Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified
📁 ..	-	2026-03-27 02:58
📄 __init__.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import logging import os import re __version__ = '1.38.23' class NullHandler(logging.Handler): def emit(self, record): pass # Configure default logger to do nothing log = logging.getLogger('botocore') log.addHandler(NullHandler()) _INITIALIZERS = [] _first_cap_regex = re.compile('(.)([A-Z][a-z]+)') _end_cap_regex = re.compile('([a-z0-9])([A-Z])') # The regex below handles the special case where some acronym # name is pluralized, e.g GatewayARNs, ListWebACLs, SomeCNAMEs. _special_case_transform = re.compile('[A-Z]{2,}s$') # Prepopulate the cache with special cases that don't match # our regular transformation. _xform_cache = { ('CreateCachediSCSIVolume', '_'): 'create_cached_iscsi_volume', ('CreateCachediSCSIVolume', '-'): 'create-cached-iscsi-volume', ('DescribeCachediSCSIVolumes', '_'): 'describe_cached_iscsi_volumes', ('DescribeCachediSCSIVolumes', '-'): 'describe-cached-iscsi-volumes', ('DescribeStorediSCSIVolumes', '_'): 'describe_stored_iscsi_volumes', ('DescribeStorediSCSIVolumes', '-'): 'describe-stored-iscsi-volumes', ('CreateStorediSCSIVolume', '_'): 'create_stored_iscsi_volume', ('CreateStorediSCSIVolume', '-'): 'create-stored-iscsi-volume', ('ListHITsForQualificationType', '_'): 'list_hits_for_qualification_type', ('ListHITsForQualificationType', '-'): 'list-hits-for-qualification-type', ('ExecutePartiQLStatement', '_'): 'execute_partiql_statement', ('ExecutePartiQLStatement', '-'): 'execute-partiql-statement', ('ExecutePartiQLTransaction', '_'): 'execute_partiql_transaction', ('ExecutePartiQLTransaction', '-'): 'execute-partiql-transaction', ('ExecutePartiQLBatch', '_'): 'execute_partiql_batch', ('ExecutePartiQLBatch', '-'): 'execute-partiql-batch', ( 'AssociateWhatsAppBusinessAccount', '_', ): 'associate_whatsapp_business_account', ( 'AssociateWhatsAppBusinessAccount', '-', ): 'associate-whatsapp-business-account', ('DeleteWhatsAppMessageMedia', '_'): 'delete_whatsapp_message_media', ('DeleteWhatsAppMessageMedia', '-'): 'delete-whatsapp-message-media', ( 'DisassociateWhatsAppBusinessAccount', '_', ): 'disassociate_whatsapp_business_account', ( 'DisassociateWhatsAppBusinessAccount', '-', ): 'disassociate-whatsapp-business-account', ( 'GetLinkedWhatsAppBusinessAccount', '_', ): 'get_linked_whatsapp_business_account', ( 'GetLinkedWhatsAppBusinessAccount', '-', ): 'get-linked-whatsapp-business-account', ( 'GetLinkedWhatsAppBusinessAccountPhoneNumber', '_', ): 'get_linked_whatsapp_business_account_phone_number', ( 'GetLinkedWhatsAppBusinessAccountPhoneNumber', '-', ): 'get-linked-whatsapp-business-account-phone-number', ('GetWhatsAppMessageMedia', '_'): 'get_whatsapp_message_media', ('GetWhatsAppMessageMedia', '-'): 'get-whatsapp-message-media', ( 'ListLinkedWhatsAppBusinessAccounts', '_', ): 'list_linked_whatsapp_business_accounts', ( 'ListLinkedWhatsAppBusinessAccounts', '-', ): 'list-linked-whatsapp-business-accounts', ('PostWhatsAppMessageMedia', '_'): 'post_whatsapp_message_media', ('PostWhatsAppMessageMedia', '-'): 'post-whatsapp-message-media', ( 'PutWhatsAppBusinessAccountEventDestinations', '_', ): 'put_whatsapp_business_account_event_destinations', ( 'PutWhatsAppBusinessAccountEventDestinations', '-', ): 'put-whatsapp-business-account-event-destinations', ('SendWhatsAppMessage', '_'): 'send_whatsapp_message', ('SendWhatsAppMessage', '-'): 'send-whatsapp-message', } ScalarTypes = ('string', 'integer', 'boolean', 'timestamp', 'float', 'double') BOTOCORE_ROOT = os.path.dirname(os.path.abspath(__file__)) # Used to specify anonymous (unsigned) request signature class UNSIGNED: def __copy__(self): return self def __deepcopy__(self, memodict): return self UNSIGNED = UNSIGNED() def xform_name(name, sep='_', _xform_cache=_xform_cache): """Convert camel case to a "pythonic" name. If the name contains the ``sep`` character, then it is returned unchanged. """ if sep in name: # If the sep is in the name, assume that it's already # transformed and return the string unchanged. return name key = (name, sep) if key not in _xform_cache: if _special_case_transform.search(name) is not None: is_special = _special_case_transform.search(name) matched = is_special.group() # Replace something like ARNs, ACLs with _arns, _acls. name = f"{name[: -len(matched)]}{sep}{matched.lower()}" s1 = _first_cap_regex.sub(r'\1' + sep + r'\2', name) transformed = _end_cap_regex.sub(r'\1' + sep + r'\2', s1).lower() _xform_cache[key] = transformed return _xform_cache[key] def register_initializer(callback): """Register an initializer function for session creation. This initializer function will be invoked whenever a new `botocore.session.Session` is instantiated. :type callback: callable :param callback: A callable that accepts a single argument of type `botocore.session.Session`. """ _INITIALIZERS.append(callback) def unregister_initializer(callback): """Unregister an initializer function. :type callback: callable :param callback: A callable that was previously registered with `botocore.register_initializer`. :raises ValueError: If a callback is provided that is not currently registered as an initializer. """ _INITIALIZERS.remove(callback) def invoke_initializers(session): """Invoke all initializers for a session. :type session: botocore.session.Session :param session: The session to initialize. """ for initializer in _INITIALIZERS: initializer(session)	6.49 KB	2025-05-25 12:26
📁 __pycache__	-	2025-05-25 12:26
📄 args.py # Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Internal module to help with normalizing botocore client args. This module (and all function/classes within this module) should be considered internal, and not a public API. """ import copy import logging import socket import botocore.exceptions import botocore.parsers import botocore.serialize from botocore.config import Config from botocore.endpoint import EndpointCreator from botocore.regions import EndpointResolverBuiltins as EPRBuiltins from botocore.regions import EndpointRulesetResolver from botocore.signers import RequestSigner from botocore.useragent import UserAgentString, register_feature_id from botocore.utils import ensure_boolean, is_s3_accelerate_url logger = logging.getLogger(__name__) VALID_REGIONAL_ENDPOINTS_CONFIG = [ 'legacy', 'regional', ] LEGACY_GLOBAL_STS_REGIONS = [ 'ap-northeast-1', 'ap-south-1', 'ap-southeast-1', 'ap-southeast-2', 'aws-global', 'ca-central-1', 'eu-central-1', 'eu-north-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'sa-east-1', 'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2', ] # Maximum allowed length of the ``user_agent_appid`` config field. Longer # values result in a warning-level log message. USERAGENT_APPID_MAXLEN = 50 VALID_REQUEST_CHECKSUM_CALCULATION_CONFIG = ( "when_supported", "when_required", ) VALID_RESPONSE_CHECKSUM_VALIDATION_CONFIG = ( "when_supported", "when_required", ) PRIORITY_ORDERED_SUPPORTED_PROTOCOLS = ( 'smithy-rpc-v2-cbor', 'json', 'rest-json', 'rest-xml', 'query', 'ec2', ) VALID_ACCOUNT_ID_ENDPOINT_MODE_CONFIG = ( 'preferred', 'disabled', 'required', ) class ClientArgsCreator: def __init__( self, event_emitter, user_agent, response_parser_factory, loader, exceptions_factory, config_store, user_agent_creator=None, ): self._event_emitter = event_emitter self._response_parser_factory = response_parser_factory self._loader = loader self._exceptions_factory = exceptions_factory self._config_store = config_store if user_agent_creator is None: self._session_ua_creator = UserAgentString.from_environment() else: self._session_ua_creator = user_agent_creator def get_client_args( self, service_model, region_name, is_secure, endpoint_url, verify, credentials, scoped_config, client_config, endpoint_bridge, auth_token=None, endpoints_ruleset_data=None, partition_data=None, ): final_args = self.compute_client_args( service_model, client_config, endpoint_bridge, region_name, endpoint_url, is_secure, scoped_config, ) service_name = final_args['service_name'] # noqa parameter_validation = final_args['parameter_validation'] endpoint_config = final_args['endpoint_config'] protocol = final_args['protocol'] config_kwargs = final_args['config_kwargs'] s3_config = final_args['s3_config'] partition = endpoint_config['metadata'].get('partition', None) socket_options = final_args['socket_options'] configured_endpoint_url = final_args['configured_endpoint_url'] signing_region = endpoint_config['signing_region'] endpoint_region_name = endpoint_config['region_name'] account_id_endpoint_mode = config_kwargs['account_id_endpoint_mode'] event_emitter = copy.copy(self._event_emitter) signer = RequestSigner( service_model.service_id, signing_region, endpoint_config['signing_name'], endpoint_config['signature_version'], credentials, event_emitter, auth_token, ) config_kwargs['s3'] = s3_config