+
    #Si#,                    d   R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIHt ^ RI	H
t
 ^ RIHt ^ RIHt ^ RIHtHt ^ RIHt ^ R	IHt ^ R
IHt ^ RIHtHt ^ RIHt ^RIHtHt ^RI H!t!H"t"H#t# ^RI$H%t% ^RI&H't' ]'       d   ^ RIH(t( ]
! ])4      t*]PV                  ! R4      t, ! R R4      t-]-! 4       t.R# )a'  Signature verification for conda packages.

This module provides the signature verification functionality that integrates
with conda's post-solve hook system to verify package signatures during
installation.

Note: This module was migrated from conda.trust.signature_verification in conda 26.3.
)annotationsN)cached_property)	getLogger)Path)TYPE_CHECKING)CONDA_PACKAGE_EXTENSION_V1CONDA_PACKAGE_EXTENSION_V2)context)join_url)
SubdirData)	HTTPErrorInsecureRequestWarning)get_session)verify_delegationverify_root)SignatureErrorload_metadata_from_filewrite_metadata_to_file)KEY_MGR_FILE)wrap_as_signable)Anyz(?P<number>\d+)\.root\.jsonc                      ] tR t^.tRt]R R l4       t]R R l4       t]R R l4       tRR	 R
 llt	R R lt
R R ltR R ltRtR# )_SignatureVerificationzSignature verification for conda packages.

This class provides caching signature verification that checks package
metadata signatures against the trusted root and key manager metadata.
c                   V ^8  d   QhRR/# )   returnbool )formats   "@lib/python3.14/site-packages/conda_content_trust/verification.py__annotate__#_SignatureVerification.__annotate__6   s           c                	x   \         P                  '       g   R # \         P                  '       g   \        P	                  R4       R # \        \         P                  4      P                  RRR7       V P                  f   \        P	                  R4       R # V P                  f   \        P	                  R4       R # R# )FzWmetadata signature verification requested, but no metadata URL base has been specified.T)parentsexist_okzDcould not find trusted_root data for metadata signature verificationz?could not find key_mgr data for metadata signature verification)
r	   extra_safety_checkssigning_metadata_url_baselogwarningr   av_data_dirmkdirtrusted_rootkey_mgr)selfs   &r   enabled_SignatureVerification.enabled5   s     *** 000KK?  	W  !''t'D $KKV  <<KKQ  r"   c                   V ^8  d   QhRR/# r   r   zdict | Noner   )r   s   "r   r    r!   X   s     A Ak Ar"   c                	(   R p \         P                  ! \        P                  4       Uu/ uFG  p\        P                  VP                  4      ;p'       g   K,  \        VP                  R4      4      VbKI  	  pp\        VP                  4       RR7       F*  w  rR\        P                  RV R24        \        V4      p M	   V'       g*   \        P%                  R\        P                   R24       R #  VR,          R	,          ^,            R
2p\'        \        P                  V4      p V P)                  \        P*                  V4      p\-        W4       \/        T;q4       Kp  u upi   \        \        \         3 d     K  i ; i  \        \"        \         3 d     Li ; i  \0         d<   p	T	P2                  P4                  R8w  d   \        P7                  T	4        R p	?	T# R p	?	i\8         d!   p	\        P7                  T	4        R p	?	T# R p	?	ii ; i)NnumberT)reversezLoading root metadata from .zNo root metadata found in zE. Install conda-anaconda-trust-root to enable signature verification.signedversionz
.root.jsoni  )osscandirr	   r*   RE_ROOT_METADATAmatchnameintgroupsorteditemsr(   infor   IsADirectoryErrorFileNotFoundErrorPermissionErrorNotADirectoryErrordebugr   _fetch_channel_signing_datar'   r   r   r   responsestatus_codeerror	Exception)
r.   trustedentrympaths_fnamepath	untrustederrs
   &         r   r,   #_SignatureVerification.trusted_rootW   s     $	  ZZ(;(;<<E)//

