gc  [        5       nSnU R                   HH  nU H?  nUS   R                  nUnXQ;   a  X   /X'   X   R	                  US   5        M8  US   X'   MA     MJ     / nUR                  5       nUS:X  a  [        [        U5      5      nU H0  nX   n	U R                  U	5      n
UR	                  U< SU
< 35        M2     SnU H  nUR                  S5      S:w  d  M  S	n  O   U(       d  S
OSnUR                  USSS2   5      U l         U R                   $ )zO
:return:
    A human-friendly unicode string containing the parts of the name
Nr   rY   r*  rc  F,r   T, z; )_human_friendlyr   r  r2  rh  rg  reversedr  _recursive_humanizer   rI  )r@   data
last_fieldrx  r  r  to_joinrg  rj  rY   native_value	has_commaelement	separators                 rB   r2  Name.human_friendly@  s4    '=DJ{{ #H!)&!1!@!@J!+J!),0,<+=((//0AB+3G+<( !$ # G99;DY&T
+	#77>3=> 
 I"<<$* $I #
 %.4I#,>>'$B$-#@D ###rF   c           
          [        U[        5      (       a9  SR                  [        U Vs/ s H  o R	                  U5      PM     sn5      5      $ UR
                  $ s  snf )z
Recursively serializes data compiled from the RDNSequence

:param value:
    An Asn1Value object, or a list of Asn1Value objects

:return:
    A unicode string
r  )rH   r  rI  r  r  rn   )r@   rY   	sub_values      rB   r  Name._recursive_humanizeg  sT     eT""99uUu)229=uUV  || Vs   Ac                     U R                   c7  [        R                  " U R                  5       5      R	                  5       U l         U R                   $ )zB
:return:
    The SHA1 hash of the DER-encoded bytes of this name
_sha1hashlibsha1dumpdigestru   s    rB   r  	Name.sha1x  7     :: diik299;DJzzrF   c                     U R                   c7  [        R                  " U R                  5       5      R	                  5       U l         U R                   $ )zE
:return:
    The SHA-256 hash of the DER-encoded bytes of this name
_sha256r  sha256r  r  ru   s    rB   r  Name.sha256  s7     <<">>$))+6==?DL||rF   )r  r   r  r  )F)r^   r_   r`   ra   r  r   r  r  r  r4  r  r   rk  r  rC   rK   rn   r2  r  r  r  rc   r>   rF   rB   r.  r.    s    	[M OEG:5 :5x $ $ !+   $$ $$L"    rF   r.  c                   *    \ rS rSrS\4S\SS04/rSrg)AnotherNamei  type_idrY   explicitr   r>   N)r^   r_   r`   ra   r"   r   r   rc   r>   rF   rB   r  r    s     	$%	#
A'GrF   r  c                   ,    \ rS rSrSrSrS\4S\4/rSr	g)CountryNamei  r	   x121_dcc_codeiso_3166_alpha2_coder>   N
r^   r_   r`   ra   class_tagr!   r&   r   rc   r>   rF   rB   r  r    s%    F
C 
-(	1MrF   r  c                   ,    \ rS rSrSrSrS\4S\4/rSr	g)AdministrationDomainNamei  r	   r   numeric	printabler>   Nr  r>   rF   rB   r  r    s%    F
C 
M"	o&MrF   r  c                   $    \ rS rSrS\4S\4/rSrg)PrivateDomainNamei  r  r  r>   Nr^   r_   r`   ra   r!   r&   r   rc   r>   rF   rB   r  r    s    	M"	o&MrF   r  c                   N    \ rS rSrS\SS04S\SSS.4S	\S
SS.4S\SSS.4/rSrg)PersonalNamei  r   r   r   r  r	   Tr   r  r   r  r   r>   Nr^   r_   r`   ra   r&   r   rc   r>   rF   rB   r  r    sD    	Oj!_5	QD(IJ	_1$&GH	qd2ST	GrF   r  c                   N    \ rS rSrS\SS04S\SSS.4S	\S
SS.4S\SSS.4/rSrg)TeletexPersonalNamei  r   r   r   r  r	   Tr   r  r   r  r   r>   Nr^   r_   r`   ra   r+   r   rc   r>   rF   rB   r  r    sD    	MJ?3	}1$&GH	]$EF	QD0QR	GrF   r  c                       \ rS rSr\rSrg)OrganizationalUnitNamesi  r>   Nr^   r_   r`   ra   r&   r   rc   r>   rF   rB   r  r        !KrF   r  c                       \ rS rSr\rSrg)TeletexOrganizationalUnitNamesi  r>   N)r^   r_   r`   ra   r+   r   rc   r>   rF   rB   r  r        KrF   r  c                       \ rS rSrS\SS04S\SS04S\SSS.4S	\S
SS.4S\SSS.4S\SSS.4S\SSS.4S\	SSS.4S\
SSS.4/	rSrg)BuiltInStandardAttributesi  r   r   Tadministration_domain_namenetwork_addressr   r   terminal_identifierr	   private_domain_namer   r  r   r  r   numeric_user_identifierr   personal_namer   organizational_unit_namesr   r>   N)r^   r_   r`   ra   r  r  r!   r&   r  r  r  r   rc   r>   rF   rB   r  r    s    	z4&89	%'?*dAST	Mt+LM	aT1RS	 1t3TU	oA4/PQ	"Mt3TU	,QD(IJ	$&=A[_?`a
GrF   r  c                   $    \ rS rSrS\4S\4/rSrg)BuiltInDomainDefinedAttributei  r   rY   r>   Nr  r>   rF   rB   r  r    s    	!	/"GrF   r  c                       \ rS rSr\rSrg)BuiltInDomainDefinedAttributesi  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r        /KrF   r  c                   $    \ rS rSrS\4S\4/rSrg)TeletexDomainDefinedAttributei  r   rY   r>   Nr  r>   rF   rB   r  r    s    		- GrF   r  c                       \ rS rSr\rSrg)TeletexDomainDefinedAttributesi  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r    r  rF   r  c                   $    \ rS rSrS\4S\4/rSrg)PhysicalDeliveryCountryNamei  r  r  r>   Nr  r>   rF   rB   r  r    s    	-(	1MrF   r  c                   $    \ rS rSrS\4S\4/rSrg)
PostalCodei  numeric_codeprintable_coder>   Nr  r>   rF   rB   r  r    s    	'	?+MrF   r  c                   0    \ rS rSrS\SS04S\SS04/rSrg)PDSParameteri  r   r   Tr   r>   N)r^   r_   r`   ra   r&   r+   r   rc   r>   rF   rB   r  r    s'    	_z4.@A	=:t*<=GrF   r  c                       \ rS rSr\rSrg)PrintableAddressi  r>   Nr  r>   rF   rB   r  r    r  rF   r  c                   0    \ rS rSrS\SS04S\SS04/rSrg)UnformattedPostalAddressi  printable_addressr   Tr   r>   N)r^   r_   r`   ra   r  r+   r   rc   r>   rF   rB   r	  r	    s(    	.T0BC	=:t*<=GrF   r	  c                   2    \ rS rSrS\SS04S\SSS.4/rS	rg
)E1634Addressi  numberr   r   sub_addressr	   Tr   r>   N)r^   r_   r`   ra   r!   r   rc   r>   rF   rB   r  r    s&    	=:q/2	A4'HIGrF   r  c                       \ rS rSr\rSrg)
NAddressesi  r>   N)r^   r_   r`   ra   r$   r   rc   r>   rF   rB   r  r        KrF   r  c                   N    \ rS rSrS\SSS.4S\SSS.4S\S	SS.4S
\SS04/rSrg)PresentationAddressi  
p_selectorr   Tr  
s_selectorr	   
t_selectorr   n_addressesr  r   r>   N)r^   r_   r`   ra   r$   r  r   rc   r>   rF   rB   r  r    sD    	{$EF	{$EF	{$EF	
ZO4	GrF   r  c                   *    \ rS rSrS\4S\SS04/rSrg)ExtendedNetworkAddressi#  e163_4_addresspsap_addressr   r   r>   N)r^   r_   r`   ra   r  r  r   rc   r>   rF   rB   r  r  #  s     	<(	,z1o>MrF   r  c                   &    \ rS rSrSSSSSSS.rS	rg
)TerminalTypei*  telexr   g3_facsimileg4_facsimileia5_terminalvideotex)r   r   r   r   r   r   r>   Nr   r>   rF   rB   r  r  *  s    DrF   r  c                       \ rS rSr0 SS_SS_SS_SS	_S
S_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_S S!_S"S#_S$S%S&S'S(S)S*.ErS+rg,)-ExtensionAttributeTypei5  r	   r   r   teletex_common_namer   teletex_organization_namer   teletex_personal_namer   teletex_organization_unit_namesr   !teletex_domain_defined_attributesr   pds_namer   physical_delivery_country_name	   r  
   physical_delivery_office_name   physical_delivery_office_numberr:   extension_of_address_components   physical_delivery_personal_name   #physical_delivery_organization_name   .extension_physical_delivery_address_componentsr   unformatted_postal_address   r  post_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_addressterminal_type)   r;               r>   Nr   r>   rF   rB   r$  r$  5  s    	=	  	
& 	
"	
 	
