o .jY@sfUdZddlmZddlZddlZddlmZddlmZddl m Z m Z ddl m Z mZdd l mZdd lmZdd lmZmZe ridd l mZmZmZdd lmZed ZedddZGdddeeefZdZded<gZ ded<eZ!dZ"ded<e"a#ded<d8d d!Z$d9d$d%Z%e$d:d;d)d*Ze$d:dd2d3Z(d:d?d5d6Z)d7Z*dS)@z the Wassima library is a simple library. It aims to provide a pythonic way to retrieve root CAs from your system without any difficulties or hazmat. ) annotationsN)wraps)RLock) TYPE_CHECKINGAny)IS_BSDIS_LINUX)root_der_certificates)VERSION __version__)CallableProtocolTypeVar) ParamSpec_P_RT) covariantc@s eZdZd ddZdd d Zd S) _CachedFuncargs_P.argskwargs _P.kwargsreturnrcOdSN)selfrrrrE/home/thesage/.local/lib/python3.10/site-packages/wassima/__init__.py__call__!z_CachedFunc.__call__NonecCrrr)rrrr cache_clear"r z_CachedFunc.cache_clearN)rrrrrrrr!)__name__ __module__ __qualname__rr"rrrrr s rzECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305strMOZ_INTERMEDIATE_CIPHERS list[bytes]_MANUALLY_REGISTERED_CAiintDEFAULT_CACHE_TTL_SECONDS_CACHE_TTL_SECONDSfuncCallable[_P, _R]r_CachedFunc[_P, _R]csRtiddittd fdd }dfd d }||_|S)zEA minimal, thread-safe memorizing decorator with a per-call-site TTL. expires_atrrrrcs|r |tt|fn|}3t}|dkr%|td<|}|ur:|i|}||<|WdS1sFwYdS)Nr1)tuplesorteditemstime monotonicclearr-get)rrkeynowresultcacher.locksentinelstaterrwrapper?s   $z_ttl_lru_cache..wrapperr!cs:dd<WddS1swYdS)Nr2r1)r8r)r>r?rArrr"Ms "z#_ttl_lru_cache..cache_clearN)rrrrrrr#)objectrrr")r.rBr"rr=r_ttl_lru_cache8s rDsecondsr!cCsDt|tr t|trtd|dkrtd|attdS)zOverride the default cache TTL (in seconds) used by :func:`root_der_certificates` and :func:`root_pem_certificates`. A value of ``0`` disables caching entirely (each call recomputes). Any pending cached result is dropped immediately. z"cache TTL must be an int (seconds)rzcache TTL cannot be negativeN) isinstancer+bool TypeError ValueErrorr-r r"root_pem_certificates)rErrr set_cache_ttlVs rKF hybrid_storerGcCst}|}ts trddlm}|rd}|st}n|r8t|}t|}tD]}||vr7||| |q't t }|rUt|}|D]}||vrT||| |qD|S)aFRetrieve a list of root certificates from your operating system trust store, DER (binary) encoded. When ``hybrid_store`` is ``True``, the embedded CCADB Mozilla bundle is forcibly merged in addition to the OS trusted CAs. This is also implicitly enabled on Linux/BSD when the system trust store appears to be stale (older than 3 years without update). The OS-specific backends already guarantee a duplicate-free list; this function only re-deduplicates when extra sources (CCADB fallback, hybrid bundle, user-registered CAs) are merged on top. r)is_trust_store_staleT) _root_der_certificatesr r _os._linuxrMfallback_der_certificatessetlistaddappendr3r*)rL certificates force_hybridrMseencertmanually_registeredrrrr gs2      r list[str]cCs(g}t|dD] }|t|q|S)z Retrieve a list of root certificate from your operating system trust store. They will be PEM encoded. See :func:`root_der_certificates` for the meaning of ``hybrid_store``. rL)r rTsslDER_cert_to_PEM_cert)rL pem_certsbin_certrrrrJsrJcCsdt|dS)z Generate an aggregated CA bundle that originate from your system trust store. Simply put, concatenated root PEM certificate. See :func:`root_der_certificates` for the meaning of ``hybrid_store``. z r[)joinrJr[rrrgenerate_ca_bundlesrapem_or_der_certificate bytes | strcCspt,t|tr t|}|tvr&t|tt WddSWddS1s1wYdS)zZ You may register your own CA certificate in addition to your system trust store. N) _USER_APPEND_CA_LOCKrFr'r\PEM_cert_to_DER_certr*rTrJr"r )rbrrr register_cas    "rfssl.SSLContextcCszttj}|jt|ddtjj|_|t tj |_ zd|_ Wn t y+Ynwzd|_W|St y<Y|Sw)a Instantiate a native SSLContext (client purposes) that ships with your system root CAs. In addition to that, assign it the default OpenSSL ciphers suite and set TLS 1.2 as the minimum supported version. Also disable commonName check and enforce hostname altName verification. The Mozilla Recommended Cipher Suite is used instead of system default. See :func:`root_der_certificates` for the meaning of ``hybrid_store``. r[)cadataFT)r\ SSLContextPROTOCOL_TLS_CLIENTload_verify_locationsra TLSVersionTLSv1_2minimum_version set_ciphersr( CERT_REQUIRED verify_modehostname_checks_common_nameAttributeErrorcheck_hostname)rLctxrrrcreate_default_ssl_contexts"      rv) r rJrarvrfrKr,r r )r.r/rr0)rEr+rr!)F)rLrGrr))rLrGrrZ)rLrGrr')rbrcrr!)rLrGrrg)+__doc__ __future__rr\r6 functoolsr threadingrtypingrr_osrr r rN _os._embedrP_versionr r r rrtyping_extensionsrrrrr(__annotations__r*rdr,r-rDrKrJrarfrv__all__rrrrs@             0