File: //usr/lib/python3.6/site-packages/ipaclient/plugins/__pycache__/vault.cpython-36.pyc
3
�
�i� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z m Z d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZ d d lmZ d d
lm Z m Z d d l m Z d d l m!Z! d d
l m"Z" d dl#m$Z$m%Z%m&Z& d dl'm(Z( d dl m)Z)m*Z* d dl m+Z+m,Z,m-Z- d dl.m/Z/ d dl m0Z0 d dl1m2Z2 d dl3m4Z4 ej5e6�Z7d<dd�Z8e/� Z9d=Z:dd � Z;d>d d �Z<d?d d �Z=e9d!d"�G d#d$� d$e&��Z>e9d!d"�G d%d&� d&e%��Z?e9� G d'd(� d(e$��Z@e9d!d"�G d)d*� d*e%��ZAe9� G d+d,� d,e$��ZBG d-d.� d.�ZCeC� ZDe9d!d!d/�G d0d1� d1e ��ZEG d2d3� d3e$�ZFe9d!d"�G d4d5� d5e%��ZGe9� G d6d7� d7eF��ZHe9d!d"�G d8d9� d9e%��ZIe9� G d:d;� d;eF��ZJdS )@� )�print_functionN)�Fernet� InvalidToken)�default_backend)�hashes)�
PBKDF2HMAC)�padding)�Cipher�
algorithms�modes)�PKCS7)�load_pem_public_key�load_pem_private_key)�MethodOverride)�x509)� constants)�Local�Method�Object)�
classproperty)�api�errors)�Bytes�Flag�Str)�Registry)�_)�ipautil)�DNSName�rc C s� y(t j|||d��}|j� }W dQ R X W n� tk
rl } z(tj| td�||jd d� d��W Y dd}~X n> tk
r� } z"tj| td�||d� d��W Y dd}~X nX |S )ztRead file and catch errors
IOError and UnicodeError (for text files) are turned into a
ValidationError
)�mode�encodingNz(Cannot read file '%(filename)s': %(exc)s� )�filename�exc)�name�errorz*Cannot decode file '%(filename)s': %(exc)s) �io�open�read�IOErrorr �ValidationErrorr �args� UnicodeError)Zargnamer# r r! �f�datar$ � r0 �/usr/lib/python3.6/vault.py�validated_read8 s &"r2 � � c C s. t tj� d|dt� d�}tj|j| jd���S )z9
Generates symmetric key from password and salt.
� i�� )� algorithmZlength�saltZ
iterations�backendzutf-8)r r �SHA256r �base64� b64encodeZderive�encode)�passwordr7 Zkdfr0 r0 r1 �generate_symmetric_keyW s
r> c C st |dk r*|dk rt d��t|�}|j| �S |dk rht|t� d�}|j| tjtjtj � d�tj � dd��S t d��dS )z9
Encrypts data with symmetric key or public key.
Nz9Either a symmetric or a public key is required, not both.)r/ r8 )r6 )�mgfr6 �labelz/Either a symmetric or a public key is required.)
�
ValueErrorr �encryptr
r r �OAEP�MGF1r r9 )r/ �
symmetric_key�
public_key�fernetZpublic_key_objr0 r0 r1 rB f s"
rB c
C s� |dk rR|dk rt d��yt|�}|j| �S tk
rN tjtd�d��Y q�X np|dk r�y8t|dt� d�}|j| t j
t j t j
� d�t j
� dd��S t k
r� tjtd�d��Y q�X nt d��dS ) z9
Decrypts data with symmetric key or public key.
