added v3

venv/lib/python3.11/site-packages/cryptography/x509/__init__.py

@@ -0,0 +1,267 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+from cryptography.x509 import certificate_transparency, verification
+from cryptography.x509.base import (
+    Attribute,
+    AttributeNotFound,
+    Attributes,
+    Certificate,
+    CertificateBuilder,
+    CertificateRevocationList,
+    CertificateRevocationListBuilder,
+    CertificateSigningRequest,
+    CertificateSigningRequestBuilder,
+    InvalidVersion,
+    RevokedCertificate,
+    RevokedCertificateBuilder,
+    Version,
+    load_der_x509_certificate,
+    load_der_x509_crl,
+    load_der_x509_csr,
+    load_pem_x509_certificate,
+    load_pem_x509_certificates,
+    load_pem_x509_crl,
+    load_pem_x509_csr,
+    random_serial_number,
+)
+from cryptography.x509.extensions import (
+    AccessDescription,
+    Admission,
+    Admissions,
+    AuthorityInformationAccess,
+    AuthorityKeyIdentifier,
+    BasicConstraints,
+    CertificateIssuer,
+    CertificatePolicies,
+    CRLDistributionPoints,
+    CRLNumber,
+    CRLReason,
+    DeltaCRLIndicator,
+    DistributionPoint,
+    DuplicateExtension,
+    ExtendedKeyUsage,
+    Extension,
+    ExtensionNotFound,
+    Extensions,
+    ExtensionType,
+    FreshestCRL,
+    GeneralNames,
+    InhibitAnyPolicy,
+    InvalidityDate,
+    IssuerAlternativeName,
+    IssuingDistributionPoint,
+    KeyUsage,
+    MSCertificateTemplate,
+    NameConstraints,
+    NamingAuthority,
+    NoticeReference,
+    OCSPAcceptableResponses,
+    OCSPNoCheck,
+    OCSPNonce,
+    PolicyConstraints,
+    PolicyInformation,
+    PrecertificateSignedCertificateTimestamps,
+    PrecertPoison,
+    ProfessionInfo,
+    ReasonFlags,
+    SignedCertificateTimestamps,
+    SubjectAlternativeName,
+    SubjectInformationAccess,
+    SubjectKeyIdentifier,
+    TLSFeature,
+    TLSFeatureType,
+    UnrecognizedExtension,
+    UserNotice,
+)
+from cryptography.x509.general_name import (
+    DirectoryName,
+    DNSName,
+    GeneralName,
+    IPAddress,
+    OtherName,
+    RegisteredID,
+    RFC822Name,
+    UniformResourceIdentifier,
+    UnsupportedGeneralNameType,
+)
+from cryptography.x509.name import (
+    Name,
+    NameAttribute,
+    RelativeDistinguishedName,
+)
+from cryptography.x509.oid import (
+    AuthorityInformationAccessOID,
+    CertificatePoliciesOID,
+    CRLEntryExtensionOID,
+    ExtendedKeyUsageOID,
+    ExtensionOID,
+    NameOID,
+    ObjectIdentifier,
+    PublicKeyAlgorithmOID,
+    SignatureAlgorithmOID,
+)
+
+OID_AUTHORITY_INFORMATION_ACCESS = ExtensionOID.AUTHORITY_INFORMATION_ACCESS
+OID_AUTHORITY_KEY_IDENTIFIER = ExtensionOID.AUTHORITY_KEY_IDENTIFIER
+OID_BASIC_CONSTRAINTS = ExtensionOID.BASIC_CONSTRAINTS
+OID_CERTIFICATE_POLICIES = ExtensionOID.CERTIFICATE_POLICIES
+OID_CRL_DISTRIBUTION_POINTS = ExtensionOID.CRL_DISTRIBUTION_POINTS
+OID_EXTENDED_KEY_USAGE = ExtensionOID.EXTENDED_KEY_USAGE
+OID_FRESHEST_CRL = ExtensionOID.FRESHEST_CRL
+OID_INHIBIT_ANY_POLICY = ExtensionOID.INHIBIT_ANY_POLICY
+OID_ISSUER_ALTERNATIVE_NAME = ExtensionOID.ISSUER_ALTERNATIVE_NAME
+OID_KEY_USAGE = ExtensionOID.KEY_USAGE
+OID_NAME_CONSTRAINTS = ExtensionOID.NAME_CONSTRAINTS
+OID_OCSP_NO_CHECK = ExtensionOID.OCSP_NO_CHECK
+OID_POLICY_CONSTRAINTS = ExtensionOID.POLICY_CONSTRAINTS
+OID_POLICY_MAPPINGS = ExtensionOID.POLICY_MAPPINGS
+OID_SUBJECT_ALTERNATIVE_NAME = ExtensionOID.SUBJECT_ALTERNATIVE_NAME
+OID_SUBJECT_DIRECTORY_ATTRIBUTES = ExtensionOID.SUBJECT_DIRECTORY_ATTRIBUTES
+OID_SUBJECT_INFORMATION_ACCESS = ExtensionOID.SUBJECT_INFORMATION_ACCESS
+OID_SUBJECT_KEY_IDENTIFIER = ExtensionOID.SUBJECT_KEY_IDENTIFIER
+
+OID_DSA_WITH_SHA1 = SignatureAlgorithmOID.DSA_WITH_SHA1
+OID_DSA_WITH_SHA224 = SignatureAlgorithmOID.DSA_WITH_SHA224
+OID_DSA_WITH_SHA256 = SignatureAlgorithmOID.DSA_WITH_SHA256
+OID_ECDSA_WITH_SHA1 = SignatureAlgorithmOID.ECDSA_WITH_SHA1
+OID_ECDSA_WITH_SHA224 = SignatureAlgorithmOID.ECDSA_WITH_SHA224
+OID_ECDSA_WITH_SHA256 = SignatureAlgorithmOID.ECDSA_WITH_SHA256
+OID_ECDSA_WITH_SHA384 = SignatureAlgorithmOID.ECDSA_WITH_SHA384
+OID_ECDSA_WITH_SHA512 = SignatureAlgorithmOID.ECDSA_WITH_SHA512
+OID_RSA_WITH_MD5 = SignatureAlgorithmOID.RSA_WITH_MD5
+OID_RSA_WITH_SHA1 = SignatureAlgorithmOID.RSA_WITH_SHA1
+OID_RSA_WITH_SHA224 = SignatureAlgorithmOID.RSA_WITH_SHA224
+OID_RSA_WITH_SHA256 = SignatureAlgorithmOID.RSA_WITH_SHA256
+OID_RSA_WITH_SHA384 = SignatureAlgorithmOID.RSA_WITH_SHA384
+OID_RSA_WITH_SHA512 = SignatureAlgorithmOID.RSA_WITH_SHA512
+OID_RSASSA_PSS = SignatureAlgorithmOID.RSASSA_PSS
+
+OID_COMMON_NAME = NameOID.COMMON_NAME
+OID_COUNTRY_NAME = NameOID.COUNTRY_NAME
+OID_DOMAIN_COMPONENT = NameOID.DOMAIN_COMPONENT
+OID_DN_QUALIFIER = NameOID.DN_QUALIFIER
+OID_EMAIL_ADDRESS = NameOID.EMAIL_ADDRESS
+OID_GENERATION_QUALIFIER = NameOID.GENERATION_QUALIFIER
+OID_GIVEN_NAME = NameOID.GIVEN_NAME
+OID_LOCALITY_NAME = NameOID.LOCALITY_NAME
+OID_ORGANIZATIONAL_UNIT_NAME = NameOID.ORGANIZATIONAL_UNIT_NAME
+OID_ORGANIZATION_NAME = NameOID.ORGANIZATION_NAME
+OID_PSEUDONYM = NameOID.PSEUDONYM
+OID_SERIAL_NUMBER = NameOID.SERIAL_NUMBER
+OID_STATE_OR_PROVINCE_NAME = NameOID.STATE_OR_PROVINCE_NAME
+OID_SURNAME = NameOID.SURNAME
+OID_TITLE = NameOID.TITLE
+
+OID_CLIENT_AUTH = ExtendedKeyUsageOID.CLIENT_AUTH
+OID_CODE_SIGNING = ExtendedKeyUsageOID.CODE_SIGNING
+OID_EMAIL_PROTECTION = ExtendedKeyUsageOID.EMAIL_PROTECTION
+OID_OCSP_SIGNING = ExtendedKeyUsageOID.OCSP_SIGNING
+OID_SERVER_AUTH = ExtendedKeyUsageOID.SERVER_AUTH
+OID_TIME_STAMPING = ExtendedKeyUsageOID.TIME_STAMPING
+
+OID_ANY_POLICY = CertificatePoliciesOID.ANY_POLICY
+OID_CPS_QUALIFIER = CertificatePoliciesOID.CPS_QUALIFIER
+OID_CPS_USER_NOTICE = CertificatePoliciesOID.CPS_USER_NOTICE
+
+OID_CERTIFICATE_ISSUER = CRLEntryExtensionOID.CERTIFICATE_ISSUER
+OID_CRL_REASON = CRLEntryExtensionOID.CRL_REASON
+OID_INVALIDITY_DATE = CRLEntryExtensionOID.INVALIDITY_DATE
+
+OID_CA_ISSUERS = AuthorityInformationAccessOID.CA_ISSUERS
+OID_OCSP = AuthorityInformationAccessOID.OCSP
+
+__all__ = [
+    "OID_CA_ISSUERS",
+    "OID_OCSP",
+    "AccessDescription",
+    "Admission",
+    "Admissions",
+    "Attribute",
+    "AttributeNotFound",
+    "Attributes",
+    "AuthorityInformationAccess",
+    "AuthorityKeyIdentifier",
+    "BasicConstraints",
+    "CRLDistributionPoints",
+    "CRLNumber",
+    "CRLReason",
+    "Certificate",
+    "CertificateBuilder",
+    "CertificateIssuer",
+    "CertificatePolicies",
+    "CertificateRevocationList",
+    "CertificateRevocationListBuilder",
+    "CertificateSigningRequest",
+    "CertificateSigningRequestBuilder",
+    "DNSName",
+    "DeltaCRLIndicator",
+    "DirectoryName",
+    "DistributionPoint",
+    "DuplicateExtension",
+    "ExtendedKeyUsage",
+    "Extension",
+    "ExtensionNotFound",
+    "ExtensionType",
+    "Extensions",
+    "FreshestCRL",
+    "GeneralName",
+    "GeneralNames",
+    "IPAddress",
+    "InhibitAnyPolicy",
+    "InvalidVersion",
+    "InvalidityDate",
+    "IssuerAlternativeName",
+    "IssuingDistributionPoint",
+    "KeyUsage",
+    "MSCertificateTemplate",
+    "Name",
+    "NameAttribute",
+    "NameConstraints",
+    "NameOID",
+    "NamingAuthority",
+    "NoticeReference",
+    "OCSPAcceptableResponses",
+    "OCSPNoCheck",
+    "OCSPNonce",
+    "ObjectIdentifier",
+    "OtherName",
+    "PolicyConstraints",
+    "PolicyInformation",
+    "PrecertPoison",
+    "PrecertificateSignedCertificateTimestamps",
+    "ProfessionInfo",
+    "PublicKeyAlgorithmOID",
+    "RFC822Name",
+    "ReasonFlags",
+    "RegisteredID",
+    "RelativeDistinguishedName",
+    "RevokedCertificate",
+    "RevokedCertificateBuilder",
+    "SignatureAlgorithmOID",
+    "SignedCertificateTimestamps",
+    "SubjectAlternativeName",
+    "SubjectInformationAccess",
+    "SubjectKeyIdentifier",
+    "TLSFeature",
+    "TLSFeatureType",
+    "UniformResourceIdentifier",
+    "UnrecognizedExtension",
+    "UnsupportedGeneralNameType",
+    "UserNotice",
+    "Version",
+    "certificate_transparency",
+    "load_der_x509_certificate",
+    "load_der_x509_crl",
+    "load_der_x509_csr",
+    "load_pem_x509_certificate",
+    "load_pem_x509_certificates",
+    "load_pem_x509_crl",
+    "load_pem_x509_csr",
+    "random_serial_number",
+    "verification",
+    "verification",
+]