, 	
. 	
: 	
+ 	
= 	+ 	- 	- 	- 	1 	<  	(!" 	#$ &$ %&/DrF   r$  c                       \ rS rSrS\SS04S\SS04/rSr0 S	\_S
\	_S\	_S\
_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_\\\\\\S.ErSrg)ExtensionAttributeiQ  extension_attribute_typer   r   extension_attribute_valuer  r	   )rG  rH  r   r%  r&  r'  r(  r)  r*  r+  r  r.  r0  r1  r3  r5  r7  r8  r  )r:  r;  r<  r=  r>  r?  r>   N)r^   r_   r`   ra   r$  r   r   r]  r&   r+   r  r  r  r  r  r  r	  r  r  r^  rc   r>   rF   rB   rF  rF  Q  s   	#%;j!_M	$cJ?;G
 JI} 	$] 	 !4	
 	*+I 	,-K 	O 	)*E 	z 	( 	*< 	*< 	*< 	.| 	9,  	%&>!" 	,#$ $0".*#/$:%/JrF   rF  c                       \ rS rSr\rSrg)ExtensionAttributesis  r>   N)r^   r_   r`   ra   rF  r   rc   r>   rF   rB   rJ  rJ  s      $KrF   rJ  c                   6    \ rS rSrS\4S\SS04S\SS04/rSrg)		ORAddressiw  built_in_standard_attributes"built_in_domain_defined_attributesr   Textension_attributesr>   N)	r^   r_   r`   ra   r  r  rJ  r   rc   r>   rF   rB   rM  rM  w  s4    	')BC	-/MPZ\`Oab	!4z46HIGrF   rM  c                   2    \ rS rSrS\SSS.4S\SS04/rS	rg
)EDIPartyNamei  name_assignerr   Tr   
party_namer   r	   r>   N)r^   r_   r`   ra   r   r   rc   r>   rF   rB   rR  rR    s&    	/t+LM	Q8GrF   rR  c                       \ rS rSrS\SS04S\SS04S\SS04S	\SS
04S\SS04S\	SS04S\
SS04S\SS04S\SS04/	rS rS rSrg)GeneralNamei  
other_namer   r   rfc822_namer	   dns_namer   x400_addressr   directory_namer  r   edi_party_namer   uniform_resource_identifierr   
ip_addressr   registered_idr   c                     X:X  + $ r=   r>   r?   s     rB   rC   GeneralName.__ne__  rE   rF   c                 &   U R                   S;   a  [        [        SU R                   5      5      eUR                   S;   a  [        [        SUR                   5      5      eU R                   UR                   :w  a  gU R                  UR                  :H  $ )z
Does not support other_name, x400_address or edi_party_name

:param other:
    The other GeneralName to compare to

:return:
    A boolean
)rW  rZ  r\  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r
  r   r
   r  r?   s     rB   rK   GeneralName.__eq__  s     99HHV 		   ::IIV 