Nz:Either a symmetric or a private key is required, not both.zInvalid credentials)�message)r/ r= r8 )r6 )r? r6 r@ z0Either a symmetric or a private key is required.)rA r �decryptr r ZAuthenticationErrorr r r r rC rD r r9 )r/ rE � private_keyrG Zprivate_key_objr0 r0 r1 rI � s4
rI T)�no_failc @ s e Zd ZdZdS )� _fake_vault�vaultN)�__name__�
__module__� __qualname__r% r0 r0 r0 r1 rL � s rL c @ s e Zd ZdZdZdS )�_fake_vault_add_internal�vault_add_internalTN)rN rO rP r% �NO_CLIr0 r0 r0 r1 rQ � s rQ c s� e Zd Zed�Zedded�d�edded�d�ed d
ed �d�fZed d
� �Ze e�Z
e dd� �Z � fdd�Z
� fdd�Z� fdd�Zdd� Zdd� Z� ZS )� vault_addzCreate a new vault.z password?r= zVault password)�cli_name�doczpassword_file?�
password_filez"File containing the vault passwordzpublic_key_file?�public_key_filez$File containing the vault public keyc C s t jjd�tkS )NrR )r �Command�
get_pluginrQ )�clsr0 r0 r1 �__NO_CLI_getter� s
zvault_add.__NO_CLI_getterc C s | j jjjS )N)r rY rR � api_version)�selfr0 r0 r1 r] � s zvault_add.api_versionc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY rR r, �superrT �get_args)r^ �arg)� __class__r0 r1 r` � s
zvault_add.get_argsc # sJ x&| j jjj� D ]}|jdkr|V qW x tt| �j� D ]
}|V q8W d S )N� ipavaultsalt�version)rc rd )r rY rR �optionsr% r_ rT � get_options)r^ �option)rb r0 r1 rf � s
zvault_add.get_optionsc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY rR �
output_paramsr_ rT �get_output_params)r^ �param)rb r0 r1 ri � s
zvault_add.get_output_paramsc C s | j jjj� S )N)r rY rR �output)r^ r0 r0 r1 � _iter_output� s zvault_add._iter_outputc
O s� |j d�}|d kr&| jjj}|jjj}|j d�}|j d�}|j d�}|j d�}d|kr\|d= d|krj|d= d|krx|d= |dkr�|s�|r�tjt d�d��|d kr�|s�|r�tjt d
�d��| jj
j r�| jj j
} n
| jj j} | j� s�| j� |d kr�n |dk�rd|�r |�r tjt d �d��n8|�r$n0|�rDtd
|dd�}|jd�}n| jj jjd�}tjd�|d< n�|d k�r|�r�|�r�tjt d�d��n8|�r�n0|�r�td|dd�}||d< ntjdt d�d��yt|t� d� W n: tk
�r }
z tjdt d�|
d��W Y d d }
~
X nX | jjj||�} |j� } d | k�r:| d = d| k�rJ| d= |dk�rd|| d< | d= n|d k�rt| d= | jjj || � | S ) N� ipavaulttyper= rW �ipavaultpublickeyrX � symmetricz2Password can be specified only for symmetric vault)�reason�
asymmetricz5Public key can be specified only for asymmetric vault�standardz!Password specified multiple timesz
password-filezutf-8)r! �
z New password� rc z#Public key specified multiple timeszpublic-key-file�rb)r zMissing vault public key)r% r& )r/ r8 z+Invalid or unsupported vault public key: %s� description) �getr rY rR Zparamsrm �defaultr �MutuallyExclusiveErrorr �env� in_server�Backend�ldap2� rpcclient� isconnected�connectr2 �rstrip�textui�prompt_password�os�urandomr+ r
r rA �copy�
vault_archive)
r^ r, re �
vault_typeZ internal_cmdr= rW rF rX r8 �e�response�optsr0 r0 r1 �forward� s�
"
zvault_add.forward)rN rO rP r �__doc__r �
takes_options� classmethodZ_vault_add__NO_CLI_getterr rS �propertyr] r` rf ri rl r� �
__classcell__r0 r0 )rb r1 rT � s*
rT c @ s e Zd ZdZdZdS )�_fake_vault_mod_internal�vault_mod_internalTN)rN rO rP r% rS r0 r0 r0 r1 r� i s r� c s� e Zd Zed�Zeded�d�edded�d�ed d
ed �d�ed d
ed�d�edded�d�edded�d�edded�d�edded�d�fZe dd � �Z
e e
�Z e
d d � �Z� fd d �Z� fd!d"�Z� fd#d$�Zd%d&� Zd'd(� Z� ZS ))� vault_modzModify a vault.zchange_password?zChange password)rV z
old_password?� old_passwordzOld vault password)rU rV zold_password_file?�old_password_filez&File containing the old vault passwordz
new_password?� new_passwordzNew vault passwordznew_password_file?�new_password_filez&File containing the new vault passwordz private_key?rJ zOld vault private keyzprivate_key_file?�private_key_filez)File containing the old vault private keyzpublic_key_file?rX z(File containing the new vault public keyc C s t jjd�tkS )Nr� )r rY rZ r� )r[ r0 r0 r1 r\ � s
zvault_mod.__NO_CLI_getterc C s | j jjjS )N)r rY r� r] )r^ r0 r0 r1 r] � s zvault_mod.api_versionc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY r� r, r_ r� r` )r^ ra )rb r0 r1 r` � s
zvault_mod.get_argsc # sJ x&| j jjj� D ]}|jdkr|V qW x tt| �j� D ]
}|V q8W d S )Nrd )r rY r� re r% r_ r� rf )r^ rg )rb r0 r1 rf � s
zvault_mod.get_optionsc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY r� rh r_ r� ri )r^ rj )rb r0 r1 ri � s
zvault_mod.get_output_paramsc C s | j jjj� S )N)r rY r� rk )r^ r0 r0 r1 rl � s zvault_mod._iter_outputc O s\ |j dd�}|j dd�}|j dd�}|j dd �}|j dd �}|j dd �}|j dd �} |j d d �}
|j d
d �} |j d d �} |j d d �}
| jjjr�| jjj}n
| jjj}|j� s�|j� |r�n"|s�|s�| s�|r�d
}n | s�|
r�d}|�r2|j � }|j dd � ||d< ||d< |
|d < | |d
< | jj
j ||�}|d d }|j � }|�r�||d< |dk�rdd |d< d |d < n�|d
k�r�|�r~||d< nt j
d�|d< d |d < nh|dk�r�| �r�|
�r�tjtd�d��n0| �r�n(|
�r�td |
dd�} ntjd td�d��d |d< | |d < | jj
j||�}|�rX|j � }|j dd � ||d< ||d< | |d< d |d < | jj
j||� |S ) Nrm Frc �change_passwordr� r� r� r� rJ r� rn rX ro rq rv r= rW �resultr/ rr rt z'New public key specified multiple times)rp ru )r z Missing new vault public key)r% r& T�override_password)�popr rz r{ r| r} r~ r r� r� rY �vault_retriever� r� r ry r r2 r+ r� r� )r^ r, re r� r7 r� r� r� r� r� Zold_private_keyZold_private_key_fileZnew_public_keyZnew_public_key_filer8 r� r� r/ r0 r0 r1 r� � s�
zvault_mod.forward)rN rO rP r r� r r r r� r� Z_vault_mod__NO_CLI_getterr rS r� r] r` rf ri rl r� r� r0 r0 )rb r1 r� o sP
r� c @ s8 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd S )
�_KraConfigCachez9The KRA config cache stores vaultconfig-show result.
c C s t jjtjdd�| _d S )NZipaz
kra-config)r� �path�joinr ZUSER_CACHE_PATH�_dirname)r^ r0 r0 r1 �__init__) s z_KraConfigCache.__init__c C s t |�j� d }tjj| j|�S )Nz.json)r ZToASCIIr� r� r� r� )r^ �domain�basenamer0 r0 r1 �
_get_filename. s z _KraConfigCache._get_filenamec C s� | j |�}yTy t|�� }tj|�S Q R X W n0 tk
rZ } z|jtjkrJ� W Y dd}~X nX W n$ tk
r� tj d|dd� Y nX dS )z`Load config from cache
:param domain: IPA domain
:return: dict or None