venv/lib/python3.11/site-packages/cryptography/x509/base.py

@@ -0,0 +1,815 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import abc
+import datetime
+import os
+import typing
+import warnings
+
+from cryptography import utils
+from cryptography.hazmat.bindings._rust import x509 as rust_x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import (
+    dsa,
+    ec,
+    ed448,
+    ed25519,
+    padding,
+    rsa,
+    x448,
+    x25519,
+)
+from cryptography.hazmat.primitives.asymmetric.types import (
+    CertificateIssuerPrivateKeyTypes,
+    CertificatePublicKeyTypes,
+)
+from cryptography.x509.extensions import (
+    Extension,
+    Extensions,
+    ExtensionType,
+    _make_sequence_methods,
+)
+from cryptography.x509.name import Name, _ASN1Type
+from cryptography.x509.oid import ObjectIdentifier
+
+_EARLIEST_UTC_TIME = datetime.datetime(1950, 1, 1)
+
+# This must be kept in sync with sign.rs's list of allowable types in
+# identify_hash_type
+_AllowedHashTypes = typing.Union[
+    hashes.SHA224,
+    hashes.SHA256,
+    hashes.SHA384,
+    hashes.SHA512,
+    hashes.SHA3_224,
+    hashes.SHA3_256,
+    hashes.SHA3_384,
+    hashes.SHA3_512,
+]
+
+
+class AttributeNotFound(Exception):
+    def __init__(self, msg: str, oid: ObjectIdentifier) -> None:
+        super().__init__(msg)
+        self.oid = oid
+
+
+def _reject_duplicate_extension(
+    extension: Extension[ExtensionType],
+    extensions: list[Extension[ExtensionType]],
+) -> None:
+    # This is quadratic in the number of extensions
+    for e in extensions:
+        if e.oid == extension.oid:
+            raise ValueError("This extension has already been set.")
+
+
+def _reject_duplicate_attribute(
+    oid: ObjectIdentifier,
+    attributes: list[tuple[ObjectIdentifier, bytes, int | None]],
+) -> None:
+    # This is quadratic in the number of attributes
+    for attr_oid, _, _ in attributes:
+        if attr_oid == oid:
+            raise ValueError("This attribute has already been set.")
+
+
+def _convert_to_naive_utc_time(time: datetime.datetime) -> datetime.datetime:
+    """Normalizes a datetime to a naive datetime in UTC.
+
+    time -- datetime to normalize. Assumed to be in UTC if not timezone
+            aware.
+    """
+    if time.tzinfo is not None:
+        offset = time.utcoffset()
+        offset = offset if offset else datetime.timedelta()
+        return time.replace(tzinfo=None) - offset
+    else:
+        return time
+
+
+class Attribute:
+    def __init__(
+        self,
+        oid: ObjectIdentifier,
+        value: bytes,
+        _type: int = _ASN1Type.UTF8String.value,
+    ) -> None:
+        self._oid = oid
+        self._value = value
+        self._type = _type
+
+    @property
+    def oid(self) -> ObjectIdentifier:
+        return self._oid
+
+    @property
+    def value(self) -> bytes:
+        return self._value
+
+    def __repr__(self) -> str:
+        return f"<Attribute(oid={self.oid}, value={self.value!r})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, Attribute):
+            return NotImplemented
+
+        return (
+            self.oid == other.oid
+            and self.value == other.value
+            and self._type == other._type
+        )
+
+    def __hash__(self) -> int:
+        return hash((self.oid, self.value, self._type))
+
+
+class Attributes:
+    def __init__(
+        self,
+        attributes: typing.Iterable[Attribute],
+    ) -> None:
+        self._attributes = list(attributes)
+
+    __len__, __iter__, __getitem__ = _make_sequence_methods("_attributes")
+
+    def __repr__(self) -> str:
+        return f"<Attributes({self._attributes})>"
+
+    def get_attribute_for_oid(self, oid: ObjectIdentifier) -> Attribute:
+        for attr in self:
+            if attr.oid == oid:
+                return attr
+
+        raise AttributeNotFound(f"No {oid} attribute was found", oid)
+
+
+class Version(utils.Enum):
+    v1 = 0
+    v3 = 2
+
+
+class InvalidVersion(Exception):
+    def __init__(self, msg: str, parsed_version: int) -> None:
+        super().__init__(msg)
+        self.parsed_version = parsed_version
+
+
+Certificate = rust_x509.Certificate
+
+
+class RevokedCertificate(metaclass=abc.ABCMeta):
+    @property
+    @abc.abstractmethod
+    def serial_number(self) -> int:
+        """
+        Returns the serial number of the revoked certificate.
+        """
+
+    @property
+    @abc.abstractmethod
+    def revocation_date(self) -> datetime.datetime:
+        """
+        Returns the date of when this certificate was revoked.
+        """
+
+    @property
+    @abc.abstractmethod
+    def revocation_date_utc(self) -> datetime.datetime:
+        """
+        Returns the date of when this certificate was revoked as a non-naive
+        UTC datetime.
+        """
+
+    @property
+    @abc.abstractmethod
+    def extensions(self) -> Extensions:
+        """
+        Returns an Extensions object containing a list of Revoked extensions.
+        """
+
+
+# Runtime isinstance checks need this since the rust class is not a subclass.
+RevokedCertificate.register(rust_x509.RevokedCertificate)
+
+
+class _RawRevokedCertificate(RevokedCertificate):
+    def __init__(
+        self,
+        serial_number: int,
+        revocation_date: datetime.datetime,
+        extensions: Extensions,
+    ):
+        self._serial_number = serial_number
+        self._revocation_date = revocation_date
+        self._extensions = extensions
+
+    @property
+    def serial_number(self) -> int:
+        return self._serial_number
+
+    @property
+    def revocation_date(self) -> datetime.datetime:
+        warnings.warn(
+            "Properties that return a naïve datetime object have been "
+            "deprecated. Please switch to revocation_date_utc.",
+            utils.DeprecatedIn42,
+            stacklevel=2,
+        )
+        return self._revocation_date
+
+    @property
+    def revocation_date_utc(self) -> datetime.datetime:
+        return self._revocation_date.replace(tzinfo=datetime.timezone.utc)
+
+    @property
+    def extensions(self) -> Extensions:
+        return self._extensions
+
+
+CertificateRevocationList = rust_x509.CertificateRevocationList
+CertificateSigningRequest = rust_x509.CertificateSigningRequest
+
+
+load_pem_x509_certificate = rust_x509.load_pem_x509_certificate
+load_der_x509_certificate = rust_x509.load_der_x509_certificate
+
+load_pem_x509_certificates = rust_x509.load_pem_x509_certificates
+
+load_pem_x509_csr = rust_x509.load_pem_x509_csr
+load_der_x509_csr = rust_x509.load_der_x509_csr
+
+load_pem_x509_crl = rust_x509.load_pem_x509_crl
+load_der_x509_crl = rust_x509.load_der_x509_crl
+
+
+class CertificateSigningRequestBuilder:
+    def __init__(
+        self,
+        subject_name: Name | None = None,
+        extensions: list[Extension[ExtensionType]] = [],
+        attributes: list[tuple[ObjectIdentifier, bytes, int | None]] = [],
+    ):
+        """
+        Creates an empty X.509 certificate request (v1).
+        """
+        self._subject_name = subject_name
+        self._extensions = extensions
+        self._attributes = attributes
+
+    def subject_name(self, name: Name) -> CertificateSigningRequestBuilder:
+        """
+        Sets the certificate requestor's distinguished name.
+        """
+        if not isinstance(name, Name):
+            raise TypeError("Expecting x509.Name object.")
+        if self._subject_name is not None:
+            raise ValueError("The subject name may only be set once.")
+        return CertificateSigningRequestBuilder(
+            name, self._extensions, self._attributes
+        )
+
+    def add_extension(
+        self, extval: ExtensionType, critical: bool
+    ) -> CertificateSigningRequestBuilder:
+        """
+        Adds an X.509 extension to the certificate request.
+        """
+        if not isinstance(extval, ExtensionType):
+            raise TypeError("extension must be an ExtensionType")
+
+        extension = Extension(extval.oid, critical, extval)
+        _reject_duplicate_extension(extension, self._extensions)
+
+        return CertificateSigningRequestBuilder(
+            self._subject_name,
+            [*self._extensions, extension],
+            self._attributes,
+        )
+
+    def add_attribute(
+        self,
+        oid: ObjectIdentifier,
+        value: bytes,
+        *,
+        _tag: _ASN1Type | None = None,
+    ) -> CertificateSigningRequestBuilder:
+        """
+        Adds an X.509 attribute with an OID and associated value.
+        """
+        if not isinstance(oid, ObjectIdentifier):
+            raise TypeError("oid must be an ObjectIdentifier")
+
+        if not isinstance(value, bytes):
+            raise TypeError("value must be bytes")
+
+        if _tag is not None and not isinstance(_tag, _ASN1Type):
+            raise TypeError("tag must be _ASN1Type")
+
+        _reject_duplicate_attribute(oid, self._attributes)
+
+        if _tag is not None:
+            tag = _tag.value
+        else:
+            tag = None
+
+        return CertificateSigningRequestBuilder(
+            self._subject_name,
+            self._extensions,