	   99

"{{ell**rF   r>   N)r^   r_   r`   ra   r  rx   r7   rM  r.  rR  re   r   r"   r   rC   rK   rc   r>   rF   rB   rV  rV    s    	{ZO4	z1o6	Wz1o.	ZO4	4*a1	<*a9	&j!_=	y:q/2	*ZO<
M!+rF   rV  c                       \ rS rSr\rSrg)GeneralNamesi  r>   N)r^   r_   r`   ra   rV  r   rc   r>   rF   rB   re  re    r  rF   re  c                   $    \ rS rSrS\4S\4/rSrg)Timei  utc_timegeneral_timer>   N)r^   r_   r`   ra   r-   r   r   rc   r>   rF   rB   rg  rg    s    	W	)MrF   rg  c                   $    \ rS rSrS\4S\4/rSrg)Validityi  r   r   r>   N)r^   r_   r`   ra   rg  r   rc   r>   rF   rB   rk  rk    s    	t	dGrF   rk  c                   0    \ rS rSrS\SS04S\SS04/rSrg	)
BasicConstraintsi  cadefaultFpath_len_constraintr   Tr>   N)r^   r_   r`   ra   r   r   r   rc   r>   rF   rB   rm  rm    s'    	wE*+	*d);<GrF   rm  c                   B    \ rS rSrS\SSS.4S\SSS.4S\S	SS.4/rS
rg)AuthorityKeyIdentifieri  key_identifierr   Tr   authority_cert_issuerr	   authority_cert_serial_numberr   r>   N)	r^   r_   r`   ra   r$   re  r   r   rc   r>   rF   rB   rr  rr    s6    	;QD(IJ	 ,QD0QR	'qd2STGrF   rr  c                   0    \ rS rSrS\SS04S\SS04/rSrg)	DistributionPointNamei  	full_namer   r   name_relative_to_crl_issuerr	   r>   N)r^   r_   r`   ra   re  r`  r   rc   r>   rF   rB   rw  rw    s'    	lZO4	&(AJPQ?SMrF   rw  c            
       ,    \ rS rSrSSSSSSSS	S
S.	rSrg)ReasonFlagsi  unusedkey_compromiseca_compromiseaffiliation_changed
supersededcessation_of_operationcertificate_holdprivilege_withdrawnaa_compromiser   r>   Nr   r>   rF   rB   r{  r{    s$     # 
DrF   r{  c                   :    \ rS rSrS\4S\SSS.4S\SSS	.4/rS
rg)GeneralSubtreei  baseminimumr   r   ro  maximumr	   Tr   r>   N)r^   r_   r`   ra   rV  r   r   rc   r>   rF   rB   r  r    s/    		G!:;	G!>?GrF   r  c                       \ rS rSr\rSrg)GeneralSubtreesi  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r    s     KrF   r  c                   4    \ rS rSrS\SSS.4S\SSS.4/rSrg	)
NameConstraintsi  permitted_subtreesr   Tr   excluded_subtreesr	   r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r    s'    	QD0QR	oA4/PQGrF   r  c                   V    \ rS rSrS\SSS.4S\SSS.4S	\S
SS.4/rSr\	S 5       r
Srg)DistributionPointi  distribution_pointr   Tr  reasonsr	   r   
crl_issuerr   Fc                 h   U R                   SL a  SU l         U S   nUR                  S:w  a  [        [        S5      5      eUR                   HX  nUR                  S:X  d  M  UR
                  nUR                  5       R                  S5      (       d  MG  X0l           U R                   $    U R                   $ )zG
:return:
    None or a unicode string of the distribution point's URL
FNr  rx  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    r]  zhttp://zhttps://zldap://zldaps://)_urlr
  r   r
   r  rn   rJ   rR   )r@   r
  general_nameurls       rB   r  DistributionPoint.url
  s     99DI,-DyyK' "   !%$$(EE&--Cyy{--.\]]$'	yy !, yyrF   )r  N)r^   r_   r`   ra   rw  r{  re  r   r  r   r  rc   r>   rF   rB   r  r    sQ    	41RV6WX	KaT!BC	|!%FGG D rF   r  c                       \ rS rSr\rSrg)CRLDistributionPointsi&  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r  &      #KrF   r  c                   0    \ rS rSrS\4S\4S\4S\4/rSr	g)DisplayTexti*  r   visible_stringr   r   r>   N)
r^   r_   r`   ra   r   r/   r   r.   r   rc   r>   rF   rB   r  r  *  s)    	y!	=)	y!	
#	MrF   r  c                       \ rS rSr\rSrg)NoticeNumbersi3  r>   Nr^   r_   r`   ra   r   r   rc   r>   rF   rB   r  r  3      KrF   r  c                   $    \ rS rSrS\4S\4/rSrg)NoticeReferencei7  organizationnotice_numbersr>   N)r^   r_   r`   ra   r  r  r   rc   r>   rF   rB   r  r  7  s    	%	=)GrF   r  c                   0    \ rS rSrS\SS04S\SS04/rSrg)
UserNoticei>  
notice_refr   Texplicit_textr>   N)r^   r_   r`   ra   r  r  r   rc   r>   rF   rB   r  r  >  s'    	T(:;	+
D'9:GrF   r  c                       \ rS rSrSSS.rSrg)PolicyQualifierIdiE   certification_practice_statementuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2r>   Nr   r>   rF   rB   r  r  E  s    ?*DrF   r  c                   2    \ rS rSrS\4S\4/rSr\\	S.r
Srg)PolicyQualifierInfoiL  policy_qualifier_id	qualifier)r  r  )r  r  r>   N)r^   r_   r`   ra   r  r   r   r]  r   r  r^  rc   r>   rF   rB   r  r  L  s.    	 12	cG
 5I,5!JrF   r  c                       \ rS rSr\rSrg)PolicyQualifierInfosiY  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r  Y      %KrF   r  c                       \ rS rSrSS0rSrg)PolicyIdentifieri]  z2.5.29.32.0
any_policyr>   Nr   r>   rF   rB   r  r  ]  s    |DrF   r  c                   *    \ rS rSrS\4S\SS04/rSrg)PolicyInformationic  policy_identifierpolicy_qualifiersr   Tr>   N)r^   r_   r`   ra   r  r  r   rc   r>   rF   rB   r  r  c  s"    	./	2Z4FGGrF   r  c                       \ rS rSr\rSrg)CertificatePoliciesij  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r  j  r  rF   r  c                   $    \ rS rSrS\4S\4/rSrg)PolicyMappingin  issuer_domain_policysubject_domain_policyr>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r  n  s    	!12	 "23GrF   r  c                       \ rS rSr\rSrg)PolicyMappingsiu  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r  u  r  rF   r  c                   4    \ rS rSrS\SSS.4S\SSS.4/rSrg	)
PolicyConstraintsiy  require_explicit_policyr   Tr   inhibit_policy_mappingr	   r>   Nr^   r_   r`   ra   r   r   rc   r>   rF   rB   r  r  y  s'    	"G!-NO	!7,MNGrF   r  c                   &   \ rS rSr0 SS_SS_SS_SS	_S
S_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_S S!_S"S#_0 S$S%_S&S'_S(S)_S*S+_S,S-_S.S/_S0S1_S2S3_S4S5_S6S7_S8S9_S:S;_S<S=_S>S?_S@SA_SBSC_SDSE_E0 SFSG_SHSI_SJSK_SLSM_SNSO_SPSQ_SRSS_STSU_SVSW_SXSY_SZS[_S\S]_S^S__S`Sa_SbSc_SdSe_SfSg_E0 ShSi_SjSk_SlSm_SnSo_SpSq_SrSs_StSu_SvSw_SxSy_SzS{_S|S}_S~S_SS_SS_SS_SS_SS_E0 SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_ErSrg)KeyPurposeIdi  z2.5.29.37.0any_extended_key_usagez1.3.6.1.5.5.7.3.1server_authz1.3.6.1.5.5.7.3.2client_authz1.3.6.1.5.5.7.3.3code_signingz1.3.6.1.5.5.7.3.4email_protectionz1.3.6.1.5.5.7.3.5ipsec_end_systemz1.3.6.1.5.5.7.3.6ipsec_tunnelz1.3.6.1.5.5.7.3.7
ipsec_userz1.3.6.1.5.5.7.3.8time_stampingz1.3.6.1.5.5.7.3.9ocsp_signingz1.3.6.1.5.5.7.3.10dvcsz1.3.6.1.5.5.7.3.13eap_over_pppz1.3.6.1.5.5.7.3.14eap_over_lanz1.3.6.1.5.5.7.3.15scvp_serverz1.3.6.1.5.5.7.3.16scvp_clientz1.3.6.1.5.5.7.3.17	ipsec_ikez1.3.6.1.5.5.7.3.18	capwap_acz1.3.6.1.5.5.7.3.19
capwap_wtpz1.3.6.1.5.5.7.3.20
sip_domainz1.3.6.1.5.5.7.3.21secure_shell_clientz1.3.6.1.5.5.7.3.22secure_shell_serverz1.3.6.1.5.5.7.3.23send_routerz1.3.6.1.5.5.7.3.24send_proxied_routerz1.3.6.1.5.5.7.3.25