NzFailed to load %sT)�exc_info)
r� r( �json�load�OSError�errno�ENOENT� Exception�logger�warning)r^ r� r# r. r� r0 r0 r1 r� 2 s
z_KraConfigCache.loadc & C s |d j � }tj|d �|d< | j|�}y�ytj| j� W n0 tk
rj } z|jtj krZ� W Y dd}~X nX t
j | jddd��Z}y0t j
||� tj|� |j� tj|j|� W n" tk
r� tj|j� � Y nX W dQ R X W n& tk
�r tjd|dd � dS X dS dS )
z�Store config in cache
:param domain: IPA domain
:param config: ipa vaultconfig-show response
:return: True if config was stored successfully
r� �transport_certNF�w)�dir�deleter zFailed to save %sT)r� )r� �sslZDER_cert_to_PEM_certr� r� �makedirsr� �EnvironmentErrorr� ZEEXIST�tempfileZNamedTemporaryFiler� �dumpr Z
flush_sync�close�renamer% r� �unlinkr� r� )r^ r� r� �configr# r� r. r0 r0 r1 �storeD s0
z_KraConfigCache.storec C s^ | j |�}ytj|� W n< tk
rT } z |jtjkrFtjd|dd� dS d}~X nX dS dS )z�Remove a config from cache, ignores errors
:param domain: IPA domain
:return: True if cert was found and removed
zFailed to remove %sT)r� FN)r� r� r� r� r� r� r� r� )r^ r� r# r� r0 r0 r1 �removeg s
z_KraConfigCache.removeN) rN rO rP r� r� r� r� r� r� r0 r0 r0 r1 r� & s #r� )�overriderK c s e Zd Z� fdd�Z� ZS )�vaultconfig_showc
sl |j d�}d|kr|d= tt| �j||�}tj| jjj|� |rht |d��}|j
|d d � W d Q R X |S )NZ
transport_out�wbr� r� ) rw r_ r� r� �_kra_config_cacher� r rz r� r( �write)r^ r, re �filer� r. )rb r0 r1 r� } s
zvaultconfig_show.forward)rN rO rP r� r� r0 r0 )rb r1 r� { s r� c @ s0 e Zd Zdd� Zd dd�Zd dd�Zdd � Zd
S )
� ModVaultDatac C sh |t jkr(td�}tj|jt|�d���|t jkrBtj t
j d��S |t j kr\tj
t
j d��S t|��d S )Nz2{algo} is not a supported vault wrapping algorithm)�algo� � �� rt � )r � VAULT_WRAPPING_SUPPORTED_ALGOSr r r+ �format�reprZVAULT_WRAPPING_AES128_CBCr
ZAESr� r� �VAULT_WRAPPING_3DESZ TripleDESrA )r^ r% �msgr0 r0 r1 �_generate_session_key� s
z"ModVaultData._generate_session_keyFc C s� d }|st j| jjj�}|d krD| jjj� }|d }tj|d �}ntj |d j
d��}|j d�}|d krrt j
}n<|t jkr�|}n,x*|d D ]}|t jkr�|}P q�W tjd��||fS )Nr� r� �asciiZwrapping_default_algorithmZ wrapping_supported_algorithmsz<No overlapping wrapping algorithm between server and client.)r� r� r rz r� rY r� r Zload_der_x509_certificateZload_pem_x509_certificater< rw r r� r� r r+ )r^ �
force_refreshr� r� r� Z default_algo�
wrapping_algor� r0 r0 r1 �_get_vaultconfig� s,
z ModVaultData._get_vaultconfigc
O s� |j � }|sdy|j|jtj� �}W q� tk
r` |j|jtjtjtj � d�tj � d d��}Y q�X n*|j|jtjtjtj � d�tj � d d��}||d< | j
d } y| j j | ||�S t
jt
jt
jfk
r� tj| j jj� |r�|r� Y nX d S )N)r6 )r? r6 r@ � session_keyZ _internal)rF rB �keyr ZPKCS1v15rA rC rD r r9 r% r rY r Z
InternalErrorZExecutionErrorZ GenericErrorr� r� rz r� )
r^ r� r� Zraise_unexpectedZuse_oaepr, re rF Zwrapped_session_keyr% r0 r0 r1 � _do_internal� s<
zModVaultData._do_internalc
O s� y | j ||ddf|�|�}W n. tjk
rJ | j ||ddf|�|�}Y nX |dk rX|S | jdd�d }| j ||ddf|�|�}|dk r�|S | j ||ddf|�|�S )z@
Calls the internal counterpart of the command.