new_config = Config(config_kwargs) endpoint_creator = EndpointCreator(event_emitter) endpoint = endpoint_creator.create_endpoint( service_model, region_name=endpoint_region_name, endpoint_url=endpoint_config['endpoint_url'], verify=verify, response_parser_factory=self._response_parser_factory, max_pool_connections=new_config.max_pool_connections, proxies=new_config.proxies, timeout=(new_config.connect_timeout, new_config.read_timeout), socket_options=socket_options, client_cert=new_config.client_cert, proxies_config=new_config.proxies_config, ) serializer = botocore.serialize.create_serializer( protocol, parameter_validation ) response_parser = botocore.parsers.create_parser(protocol) ruleset_resolver = self._build_endpoint_resolver( endpoints_ruleset_data, partition_data, client_config, service_model, endpoint_region_name, region_name, configured_endpoint_url, endpoint, is_secure, endpoint_bridge, event_emitter, credentials, account_id_endpoint_mode, ) # Copy the session's user agent factory and adds client configuration. client_ua_creator = self._session_ua_creator.with_client_config( new_config ) supplied_ua = client_config.user_agent if client_config else None new_config._supplied_user_agent = supplied_ua return { 'serializer': serializer, 'endpoint': endpoint, 'response_parser': response_parser, 'event_emitter': event_emitter, 'request_signer': signer, 'service_model': service_model, 'loader': self._loader, 'client_config': new_config, 'partition': partition, 'exceptions_factory': self._exceptions_factory, 'endpoint_ruleset_resolver': ruleset_resolver, 'user_agent_creator': client_ua_creator, } def compute_client_args( self, service_model, client_config, endpoint_bridge, region_name, endpoint_url, is_secure, scoped_config, ): service_name = service_model.endpoint_prefix protocol = self._resolve_protocol(service_model) parameter_validation = True if client_config and not client_config.parameter_validation: parameter_validation = False elif scoped_config: raw_value = scoped_config.get('parameter_validation') if raw_value is not None: parameter_validation = ensure_boolean(raw_value) s3_config = self.compute_s3_config(client_config) configured_endpoint_url = self._compute_configured_endpoint_url( client_config=client_config, endpoint_url=endpoint_url, ) if configured_endpoint_url is not None: register_feature_id('ENDPOINT_OVERRIDE') endpoint_config = self._compute_endpoint_config( service_name=service_name, region_name=region_name, endpoint_url=configured_endpoint_url, is_secure=is_secure, endpoint_bridge=endpoint_bridge, s3_config=s3_config, ) endpoint_variant_tags = endpoint_config['metadata'].get('tags', []) # Some third-party libraries expect the final user-agent string in # ``client.meta.config.user_agent``. To maintain backwards # compatibility, the preliminary user-agent string (before any Config # object modifications and without request-specific user-agent # components) is stored in the new Config object's ``user_agent`` # property but not used by Botocore itself. preliminary_ua_string = self._session_ua_creator.with_client_config( client_config ).to_string() # Create a new client config to be passed to the client based # on the final values. We do not want the user to be able # to try to modify an existing client with a client config. config_kwargs = dict( region_name=endpoint_config['region_name'], signature_version=endpoint_config['signature_version'], user_agent=preliminary_ua_string, ) if 'dualstack' in endpoint_variant_tags: config_kwargs.update(use_dualstack_endpoint=True) if 'fips' in endpoint_variant_tags: config_kwargs.update(use_fips_endpoint=True) if client_config is not None: config_kwargs.update( connect_timeout=client_config.connect_timeout, read_timeout=client_config.read_timeout, max_pool_connections=client_config.max_pool_connections, proxies=client_config.proxies, proxies_config=client_config.proxies_config, retries=client_config.retries, client_cert=client_config.client_cert, inject_host_prefix=client_config.inject_host_prefix, tcp_keepalive=client_config.tcp_keepalive, user_agent_extra=client_config.user_agent_extra, user_agent_appid=client_config.user_agent_appid, request_min_compression_size_bytes=( client_config.request_min_compression_size_bytes ), disable_request_compression=( client_config.disable_request_compression ), client_context_params=client_config.client_context_params, sigv4a_signing_region_set=( client_config.sigv4a_signing_region_set ), request_checksum_calculation=( client_config.request_checksum_calculation ), response_checksum_validation=( client_config.response_checksum_validation ), account_id_endpoint_mode=client_config.account_id_endpoint_mode, ) self._compute_retry_config(config_kwargs) self._compute_connect_timeout(config_kwargs) self._compute_user_agent_appid_config(config_kwargs) self._compute_request_compression_config(config_kwargs) self._compute_sigv4a_signing_region_set_config(config_kwargs) self._compute_checksum_config(config_kwargs) self._compute_account_id_endpoint_mode_config(config_kwargs) self._compute_inject_host_prefix(client_config, config_kwargs) s3_config = self.compute_s3_config(client_config) is_s3_service = self._is_s3_service(service_name) if is_s3_service and 'dualstack' in endpoint_variant_tags: if s3_config is None: s3_config = {} s3_config['use_dualstack_endpoint'] = True return { 'service_name': service_name, 'parameter_validation': parameter_validation, 'configured_endpoint_url': configured_endpoint_url, 'endpoint_config': endpoint_config, 'protocol': protocol, 'config_kwargs': config_kwargs, 's3_config': s3_config, 'socket_options': self._compute_socket_options( scoped_config, client_config ), } def _compute_inject_host_prefix(self, client_config, config_kwargs): # In the cases that a Config object was not provided, or the private value # remained UNSET, we should resolve the value from the config store. if ( client_config is None or client_config._inject_host_prefix == 'UNSET' ): configured_disable_host_prefix_injection = ( self._config_store.get_config_variable( 'disable_host_prefix_injection' ) ) if configured_disable_host_prefix_injection is not None: config_kwargs[ 'inject_host_prefix' ] = not configured_disable_host_prefix_injection else: config_kwargs['inject_host_prefix'] = True def _compute_configured_endpoint_url(self, client_config, endpoint_url): if endpoint_url is not None: return endpoint_url if self._ignore_configured_endpoint_urls(client_config): logger.debug("Ignoring configured endpoint URLs.") return endpoint_url return self._config_store.get_config_variable('endpoint_url') def _ignore_configured_endpoint_urls(self, client_config): if ( client_config and client_config.ignore_configured_endpoint_urls is not None ): return client_config.ignore_configured_endpoint_urls return self._config_store.get_config_variable( 'ignore_configured_endpoint_urls' ) def compute_s3_config(self, client_config): s3_configuration = self._config_store.get_config_variable('s3') # Next specific client config values takes precedence over # specific values in the scoped config. if client_config is not None: if client_config.s3 is not None: if s3_configuration is None: s3_configuration = client_config.s3 else: # The current s3_configuration dictionary may be # from a source that only should be read from so # we want to be safe and just make a copy of it to modify # before it actually gets updated. s3_configuration = s3_configuration.copy() s3_configuration.update(client_config.s3) return s3_configuration def _is_s3_service(self, service_name): """Whether the service is S3 or S3 Control. Note that throughout this class, service_name refers to the endpoint prefix, not the folder name of the service in botocore/data. For S3 Control, the folder name is 's3control' but the endpoint prefix is 's3-control'. """ return service_name in ['s3', 's3-control'] def _compute_endpoint_config( self, service_name, region_name, endpoint_url, is_secure, endpoint_bridge, s3_config, ): resolve_endpoint_kwargs = { 'service_name': service_name, 'region_name': region_name, 'endpoint_url': endpoint_url, 'is_secure': is_secure, 'endpoint_bridge': endpoint_bridge, } if service_name == 's3': return self._compute_s3_endpoint_config( s3_config=s3_config, resolve_endpoint_kwargs ) if service_name == 'sts': return self._compute_sts_endpoint_config(resolve_endpoint_kwargs) return self._resolve_endpoint(resolve_endpoint_kwargs) def _compute_s3_endpoint_config( self, s3_config, resolve_endpoint_kwargs ): force_s3_global = self._should_force_s3_global( resolve_endpoint_kwargs['region_name'], s3_config ) if force_s3_global: resolve_endpoint_kwargs['region_name'] = None endpoint_config = self._resolve_endpoint(resolve_endpoint_kwargs) self._set_region_if_custom_s3_endpoint( endpoint_config, resolve_endpoint_kwargs['endpoint_bridge'] ) # For