
!dV                 @   s   d  Z  d d g Z d d l Z d d l m Z m Z m Z m Z d a d Z	 d d	   Z
 d
 d   Z d d d  Z d d   Z d d   Z d S)z5
Create and verify jws-js format Ed25519 signatures.
signverify    N   )urlsafe_b64decodeurlsafe_b64encodenativebinaryZEd25519c               C   sO   t  sK y d d l  a  Wn( t t f k
 r@ d d l m a  Yn Xt   n  t  S)z&Lazy import-and-test of ed25519 moduler   N   )	ed25519py)	ed25519llImportErrorOSError r
   test r   r   :/tmp/pip-build-0jahl3lb/wheel/wheel/signatures/__init__.pyget_ed25519ll   s    
r   c       	      C   s   t    i t d 6i t d 6t t | j   d 6d 6} t t t j | d d   } t t t j |  d d   } d j | | f  } t	 j
 | | j  } | d t	 j  } t |  } i i t |  d	 6t |  d
 6g d 6t |  d 6S)z_Return a JWS-JS format signature given a JSON-serializable payload and 
    an Ed25519 keypair.algktyvkjwk	sort_keysT   .Nheader	signature
recipientspayload)r   ALGr   r   r   r   jsondumpsjoinr   Zcrypto_signskZSIGNATUREBYTES)	r   Zkeypairr   Zencoded_headerencoded_payloadsecured_inputsig_msgr   Zencoded_signaturer   r   r   r      s     !!r   c             C   s   |  s t  |   n  d  S)N)
ValueError)	conditionmessager   r   r   
assertTrue4   s    r(   c             C   s  t    |  d } t |  d  } g  } x| D]} t t |  d k d j |   t | d  } t | d  } t j t t |    } t | d t	 k d j | d   d | d	 k r d
 | d	 k r | d	 d | d	 d
 <n  t | d	 d
 t	 k d j | d	 d
   t t | d	 d   } d j
 | | f  }	 t |  }
 |
 |	 } t t j | |   } | j d  \ } } t |  } t t |   } | j t j |   q. Wt |  } t j t t |    } | | f S)zReturn (decoded headers, payload) if all signatures in jwsjs are
    consistent, else raise ValueError.
    
    Caller must decide whether the keys are actually trusted.r   r   r   zUnknown recipient key {0}r   r   r   zUnexpected algorithm {0}r   r   zUnexpected key type {0}r   r   .)r   r   r(   lenformatr   loadsr   r   r   r    r   Zcrypto_sign_opensplitappend)jwsjsr   r"   headersZ	recipienthsr   r   r#   sigr$   Zverified_inputZverified_headerZverified_payloadZdecoded_headerr   r   r   r   r   8   s6    
" 
c              C   s   t  j   }  i d d 6} t j t j t | |     } t |  | d d 7<y t |  Wn t k
 rt Yn Xt d   d  S)NZ	onstartupr   r   xz+No error from bad wheel.signatures payload.)	r   Zcrypto_sign_keypairr   r,   r   r   r   r%   RuntimeError)Zkpr   r/   r   r   r   r   ^   s    !
r   )__doc____all__r   utilr   r   r   r   r   r   r   r   r(   r   r   r   r   r   r   <module>   s   "&