send_ownerz1.3.6.1.5.5.7.3.26send_proxied_ownerz1.3.6.1.5.5.7.3.27cmc_caz1.3.6.1.5.5.7.3.28cmc_raz1.3.6.1.5.5.7.3.29cmc_archivez1.3.6.1.5.5.7.3.30bgpspec_routerz1.3.6.1.5.5.8.2.2ike_intermediatez1.3.6.1.4.1.311.10.3.1microsoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2microsoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3microsoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1microsoft_serializedz1.3.6.1.4.1.311.10.3.4microsoft_efsz1.3.6.1.4.1.311.10.3.4.1microsoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5microsoft_whqlz1.3.6.1.4.1.311.10.3.6microsoft_nt5z1.3.6.1.4.1.311.10.3.7microsoft_oem_whqlz1.3.6.1.4.1.311.10.3.8microsoft_embedded_ntz1.3.6.1.4.1.311.10.3.9microsoft_root_list_signerz1.3.6.1.4.1.311.10.3.10!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11microsoft_key_recoveryz1.3.6.1.4.1.311.10.3.12microsoft_document_signingz1.3.6.1.4.1.311.10.3.13microsoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14 microsoft_mobile_device_softwarez1.3.6.1.4.1.311.20.2.2microsoft_smart_card_logonz1.2.840.113635.100.1.2apple_x509_basicz1.2.840.113635.100.1.3	apple_sslz1.2.840.113635.100.1.4apple_local_cert_genz1.2.840.113635.100.1.5apple_csr_genz1.2.840.113635.100.1.6apple_revocation_crlz1.2.840.113635.100.1.7apple_revocation_ocspz1.2.840.113635.100.1.8apple_smimez1.2.840.113635.100.1.9	apple_eapz1.2.840.113635.100.1.10apple_software_update_signingz1.2.840.113635.100.1.11apple_ipsecz1.2.840.113635.100.1.12apple_ichatz1.2.840.113635.100.1.13apple_resource_signingz1.2.840.113635.100.1.14apple_pkinit_clientz1.2.840.113635.100.1.15apple_pkinit_serverz1.2.840.113635.100.1.16apple_code_signingz1.2.840.113635.100.1.17apple_package_signingz1.2.840.113635.100.1.18apple_id_validationz1.2.840.113635.100.1.20apple_time_stampingz1.2.840.113635.100.1.21apple_revocationz1.2.840.113635.100.1.22apple_passbook_signingz1.2.840.113635.100.1.23apple_mobile_storez1.2.840.113635.100.1.24apple_escrow_servicez1.2.840.113635.100.1.25apple_profile_signerz1.2.840.113635.100.1.26apple_qa_profile_signerz1.2.840.113635.100.1.27apple_test_mobile_storez1.2.840.113635.100.1.28apple_otapki_signerz1.2.840.113635.100.1.29apple_test_otapki_signerz1.2.840.113625.100.1.30)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31apple_smp_encryptionz1.2.840.113625.100.1.32apple_test_smp_encryptionz1.2.840.113635.100.1.33apple_server_authenticationz1.2.840.113635.100.1.34apple_pcs_escrow_servicez2.16.840.1.101.3.6.8piv_card_authenticationz2.16.840.1.101.3.6.7piv_content_signingz1.3.6.1.5.2.3.4pkinit_kpclientauthz1.3.6.1.5.2.3.5pkinit_kpkdcz1.2.840.113583.1.1.5adobe_authentic_documents_trustz2.16.840.1.101.3.8.7fpki_pivi_content_signingr>   Nr   r>   rF   rB   r  r    s   l/l 	]l 	]	l
 	^l 	/l 	/l 	^l 	\l 	_l 	^l 	fl 	nl  	n!l$ 	m%l& 	m'l* 	k+l. 	k/l0 	l1l4 	l5l8 	39l: 	3;l> 	m?l@ 	3AlB 	lClD 	2ElH 	hIlJ 	hKlL 	mMlP 	.QlT 	/UlZ 	!"@[l\ 	!"@]l^ 	!":_l` 	#$:alb 	!/cld 	#$<elf 	!"2glh 	!/ilj 	!"6kll 	!"9mln 	!">olp 	"#Fqlr 	"#;slt 	"#?ulv 	"#?wlx 	"#Eyl| 	!">}lD 	!"4ElF 	!+GlH 	!"8IlJ 	!/KlL 	!"8MlN 	!"9OlP 	!-QlR 	!+SlT 	"#BUlV 	"=WlX 	"=YlZ 	"#;[l\ 	"#8]l^ 	"#8_l` 	"#7alb 	"#:cld 	"#8elf 	"#8glh 	"#5ilj 	"#;kll 	"#7mln 	"#9olp 	"#9qlr 	"#<slt 	"#<ulv 	"#8wlx 	"#=ylz 	"#N{l| 	"#9}l~ 	"#>l@ 	"#@AlB 	"#=ClF 	 9GlH 	 5IlL 	0MlN 	>OlR 	 ASlV 	 ;WlDrF   r  c                       \ rS rSr\rSrg)ExtKeyUsageSyntaxi  r>   Nr^   r_   r`   ra   r  r   rc   r>   rF   rB   r%  r%        KrF   r%  c                   "    \ rS rSrSSSSS.rSrg)	AccessMethodi  ocsp
ca_issuersr  ca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5r>   Nr   r>   rF   rB   r)  r)    s    $*--	DrF   r)  c                   $    \ rS rSrS\4S\4/rSrg)AccessDescriptioni  access_methodaccess_locationr>   N)r^   r_   r`   ra   r)  rV  r   rc   r>   rF   rB   r.  r.    s    	,'	K(GrF   r.  c                       \ rS rSr\rSrg)AuthorityInfoAccessSyntaxi  r>   Nr^   r_   r`   ra   r.  r   rc   r>   rF   rB   r2  r2    r  rF   r2  c                       \ rS rSr\rSrg)SubjectInfoAccessSyntaxi  r>   Nr3  r>   rF   rB   r5  r5    r  rF   r5  c                       \ rS rSr\rSrg)Featuresi  r>   Nr  r>   rF   rB   r7  r7    r  rF   r7  c                   $    \ rS rSrS\4S\4/rSrg)EntrustVersionInfoi  entrust_versentrust_info_flagsr>   N)r^   r_   r`   ra   r   r   r   rc   r>   rF   rB   r9  r9    s    	'	y)GrF   r9  c            	       *    \ rS rSrSSSSSSSS	S
.rSrg)NetscapeCertificateTypei  
ssl_client
ssl_serveremailobject_signingreservedssl_caemail_caobject_signing_ca)r   r	   r   r   r   r   r   r   r>   Nr   r>   rF   rB   r=  r=    s!    	DrF   r=  c                        \ rS rSrSSSS.rSrg)Versioni%  v1v2v3r   r	   r   r>   Nr   r>   rF   rB   rG  rG  %  s    DrF   rG  c                   *    \ rS rSrS\4S\4S\4/rSrg)TPMSpecificationi-  r   levelrevisionr>   N)r^   r_   r`   ra   r.   r   r   rc   r>   rF   rB   rM  rM  -  s!    	:	'	WGrF   rM  c                       \ rS rSr\rSrg)SetOfTPMSpecificationi5  r>   N)r^   r_   r`   ra   rM  r   rc   r>   rF   rB   rQ  rQ  5  s    "KrF   rQ  c                   *    \ rS rSrS\4S\4S\4/rSrg)TCGSpecificationVersioni9  major_versionminor_versionrO  r>   Nr  r>   rF   rB   rS  rS  9  s!    	'"	'"	WGrF   rS  c                   $    \ rS rSrS\4S\4/rSrg)TCGPlatformSpecificationiA  versionplatform_classr>   N)r^   r_   r`   ra   rS  r$   r   rc   r>   rF   rB   rW  rW  A  s    	+,	;'GrF   rW  c                       \ rS rSr\rSrg)SetOfTCGPlatformSpecificationiH  r>   N)r^   r_   r`   ra   rW  r   rc   r>   rF   rB   r[  r[  H  s    *KrF   r[  c                   "    \ rS rSrSSSSS.rSrg)	EKGenerationTypeiL  internalinjectedinternal_revocableinjected_revocable)r   r	   r   r   r>   Nr   r>   rF   rB   r]  r]  L  s    	DrF   r]  c                        \ rS rSrSSSS.rSrg)EKGenerationLocationiU  r  r  ek_cert_signerrK  r>   Nr   r>   rF   rB   rc  rc  U      "DrF   rc  c                        \ rS rSrSSSS.rSrg)EKCertificateGenerationLocationi]  r  r  rd  rK  r>   Nr   r>   rF   rB   rg  rg  ]  re  rF   rg  c                   (    \ rS rSrSSSSSSSS	.rS
rg)EvaluationAssuranceLevelie  level1level2level3level4level5level6level7)r	   r   r   r   r   r   r   r>   Nr   r>   rF   rB   ri  ri  e  s    DrF   ri  c                        \ rS rSrSSSS.rSrg)EvaluationStatusiq  designed_to_meetevaluation_in_progressevaluation_completedrK  r>   Nr   r>   rF   rB   rr  rr  q  s    #!DrF   rr  c                        \ rS rSrSSSS.rSrg)StrengthOfFunctioniy  basicmediumhighrK  r>   Nr   r>   rF   rB   rw  rw  y  s    DrF   rw  c                   6    \ rS rSrS\4S\SS04S\SS04/rSrg)	URIReferencei  r]  hash_algorithmr   T
hash_valuer>   N)	r^   r_   r`   ra   r   r   r   r   rc   r>   rF   rB   r|  r|    s/    	&	2	?Z,>?	y:t"45GrF   r|  c                   |    \ rS rSrS\4S\4S\4S\SS04S\S	S
S.4S\	SS
S.4S\
SS
S.4S\	SS
S.4S\
SS