FTN)r� r )r� r Z
EncodingErrorr� )r^ r� r� r, re r� r0 r0 r1 �internal� s
zModVaultData.internalN)F)F)rN rO rP r� r� r� r� r0 r0 r0 r1 r� � s
&
/r� c @ s e Zd ZdZdZdS )� _fake_vault_archive_internal�vault_archive_internalTN)rN rO rP r% rS r0 r0 r0 r1 r� s r� c s� e Zd Zed�Zeded�d�eded�d�edded �d
�ed d ed
�d
�eded�d�fZe dd� �Z
e e
�Z e
dd� �Z� fdd�Z� fdd�Z� fdd�Zdd� Zd d � Zd d � Z� ZS ) r� zArchive data into a vault.zdata?zBinary data to archive)rV zin?z File containing data to archivez password?r= zVault password)rU rV zpassword_file?rW z"File containing the vault passwordzoverride_password?zOverride existing passwordc C s t jjd�tkS )Nr� )r rY rZ r� )r[ r0 r0 r1 r\ 3 s
z vault_archive.__NO_CLI_getterc C s | j jjjS )N)r rY r� r] )r^ r0 r0 r1 r] : s zvault_archive.api_versionc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY r� r, r_ r� r` )r^ ra )rb r0 r1 r` > s
zvault_archive.get_argsc # sJ x&| j jjj� D ]}|jdkr|V qW x tt| �j� D ]
}|V q8W d S )N�noncer� �
vault_datard r� )r� r� r� rd r� )r rY r� re r% r_ r� rf )r^ rg )rb r0 r1 rf D s
zvault_archive.get_optionsc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY r� rh r_ r� ri )r^ rj )rb r0 r1 ri O s
z vault_archive.get_output_paramsc C s | j jjj� S )N)r rY r� rk )r^ r0 r0 r1 rl U s zvault_archive._iter_outputc C sl t j|jd �}t|j�j� }|j|�}||j� 7 }t|tj |�t
� d�}|j � }|j|�|j� }||fS )z�Encrypt data with wrapped session key and transport cert
:param algo: wrapping algorithm instance
:param bytes json_vault_data: dumped vault data
:return:
r� )r8 ) r� r� �
block_sizer �padder�update�finalizer r �CBCr � encryptor) r^ r� �json_vault_datar� r� � padded_data�cipherr� �wrapped_vault_datar0 r0 r1 �
_wrap_dataX s
zvault_archive._wrap_datac O s� |j d�}|j d�}|j d�}|j d�}|jdd�}d|krB|d= d|krP|d= d|kr^|d= d|krl|d= |r�|r�tjtd�d��n�|r�t|�tkr�tjdtd �d
ti d ��n�|�rDytj |�}W nF t
k
�r } z(tjdtd �|| j d
d� d ��W Y d d } ~ X nX |j tk�r4tjdtd �d
ti d ��t
d|dd�}nd}| jjj�r`| jjj}
n
| jjj}
|
j� �s||
j� | jjj||�d } | d d } | dk�r�d }
�n:| dk�r�|�r�|�r�tjtd�d��nT|�r�nL|�r�t
d|dd�}|jd�}n,|�r| jjjjd �}n| jjjjd dd �}|�sn|j� }||d< y| jjj ||� W n tj k
�rl Y nX | d d }t ||�}t ||d �}d }
nR| d!k�r�| d" d }t j!tj"d#��}t ||d �}t ||d$�}
ntjd%td&�d ��dt j!|�j#d�i}|
�rt j!|
�j#d�|d'< t$j%|�j&d�}| j'� \}}|jd(|�}|t(j)k�rR||d(< | j*|�}| j+||�\}}|j,||d)� | j-||f|�|�S )*Nr/ �inr= rW r� Fz#Input data specified multiple times)rp zLSize of data exceeds the limit. Current vault data size limit is %(limit)d B�limit)r% r& z(Cannot read file '%(filename)s': %(exc)sr" )r# r$ ru )r � r� rm r rr ro z!Password specified multiple timesz
password-filezutf-8)r! rs z New password�Password)�confirmrc )rE rq rn r5 )rF r� zInvalid vault type�
encrypted_keyr� )r� r� ).rw r� r ry r �len�MAX_VAULT_DATA_SIZEr+ r� �statr� r, �st_sizer2 r rz r{ r| r} r~ r r� rY �
vault_showr� r� r� r� r� ZNotFoundr> rB r: r; r� �decoder� �dumpsr< r� r r� r� r� r� r� )r^ r, re r/ Z
input_filer= rW r� r� r$ r8 rM r� r� r� r7 �encryption_keyrF r� r� r� r� r� r� r� r0 r0 r1 r� l s�
(
zvault_archive.forward)rN rO rP r r� r r r r� r� Z _vault_archive__NO_CLI_getterr rS r� r] r` rf ri rl r� r� r� r0 r0 )rb r1 r� s6
