403Webshell
Server IP : 172.67.201.108  /  Your IP : 216.73.216.55
Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.7
System : Linux ip-172-31-69-123.ec2.internal 6.1.177-224.371.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jul 27 20:28:29 UTC 2026 x86_64
User : ec2-user ( 1000)
PHP Version : 8.4.24
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /lib/python3.9/site-packages/cfnbootstrap/__pycache__/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /lib/python3.9/site-packages/cfnbootstrap/__pycache__/_ca_install.cpython-39.pyc
a

��Rj�,�@s�dZddlZddlZddlmZe�d�ZdZGdd�de�Z	e
hd��Zeed	�d
d�Z
eed	�dd
�Zeed	�dd�Zed�dd�Zdd�dd�Zedd�dd�Zedd�dd�Zeed�dd�ZdS)a0
OS dispatcher for the override CA install/trust subsystem.

Public surface:

    ensure_ca_override_installed()  -- safe + cheap to call from every cfn-*
                                       entrypoint at process startup. Idempotent.
                                       Linux: no-op (the existing _certs path
                                       points the stdlib ssl module at the
                                       override PEM file directly). Windows:
                                       delegates to _ca_install_win.install_or_rotate
                                       which installs/rotates trust in the
                                       Windows cert stores via certutil.exe
                                       subprocess calls.

    CaOverrideError                 -- the single exception class raised by this
                                       subsystem. Distinguish failure modes via
                                       the .kind string attribute (NOT subclass).
                                       cfn-* entrypoints MUST NOT catch this
                                       error -- letting it terminate the process
                                       with full traceback is the documented
                                       behaviour so on-call sees the root cause.

Hard invariants enforced here:

    * Never imports `ssl` or `OpenSSL`. The Windows path uses subprocess only.
    * Linux behaviour is byte-for-byte unchanged: PEM absent => no-op; PEM
      present => no-op (the request-time _certs.resolve_ca_bundle() already
      hands the PEM to the stdlib ssl module).
    * The no-override commercial Windows path is byte-for-byte unchanged:
      missing PEM short-circuits BEFORE any hashing or install work.
    * Inclusive language only (per the Inclusive Tech word list).
�N)�Optionalzcfn.initz[CaOverrideInstall]csDeZdZdZehd��Zeedd��fdd�Zed�dd	�Z�Z	S)
�CaOverrideErrora�Single exception class for every failure in the override-CA subsystem.

    Distinguish failure modes via the ``.kind`` string attribute (one of the
    values listed in the design's section 4). Callers MUST NOT branch on the
    exception subclass; branch on ``.kind`` only.

    Attributes:
        kind: One of the canonical kind strings.
        message: Human-readable message. By convention starts with
            ``[CaOverrideInstall]`` and ends with operator-actionable guidance.
    >Zclassify�concurrent_installZfipsZ
certutil_callZcert_not_foundZ	pem_parseZcertutil_not_found�marker_writeZstate_fsZstore_not_writable�budget_exceededZ
pem_not_foundN)�kind�message�returncst��|�||_||_dS)z�Construct a CaOverrideError.

        Args:
            kind: Canonical kind string (see ``KINDS``).
            message: Human-readable diagnostic for the operator.
        N)�super�__init__rr)�selfrr��	__class__��</usr/lib/python3.9/site-packages/cfnbootstrap/_ca_install.pyr[szCaOverrideError.__init__�r	cCsd|j|jfS)Nz$CaOverrideError(kind=%r, message=%r))rr)rrrr�__repr__fszCaOverrideError.__repr__)
�__name__�
__module__�__qualname__�__doc__�	frozensetZKINDS�strrr�
__classcell__rrr
rr<sr>rrr)�excr	cCst|dd�tvS)z�True if ``exc`` is a CaOverrideError whose ``.kind`` is transient/benign
    (see :data:`BENIGN_INSTALL_KINDS`) and should be logged-and-tolerated rather
    than turned into a hard process exit. Pure predicate: no ssl, no I/O.rN)�getattr�BENIGN_INSTALL_KINDS)rrrr�is_benign_install_failure~srcCst|dd�}dt||fS)z�Log line for a BENIGN install failure the tool is deliberately tolerating
    (as opposed to :func:`format_install_failure`, which is the loud fatal
    line). Pure string formatting: no ssl, no I/O.r�unknownz�%s override CA install did not complete (kind=%s): %s -- transient/benign, continuing (a peer process or later run will complete it)�r�_LOG_PREFIX�rrrrr�format_install_tolerated�s
��r"cCst|dd�}dt||fS)a_Return the single, uniform 'override CA install FAILED' log line.