+            [*self._attributes, (oid, value, tag)],
+        )
+
+    def sign(
+        self,
+        private_key: CertificateIssuerPrivateKeyTypes,
+        algorithm: _AllowedHashTypes | None,
+        backend: typing.Any = None,
+        *,
+        rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
+    ) -> CertificateSigningRequest:
+        """
+        Signs the request using the requestor's private key.
+        """
+        if self._subject_name is None:
+            raise ValueError("A CertificateSigningRequest must have a subject")
+
+        if rsa_padding is not None:
+            if not isinstance(rsa_padding, (padding.PSS, padding.PKCS1v15)):
+                raise TypeError("Padding must be PSS or PKCS1v15")
+            if not isinstance(private_key, rsa.RSAPrivateKey):
+                raise TypeError("Padding is only supported for RSA keys")
+
+        return rust_x509.create_x509_csr(
+            self, private_key, algorithm, rsa_padding
+        )
+
+
+class CertificateBuilder:
+    _extensions: list[Extension[ExtensionType]]
+
+    def __init__(
+        self,
+        issuer_name: Name | None = None,
+        subject_name: Name | None = None,
+        public_key: CertificatePublicKeyTypes | None = None,
+        serial_number: int | None = None,
+        not_valid_before: datetime.datetime | None = None,
+        not_valid_after: datetime.datetime | None = None,
+        extensions: list[Extension[ExtensionType]] = [],
+    ) -> None:
+        self._version = Version.v3
+        self._issuer_name = issuer_name
+        self._subject_name = subject_name
+        self._public_key = public_key
+        self._serial_number = serial_number
+        self._not_valid_before = not_valid_before
+        self._not_valid_after = not_valid_after
+        self._extensions = extensions
+
+    def issuer_name(self, name: Name) -> CertificateBuilder:
+        """
+        Sets the CA's distinguished name.
+        """
+        if not isinstance(name, Name):
+            raise TypeError("Expecting x509.Name object.")
+        if self._issuer_name is not None:
+            raise ValueError("The issuer name may only be set once.")
+        return CertificateBuilder(
+            name,
+            self._subject_name,
+            self._public_key,
+            self._serial_number,
+            self._not_valid_before,
+            self._not_valid_after,
+            self._extensions,
+        )
+
+    def subject_name(self, name: Name) -> CertificateBuilder:
+        """
+        Sets the requestor's distinguished name.
+        """
+        if not isinstance(name, Name):
+            raise TypeError("Expecting x509.Name object.")
+        if self._subject_name is not None:
+            raise ValueError("The subject name may only be set once.")
+        return CertificateBuilder(
+            self._issuer_name,
+            name,
+            self._public_key,
+            self._serial_number,
+            self._not_valid_before,
+            self._not_valid_after,
+            self._extensions,
+        )
+
+    def public_key(
+        self,
+        key: CertificatePublicKeyTypes,
+    ) -> CertificateBuilder:
+        """
+        Sets the requestor's public key (as found in the signing request).
+        """
+        if not isinstance(
+            key,
+            (
+                dsa.DSAPublicKey,
+                rsa.RSAPublicKey,
+                ec.EllipticCurvePublicKey,
+                ed25519.Ed25519PublicKey,
+                ed448.Ed448PublicKey,
+                x25519.X25519PublicKey,
+                x448.X448PublicKey,
+            ),
+        ):
+            raise TypeError(
+                "Expecting one of DSAPublicKey, RSAPublicKey,"
+                " EllipticCurvePublicKey, Ed25519PublicKey,"
+                " Ed448PublicKey, X25519PublicKey, or "
+                "X448PublicKey."
+            )
+        if self._public_key is not None:
+            raise ValueError("The public key may only be set once.")
+        return CertificateBuilder(
+            self._issuer_name,
+            self._subject_name,
+            key,
+            self._serial_number,
+            self._not_valid_before,
+            self._not_valid_after,
+            self._extensions,
+        )
+
+    def serial_number(self, number: int) -> CertificateBuilder:
+        """
+        Sets the certificate serial number.
+        """
+        if not isinstance(number, int):
+            raise TypeError("Serial number must be of integral type.")
+        if self._serial_number is not None:
+            raise ValueError("The serial number may only be set once.")
+        if number <= 0:
+            raise ValueError("The serial number should be positive.")
+
+        # ASN.1 integers are always signed, so most significant bit must be
+        # zero.
+        if number.bit_length() >= 160:  # As defined in RFC 5280
+            raise ValueError(
+                "The serial number should not be more than 159 bits."
+            )
+        return CertificateBuilder(
+            self._issuer_name,
+            self._subject_name,
+            self._public_key,
+            number,
+            self._not_valid_before,
+            self._not_valid_after,
+            self._extensions,
+        )
+
+    def not_valid_before(self, time: datetime.datetime) -> CertificateBuilder:
+        """
+        Sets the certificate activation time.
+        """
+        if not isinstance(time, datetime.datetime):
+            raise TypeError("Expecting datetime object.")
+        if self._not_valid_before is not None:
+            raise ValueError("The not valid before may only be set once.")
+        time = _convert_to_naive_utc_time(time)
+        if time < _EARLIEST_UTC_TIME:
+            raise ValueError(
+                "The not valid before date must be on or after"
+                " 1950 January 1)."
+            )
+        if self._not_valid_after is not None and time > self._not_valid_after:
+            raise ValueError(
+                "The not valid before date must be before the not valid after "
+                "date."
+            )
+        return CertificateBuilder(
+            self._issuer_name,
+            self._subject_name,
+            self._public_key,
+            self._serial_number,
+            time,
+            self._not_valid_after,
+            self._extensions,
+        )
+
+    def not_valid_after(self, time: datetime.datetime) -> CertificateBuilder:
+        """
+        Sets the certificate expiration time.
+        """
+        if not isinstance(time, datetime.datetime):
+            raise TypeError("Expecting datetime object.")
+        if self._not_valid_after is not None:
+            raise ValueError("The not valid after may only be set once.")
+        time = _convert_to_naive_utc_time(time)
+        if time < _EARLIEST_UTC_TIME:
+            raise ValueError(
+                "The not valid after date must be on or after"
+                " 1950 January 1."
+            )
+        if (
+            self._not_valid_before is not None
+            and time < self._not_valid_before
+        ):
+            raise ValueError(
+                "The not valid after date must be after the not valid before "
+                "date."
+            )
+        return CertificateBuilder(
+            self._issuer_name,
+            self._subject_name,
+            self._public_key,
+            self._serial_number,
+            self._not_valid_before,
+            time,
+            self._extensions,
+        )
+
+    def add_extension(
+        self, extval: ExtensionType, critical: bool
+    ) -> CertificateBuilder:
+        """
+        Adds an X.509 extension to the certificate.
+        """
+        if not isinstance(extval, ExtensionType):
+            raise TypeError("extension must be an ExtensionType")
+
+        extension = Extension(extval.oid, critical, extval)
+        _reject_duplicate_extension(extension, self._extensions)
+
+        return CertificateBuilder(
+            self._issuer_name,
+            self._subject_name,
+            self._public_key,
+            self._serial_number,
+            self._not_valid_before,
+            self._not_valid_after,
+            [*self._extensions, extension],
+        )
+
+    def sign(
+        self,
+        private_key: CertificateIssuerPrivateKeyTypes,
+        algorithm: _AllowedHashTypes | None,
+        backend: typing.Any = None,
+        *,
+        rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
+    ) -> Certificate:
+        """
+        Signs the certificate using the CA's private key.
+        """
+        if self._subject_name is None:
+            raise ValueError("A certificate must have a subject name")
+
+        if self._issuer_name is None:
+            raise ValueError("A certificate must have an issuer name")
+
+        if self._serial_number is None:
+            raise ValueError("A certificate must have a serial number")
+
+        if self._not_valid_before is None:
+            raise ValueError("A certificate must have a not valid before time")
+
+        if self._not_valid_after is None:
+            raise ValueError("A certificate must have a not valid after time")
+
+        if self._public_key is None:
+            raise ValueError("A certificate must have a public key")
+
+        if rsa_padding is not None:
+            if not isinstance(rsa_padding, (padding.PSS, padding.PKCS1v15)):
+                raise TypeError("Padding must be PSS or PKCS1v15")
+            if not isinstance(private_key, rsa.RSAPrivateKey):
+                raise TypeError("Padding is only supported for RSA keys")
+
+        return rust_x509.create_x509_certificate(
+            self, private_key, algorithm, rsa_padding
+        )
+
+
+class CertificateRevocationListBuilder:
+    _extensions: list[Extension[ExtensionType]]
+    _revoked_certificates: list[RevokedCertificate]
+
+    def __init__(
+        self,
+        issuer_name: Name | None = None,
+        last_update: datetime.datetime | None = None,
+        next_update: datetime.datetime | None = None,
+        extensions: list[Extension[ExtensionType]] = [],
+        revoked_certificates: list[RevokedCertificate] = [],
+    ):
+        self._issuer_name = issuer_name
+        self._last_update = last_update
+        self._next_update = next_update
+        self._extensions = extensions
+        self._revoked_certificates = revoked_certificates
+
+    def issuer_name(
+        self, issuer_name: Name
+    ) -> CertificateRevocationListBuilder:
+        if not isinstance(issuer_name, Name):
+            raise TypeError("Expecting x509.Name object.")
+        if self._issuer_name is not None:
+            raise ValueError("The issuer name may only be set once.")
+        return CertificateRevocationListBuilder(
+            issuer_name,
+            self._last_update,
+            self._next_update,
+            self._extensions,
+            self._revoked_certificates,
+        )
+
+    def last_update(
+        self, last_update: datetime.datetime
+    ) -> CertificateRevocationListBuilder:
+        if not isinstance(last_update, datetime.datetime):
+            raise TypeError("Expecting datetime object.")
+        if self._last_update is not None:
+            raise ValueError("Last update may only be set once.")
+        last_update = _convert_to_naive_utc_time(last_update)
+        if last_update < _EARLIEST_UTC_TIME:
+            raise ValueError(
+                "The last update date must be on or after 1950 January 1."
+            )
+        if self._next_update is not None and last_update > self._next_update:
+            raise ValueError(
+                "The last update date must be before the next update date."
+            )
+        return CertificateRevocationListBuilder(
+            self._issuer_name,
+            last_update,
+            self._next_update,
+            self._extensions,
+            self._revoked_certificates,
+        )
+
+    def next_update(
+        self, next_update: datetime.datetime
+    ) -> CertificateRevocationListBuilder:
+        if not isinstance(next_update, datetime.datetime):
+            raise TypeError("Expecting datetime object.")
+        if self._next_update is not None:
+            raise ValueError("Last update may only be set once.")
+        next_update = _convert_to_naive_utc_time(next_update)
+        if next_update < _EARLIEST_UTC_TIME:
+            raise ValueError(
+                "The last update date must be on or after 1950 January 1."
+            )
+        if self._last_update is not None and next_update < self._last_update:
+            raise ValueError(
+                "The next update date must be after the last update date."
+            )
+        return CertificateRevocationListBuilder(
+            self._issuer_name,
+            self._last_update,
+            next_update,
+            self._extensions,
+            self._revoked_certificates,
+        )
+
+    def add_extension(
+        self, extval: ExtensionType, critical: bool
+    ) -> CertificateRevocationListBuilder:
+        """
+        Adds an X.509 extension to the certificate revocation list.
+        """
+        if not isinstance(extval, ExtensionType):
+            raise TypeError("extension must be an ExtensionType")
+
+        extension = Extension(extval.oid, critical, extval)
+        _reject_duplicate_extension(extension, self._extensions)
+        return CertificateRevocationListBuilder(
+            self._issuer_name,
+            self._last_update,
+            self._next_update,
+            [*self._extensions, extension],
+            self._revoked_certificates,
+        )
+
+    def add_revoked_certificate(
+        self, revoked_certificate: RevokedCertificate
+    ) -> CertificateRevocationListBuilder:
+        """
+        Adds a revoked certificate to the CRL.
+        """
+        if not isinstance(revoked_certificate, RevokedCertificate):
+            raise TypeError("Must be an instance of RevokedCertificate")
+
+        return CertificateRevocationListBuilder(
+            self._issuer_name,
+            self._last_update,
+            self._next_update,
+            self._extensions,
+            [*self._revoked_certificates, revoked_certificate],
+        )
+
+    def sign(
+        self,
+        private_key: CertificateIssuerPrivateKeyTypes,
+        algorithm: _AllowedHashTypes | None,
+        backend: typing.Any = None,
+        *,
+        rsa_padding: padding.PSS | padding.PKCS1v15 | None = None,
+    ) -> CertificateRevocationList:
+        if self._issuer_name is None:
+            raise ValueError("A CRL must have an issuer name")
+
+        if self._last_update is None:
+            raise ValueError("A CRL must have a last update time")
+
+        if self._next_update is None:
+            raise ValueError("A CRL must have a next update time")
+
+        if rsa_padding is not None:
+            if not isinstance(rsa_padding, (padding.PSS, padding.PKCS1v15)):
+                raise TypeError("Padding must be PSS or PKCS1v15")
+            if not isinstance(private_key, rsa.RSAPrivateKey):
+                raise TypeError("Padding is only supported for RSA keys")
+
+        return rust_x509.create_x509_crl(
+            self, private_key, algorithm, rsa_padding
+        )
+
+
+class RevokedCertificateBuilder:
+    def __init__(
+        self,
+        serial_number: int | None = None,
+        revocation_date: datetime.datetime | None = None,
+        extensions: list[Extension[ExtensionType]] = [],
+    ):
+        self._serial_number = serial_number
+        self._revocation_date = revocation_date
+        self._extensions = extensions
+
+    def serial_number(self, number: int) -> RevokedCertificateBuilder:
+        if not isinstance(number, int):
+            raise TypeError("Serial number must be of integral type.")
+        if self._serial_number is not None:
+            raise ValueError("The serial number may only be set once.")
+        if number <= 0:
+            raise ValueError("The serial number should be positive")
+
+        # ASN.1 integers are always signed, so most significant bit must be
+        # zero.
+        if number.bit_length() >= 160:  # As defined in RFC 5280
+            raise ValueError(
+                "The serial number should not be more than 159 bits."
+            )
+        return RevokedCertificateBuilder(
+            number, self._revocation_date, self._extensions
+        )
+
+    def revocation_date(
+        self, time: datetime.datetime
+    ) -> RevokedCertificateBuilder:
+        if not isinstance(time, datetime.datetime):
+            raise TypeError("Expecting datetime object.")
+        if self._revocation_date is not None:
+            raise ValueError("The revocation date may only be set once.")
+        time = _convert_to_naive_utc_time(time)
+        if time < _EARLIEST_UTC_TIME:
+            raise ValueError(
+                "The revocation date must be on or after 1950 January 1."
+            )
+        return RevokedCertificateBuilder(
+            self._serial_number, time, self._extensions
+        )
+
+    def add_extension(
+        self, extval: ExtensionType, critical: bool
+    ) -> RevokedCertificateBuilder:
+        if not isinstance(extval, ExtensionType):
+            raise TypeError("extension must be an ExtensionType")
+
+        extension = Extension(extval.oid, critical, extval)
+        _reject_duplicate_extension(extension, self._extensions)
+        return RevokedCertificateBuilder(
+            self._serial_number,
+            self._revocation_date,
+            [*self._extensions, extension],
+        )
+
+    def build(self, backend: typing.Any = None) -> RevokedCertificate:
+        if self._serial_number is None:
+            raise ValueError("A revoked certificate must have a serial number")
+        if self._revocation_date is None:
+            raise ValueError(
+                "A revoked certificate must have a revocation date"
+            )
+        return _RawRevokedCertificate(
+            self._serial_number,
+            self._revocation_date,
+            Extensions(self._extensions),
+        )
+
+
+def random_serial_number() -> int:
+    return int.from_bytes(os.urandom(20), "big") >> 1