S.4/	rSrg)CommonCriteriaMeasuresi  rX  assurance_levelevaluation_statusplusro  Fstrengh_of_functionr   Tr   profile_oidr	   profile_urlr   
target_oidr   
target_urir   r>   N)r^   r_   r`   ra   r   ri  rr  r   rw  r"   r|  r   rc   r>   rF   rB   r  r    s    	I	45	./	9e,-	 2PT4UV	(qd*KL	1$&GH	'aT)JK	|!%FG
GrF   r  c                   "    \ rS rSrSSSSS.rSrg)	SecurityLeveli  rj  rk  rl  rm  )r	   r   r   r   r>   Nr   r>   rF   rB   r  r    s    	DrF   r  c                   0    \ rS rSrS\4S\4S\SS04/rSrg)		FIPSLeveli  rX  rN  r  ro  Fr>   N)	r^   r_   r`   ra   r   r  r   r   rc   r>   rF   rB   r  r    s(    	I	- 	9e,-GrF   r  c                       \ rS rSrS\SS04S\SS04S\SS	S
.4S\SS	S
.4S\SS	S
.4S\	SS	S
.4S\
SS	S
.4S\SSS.4S\SS	04/	rSrg)TPMSecurityAssertionsi  rX  ro  rH  field_upgradableFek_generation_typer   Tr   ek_generation_locationr	   "ek_certificate_generation_locationr   cc_infor   
fips_levelr   iso_9000_certifiedr   r  iso_9000_urir   r>   N)r^   r_   r`   ra   rG  r   r]  rc  rg  r  r  r   r   rc   r>   rF   rB   r  r    s    	Gi./	Wy%&89	/aT1RS	!#7aUY9Z[	-/N]^lpPqr	*,MN	yqd"CD	wQ5(IJ	Z$67
GrF   r  c                       \ rS rSr\rSrg)SetOfTPMSecurityAssertionsi  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r    s    'KrF   r  c                   .    \ rS rSrSSSSSSSS	S
SS.
rSrg)SubjectDirectoryAttributeIdi  supported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth
pda_genderpda_country_of_citizenshippda_country_of_residenceentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29r>   Nr   r>   rF   rB   r  r    s)     +,5201)97"5DrF   r  c                       \ rS rSr\rSrg)SetOfGeneralizedTimei  r>   N)r^   r_   r`   ra   r   r   rc   r>   rF   rB   r  r    r  rF   r  c                       \ rS rSr\rSrg)SetOfDirectoryStringi  r>   N)r^   r_   r`   ra   r   r   rc   r>   rF   rB   r  r    r  rF   r  c                       \ rS rSr\rSrg)SetOfPrintableStringi  r>   Nr  r>   rF   rB   r  r    r  rF   r  c                   :    \ rS rSrS\4S\SSS.4S\SSS.4/rS	rg
)SupportedAlgorithmi  algorithm_identifierintended_usager   Tr  intended_certificate_policiesr	   r>   N)	r^   r_   r`   ra   r   r   r  r   rc   r>   rF   rB   r  r    s2    	!78	8!%FG	(*=A[_?`aGrF   r  c                       \ rS rSr\rSrg)SetOfSupportedAlgorithmi  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r    rK  rF   r  c            
       N    \ rS rSrS\4S\4/rSr\\	\
\\\\\\S.	rS rS\0rSrg)	SubjectDirectoryAttributei  r   r   )r   r   )	r  r  r  r  r  r  r  r  r  c                 h    U S   R                   nXR                  ;   a  U R                  U   $ [        $ )Nr   )rn   r^  r*   )r@   type_s     rB   _values_spec&SubjectDirectoryAttribute._values_spec  s/    V##OO#??5))rF   r>   N)r^   r_   r`   ra   r  r   r   r]  r  rQ  r[  r  r  r  r  r^  r  _spec_callbacksrc   r>   rF   rB   r  r    sU    	,-	3G
 #I 72&C#=12*&:$8
J 	,OrF   r  c                       \ rS rSr\rSrg)SubjectDirectoryAttributesi  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r    s    +KrF   r  c            	           \ rS rSr0 SS_SS_SS_SS	_S
S_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_S S!_S"S#_S$S%S&S'S(S)S*S+.ErS,rg-).ExtensionIdi  z2.5.29.9subject_directory_attributesz	2.5.29.14rs  z	2.5.29.15	key_usagez	2.5.29.16private_key_usage_periodz	2.5.29.17subject_alt_namez	2.5.29.18issuer_alt_namez	2.5.29.19basic_constraintsz	2.5.29.30name_constraintsz	2.5.29.31crl_distribution_pointsz	2.5.29.32certificate_policiesz	2.5.29.33policy_mappingsz	2.5.29.35authority_key_identifierz	2.5.29.36policy_constraintsz	2.5.29.37extended_key_usagez	2.5.29.46freshest_crlz	2.5.29.54inhibit_any_policyz1.3.6.1.5.5.7.1.1authority_information_accesssubject_information_accesstls_featureocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_listmicrosoft_enroll_certtype)z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2z1.3.6.1.4.1.311.20.2r>   Nr   r>   rF   rB   r  r    s    2% 	[ 	/	
 	' 	& 	( 	' 	. 	+ 	& 	/ 	) 	) 	^  	)!" 	;#$ ;+ /!<!<#F ;7DrF   r  c            	           \ rS rSrS\4S\SS04S\4/rSr0 S\	_S	\
_S
\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_S\_\\\\\\
\S.ErSrg)	Extensioni'  extn_idcriticalro  F
extn_value)r  r  r  rs  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  )r  r  r  r  r  r  r  r>   N) r^   r_   r`   ra   r  r   r%   r   r]  r  r$   r   r   re  rm  r  r  r  r  rr  r  r%  r   r2  r5  r7  r    r9  r=  r   r^  rc   r>   rF   rB   r  r  '  s'   	K 	Wy%01	*+G *I&(B+ 	X 	#$9	
 	L 	< 	- 	O 	"#8 	 3 	> 	#$: 	/ 	/ 	-  	g!" 	'(A#$ '>%7%<-8 &/5JrF   r  c                       \ rS rSr\rSrg)
ExtensionsiM  r>   N)r^   r_   r`   ra   r  r   rc   r>   rF   rB   r  r  M  r   rF   r  c                   t    \ rS rSrS\SSS.4S\4S\4S\4S	\4S
\4S\	4S\
SSS.4S\
SSS.4S\SSS.4/
rSrg)TbsCertificateiQ  rX  r   rH  )r  ro  r   	signatureissuervaliditysubjectsubject_public_key_infoissuer_unique_idr	   Tr   subject_unique_idr   
extensionsr   r  r>   N)r^   r_   r`   ra   rG  r   r   r.  rk  r1   r#   r  r   rc   r>   rF   rB   r  r  Q  sv    	G!=>	'"	+,	4	X	D	"M2	^!-NO	n1$.OP	zt#DEGrF   r  c                      \ rS rSrS\4S\4S\4/rSrSr	Sr
SrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSr Sr!Sr"Sr#Sr$Sr%Sr&Sr'S r(\)S 5       r*\)S	 5       r+\)S
 5       r,\)S 5       r-\)S 5       r.\)S 5       r/\)S 5       r0\)S 5       r1\)S 5       r2\)S 5       r3\)S 5       r4\)S 5       r5\)S 5       r6\)S 5       r7\)S 5       r8\)S 5       r9\)S 5       r:\)S 5       r;\)S 5       r<\)S 5       r=\)S 5       r>\)S 5       r?\)S 5       r@\)S 5       rA\)S  5       rB\)S! 5       rC\)S" 5       rD\)S# 5       rE\)S$ 5       rF\)S% 5       rG\)S& 5       rH\)S' 5       rI\)S( 5       rJ\)S) 5       rK\)S* 5       rL\)S+ 5       rMS, rN\)S- 5       rO\)S. 5       rP\)S/ 5       rQ\)S0 5       rR\)S1 5       rS\)S2 5       rT\)S3 5       rU\)S4 5       rV\)S5 5       rW\)S6 5       rX\)S7 5       rYS8 rZS9 r[S: r\S;r]g)<Certificatei`  tbs_certificatesignature_algorithmsignature_valueFNc                 *   [        5       U l        U S   S    Hq  nUS   R                  nSU-  n[        X5      (       a  [	        XUS   R
                  5        US   R                  (       d  MV  U R                  R                  U5        Ms     SU l        g)	z^
Sets common named extensions to private attributes and creates a list
of critical extensions
r  r  r  z	_%s_valuer  r  TN)r[   _critical_extensionsrn   hasattrsetattrparsedadd_processed_extensions)r@   	extensionr
  r  s       rB   _set_extensionsCertificate._set_extensions  s     %(E!/0>IY'..D(4/Nt,,i.E.L.LM$+++))--d3 ? &*"rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
Returns a set of the names (or OID if not a known extension) of the
extensions marked as critical