r� c @ s e Zd ZdZdZdS )� _fake_vault_retrieve_internal�vault_retrieve_internalTN)rN rO rP r% rS r0 r0 r0 r1 r� s r� c s� e Zd Zed�Zeded�d�edded�d�ed d
ed �d�ed d
ed�d�edded�d�fZeded�d�fZe dd� �Z
e e
�Z e
dd� �Z� fdd�Z� fdd �Z� fd d �Zd d � Zd!d"� Zd#d$� Z� ZS )%r� z Retrieve a data from a vault.zout?z File to store retrieved data)rV z password?r= zVault password)rU rV zpassword_file?rW z"File containing the vault passwordz private_key?rJ zVault private keyzprivate_key_file?r� z%File containing the vault private keyr/ ZData)r@ c C s t jjd�tkS )Nr� )r rY rZ r� )r[ r0 r0 r1 r\ 3 s
z vault_retrieve.__NO_CLI_getterc C s | j jjjS )N)r rY r� r] )r^ r0 r0 r1 r] : s zvault_retrieve.api_versionc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY r� r, r_ r� r` )r^ ra )rb r0 r1 r` > s
zvault_retrieve.get_argsc # sJ x&| j jjj� D ]}|jdkr|V qW x tt| �j� D ]
}|V q8W d S )Nr� rd r� )r� rd r� )r rY r� re r% r_ r� rf )r^ rg )rb r0 r1 rf D s
zvault_retrieve.get_optionsc # s@ x | j jjj� D ]
}|V qW x tt| �j� D ]
}|V q.W d S )N)r rY r� rh r_ r� ri )r^ rj )rb r0 r1 ri K s
z vault_retrieve.get_output_paramsc C s | j jjj� S )N)r rY r� rk )r^ r0 r0 r1 rl Q s zvault_retrieve._iter_outputc C sh t |tj|�t� d�}|j� }|j|�}||j� 7 }t|j�j � }|j|�}||j� 7 }t
j |j d��S )N)r8 zutf-8)
r r r� r � decryptorr� r� r r� �unpadderr� �loadsr� ) r^ r� r� r� r� r� r� r� r� r0 r0 r1 �_unwrap_responseT s
z vault_retrieve._unwrap_responsec O s� |j d�}|j d�}|j d�}|j d�}|j d�}d|kr@|d= d|krN|d= d|kr\|d= d|krj|d= d|krx|d= | jjjr�| jjj}n
| jjj}|j� s�|j� | jj j
||�d } | d d }
| j � \} } |j d | �} | t
jkr�| |d < | j| �}
| j|
| f|�|�}| j|
|d d
|d d �}~
tj|d jd
��}d }d|k�rftj|d jd
��}|
dk�rt�n |
dk�r�| d d }|�r�|�r�tjtd�d��n<|�r�n4|�r�td|d
d�}|jd�}n| jjjjddd�}t ||�}t ||d�}n�|
dk�rn|�r$|�r$tjtd �d��n0|�r,n(|�rBtd |d d �}ntj dtd �d!��t ||d"�}t ||d�}ntj d#td$�d!��|�r�t |d%��}|j |� W d Q R X n d |i|d< |S )&N�outr= rW rJ r� r� rm r r� r� r� r/ zutf-8r� rr ro rc z!Password specified multiple times)rp z
password-file)r! rs r� F)r� )rE rq z$Private key specified multiple timeszprivate-key-fileru )r zMissing vault private key)r% r& )rJ r� zInvalid vault typer� )!rw r rz r{ r| r} r~ r r� rY r� r� r� r r� r� r� r� r: Z b64decoder< r ry r r2 r� r� r� r> rI r+ r( r� )r^ r, re Z output_filer= rW rJ r� r8 rM r� r� r� r� r� r� r/ r� r7 r� r. r0 r0 r1 r� a s�
zvault_retrieve.forward)rN rO rP r r� r r r� Zhas_output_paramsr� Z _vault_retrieve__NO_CLI_getterr rS r� r] r` rf ri rl r� r� r� r0 r0 )rb r1 r�
s@
r� )r Ni )NN)NN)KZ
__future__r r: r� r' r� Zloggingr� r� r� Zcryptography.fernetr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Z)cryptography.hazmat.primitives.kdf.pbkdf2r Z)cryptography.hazmat.primitives.asymmetricr Z&cryptography.hazmat.primitives.ciphersr r
r Z&cryptography.hazmat.primitives.paddingr Z,cryptography.hazmat.primitives.serializationr
r Zipaclient.frontendr Zipalibr r Zipalib.frontendr r r Z ipalib.utilr r r r r r Zipalib.plugabler r Z ipapythonr Zipapython.dnsutilr Z getLoggerrN r� r2 �registerr� r> rB rI rL rQ rT r� r� r� r� r� r� r� r� r� r� r0 r0 r0 r1 �<module> sx
& 5 7R q