venv/lib/python3.11/site-packages/cryptography/x509/certificate_transparency.py

@@ -0,0 +1,35 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+from cryptography import utils
+from cryptography.hazmat.bindings._rust import x509 as rust_x509
+
+
+class LogEntryType(utils.Enum):
+    X509_CERTIFICATE = 0
+    PRE_CERTIFICATE = 1
+
+
+class Version(utils.Enum):
+    v1 = 0
+
+
+class SignatureAlgorithm(utils.Enum):
+    """
+    Signature algorithms that are valid for SCTs.
+
+    These are exactly the same as SignatureAlgorithm in RFC 5246 (TLS 1.2).
+
+    See: <https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1>
+    """
+
+    ANONYMOUS = 0
+    RSA = 1
+    DSA = 2
+    ECDSA = 3
+
+
+SignedCertificateTimestamp = rust_x509.Sct

venv/lib/python3.11/site-packages/cryptography/x509/general_name.py

@@ -0,0 +1,281 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import abc
+import ipaddress
+import typing
+from email.utils import parseaddr
+
+from cryptography.x509.name import Name
+from cryptography.x509.oid import ObjectIdentifier
+
+_IPAddressTypes = typing.Union[
+    ipaddress.IPv4Address,
+    ipaddress.IPv6Address,
+    ipaddress.IPv4Network,
+    ipaddress.IPv6Network,
+]
+
+
+class UnsupportedGeneralNameType(Exception):
+    pass
+
+
+class GeneralName(metaclass=abc.ABCMeta):
+    @property
+    @abc.abstractmethod
+    def value(self) -> typing.Any:
+        """
+        Return the value of the object
+        """
+
+
+class RFC822Name(GeneralName):
+    def __init__(self, value: str) -> None:
+        if isinstance(value, str):
+            try:
+                value.encode("ascii")
+            except UnicodeEncodeError:
+                raise ValueError(
+                    "RFC822Name values should be passed as an A-label string. "
+                    "This means unicode characters should be encoded via "
+                    "a library like idna."
+                )
+        else:
+            raise TypeError("value must be string")
+
+        name, address = parseaddr(value)
+        if name or not address:
+            # parseaddr has found a name (e.g. Name <email>) or the entire
+            # value is an empty string.
+            raise ValueError("Invalid rfc822name value")
+
+        self._value = value
+
+    @property
+    def value(self) -> str:
+        return self._value
+
+    @classmethod
+    def _init_without_validation(cls, value: str) -> RFC822Name:
+        instance = cls.__new__(cls)
+        instance._value = value
+        return instance
+
+    def __repr__(self) -> str:
+        return f"<RFC822Name(value={self.value!r})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, RFC822Name):
+            return NotImplemented
+
+        return self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash(self.value)
+
+
+class DNSName(GeneralName):
+    def __init__(self, value: str) -> None:
+        if isinstance(value, str):
+            try:
+                value.encode("ascii")
+            except UnicodeEncodeError:
+                raise ValueError(
+                    "DNSName values should be passed as an A-label string. "
+                    "This means unicode characters should be encoded via "
+                    "a library like idna."
+                )
+        else:
+            raise TypeError("value must be string")
+
+        self._value = value
+
+    @property
+    def value(self) -> str:
+        return self._value
+
+    @classmethod
+    def _init_without_validation(cls, value: str) -> DNSName:
+        instance = cls.__new__(cls)
+        instance._value = value
+        return instance
+
+    def __repr__(self) -> str:
+        return f"<DNSName(value={self.value!r})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, DNSName):
+            return NotImplemented
+
+        return self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash(self.value)
+
+
+class UniformResourceIdentifier(GeneralName):
+    def __init__(self, value: str) -> None:
+        if isinstance(value, str):
+            try:
+                value.encode("ascii")
+            except UnicodeEncodeError:
+                raise ValueError(
+                    "URI values should be passed as an A-label string. "
+                    "This means unicode characters should be encoded via "
+                    "a library like idna."
+                )
+        else:
+            raise TypeError("value must be string")
+
+        self._value = value
+
+    @property
+    def value(self) -> str:
+        return self._value
+
+    @classmethod
+    def _init_without_validation(cls, value: str) -> UniformResourceIdentifier:
+        instance = cls.__new__(cls)
+        instance._value = value
+        return instance
+
+    def __repr__(self) -> str:
+        return f"<UniformResourceIdentifier(value={self.value!r})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, UniformResourceIdentifier):
+            return NotImplemented
+
+        return self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash(self.value)
+
+
+class DirectoryName(GeneralName):
+    def __init__(self, value: Name) -> None:
+        if not isinstance(value, Name):
+            raise TypeError("value must be a Name")
+
+        self._value = value
+
+    @property
+    def value(self) -> Name:
+        return self._value
+
+    def __repr__(self) -> str:
+        return f"<DirectoryName(value={self.value})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, DirectoryName):
+            return NotImplemented
+
+        return self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash(self.value)
+
+
+class RegisteredID(GeneralName):
+    def __init__(self, value: ObjectIdentifier) -> None:
+        if not isinstance(value, ObjectIdentifier):
+            raise TypeError("value must be an ObjectIdentifier")
+
+        self._value = value
+
+    @property
+    def value(self) -> ObjectIdentifier:
+        return self._value
+
+    def __repr__(self) -> str:
+        return f"<RegisteredID(value={self.value})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, RegisteredID):
+            return NotImplemented
+
+        return self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash(self.value)
+
+
+class IPAddress(GeneralName):
+    def __init__(self, value: _IPAddressTypes) -> None:
+        if not isinstance(
+            value,
+            (
+                ipaddress.IPv4Address,
+                ipaddress.IPv6Address,
+                ipaddress.IPv4Network,
+                ipaddress.IPv6Network,
+            ),
+        ):
+            raise TypeError(
+                "value must be an instance of ipaddress.IPv4Address, "
+                "ipaddress.IPv6Address, ipaddress.IPv4Network, or "
+                "ipaddress.IPv6Network"
+            )
+
+        self._value = value
+
+    @property
+    def value(self) -> _IPAddressTypes:
+        return self._value
+
+    def _packed(self) -> bytes:
+        if isinstance(
+            self.value, (ipaddress.IPv4Address, ipaddress.IPv6Address)
+        ):
+            return self.value.packed
+        else:
+            return (
+                self.value.network_address.packed + self.value.netmask.packed
+            )
+
+    def __repr__(self) -> str:
+        return f"<IPAddress(value={self.value})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, IPAddress):
+            return NotImplemented
+
+        return self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash(self.value)
+
+
+class OtherName(GeneralName):
+    def __init__(self, type_id: ObjectIdentifier, value: bytes) -> None:
+        if not isinstance(type_id, ObjectIdentifier):
+            raise TypeError("type_id must be an ObjectIdentifier")
+        if not isinstance(value, bytes):
+            raise TypeError("value must be a binary string")
+
+        self._type_id = type_id
+        self._value = value
+
+    @property
+    def type_id(self) -> ObjectIdentifier:
+        return self._type_id
+
+    @property
+    def value(self) -> bytes:
+        return self._value
+
+    def __repr__(self) -> str:
+        return f"<OtherName(type_id={self.type_id}, value={self.value!r})>"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, OtherName):
+            return NotImplemented
+
+        return self.type_id == other.type_id and self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash((self.type_id, self.value))