backwards compatibility reasons, we want to make sure the # client.meta.region_name will remain us-east-1 if we forced the # endpoint to be the global region. Specifically, if this value # changes to aws-global, it breaks logic where a user is checking # for us-east-1 as the global endpoint such as in creating buckets. if force_s3_global and endpoint_config['region_name'] == 'aws-global': endpoint_config['region_name'] = 'us-east-1' return endpoint_config def _should_force_s3_global(self, region_name, s3_config): s3_regional_config = 'legacy' if s3_config and 'us_east_1_regional_endpoint' in s3_config: s3_regional_config = s3_config['us_east_1_regional_endpoint'] self._validate_s3_regional_config(s3_regional_config) is_global_region = region_name in ('us-east-1', None) return s3_regional_config == 'legacy' and is_global_region def _validate_s3_regional_config(self, config_val): if config_val not in VALID_REGIONAL_ENDPOINTS_CONFIG: raise botocore.exceptions.InvalidS3UsEast1RegionalEndpointConfigError( s3_us_east_1_regional_endpoint_config=config_val ) def _set_region_if_custom_s3_endpoint( self, endpoint_config, endpoint_bridge ): # If a user is providing a custom URL, the endpoint resolver will # refuse to infer a signing region. If we want to default to s3v4, # we have to account for this. if ( endpoint_config['signing_region'] is None and endpoint_config['region_name'] is None ): endpoint = endpoint_bridge.resolve('s3') endpoint_config['signing_region'] = endpoint['signing_region'] endpoint_config['region_name'] = endpoint['region_name'] def _compute_sts_endpoint_config(self, resolve_endpoint_kwargs): endpoint_config = self._resolve_endpoint(resolve_endpoint_kwargs) if self._should_set_global_sts_endpoint( resolve_endpoint_kwargs['region_name'], resolve_endpoint_kwargs['endpoint_url'], endpoint_config, ): self._set_global_sts_endpoint( endpoint_config, resolve_endpoint_kwargs['is_secure'] ) return endpoint_config def _should_set_global_sts_endpoint( self, region_name, endpoint_url, endpoint_config ): has_variant_tags = endpoint_config and endpoint_config.get( 'metadata', {} ).get('tags') if endpoint_url or has_variant_tags: return False return ( self._get_sts_regional_endpoints_config() == 'legacy' and region_name in LEGACY_GLOBAL_STS_REGIONS ) def _get_sts_regional_endpoints_config(self): sts_regional_endpoints_config = self._config_store.get_config_variable( 'sts_regional_endpoints' ) if not sts_regional_endpoints_config: sts_regional_endpoints_config = 'legacy' if ( sts_regional_endpoints_config not in VALID_REGIONAL_ENDPOINTS_CONFIG ): raise botocore.exceptions.InvalidSTSRegionalEndpointsConfigError( sts_regional_endpoints_config=sts_regional_endpoints_config ) return sts_regional_endpoints_config def _set_global_sts_endpoint(self, endpoint_config, is_secure): scheme = 'https' if is_secure else 'http' endpoint_config['endpoint_url'] = f'{scheme}://sts.amazonaws.com' endpoint_config['signing_region'] = 'us-east-1' def _resolve_endpoint( self, service_name, region_name, endpoint_url, is_secure, endpoint_bridge, ): return endpoint_bridge.resolve( service_name, region_name, endpoint_url, is_secure ) def _compute_socket_options(self, scoped_config, client_config=None): # This disables Nagle's algorithm and is the default socket options # in urllib3. socket_options = [(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)] client_keepalive = client_config and client_config.tcp_keepalive scoped_keepalive = scoped_config and self._ensure_boolean( scoped_config.get("tcp_keepalive", False) ) # Enables TCP Keepalive if specified in client config object or shared config file. if client_keepalive or scoped_keepalive: socket_options.append((socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)) return socket_options def _compute_retry_config(self, config_kwargs): self._compute_retry_max_attempts(config_kwargs) self._compute_retry_mode(config_kwargs) def _compute_retry_max_attempts(self, config_kwargs): # There's a pre-existing max_attempts client config value that actually # means max retry attempts. There's also a `max_attempts` we pull # from the config store that means total attempts, which includes the # intitial request. We can't change what `max_attempts` means in # client config so we try to normalize everything to a new # "total_max_attempts" variable. We ensure that after