:return:
    A set of unicode strings
)r  r  r  ru   s    rB   critical_extensionsCertificate.critical_extensions  s%     ))  "(((rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to constrain the period over which the subject
private key may be used

:return:
    None or a PrivateKeyUsagePeriod object
)r  r  _private_key_usage_period_valueru   s    rB   private_key_usage_period_value*Certificate.private_key_usage_period_value  %     ))  "333rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to contain additional identification attributes
about the subject.

:return:
    None or a SubjectDirectoryAttributes object
)r  r  #_subject_directory_attributes_valueru   s    rB   "subject_directory_attributes_value.Certificate.subject_directory_attributes_value  %     ))  "777rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to help in creating certificate validation paths.
It contains an identifier that should generally, but is not guaranteed
to, be unique.

:return:
    None or an OctetString object
)r  r  _key_identifier_valueru   s    rB   key_identifier_value Certificate.key_identifier_value  s%     ))  ")))rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to define the purpose of the public key
contained within the certificate.

:return:
    None or a KeyUsage
)r  r  _key_usage_valueru   s    rB   key_usage_valueCertificate.key_usage_value  s%     ))  "$$$rF   c                 \    U R                   (       d  U R                  5         U R                  $ )a  
This extension allows for additional names to be associate with the
subject of the certificate. While it may contain a whole host of
possible names, it is usually used to allow certificates to be used
with multiple different domain names.

:return:
    None or a GeneralNames object
)r  r  _subject_alt_name_valueru   s    rB   subject_alt_name_value"Certificate.subject_alt_name_value  s%     ))  "+++rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension allows associating one or more alternative names with
the issuer of the certificate.

:return:
    None or an x509.GeneralNames object
)r  r  _issuer_alt_name_valueru   s    rB   issuer_alt_name_value!Certificate.issuer_alt_name_value  s%     ))  "***rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to determine if the subject of the certificate
is a CA, and if so, what the maximum number of intermediate CA certs
after this are, before an end-entity certificate is found.

:return:
    None or a BasicConstraints object
)r  r  _basic_constraints_valueru   s    rB   basic_constraints_value#Certificate.basic_constraints_value  s%     ))  ",,,rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used in CA certificates, and is used to limit the
possible names of certificates issued.

:return:
    None or a NameConstraints object
)r  r  _name_constraints_valueru   s    rB   name_constraints_value"Certificate.name_constraints_value	  s%     ))  "+++rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to help in locating the CRL for this certificate.

:return:
    None or a CRLDistributionPoints object
    extension
)r  r  _crl_distribution_points_valueru   s    rB   crl_distribution_points_value)Certificate.crl_distribution_points_value	  s%     ))  "222rF   c                 \    U R                   (       d  U R                  5         U R                  $ )a  
This extension defines policies in CA certificates under which
certificates may be issued. In end-entity certificates, the inclusion
of a policy indicates the issuance of the certificate follows the
policy.

:return:
    None or a CertificatePolicies object
)r  r  _certificate_policies_valueru   s    rB   certificate_policies_value&Certificate.certificate_policies_value*	  s%     ))  "///rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension allows mapping policy OIDs to other OIDs. This is used
to allow different policies to be treated as equivalent in the process
of validation.

:return:
    None or a PolicyMappings object
)r  r  _policy_mappings_valueru   s    rB   policy_mappings_value!Certificate.policy_mappings_value:	  s%     ))  "***rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension helps in identifying the public key with which to
validate the authenticity of the certificate.

:return:
    None or an AuthorityKeyIdentifier object
)r  r  _authority_key_identifier_valueru   s    rB   authority_key_identifier_value*Certificate.authority_key_identifier_valueI	  r  rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to control if policy mapping is allowed and
when policies are required.

:return:
    None or a PolicyConstraints object
)r  r  _policy_constraints_valueru   s    rB   policy_constraints_value$Certificate.policy_constraints_valueW	  %     ))  "---rF   c                 \    U R                   (       d  U R                  5         U R                  $ )zv
This extension is used to help locate any available delta CRLs

:return:
    None or an CRLDistributionPoints object
)r  r  _freshest_crl_valueru   s    rB   freshest_crl_valueCertificate.freshest_crl_valuee	  s%     ))  "'''rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z}
This extension is used to prevent mapping of the any policy to
specific requirements

:return:
    None or a Integer object
)r  r  _inhibit_any_policy_valueru   s    rB   inhibit_any_policy_value$Certificate.inhibit_any_policy_valuer	  r-  rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to define additional purposes for the public key
beyond what is contained in the basic constraints.

:return:
    None or an ExtKeyUsageSyntax object
)r  r  _extended_key_usage_valueru   s    rB   extended_key_usage_value$Certificate.extended_key_usage_value	  r-  rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to locate the CA certificate used to sign this
certificate, or the OCSP responder for this certificate.

:return:
    None or an AuthorityInfoAccessSyntax object
)r  r  #_authority_information_access_valueru   s    rB   "authority_information_access_value.Certificate.authority_information_access_value	  r   rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to access information about the subject of this
certificate.

:return:
    None or a SubjectInfoAccessSyntax object
)r  r  !_subject_information_access_valueru   s    rB    subject_information_access_value,Certificate.subject_information_access_value	  s%     ))  "555rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used to list the TLS features a server must respond
with if a client initiates a request supporting them.

:return:
    None or a Features object
)r  r  _tls_feature_valueru   s    rB   tls_feature_valueCertificate.tls_feature_value	  s%     ))  "&&&rF   c                 \    U R                   (       d  U R                  5         U R                  $ )z
This extension is used on certificates of OCSP responders, indicating
that revocation information for the certificate should never need to
be verified, thus preventing possible loops in path validation.

