<h2>Editing File: /usr/lib64/python3.6/site-packages/cryptography/hazmat/primitives/serialization/pkcs7.py</h2><form method='post'><textarea name='content' class='file-edit'># This file is dual licensed under the terms of the Apache License, Version
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
# for complete details.

from __future__ import absolute_import, division, print_function

from enum import Enum

from cryptography import x509
from cryptography.hazmat.backends import _get_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec, rsa
from cryptography.utils import _check_byteslike


def load_pem_pkcs7_certificates(data):
    backend = _get_backend(None)
    return backend.load_pem_pkcs7_certificates(data)


def load_der_pkcs7_certificates(data):
    backend = _get_backend(None)
    return backend.load_der_pkcs7_certificates(data)


class PKCS7SignatureBuilder(object):
    def __init__(self, data=None, signers=[], additional_certs=[]):
        self._data = data
        self._signers = signers
        self._additional_certs = additional_certs

    def set_data(self, data):
        _check_byteslike(&quot;data&quot;, data)
        if self._data is not None:
            raise ValueError(&quot;data may only be set once&quot;)

        return PKCS7SignatureBuilder(data, self._signers)

    def add_signer(self, certificate, private_key, hash_algorithm):
        if not isinstance(
            hash_algorithm,
            (
                hashes.SHA1,
                hashes.SHA224,
                hashes.SHA256,
                hashes.SHA384,
                hashes.SHA512,
            ),
        ):
            raise TypeError(
                &quot;hash_algorithm must be one of hashes.SHA1, SHA224, &quot;
                &quot;SHA256, SHA384, or SHA512&quot;
            )
        if not isinstance(certificate, x509.Certificate):
            raise TypeError(&quot;certificate must be a x509.Certificate&quot;)

        if not isinstance(
            private_key, (rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey)
        ):
            raise TypeError(&quot;Only RSA &amp; EC keys are supported at this time.&quot;)

        return PKCS7SignatureBuilder(
            self._data,
            self._signers + [(certificate, private_key, hash_algorithm)],
        )

    def add_certificate(self, certificate):
        if not isinstance(certificate, x509.Certificate):
            raise TypeError(&quot;certificate must be a x509.Certificate&quot;)

        return PKCS7SignatureBuilder(
            self._data, self._signers, self._additional_certs + [certificate]
        )

    def sign(self, encoding, options, backend=None):
        if len(self._signers) == 0:
            raise ValueError(&quot;Must have at least one signer&quot;)
        if self._data is None:
            raise ValueError(&quot;You must add data to sign&quot;)
        options = list(options)
        if not all(isinstance(x, PKCS7Options) for x in options):
            raise ValueError(&quot;options must be from the PKCS7Options enum&quot;)
        if encoding not in (
            serialization.Encoding.PEM,
            serialization.Encoding.DER,
            serialization.Encoding.SMIME,
        ):
            raise ValueError(
                &quot;Must be PEM, DER, or SMIME from the Encoding enum&quot;
            )

        # Text is a meaningless option unless it is accompanied by
        # DetachedSignature
        if (
            PKCS7Options.Text in options
            and PKCS7Options.DetachedSignature not in options
        ):
            raise ValueError(
                &quot;When passing the Text option you must also pass &quot;
                &quot;DetachedSignature&quot;
            )

        if PKCS7Options.Text in options and encoding in (
            serialization.Encoding.DER,
            serialization.Encoding.PEM,
        ):
            raise ValueError(
                &quot;The Text option is only available for SMIME serialization&quot;
            )

        # No attributes implies no capabilities so we'll error if you try to
        # pass both.
        if (
            PKCS7Options.NoAttributes in options
            and PKCS7Options.NoCapabilities in options
        ):
            raise ValueError(
                &quot;NoAttributes is a superset of NoCapabilities. Do not pass &quot;
                &quot;both values.&quot;
            )

        backend = _get_backend(backend)
        return backend.pkcs7_sign(self, encoding, options)


class PKCS7Options(Enum):
    Text = &quot;Add text/plain MIME type&quot;
    Binary = &quot;Don't translate input data into canonical MIME format&quot;
    DetachedSignature = &quot;Don't embed data in the PKCS7 structure&quot;
    NoCapabilities = &quot;Don't embed SMIME capabilities&quot;
    NoAttributes = &quot;Don't embed authenticatedAttributes&quot;
    NoCerts = &quot;Don't embed signer certificate&quot;
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flib64%2Fpython3.6%2Fsite-packages%2Fcryptography%2Fhazmat%2Fprimitives%2Fserialization'>Back to Directory</a>