;;A; .AGGH%&-<   #5;;=$?6ugQ?@5e<G  @ II,W-@-@,A BV V  x(3a78
CE++U3DC <<55	
 G/ ')';wBs *+<oN  	 "#5G 	 		P   <<++s2IIcN   		#
 sd   &F )E$E$7F 3E)*+F" $F )FFFF"H-0G##H0H1HHc                   V ^8  d   QhRR/# r2   r   )r   s   "r   r    r!      s       r"   c                	P   R p\         p\        \        P                  V4      p V P	                  \        P
                  V4      p\        RW@P                  4       \        T;q4       V'       g"   VP%                  4       '       d   \'        V4      pV#   \         d    p\        P                  T4        R p?LPR p?i\         da   p\        P                  \        T4      ;'       g1    TP                  P                   RTP                   P"                   R24        R p?LR p?ii ; i)Nr-   z ())r   r   r	   r*   rH   r'   r   r,   r   ConnectionErrorr(   r)   r   str	__class____name__rI   rJ   existsr   )r.   rM   rR   rS   rT   rU   s   &     r   r-   _SignatureVerification.key_mgr   s    # G''/	?8811I
 i4E4EF #i#77> 4;;==-d3G!  	KK 	 KKCTTs}}556b9Q9Q8RRST 	s*   6B D%B77D%D%AD  D%Nc               $    V ^8  d   QhRRRRRR/# )r   signing_data_urlr[   filenamer   dictr   )r   s   "r   r    r!      s$     8 8 #8/28	8r"   c           	     	`   \        V4      p\        P                  pV'       g   \        P                  ! R \
        4       RRRR/pV'       d   W7R&   V'       d   WGR&   \        W4      p\        P                  p	R\        n         \        P                  \        P                  3p
VP                  VV\        VRR	4      R	V
VR
7      pVP                  4        V	\        n         VP                  4       #   T	\        n        i ; i  \        P                   d   p\        RT RT 24      hR	p?ii ; i)ignorezAccept-Encodingz!gzip, deflate, compress, identityzContent-Typezapplication/jsonzIf-None-MatchzIf-Modified-SinceFproxiesN)headersrf   authtimeoutverifyzInvalid JSON returned from /)r   r	   
ssl_verifywarningssimplefilterr   r
   add_anaconda_tokenremote_connect_timeout_secsremote_read_timeout_secsgetgetattrraise_for_statusjsonJSONDecodeError
ValueError)r.   ra   rb   etag	mod_stampsession
verify_sslrg   urlsaved_token_settingri   resprU   s   &&&&&        r   rH   2_SignatureVerification._fetch_channel_signing_data   s6    ./ ''
!!(,BC B.
 '+O$+4'('2 &88%*"	=3300G
 ;;D9!  D !!#)<G&	99; *=G& ## 	-.>-?q
K 	s%   AC2 "D 2C?D-D((D-c               $    V ^8  d   QhRRRRRR/# )r   repodata_fnr[   recordr   r   Noner   )r   s   "r   r    r!      s&     +A +A# +As +At +Ar"   c                   \        VP                  VR7      pVP                  P                  4       w  rERV9  d6   VP                  P                  RVP                  P                   R24       R# VR,          pVP                  V9  d,   VP                  P                  RVP                   R24       R# WbP                  ,          pVP                  P                  \        4      '       d   VR,          VP                  ,          pMKVP                  P                  \        4      '       d   VR,          VP                  ,          pM\        R4      h\        V4      p	WyR&    \        R	WP                  4       \        P!                  R
VP                   24       VP                  P                  R4       R#   \"         dB    \        P%                  RTP                   24       TP                  P                  R4        R# i ; i)zVerify the signature for a package record.

Args:
    repodata_fn: The repodata filename (e.g., 'repodata.json')
    record: A PackageRecord from conda
)r   
signaturesz(no signatures found for rY   Npackageszpackages.condazunknown package extensionpkg_mgrzvalid signature for z(package metadata is TRUSTED)zinvalid signature for z(package metadata is UNTRUSTED))r   channel
repo_fetchfetch_latest_parsedmetadataaddcanonical_namefnendswithr   r   rw   r   r   r-   r(   rB   r   r)   )
r.   r   r   subdir_datarepodatarQ   r   	signaturerB   envelopes
   &&&       r   rj   _SignatureVerification.verify   s    ![I!,,@@B x'OO+FNN,I,I+J!L l+
 99J&OO";FII;a HIyy)	 99899J'		2DYY :;;,-fii8D899 $D)!*	Ai<<@
 HH+FII;78OO ?@  	CKK0<=OO AB	Cs   "F7 7AHHc               (    V ^8  d   QhRRRRRRRR/# )r   r   r[   unlink_precstuple
link_precsr   r   r   )r   s   "r   r    r!   #  s2     + ++ + 	+
 
+r"   c                b    V P                   '       g   R# V F  pV P                  W4       K  	  R# )zPost-solve hook callback.

Args:
    repodata_fn: The repodata filename
    unlink_precs: Package records to unlink (unused)
    link_precs: Package records to link (verified)
N)r/   rj   )r.   r   r   r   precs   &&&& r   __call___SignatureVerification.__call__#  s&     |||DKK* r"   c                   V ^8  d   QhRR/# )r   r   r   r   )r   s   "r   r    r!   6  s     * *T *r"   c                P    R F  pV P                   P                  VR4       K!  	  R# )zClear all cached properties.N)r/   r,   r-   )__dict__pop)r.   attrs   & r   cache_clear"_SignatureVerification.cache_clear6  s     :DMMdD) ;r"   r   )NN)r]   
__module____qualname____firstlineno____doc__r   r/   r,   r-   rH   rj   r   r   __static_attributes__r   r"   r   r   r   .   sd      B A AF  @8t+AZ+&* *r"   r   )/r   
__future__r   ru   r9   rerm   	functoolsr   loggingr   pathlibr   typingr   conda.base.constantsr   r   conda.base.contextr	   conda.common.urlr
   conda.core.subdir_datar   conda.gateways.connectionr   r   !conda.gateways.connection.sessionr   authenticationr   r   commonr   r   r   	constantsr   signingr   r   r]   r(   compiler;   r   signature_verificationr   r"   r   <module>r      s    #  	 	  %     ' % - G 9 : S S # %::<= K* K*^ 01 r"   