:return:
    None or a Null object (if present)
)r  r  _ocsp_no_check_valueru   s    rB   ocsp_no_check_valueCertificate.ocsp_no_check_value	  s%     ))  "(((rF   c                      U S   R                   $ )z-
:return:
    A byte string of the signature
r  rn   ru   s    rB   r  Certificate.signature	  s     %&---rF   c                      U S   R                   $ )zR
:return:
    A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
r  )signature_algoru   s    rB   rN  Certificate.signature_algo	  s     )*999rF   c                      U S   R                   $ )z
:return:
    A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
    "sha384", "sha512", "sha512_224", "sha512_256"
r  )	hash_algoru   s    rB   rQ  Certificate.hash_algo	  s     )*444rF   c                     U S   S   $ )z<
:return:
    The PublicKeyInfo object for this certificate
r  r  r>   ru   s    rB   
public_keyCertificate.public_key	  s     %&'@AArF   c                     U S   S   $ )zB
:return:
    The Name object for the subject of this certificate
r  r  r>   ru   s    rB   r  Certificate.subject	  s     %&y11rF   c                     U S   S   $ )zA
:return:
    The Name object for the issuer of this certificate
r  r  r>   ru   s    rB   r  Certificate.issuer	  s     %&x00rF   c                 &    U S   S   R                   $ )z<
:return:
    An integer of the certificate's serial number
r  r   rK  ru   s    rB   r   Certificate.serial_number	  s     %&7>>>rF   c                 R    U R                   (       d  gU R                   R                  $ )zn
:return:
    None or a byte string of the certificate's key identifier from the
    key identifier extension
N)r  rn   ru   s    rB   rs  Certificate.key_identifier
  s"     ((((///rF   c                     U R                   cC  U R                  R                  S-   [        U R                  5      R                  S5      -   U l         U R                   $ )z
:return:
    A byte string of the SHA-256 hash of the issuer concatenated with
    the ascii character ":", concatenated with the serial number as
    an ascii string
   :r   )_issuer_serialr  r  r   r   rS   ru   s    rB   issuer_serialCertificate.issuer_serial
  sO     &"&++"4"4t";gdFXFX>Y>`>`ah>i"iD"""rF   c                 ,    U S   S   S   R                   $ )zL
:return:
    A datetime of latest time when the certificate is still valid
r  r  r   rK  ru   s    rB   not_valid_afterCertificate.not_valid_after!
  s      %&z2;?FFFrF   c                 ,    U S   S   S   R                   $ )zL
:return:
    A datetime of the earliest time when the certificate is valid
r  r  r   rK  ru   s    rB   not_valid_beforeCertificate.not_valid_before)
  s      %&z2<@GGGrF   c                 X    U R                   (       d  gU R                   S   R                  $ )zj
:return:
    None or a byte string of the key_identifier from the authority key
    identifier extension
Nrs  )r'  rn   ru   s    rB   r  $Certificate.authority_key_identifier1
  s(     22223CDKKKrF   c                    U R                   SL a  U R                  nU(       a  US   R                  (       a  U R                  S   S   R                  nUR	                  5       nU R                  S   R                  nUR
                  S-   [        U5      R                  S5      -   U l         U R                   $ SU l         U R                   $ )a  
:return:
    None or a byte string of the SHA-256 hash of the isser from the
    authority key identifier extension concatenated with the ascii
    character ":", concatenated with the serial number from the
    authority key identifier extension as an ascii string
Frt  r   ru  r_  r   N)_authority_issuer_serialr'  rn   r  untagr  r   rS   )r@   akivr  authority_serials       rB   authority_issuer_serial#Certificate.authority_issuer_serial>
  s     ((E166D45<<<<=TUVWX__#'#F#FGe#f#m#m 060DwO_G`GgGghoGp0p- ,,, 15-,,,rF   c                 t    U R                   c   U R                  U R                  5      U l         U R                   $ )zx
Returns complete CRL URLs - does not include delta CRLs

:return:
    A list of zero or more DistributionPoint objects
)_crl_distribution_points!_get_http_crl_distribution_pointsr  ru   s    rB   r  #Certificate.crl_distribution_pointsT
  s6     ((0,0,R,RSWSuSu,vD),,,rF   c                 t    U R                   c   U R                  U R                  5      U l         U R                   $ )zx
Returns delta CRL URLs - does not include complete CRLs

:return:
    A list of zero or more DistributionPoint objects
)_delta_crl_distribution_pointsrt  r0  ru   s    rB   delta_crl_distribution_points)Certificate.delta_crl_distribution_pointsa
  s6     ..6262X2XY]YpYp2qD/222rF   c                     / nUc  / $ U H[  nUS   nU[         L a  M  UR                  S:X  a  M%  UR                   H&  nUR                  S:X  d  M  UR                  U5        M(     M]     U$ )a  
Fetches the DistributionPoint object for non-relative, HTTP CRLs
referenced by the certificate

:param crl_distribution_points:
    A CRLDistributionPoints object to grab the DistributionPoints from

:return:
    A list of zero or more DistributionPoint objects
r  ry  r]  )r0   r
  r  rh  )r@   r  ri  r  distribution_point_namer  s         rB   rt  -Certificate._get_http_crl_distribution_pointsn
  s{     "*I"9&89M&N#&$.&++/LL 7 > >$$(EEMM"45 !? #: rF   c                 4   U R                   (       d  / $ / nU R                    Hr  nUS   R                  S:X  d  M  US   nUR                  S:w  a  M/  UR                  nUR                  5       R	                  S5      (       d  Ma  UR                  U5        Mt     U$ )zX
:return:
    A list of zero or more unicode strings of the OCSP URLs for this
    cert
r/  r*  r0  r]  r  )r<  rn   r
  rJ   rR   rh  )r@   ri  entrylocationr  s        rB   	ocsp_urlsCertificate.ocsp_urls
  s     66I<<E_%,,6 !23==$AAoo99;))*XYYMM#& = rF   c                 p   U R                   Gc  / U l         U R                  (       ar  U R                   HV  nUR                  S:X  d  M  UR                  U R                   ;  d  M1  U R                   R	                  UR                  5        MX     U R                   $ [
        R                  " S5      nU R                  R                   Hc  nU HZ  nUS   R                  S:X  d  M  US   R                  nUR                  U5      (       d  M?  U R                   R	                  U5        M\     Me     U R                   $ )z
:return:
    A list of unicode strings of valid domain names for the certificate.
    Wildcard certificates will have a domain in the form: *.example.com
rY  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r   r   rY   )
_valid_domainsr  r
  rn   rh  rD  compiler  r  match)r@   r  patternrx  name_type_valuerY   s         rB   valid_domainsCertificate.valid_domains
  s    &"$D
 **$($?$?L#((J6<;N;NVZViVi;i++22<3F3FG %@$ """ **%pq<<..C+.*6299]J$3G$<$C$CE&}}U33 $ 3 3 : :5 A	 ,/ / """rF   c                     U R                   cb  / U l         U R                  (       aJ  U R                   H:  nUR                  S:X  d  M  U R                   R                  UR                  5        M<     U R                   $ )zR
:return:
    A list of unicode strings of valid IP addresses for the certificate
r^  )
_valid_ipsr  r
  rh  rn   )r@   r  s     rB   	valid_ipsCertificate.valid_ips
  sa     ??" DO**$($?$?L#((L8..|/B/BC %@ rF   c                 Z    U R                   =(       a    U R                   S   R                  $ )z?
:return;
    A boolean - if the certificate is marked as a CA
rn  )r  rn   ru   s    rB   rn  Certificate.ca
  s&     ++Y0L0LT0R0Y0YYrF   c                 X    U R                   (       d  gU R                  S   R                  $ )z<
:return;
    None or an integer of the maximum path length
Nrp  )rn  r  rn   ru   s    rB   max_path_lengthCertificate.max_path_length
  s&     ww++,ABIIIrF   c                 p    U R                   c  U R                  U R                  :H  U l         U R                   $ )zX
:return:
    A boolean - if the certificate is self-issued, as defined by RFC
    5280
)_self_issuedr  r  ru   s    rB   self_issuedCertificate.self_issued
  s1     $ $ ;D   rF   c                 6   U R                   c  SU l         U R                  (       ai  U R                  (       aQ  U R                  (       d  SU l         U R                   $ U R                  U R                  :X  a  SU l         U R                   $ SU l         U R                   $ )a  
:return:
    A unicode string of "no" or "maybe". The "maybe" result will
    be returned if the certificate issuer and subject are the same.
    If a key identifier and authority key identifier are present,
    they will need to match otherwise "no" will be returned.