venv/lib/python3.11/site-packages/cryptography/x509/name.py

@@ -0,0 +1,465 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import binascii
+import re
+import sys
+import typing
+import warnings
+
+from cryptography import utils
+from cryptography.hazmat.bindings._rust import x509 as rust_x509
+from cryptography.x509.oid import NameOID, ObjectIdentifier
+
+
+class _ASN1Type(utils.Enum):
+    BitString = 3
+    OctetString = 4
+    UTF8String = 12
+    NumericString = 18
+    PrintableString = 19
+    T61String = 20
+    IA5String = 22
+    UTCTime = 23
+    GeneralizedTime = 24
+    VisibleString = 26
+    UniversalString = 28
+    BMPString = 30
+
+
+_ASN1_TYPE_TO_ENUM = {i.value: i for i in _ASN1Type}
+_NAMEOID_DEFAULT_TYPE: dict[ObjectIdentifier, _ASN1Type] = {
+    NameOID.COUNTRY_NAME: _ASN1Type.PrintableString,
+    NameOID.JURISDICTION_COUNTRY_NAME: _ASN1Type.PrintableString,
+    NameOID.SERIAL_NUMBER: _ASN1Type.PrintableString,
+    NameOID.DN_QUALIFIER: _ASN1Type.PrintableString,
+    NameOID.EMAIL_ADDRESS: _ASN1Type.IA5String,
+    NameOID.DOMAIN_COMPONENT: _ASN1Type.IA5String,
+}
+
+# Type alias
+_OidNameMap = typing.Mapping[ObjectIdentifier, str]
+_NameOidMap = typing.Mapping[str, ObjectIdentifier]
+
+#: Short attribute names from RFC 4514:
+#: https://tools.ietf.org/html/rfc4514#page-7
+_NAMEOID_TO_NAME: _OidNameMap = {
+    NameOID.COMMON_NAME: "CN",
+    NameOID.LOCALITY_NAME: "L",
+    NameOID.STATE_OR_PROVINCE_NAME: "ST",
+    NameOID.ORGANIZATION_NAME: "O",
+    NameOID.ORGANIZATIONAL_UNIT_NAME: "OU",
+    NameOID.COUNTRY_NAME: "C",
+    NameOID.STREET_ADDRESS: "STREET",
+    NameOID.DOMAIN_COMPONENT: "DC",
+    NameOID.USER_ID: "UID",
+}
+_NAME_TO_NAMEOID = {v: k for k, v in _NAMEOID_TO_NAME.items()}
+
+_NAMEOID_LENGTH_LIMIT = {
+    NameOID.COUNTRY_NAME: (2, 2),
+    NameOID.JURISDICTION_COUNTRY_NAME: (2, 2),
+    NameOID.COMMON_NAME: (1, 64),
+}
+
+
+def _escape_dn_value(val: str | bytes) -> str:
+    """Escape special characters in RFC4514 Distinguished Name value."""
+
+    if not val:
+        return ""
+
+    # RFC 4514 Section 2.4 defines the value as being the # (U+0023) character
+    # followed by the hexadecimal encoding of the octets.
+    if isinstance(val, bytes):
+        return "#" + binascii.hexlify(val).decode("utf8")
+
+    # See https://tools.ietf.org/html/rfc4514#section-2.4
+    val = val.replace("\\", "\\\\")
+    val = val.replace('"', '\\"')
+    val = val.replace("+", "\\+")
+    val = val.replace(",", "\\,")
+    val = val.replace(";", "\\;")
+    val = val.replace("<", "\\<")
+    val = val.replace(">", "\\>")
+    val = val.replace("\0", "\\00")
+
+    if val[0] in ("#", " "):
+        val = "\\" + val
+    if val[-1] == " ":
+        val = val[:-1] + "\\ "
+
+    return val
+
+
+def _unescape_dn_value(val: str) -> str:
+    if not val:
+        return ""
+
+    # See https://tools.ietf.org/html/rfc4514#section-3
+
+    # special = escaped / SPACE / SHARP / EQUALS
+    # escaped = DQUOTE / PLUS / COMMA / SEMI / LANGLE / RANGLE
+    def sub(m):
+        val = m.group(1)
+        # Regular escape
+        if len(val) == 1:
+            return val
+        # Hex-value scape
+        return chr(int(val, 16))
+
+    return _RFC4514NameParser._PAIR_RE.sub(sub, val)
+
+
+class NameAttribute:
+    def __init__(
+        self,
+        oid: ObjectIdentifier,
+        value: str | bytes,
+        _type: _ASN1Type | None = None,
+        *,
+        _validate: bool = True,
+    ) -> None:
+        if not isinstance(oid, ObjectIdentifier):
+            raise TypeError(
+                "oid argument must be an ObjectIdentifier instance."
+            )
+        if _type == _ASN1Type.BitString:
+            if oid != NameOID.X500_UNIQUE_IDENTIFIER:
+                raise TypeError(
+                    "oid must be X500_UNIQUE_IDENTIFIER for BitString type."
+                )
+            if not isinstance(value, bytes):
+                raise TypeError("value must be bytes for BitString")
+        else:
+            if not isinstance(value, str):
+                raise TypeError("value argument must be a str")
+
+        length_limits = _NAMEOID_LENGTH_LIMIT.get(oid)
+        if length_limits is not None:
+            min_length, max_length = length_limits
+            assert isinstance(value, str)
+            c_len = len(value.encode("utf8"))
+            if c_len < min_length or c_len > max_length:
+                msg = (
+                    f"Attribute's length must be >= {min_length} and "
+                    f"<= {max_length}, but it was {c_len}"
+                )
+                if _validate is True:
+                    raise ValueError(msg)
+                else:
+                    warnings.warn(msg, stacklevel=2)
+
+        # The appropriate ASN1 string type varies by OID and is defined across
+        # multiple RFCs including 2459, 3280, and 5280. In general UTF8String
+        # is preferred (2459), but 3280 and 5280 specify several OIDs with
+        # alternate types. This means when we see the sentinel value we need
+        # to look up whether the OID has a non-UTF8 type. If it does, set it
+        # to that. Otherwise, UTF8!
+        if _type is None:
+            _type = _NAMEOID_DEFAULT_TYPE.get(oid, _ASN1Type.UTF8String)
+
+        if not isinstance(_type, _ASN1Type):
+            raise TypeError("_type must be from the _ASN1Type enum")
+
+        self._oid = oid
+        self._value = value
+        self._type = _type
+
+    @property
+    def oid(self) -> ObjectIdentifier:
+        return self._oid
+
+    @property
+    def value(self) -> str | bytes:
+        return self._value
+
+    @property
+    def rfc4514_attribute_name(self) -> str:
+        """
+        The short attribute name (for example "CN") if available,
+        otherwise the OID dotted string.
+        """
+        return _NAMEOID_TO_NAME.get(self.oid, self.oid.dotted_string)
+
+    def rfc4514_string(
+        self, attr_name_overrides: _OidNameMap | None = None
+    ) -> str:
+        """
+        Format as RFC4514 Distinguished Name string.
+
+        Use short attribute name if available, otherwise fall back to OID
+        dotted string.
+        """
+        attr_name = (
+            attr_name_overrides.get(self.oid) if attr_name_overrides else None
+        )
+        if attr_name is None:
+            attr_name = self.rfc4514_attribute_name
+
+        return f"{attr_name}={_escape_dn_value(self.value)}"
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, NameAttribute):
+            return NotImplemented
+
+        return self.oid == other.oid and self.value == other.value
+
+    def __hash__(self) -> int:
+        return hash((self.oid, self.value))
+
+    def __repr__(self) -> str:
+        return f"<NameAttribute(oid={self.oid}, value={self.value!r})>"
+
+
+class RelativeDistinguishedName:
+    def __init__(self, attributes: typing.Iterable[NameAttribute]):
+        attributes = list(attributes)
+        if not attributes:
+            raise ValueError("a relative distinguished name cannot be empty")
+        if not all(isinstance(x, NameAttribute) for x in attributes):
+            raise TypeError("attributes must be an iterable of NameAttribute")
+
+        # Keep list and frozenset to preserve attribute order where it matters
+        self._attributes = attributes
+        self._attribute_set = frozenset(attributes)
+
+        if len(self._attribute_set) != len(attributes):
+            raise ValueError("duplicate attributes are not allowed")
+
+    def get_attributes_for_oid(