    Shared by every cfn-* entrypoint (and cfnbootstrap.winhup) so the loud
    failure message is byte-identical across all callers. Pure string
    formatting: imports NO ``ssl`` and performs NO I/O.

    Args:
        exc: The exception that aborted the override-CA install. When it is a
            :class:`CaOverrideError` its ``.kind`` is surfaced; otherwise the
            kind is reported as ``'unknown'``.

    Returns:
        A greppable, operator-actionable single-line string prefixed with
        ``[CaOverrideInstall]``.
    rrz`%s override CA install FAILED (kind=%s): %s -- refusing to continue with system-store-only trustrr!rrr�format_install_failure�s
��r#rcCsddlm}|��S)z�Return the configured override-PEM path WITHOUT validating existence.

    Honours the pre-existing ``CA_OVERRIDE`` env var via
    :func:`cfnbootstrap.http._certs._override_path`. No new env var is
    introduced for the source-PEM path.
    r��_certs)Zcfnbootstrap.httpr%Z_override_pathr$rrr�_resolve_override_pem_path�s
r&cCsTt�dt�t�}|r"tj�|�s4t�dt|�dStjdkrHt|�nt	|�dS)a'Ensure the override CA(s) at the platform PEM path are trusted by the OS.

    Safe and cheap to call from every cfn-* entrypoint at process startup.
    No-op when no override PEM is present (commercial path). Idempotent: when
    the on-disk marker records the current PEM hash, returns in O(1) without
    invoking certutil.

    Raises:
        CaOverrideError: on any hard failure (PEM corrupt, certutil missing
            or failed, marker unwritable, FIPS refusal, concurrent-install
            lock contention, wall-clock budget exhaustion). cfn-* entrypoints
            MUST NOT catch this error.

    Returns:
        None. The function is intended for its side effect of populating the
        Windows cert stores (Root / CA) on os.name == 'nt'. On Linux it is a
        documented no-op.
    z&%s ensure_ca_override_installed calledz,%s no override PEM at %s; nothing to installN�nt)
�log�debugr r&�os�path�isfile�name�_dispatch_windows�_dispatch_posix��pem_pathrrr�ensure_ca_override_installed�s�

r2)r1r	cCst�dt|�dS)a�Linux dispatch path.

    The existing :func:`cfnbootstrap.http._certs.resolve_ca_bundle` already
    returns the override PEM path directly to the stdlib ``ssl`` module via
    :mod:`cfnbootstrap.http._backend_posix`, so trust is enforced at request
    time without any install step. This function is a documented no-op that
    exists so the wiring in the cfn-* entrypoints is identical across
    platforms.
    zw%s POSIX dispatch: override PEM at %s will be honoured at request time by the stdlib ssl module; no install step neededN)r(r)r r0rrrr/�s
�r/cCs4ddlm}tj�dtj�d��}|j||d�dS)a@Windows dispatch path.

    Delegates to :mod:`cfnbootstrap._ca_install_win`. The Windows module
    handles PEM hashing, marker fast-path, concurrent-install lock,
    classify-via-certutil-dump, addstore-with-probe, and rotation.

    Raises:
        CaOverrideError: propagated unchanged from the Windows module.
    r)�_ca_install_winZCFN_CA_OVERRIDE_MARKER_PATHz/${SystemDrive}\cfn\state\ca-install-marker.json)r1�marker_pathN)Zcfnbootstrapr3r*�environ�getr+�
expandvarsZinstall_or_rotate)r1r3r4rrrr.�s

�r.cCs(z
t�}WntyYdS0|p&dS)z�Return the resolved override-PEM path or None if unconfigured.

    Used by diagnostic / status tools; not used by the install hot path.
    N)r&�	Exception)r+rrr�"_override_pem_path_for_diagnostics
s

r9)rZloggingr*�typingrZ	getLoggerr(r r8rrr�boolrrr"r#r&r2r/r.r9rrrr�<module>s!
;*

Youez - 2016 - github.com/yon3zu
LinuXploit