    To verify is a certificate is truly self-signed, the signature
    will need to be verified. See the certvalidator package for
    one possible solution.
nomaybe)_self_signedr  rs  r  ru   s    rB   self_signedCertificate.self_signed
  s     $ $D&&88,3)
    	 66$:M:MM,3)     )0D%   rF   c                     U R                   c7  [        R                  " U R                  5       5      R	                  5       U l         U R                   $ )zS
:return:
    The SHA-1 hash of the DER-encoded bytes of this complete certificate
r  ru   s    rB   r  Certificate.sha1  r  rF   c                 X    SR                  S [        U R                  5       5       5      $ )z
:return:
    A unicode string of the SHA-1 hash, formatted using hex encoding
    with a space between each pair of characters, all uppercase
rB  c              3   ,   #    U  H
  nS U-  v   M     g7fz%02XNr>   r  cs     rB   r  /Certificate.sha1_fingerprint.<locals>.<genexpr>$  s     E,Dq
,D   )rI  r   r  ru   s    rB   sha1_fingerprintCertificate.sha1_fingerprint  s"     xxEM$)),DEEErF   c                     U R                   c7  [        R                  " U R                  5       5      R	                  5       U l         U R                   $ )zY
:return:
    The SHA-256 hash of the DER-encoded bytes of this complete
    certificate
r  ru   s    rB   r  Certificate.sha256&  s7     <<">>$))+6==?DL||rF   c                 X    SR                  S [        U R                  5       5       5      $ )z
:return:
    A unicode string of the SHA-256 hash, formatted using hex encoding
    with a space between each pair of characters, all uppercase
rB  c              3   ,   #    U  H
  nS U-  v   M     g7fr  r>   r  s     rB   r  1Certificate.sha256_fingerprint.<locals>.<genexpr>:  s     G,Fq
,Fr  )rI  r   r  ru   s    rB   sha256_fingerprintCertificate.sha256_fingerprint2  s"     xxGM$++,FGGGrF   c                 >   [        U[        5      (       d  [        [        S[	        U5      5      5      eUR                  S5      R                  S5      R                  5       nUR                  S5      S:g  nU(       + =(       a    [        R                  " SU5      nU(       + =(       a    U(       + nU(       a  U R                  (       d  gUR                  S5      nU R                   H  nUR                  S5      R                  S5      R                  5       nUR                  S5      n	[        U	5      [        U5      :w  a  M\  X:X  a    g	U R                  U5      n
U
(       d  M}  U R                  Xi5      (       d  M    g	   gU R                   (       d  gU(       a  ["        R$                  O["        R&                  n[)        X5      nU R                    HJ  nUR                  S5      S:w  a  ["        R$                  O["        R&                  n[)        X5      nX:X  d  MJ    g	   g)
z
Check if a domain name or IP address is valid according to the
certificate

:param domain_ip:
    A unicode string of a domain name or IP address

:return:
    A boolean - if the domain or IP is valid for the certificate
zL
                domain_ip must be a unicode string, not %s
                r   r   r   r   z^\d+\.\d+\.\d+\.\d+$FrO   T)rH   r   rQ   r
   r   rS   r   rJ   r   rD  r  r  r   r   _is_wildcard_domain_is_wildcard_matchr  r   r   r   r5   )r@   	domain_ipencoded_domain_ipis_ipv6is_ipv4	is_domaindomain_labelsvalid_domainencoded_valid_domainvalid_domain_labelsis_wildcardr   normalized_ipvalid_ipvalid_familynormalized_valid_ips                   rB   is_valid_domain_ipCertificate.is_valid_domain_ip<  s    )W--F )$	   &,,V4;;GDJJL#((-3+\"((+HJ["\K/K	 %%-33C8M $ 2 2'3':':6'B'I'I''R'X'X'Z$&:&@&@&E# *+s=/AA&7"667KL;4#:#:=#^#^ !3  ~~#*!&<H-5]]3-?2-E6>>6??L"+L"C"3 ' rF   c                     UR                  S5      S:w  a  gUR                  5       R                  S5      nU(       d  gUS   R                  S5      S:X  a  gUS   SS S:X  a  gg	)
a&  
Checks if a domain is a valid wildcard according to
https://tools.ietf.org/html/rfc6125#section-6.4.3

:param domain:
    A unicode string of the domain name, where any U-labels from an IDN
    have been converted to A-labels

:return:
    A boolean - if the domain is a valid wildcard domain
*r	   FrO   r   r   r   zxn--T)countrJ   r   r   )r@   domainlabelss      rB   r  Certificate._is_wildcard_domain~  sh     <<!%%c* !9>>#"$ !9Qq>V#rF   c                     US   nUSS nUS   nUSS nXF:w  a  gUS:X  a  g[         R                  " SUR                  SS5      -   S	-   5      nUR                  U5      (       a  gg)
a  
Determines if the labels in a domain are a match for labels from a
wildcard valid domain name

:param domain_labels:
    A list of unicode strings, with A-label form for IDNs, of the labels
    in the domain name to check

:param valid_domain_labels:
    A list of unicode strings, with A-label form for IDNs, of the labels
    in a wildcard domain pattern

:return:
    A boolean - if the domain matches the valid domain
r   r	   NFr  T^z.*$)rD  r  rH  r  )r@   r  r  first_domain_labelother_domain_labelswildcard_labelother_valid_domain_labelswildcard_regexs           rB   r  Certificate._is_wildcard_match  s    " +1-+AB/,Q/$7$;! ;S C.*@*@d*K$Kc$QR 233rF   )rl  r  rs  rw  r`  r  r  r  r  r  r  r  )^r^   r_   r`   ra   r  r   r#   r   r  r  r  r  r  r
  r  r  r  r  r  r"  r&  r*  r/  r3  r7  r;  r?  r  rC  rG  r`  rl  rs  rw  r  r  r  r  r  r  r  r   r  r  r  r  r  r  r  r  r  r  r  r#  r'  r+  r0  r4  r8  r<  r@  rD  rH  r  rN  rQ  rT  r  r  r   rs  ra  rd  rg  r  rp  r  rx  rt  r  r  r  rn  r  r  r  r  r  r  r  r  r  r  rc   r>   rF   rB   r  r  `  s   	N+	 56	N+G "*.' "!#"%)""&!&*# $ $ $*.'(,%&*#N$#%)"NJLLEG*$ ) ) 4 4 8 8 * * % % , , + + - - , , 3 3 0 0 + + 4 4 . . 
( 
( . . . . 8 8 6 6 ' ' ) ) . . : : 5 5 B B 2 2 1 1 ? ? 
0 
0 
# 
# G G H H 
L 
L - -* 
- 
- 
3 
3>  *  #  #D    Z Z J J 	! 	! ! !2   F F 	 	 H H@DB#rF   r  c                       \ rS rSr\rSrg)KeyPurposeIdentifiersi  r>   Nr&  r>   rF   rB   r  r    r'  rF   r  c                       \ rS rSr\rSrg)SequenceOfAlgorithmIdentifiersi  r>   N)r^   r_   r`   ra   r   r   rc   r>   rF   rB   r  r    r  rF   r  c            	       X    \ rS rSrS\SS04S\SSS.4S\SS04S	\SS04S
\SSS.4/rSr	g)CertificateAuxi  trustr   Trejectr   r   aliaskeyidrA   r	   r>   N)
r^   r_   r`   ra   r  r.   r$   r  r   rc   r>   rF   rB   r  r    sW    	'*d);<	(qd*KL	*z401	+
D12	0qd2STGrF   r  c                       \ rS rSr\\/rSrg)TrustedCertificatei  r>   N)r^   r_   r`   ra   r  r  _child_specsrc   r>   rF   rB   r  r    s    0LrF   r  )r   
__future__r   r   r   r   
contextlibr   	encodingsr   r  rD  r   rJ  rF  rL  _errorsr
   _irir   r   _ordereddictr   _typesr   r   r   algosr   r   r   r   corer   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   rg  r1   utilr2   r3   r4   r5   r7   re   rx   r   r   r   r   r   r   r   r   r   r6  r`  r  r.  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r	  r  r  r  r  r  r$  rF  rJ  rM  rR  rV  re  rg  rk  rm  rr  rw  r{  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r%  r)  r.  r2  r5  r7  r9  r=  rG  rM  rQ  rS  rW  r[  r]  rc  rg  ri  rr  rw  r|  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r>   rF   rB   <module>r     s   S R %   	   
   ( % 5 5 f f       <   D D2 i 2 j6) 6rn9 nbB5 B5J  y H ] 0 = =	f 	Q( Q(h~x ~BR Rj'* 'T@6 @F( & v  3 # "j " Z   H 0Z 0H 0Z 0&  3 "z "s 8  ( V 7 W 8 D%* % 8 /+& /+d: 6 x x X F ) X !j !h " "J$J $& J h  ( 
( 
&: &'  $* $H  Z   m# m`
 #  $
 $$j $
z  
i 
g x #E #h x +E +z : j 	z 	z  8 X J  H ( ("2 &"5 ""5 ""5 " %e % <, ," @# #L X b( bRJ &Z &X 1 1rF   