+        self, oid: ObjectIdentifier
+    ) -> list[NameAttribute]:
+        return [i for i in self if i.oid == oid]
+
+    def rfc4514_string(
+        self, attr_name_overrides: _OidNameMap | None = None
+    ) -> str:
+        """
+        Format as RFC4514 Distinguished Name string.
+
+        Within each RDN, attributes are joined by '+', although that is rarely
+        used in certificates.
+        """
+        return "+".join(
+            attr.rfc4514_string(attr_name_overrides)
+            for attr in self._attributes
+        )
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, RelativeDistinguishedName):
+            return NotImplemented
+
+        return self._attribute_set == other._attribute_set
+
+    def __hash__(self) -> int:
+        return hash(self._attribute_set)
+
+    def __iter__(self) -> typing.Iterator[NameAttribute]:
+        return iter(self._attributes)
+
+    def __len__(self) -> int:
+        return len(self._attributes)
+
+    def __repr__(self) -> str:
+        return f"<RelativeDistinguishedName({self.rfc4514_string()})>"
+
+
+class Name:
+    @typing.overload
+    def __init__(self, attributes: typing.Iterable[NameAttribute]) -> None: ...
+
+    @typing.overload
+    def __init__(
+        self, attributes: typing.Iterable[RelativeDistinguishedName]
+    ) -> None: ...
+
+    def __init__(
+        self,
+        attributes: typing.Iterable[NameAttribute | RelativeDistinguishedName],
+    ) -> None:
+        attributes = list(attributes)
+        if all(isinstance(x, NameAttribute) for x in attributes):
+            self._attributes = [
+                RelativeDistinguishedName([typing.cast(NameAttribute, x)])
+                for x in attributes
+            ]
+        elif all(isinstance(x, RelativeDistinguishedName) for x in attributes):
+            self._attributes = typing.cast(
+                typing.List[RelativeDistinguishedName], attributes
+            )
+        else:
+            raise TypeError(
+                "attributes must be a list of NameAttribute"
+                " or a list RelativeDistinguishedName"
+            )
+
+    @classmethod
+    def from_rfc4514_string(
+        cls,
+        data: str,
+        attr_name_overrides: _NameOidMap | None = None,
+    ) -> Name:
+        return _RFC4514NameParser(data, attr_name_overrides or {}).parse()
+
+    def rfc4514_string(
+        self, attr_name_overrides: _OidNameMap | None = None
+    ) -> str:
+        """
+        Format as RFC4514 Distinguished Name string.
+        For example 'CN=foobar.com,O=Foo Corp,C=US'
+
+        An X.509 name is a two-level structure: a list of sets of attributes.
+        Each list element is separated by ',' and within each list element, set
+        elements are separated by '+'. The latter is almost never used in
+        real world certificates. According to RFC4514 section 2.1 the
+        RDNSequence must be reversed when converting to string representation.
+        """
+        return ",".join(
+            attr.rfc4514_string(attr_name_overrides)
+            for attr in reversed(self._attributes)
+        )
+
+    def get_attributes_for_oid(
+        self, oid: ObjectIdentifier
+    ) -> list[NameAttribute]:
+        return [i for i in self if i.oid == oid]
+
+    @property
+    def rdns(self) -> list[RelativeDistinguishedName]:
+        return self._attributes
+
+    def public_bytes(self, backend: typing.Any = None) -> bytes:
+        return rust_x509.encode_name_bytes(self)
+
+    def __eq__(self, other: object) -> bool:
+        if not isinstance(other, Name):
+            return NotImplemented
+
+        return self._attributes == other._attributes
+
+    def __hash__(self) -> int:
+        # TODO: this is relatively expensive, if this looks like a bottleneck
+        # for you, consider optimizing!
+        return hash(tuple(self._attributes))
+
+    def __iter__(self) -> typing.Iterator[NameAttribute]:
+        for rdn in self._attributes:
+            yield from rdn
+
+    def __len__(self) -> int:
+        return sum(len(rdn) for rdn in self._attributes)
+
+    def __repr__(self) -> str:
+        rdns = ",".join(attr.rfc4514_string() for attr in self._attributes)
+        return f"<Name({rdns})>"
+
+
+class _RFC4514NameParser:
+    _OID_RE = re.compile(r"(0|([1-9]\d*))(\.(0|([1-9]\d*)))+")
+    _DESCR_RE = re.compile(r"[a-zA-Z][a-zA-Z\d-]*")
+
+    _PAIR = r"\\([\\ #=\"\+,;<>]|[\da-zA-Z]{2})"
+    _PAIR_RE = re.compile(_PAIR)
+    _LUTF1 = r"[\x01-\x1f\x21\x24-\x2A\x2D-\x3A\x3D\x3F-\x5B\x5D-\x7F]"
+    _SUTF1 = r"[\x01-\x21\x23-\x2A\x2D-\x3A\x3D\x3F-\x5B\x5D-\x7F]"
+    _TUTF1 = r"[\x01-\x1F\x21\x23-\x2A\x2D-\x3A\x3D\x3F-\x5B\x5D-\x7F]"
+    _UTFMB = rf"[\x80-{chr(sys.maxunicode)}]"
+    _LEADCHAR = rf"{_LUTF1}|{_UTFMB}"
+    _STRINGCHAR = rf"{_SUTF1}|{_UTFMB}"
+    _TRAILCHAR = rf"{_TUTF1}|{_UTFMB}"
+    _STRING_RE = re.compile(
+        rf"""
+        (
+            ({_LEADCHAR}|{_PAIR})
+            (
+                ({_STRINGCHAR}|{_PAIR})*
+                ({_TRAILCHAR}|{_PAIR})
+            )?
+        )?
+        """,
+        re.VERBOSE,
+    )
+    _HEXSTRING_RE = re.compile(r"#([\da-zA-Z]{2})+")
+
+    def __init__(self, data: str, attr_name_overrides: _NameOidMap) -> None:
+        self._data = data
+        self._idx = 0
+
+        self._attr_name_overrides = attr_name_overrides
+
+    def _has_data(self) -> bool:
+        return self._idx < len(self._data)
+
+    def _peek(self) -> str | None:
+        if self._has_data():
+            return self._data[self._idx]
+        return None
+
+    def _read_char(self, ch: str) -> None:
+        if self._peek() != ch:
+            raise ValueError
+        self._idx += 1
+
+    def _read_re(self, pat) -> str:
+        match = pat.match(self._data, pos=self._idx)
+        if match is None:
+            raise ValueError
+        val = match.group()
+        self._idx += len(val)
+        return val
+
+    def parse(self) -> Name:
+        """
+        Parses the `data` string and converts it to a Name.
+
+        According to RFC4514 section 2.1 the RDNSequence must be
+        reversed when converting to string representation. So, when
+        we parse it, we need to reverse again to get the RDNs on the
+        correct order.
+        """
+
+        if not self._has_data():
+            return Name([])
+
+        rdns = [self._parse_rdn()]
+
+        while self._has_data():
+            self._read_char(",")
+            rdns.append(self._parse_rdn())
+
+        return Name(reversed(rdns))
+
+    def _parse_rdn(self) -> RelativeDistinguishedName:
+        nas = [self._parse_na()]
+        while self._peek() == "+":
+            self._read_char("+")
+            nas.append(self._parse_na())
+
+        return RelativeDistinguishedName(nas)
+
+    def _parse_na(self) -> NameAttribute:
+        try:
+            oid_value = self._read_re(self._OID_RE)
+        except ValueError:
+            name = self._read_re(self._DESCR_RE)
+            oid = self._attr_name_overrides.get(
+                name, _NAME_TO_NAMEOID.get(name)
+            )
+            if oid is None:
+                raise ValueError
+        else:
+            oid = ObjectIdentifier(oid_value)
+
+        self._read_char("=")
+        if self._peek() == "#":
+            value = self._read_re(self._HEXSTRING_RE)
+            value = binascii.unhexlify(value[1:]).decode()
+        else:
+            raw_value = self._read_re(self._STRING_RE)
+            value = _unescape_dn_value(raw_value)
+
+        return NameAttribute(oid, value)

venv/lib/python3.11/site-packages/cryptography/x509/ocsp.py

@@ -0,0 +1,344 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import datetime
+import typing
+
+from cryptography import utils, x509
+from cryptography.hazmat.bindings._rust import ocsp
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric.types import (
+    CertificateIssuerPrivateKeyTypes,
+)
+from cryptography.x509.base import (
+    _EARLIEST_UTC_TIME,
+    _convert_to_naive_utc_time,
+    _reject_duplicate_extension,
+)
+
+
+class OCSPResponderEncoding(utils.Enum):
+    HASH = "By Hash"
+    NAME = "By Name"
+
+
+class OCSPResponseStatus(utils.Enum):
+    SUCCESSFUL = 0
+    MALFORMED_REQUEST = 1
+    INTERNAL_ERROR = 2
+    TRY_LATER = 3
+    SIG_REQUIRED = 5
+    UNAUTHORIZED = 6
+
+
+_ALLOWED_HASHES = (
+    hashes.SHA1,
+    hashes.SHA224,
+    hashes.SHA256,
+    hashes.SHA384,
+    hashes.SHA512,
+)
+
+
+def _verify_algorithm(algorithm: hashes.HashAlgorithm) -> None:
+    if not isinstance(algorithm, _ALLOWED_HASHES):
+        raise ValueError(
+            "Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512"
+        )
+
+
+class OCSPCertStatus(utils.Enum):
+    GOOD = 0
+    REVOKED = 1
+    UNKNOWN = 2
+
+
+class _SingleResponse:
+    def __init__(
+        self,
+        cert: x509.Certificate,
+        issuer: x509.Certificate,
+        algorithm: hashes.HashAlgorithm,
+        cert_status: OCSPCertStatus,
+        this_update: datetime.datetime,
+        next_update: datetime.datetime | None,
+        revocation_time: datetime.datetime | None,
+        revocation_reason: x509.ReasonFlags | None,
+    ):
+        if not isinstance(cert, x509.Certificate) or not isinstance(
+            issuer, x509.Certificate
+        ):
+            raise TypeError("cert and issuer must be a Certificate")
+
+        _verify_algorithm(algorithm)
+        if not isinstance(this_update, datetime.datetime):
+            raise TypeError("this_update must be a datetime object")
+        if next_update is not None and not isinstance(
+            next_update, datetime.datetime
+        ):
+            raise TypeError("next_update must be a datetime object or None")
+
+        self._cert = cert
+        self._issuer = issuer
+        self._algorithm = algorithm
+        self._this_update = this_update
+        self._next_update = next_update
+
+        if not isinstance(cert_status, OCSPCertStatus):
+            raise TypeError(
+                "cert_status must be an item from the OCSPCertStatus enum"
+            )
+        if cert_status is not OCSPCertStatus.REVOKED:
+            if revocation_time is not None:
+                raise ValueError(
+                    "revocation_time can only be provided if the certificate "
+                    "is revoked"
+                )
+            if revocation_reason is not None:
+                raise ValueError(
+                    "revocation_reason can only be provided if the certificate"
+                    " is revoked"
+                )
+        else:
+            if not isinstance(revocation_time, datetime.datetime):
+                raise TypeError("revocation_time must be a datetime object")
+
+            revocation_time = _convert_to_naive_utc_time(revocation_time)
+            if revocation_time < _EARLIEST_UTC_TIME:
+                raise ValueError(
+                    "The revocation_time must be on or after"
+                    " 1950 January 1."
+                )
+
+            if revocation_reason is not None and not isinstance(
+                revocation_reason, x509.ReasonFlags
+            ):
+                raise TypeError(
+                    "revocation_reason must be an item from the ReasonFlags "
+                    "enum or None"
+                )
+
+        self._cert_status = cert_status
+        self._revocation_time = revocation_time
+        self._revocation_reason = revocation_reason
+
+
+OCSPRequest = ocsp.OCSPRequest
+OCSPResponse = ocsp.OCSPResponse
+OCSPSingleResponse = ocsp.OCSPSingleResponse
+
+
+class OCSPRequestBuilder:
+    def __init__(
+        self,
+        request: tuple[
+            x509.Certificate, x509.Certificate, hashes.HashAlgorithm
+        ]
+        | None = None,
+        request_hash: tuple[bytes, bytes, int, hashes.HashAlgorithm]
+        | None = None,
+        extensions: list[x509.Extension[x509.ExtensionType]] = [],
+    ) -> None:
+        self._request = request
+        self._request_hash = request_hash
+        self._extensions = extensions
+
+    def add_certificate(
+        self,
+        cert: x509.Certificate,
+        issuer: x509.Certificate,
+        algorithm: hashes.HashAlgorithm,
+    ) -> OCSPRequestBuilder:
+        if self._request is not None or self._request_hash is not None:
+            raise ValueError("Only one certificate can be added to a request")
+
+        _verify_algorithm(algorithm)
+        if not isinstance(cert, x509.Certificate) or not isinstance(
+            issuer, x509.Certificate
+        ):
+            raise TypeError("cert and issuer must be a Certificate")
+
+        return OCSPRequestBuilder(
+            (cert, issuer, algorithm), self._request_hash, self._extensions
+        )
+
+    def add_certificate_by_hash(
+        self,
+        issuer_name_hash: bytes,
+        issuer_key_hash: bytes,
+        serial_number: int,
+        algorithm: hashes.HashAlgorithm,
+    ) -> OCSPRequestBuilder:
+        if self._request is not None or self._request_hash is not None:
+            raise ValueError("Only one certificate can be added to a request")
+
+        if not isinstance(serial_number, int):
+            raise TypeError("serial_number must be an integer")
+
+        _verify_algorithm(algorithm)
+        utils._check_bytes("issuer_name_hash", issuer_name_hash)
+        utils._check_bytes("issuer_key_hash", issuer_key_hash)
+        if algorithm.digest_size != len(
+            issuer_name_hash
+        ) or algorithm.digest_size != len(issuer_key_hash):
+            raise ValueError(
+                "issuer_name_hash and issuer_key_hash must be the same length "
+                "as the digest size of the algorithm"
+            )
+
+        return OCSPRequestBuilder(
+            self._request,
+            (issuer_name_hash, issuer_key_hash, serial_number, algorithm),
+            self._extensions,
+        )
+
+    def add_extension(
+        self, extval: x509.ExtensionType, critical: bool
+    ) -> OCSPRequestBuilder:
+        if not isinstance(extval, x509.ExtensionType):
+            raise TypeError("extension must be an ExtensionType")
+
+        extension = x509.Extension(extval.oid, critical, extval)
+        _reject_duplicate_extension(extension, self._extensions)
+
+        return OCSPRequestBuilder(
+            self._request, self._request_hash, [*self._extensions, extension]
+        )
+
+    def build(self) -> OCSPRequest:
+        if self._request is None and self._request_hash is None:
+            raise ValueError("You must add a certificate before building")
+
+        return ocsp.create_ocsp_request(self)
+
+
+class OCSPResponseBuilder:
+    def __init__(
+        self,
+        response: _SingleResponse | None = None,
+        responder_id: tuple[x509.Certificate, OCSPResponderEncoding]
+        | None = None,
+        certs: list[x509.Certificate] | None = None,
+        extensions: list[x509.Extension[x509.ExtensionType]] = [],
+    ):
+        self._response = response
+        self._responder_id = responder_id
+        self._certs = certs
+        self._extensions = extensions
+
+    def add_response(
+        self,
+        cert: x509.Certificate,
+        issuer: x509.Certificate,
+        algorithm: hashes.HashAlgorithm,
+        cert_status: OCSPCertStatus,
+        this_update: datetime.datetime,
+        next_update: datetime.datetime | None,
+        revocation_time: datetime.datetime | None,
+        revocation_reason: x509.ReasonFlags | None,
+    ) -> OCSPResponseBuilder:
+        if self._response is not None:
+            raise ValueError("Only one response per OCSPResponse.")
+
+        singleresp = _SingleResponse(
+            cert,
+            issuer,
+            algorithm,
+            cert_status,
+            this_update,
+            next_update,
+            revocation_time,
+            revocation_reason,
+        )
+        return OCSPResponseBuilder(
+            singleresp,
+            self._responder_id,
+            self._certs,
+            self._extensions,
+        )
+
+    def responder_id(
+        self, encoding: OCSPResponderEncoding, responder_cert: x509.Certificate
+    ) -> OCSPResponseBuilder:
+        if self._responder_id is not None:
+            raise ValueError("responder_id can only be set once")
+        if not isinstance(responder_cert, x509.Certificate):
+            raise TypeError("responder_cert must be a Certificate")
+        if not isinstance(encoding, OCSPResponderEncoding):
+            raise TypeError(
+                "encoding must be an element from OCSPResponderEncoding"
+            )
+
+        return OCSPResponseBuilder(
+            self._response,
+            (responder_cert, encoding),
+            self._certs,
+            self._extensions,
+        )
+
+    def certificates(
+        self, certs: typing.Iterable[x509.Certificate]
+    ) -> OCSPResponseBuilder:
+        if self._certs is not None:
+            raise ValueError("certificates may only be set once")
+        certs = list(certs)
+        if len(certs) == 0:
+            raise ValueError("certs must not be an empty list")
+        if not all(isinstance(x, x509.Certificate) for x in certs):
+            raise TypeError("certs must be a list of Certificates")
+        return OCSPResponseBuilder(
+            self._response,
+            self._responder_id,
+            certs,
+            self._extensions,
+        )
+
+    def add_extension(
+        self, extval: x509.ExtensionType, critical: bool
+    ) -> OCSPResponseBuilder:
+        if not isinstance(extval, x509.ExtensionType):
+            raise TypeError("extension must be an ExtensionType")
+
+        extension = x509.Extension(extval.oid, critical, extval)
+        _reject_duplicate_extension(extension, self._extensions)
+
+        return OCSPResponseBuilder(
+            self._response,
+            self._responder_id,
+            self._certs,
+            [*self._extensions, extension],
+        )
+
+    def sign(
+        self,
+        private_key: CertificateIssuerPrivateKeyTypes,
+        algorithm: hashes.HashAlgorithm | None,
+    ) -> OCSPResponse:
+        if self._response is None:
+            raise ValueError("You must add a response before signing")
+        if self._responder_id is None:
+            raise ValueError("You must add a responder_id before signing")
+
+        return ocsp.create_ocsp_response(
+            OCSPResponseStatus.SUCCESSFUL, self, private_key, algorithm
+        )
+
+    @classmethod
+    def build_unsuccessful(
+        cls, response_status: OCSPResponseStatus
+    ) -> OCSPResponse:
+        if not isinstance(response_status, OCSPResponseStatus):
+            raise TypeError(
+                "response_status must be an item from OCSPResponseStatus"
+            )
+        if response_status is OCSPResponseStatus.SUCCESSFUL:
+            raise ValueError("response_status cannot be SUCCESSFUL")
+
+        return ocsp.create_ocsp_response(response_status, None, None, None)
+
+
+load_der_ocsp_request = ocsp.load_der_ocsp_request
+load_der_ocsp_response = ocsp.load_der_ocsp_response

venv/lib/python3.11/site-packages/cryptography/x509/oid.py

@@ -0,0 +1,35 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+from cryptography.hazmat._oid import (
+    AttributeOID,
+    AuthorityInformationAccessOID,
+    CertificatePoliciesOID,
+    CRLEntryExtensionOID,
+    ExtendedKeyUsageOID,
+    ExtensionOID,
+    NameOID,
+    ObjectIdentifier,
+    OCSPExtensionOID,
+    PublicKeyAlgorithmOID,
+    SignatureAlgorithmOID,
+    SubjectInformationAccessOID,
+)
+
+__all__ = [
+    "AttributeOID",
+    "AuthorityInformationAccessOID",
+    "CRLEntryExtensionOID",
+    "CertificatePoliciesOID",
+    "ExtendedKeyUsageOID",
+    "ExtensionOID",
+    "NameOID",
+    "OCSPExtensionOID",
+    "ObjectIdentifier",
+    "PublicKeyAlgorithmOID",
+    "SignatureAlgorithmOID",
+    "SubjectInformationAccessOID",
+]

venv/lib/python3.11/site-packages/cryptography/x509/verification.py

@@ -0,0 +1,28 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import annotations
+
+import typing
+
+from cryptography.hazmat.bindings._rust import x509 as rust_x509
+from cryptography.x509.general_name import DNSName, IPAddress
+
+__all__ = [
+    "ClientVerifier",
+    "PolicyBuilder",
+    "ServerVerifier",
+    "Store",
+    "Subject",
+    "VerificationError",
+    "VerifiedClient",
+]
+
+Store = rust_x509.Store
+Subject = typing.Union[DNSName, IPAddress]
+VerifiedClient = rust_x509.VerifiedClient
+ClientVerifier = rust_x509.ClientVerifier
+ServerVerifier = rust_x509.ServerVerifier
+PolicyBuilder = rust_x509.PolicyBuilder
+VerificationError = rust_x509.VerificationError