this, the only # configuration for "max attempts" is the 'total_max_attempts' key. # An explicitly provided max_attempts in the client config # overrides everything. retries = config_kwargs.get('retries') if retries is not None: if 'total_max_attempts' in retries: retries.pop('max_attempts', None) return if 'max_attempts' in retries: value = retries.pop('max_attempts') # client config max_attempts means total retries so we # have to add one for 'total_max_attempts' to account # for the initial request. retries['total_max_attempts'] = value + 1 return # Otherwise we'll check the config store which checks env vars, # config files, etc. There is no default value for max_attempts # so if this returns None and we don't set a default value here. max_attempts = self._config_store.get_config_variable('max_attempts') if max_attempts is not None: if retries is None: retries = {} config_kwargs['retries'] = retries retries['total_max_attempts'] = max_attempts def _compute_retry_mode(self, config_kwargs): retries = config_kwargs.get('retries') if retries is None: retries = {} config_kwargs['retries'] = retries elif 'mode' in retries: # If there's a retry mode explicitly set in the client config # that overrides everything. return retry_mode = self._config_store.get_config_variable('retry_mode') if retry_mode is None: retry_mode = 'legacy' retries['mode'] = retry_mode def _compute_connect_timeout(self, config_kwargs): # Checking if connect_timeout is set on the client config. # If it is not, we check the config_store in case a # non legacy default mode has been configured. connect_timeout = config_kwargs.get('connect_timeout') if connect_timeout is not None: return connect_timeout = self._config_store.get_config_variable( 'connect_timeout' ) if connect_timeout: config_kwargs['connect_timeout'] = connect_timeout def _compute_request_compression_config(self, config_kwargs): min_size = config_kwargs.get('request_min_compression_size_bytes') disabled = config_kwargs.get('disable_request_compression') if min_size is None: min_size = self._config_store.get_config_variable( 'request_min_compression_size_bytes' ) # conversion func is skipped so input validation must be done here # regardless if the value is coming from the config store or the # config object min_size = self._validate_min_compression_size(min_size) config_kwargs['request_min_compression_size_bytes'] = min_size if disabled is None: disabled = self._config_store.get_config_variable( 'disable_request_compression' ) else: # if the user provided a value we must check if it's a boolean disabled = ensure_boolean(disabled) config_kwargs['disable_request_compression'] = disabled def _validate_min_compression_size(self, min_size): min_allowed_min_size = 1 max_allowed_min_size = 1048576 error_msg_base = ( f'Invalid value "{min_size}" for ' 'request_min_compression_size_bytes.' ) try: min_size = int(min_size) except (ValueError, TypeError): msg = ( f'{error_msg_base} Value must be an integer. ' f'Received {type(min_size)} instead.' ) raise botocore.exceptions.InvalidConfigError(error_msg=msg) if not min_allowed_min_size <= min_size <= max_allowed_min_size: msg = ( f'{error_msg_base} Value must be between ' f'{min_allowed_min_size} and {max_allowed_min_size}.' ) raise botocore.exceptions.InvalidConfigError(error_msg=msg) return min_size def _ensure_boolean(self, val): if isinstance(val, bool): return val else: return val.lower() == 'true' def _build_endpoint_resolver( self, endpoints_ruleset_data, partition_data, client_config, service_model, endpoint_region_name, region_name, endpoint_url, endpoint, is_secure, endpoint_bridge, event_emitter, credentials, account_id_endpoint_mode, ): if endpoints_ruleset_data is None: return None # The legacy EndpointResolver is global to the session, but # EndpointRulesetResolver is service-specific. Builtins for # EndpointRulesetResolver must not be derived from the legacy # endpoint resolver's output, including final_args, s3_config, # etc. s3_config_raw = self.compute_s3_config(client_config) or {} service_name_raw = service_model.endpoint_prefix # Maintain complex logic for s3 and sts endpoints for backwards # compatibility. if service_name_raw in ['s3', 'sts'] or region_name is None: eprv2_region_name = endpoint_region_name else: eprv2_region_name = region_name resolver_builtins = self.compute_endpoint_resolver_builtin_defaults( region_name=eprv2_region_name, service_name=service_name_raw, s3_config=s3_config_raw, endpoint_bridge=endpoint_bridge, client_endpoint_url=endpoint_url, legacy_endpoint_url=endpoint.host, credentials=credentials, account_id_endpoint_mode=account_id_endpoint_mode, ) # Client context params for s3 conflict with the available settings # in the `s3` parameter on the `Config` object. If the same parameter # is set in both places, the value in the `s3` parameter takes priority. if client_config is not None: client_context = client_config.client_context_params or {} else: client_context = {} if self._is_s3_service(service_name_raw): client_context.update(s3_config_raw) sig_version = ( client_config.signature_version if client_config is not None else None ) return EndpointRulesetResolver( endpoint_ruleset_data=endpoints_ruleset_data, partition_data=partition_data, service_model=service_model, builtins=resolver_builtins, client_context=client_context, event_emitter=event_emitter, use_ssl=is_secure, requested_auth_scheme=sig_version, ) def compute_endpoint_resolver_builtin_defaults( self, region_name, service_name, s3_config, endpoint_bridge, client_endpoint_url, legacy_endpoint_url, credentials, account_id_endpoint_mode, ): # EndpointRulesetResolver rulesets may accept an "SDK::Endpoint" as # input. If the endpoint_url argument of create_client() is set, it # always takes priority. if client_endpoint_url: given_endpoint = client_endpoint_url # If an endpoints.json data file other than the one bundled within # the botocore/data directory is used, the output of legacy # endpoint resolution is provided to EndpointRulesetResolver. elif not endpoint_bridge.resolver_uses_builtin_data(): given_endpoint = legacy_endpoint_url else: given_endpoint = None # The endpoint rulesets differ from legacy botocore behavior in whether # forcing path style addressing in incompatible situations raises an # exception or silently ignores the config setting. The # AWS_S3_FORCE_PATH_STYLE parameter is adjusted both here and for each # operation so that the ruleset behavior is backwards compatible. if s3_config.get('use_accelerate_endpoint', False): force_path_style = False elif client_endpoint_url is not None and not is_s3_accelerate_url( client_endpoint_url ): force_path_style = s3_config.get('addressing_style') != 'virtual' else: force_path_style = s3_config.get('addressing_style') == 'path' return { EPRBuiltins.AWS_REGION: region_name, EPRBuiltins.AWS_USE_FIPS: ( # SDK_ENDPOINT cannot be combined with AWS_USE_FIPS given_endpoint is None # use legacy resolver's _resolve_endpoint_variant_config_var() # or default to False if it returns None and endpoint_bridge._resolve_endpoint_variant_config_var( 'use_fips_endpoint' ) or False ), EPRBuiltins.AWS_USE_DUALSTACK: ( # SDK_ENDPOINT cannot be combined with AWS_USE_DUALSTACK given_endpoint is None # use legacy resolver's _resolve_use_dualstack_endpoint() and # or default to False if it returns None and endpoint_bridge._resolve_use_dualstack_endpoint( service_name ) or False ), EPRBuiltins.AWS_STS_USE_GLOBAL_ENDPOINT: ( self._should_set_global_sts_endpoint( region_name=region_name, endpoint_url=None, endpoint_config=None, ) ), EPRBuiltins.AWS_S3_USE_GLOBAL_ENDPOINT: ( self._should_force_s3_global(region_name, s3_config) ), EPRBuiltins.AWS_S3_ACCELERATE: s3_config.get( 'use_accelerate_endpoint', False ), EPRBuiltins.AWS_S3_FORCE_PATH_STYLE: force_path_style, EPRBuiltins.AWS_S3_USE_ARN_REGION: s3_config.get( 'use_arn_region', True ), EPRBuiltins.AWS_S3CONTROL_USE_ARN_REGION: s3_config.get( 'use_arn_region', False ), EPRBuiltins.AWS_S3_DISABLE_MRAP: s3_config.get( 's3_disable_multiregion_access_points', False ), EPRBuiltins.SDK_ENDPOINT: given_endpoint, EPRBuiltins.ACCOUNT_ID: credentials.get_deferred_property( 'account_id' ) if credentials else None, EPRBuiltins.ACCOUNT_ID_ENDPOINT_MODE: account_id_endpoint_mode, } def _compute_user_agent_appid_config(self, config_kwargs): user_agent_appid = config_kwargs.get('user_agent_appid') if user_agent_appid is None: user_agent_appid = self._config_store.get_config_variable( 'user_agent_appid' ) if ( user_agent_appid is not None and len(user_agent_appid) > USERAGENT_APPID_MAXLEN ): logger.warning( 'The configured value for user_agent_appid exceeds the ' f'maximum length of {USERAGENT_APPID_MAXLEN} characters.' ) config_kwargs['user_agent_appid'] = user_agent_appid def _compute_sigv4a_signing_region_set_config(self, config_kwargs): sigv4a_signing_region_set = config_kwargs.get( 'sigv4a_signing_region_set' ) if sigv4a_signing_region_set is None: sigv4a_signing_region_set = self._config_store.get_config_variable( 'sigv4a_signing_region_set' ) config_kwargs['sigv4a_signing_region_set'] = sigv4a_signing_region_set def _compute_checksum_config(self, config_kwargs): self._handle_checksum_config( config_kwargs, config_key="request_checksum_calculation", valid_options=VALID_REQUEST_CHECKSUM_CALCULATION_CONFIG, ) self._handle_checksum_config( config_kwargs, config_key="response_checksum_validation", valid_options=VALID_RESPONSE_CHECKSUM_VALIDATION_CONFIG, ) def _resolve_protocol(self, service_model): # We need to ensure `protocols` exists in the metadata before attempting to # access it directly since referencing service_model.protocols directly will # raise an UndefinedModelAttributeError if protocols is not defined if service_model.metadata.get('protocols'): for protocol in PRIORITY_ORDERED_SUPPORTED_PROTOCOLS: if protocol in service_model.protocols: return protocol raise botocore.exceptions.UnsupportedServiceProtocolsError( botocore_supported_protocols=PRIORITY_ORDERED_SUPPORTED_PROTOCOLS, service_supported_protocols=service_model.protocols, service=service_model.service_name, ) # If a service does not have a `protocols` trait, fall back to the legacy # `protocol` trait return service_model.protocol def _handle_checksum_config( self, config_kwargs, config_key, valid_options, ): value = config_kwargs.get(config_key) if value is None: value = self._config_store.get_config_variable(config_key) if isinstance(value, str): value = value.lower() if value not in valid_options: raise botocore.exceptions.InvalidChecksumConfigError( config_key=config_key, config_value=value, valid_options=valid_options, ) self._register_checksum_config_feature_ids(value, config_key) config_kwargs[config_key] = value def _register_checksum_config_feature_ids(self, value, config_key): checksum_config_feature_id = None if config_key == "request_checksum_calculation": checksum_config_feature_id = ( f"FLEXIBLE_CHECKSUMS_REQ_{value.upper()}" ) elif config_key == "response_checksum_validation": checksum_config_feature_id = ( f"FLEXIBLE_CHECKSUMS_RES_{value.upper()}" ) if checksum_config_feature_id is not None: register_feature_id(checksum_config_feature_id) def _compute_account_id_endpoint_mode_config(self, config_kwargs): config_key = 'account_id_endpoint_mode' # Disable account id based endpoint routing for unsigned requests # since there are no credentials to resolve. signature_version = config_kwargs.get('signature_version') if signature_version is botocore.UNSIGNED: config_kwargs[config_key] = 'disabled' return account_id_endpoint_mode = config_kwargs.get(config_key) if account_id_endpoint_mode is None: account_id_endpoint_mode = self._config_store.get_config_variable( config_key ) if isinstance(account_id_endpoint_mode, str): account_id_endpoint_mode = account_id_endpoint_mode.lower() if ( account_id_endpoint_mode not in VALID_ACCOUNT_ID_ENDPOINT_MODE_CONFIG ): raise botocore.exceptions.InvalidConfigError( error_msg=f"The configured value '{account_id_endpoint_mode}' for '{config_key}' is " f"invalid. Valid values are: {VALID_ACCOUNT_ID_ENDPOINT_MODE_CONFIG}." ) config_kwargs[config_key] = account_id_endpoint_mode	36.67 KB	2025-05-25 12:26
📄 auth.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import base64 import calendar import datetime import functools import hmac import json import logging import time from collections.abc import Mapping from email.utils import formatdate from hashlib import sha1, sha256 from operator import itemgetter from botocore.compat import ( HAS_CRT, HTTPHeaders, encodebytes, ensure_unicode, parse_qs, quote, unquote, urlsplit, urlunsplit, ) from botocore.exceptions import ( NoAuthTokenError, NoCredentialsError, UnknownSignatureVersionError, UnsupportedSignatureVersionError, ) from botocore.utils import ( is_valid_ipv6_endpoint_url, normalize_url_path, percent_encode_sequence, ) # Imports for backwards compatibility from botocore.compat import MD5_AVAILABLE # noqa logger = logging.getLogger(__name__) EMPTY_SHA256_HASH = ( 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' ) # This is the buffer size used when calculating sha256 checksums. # Experimenting with various buffer sizes showed that this value generally # gave the best result (in terms of performance). PAYLOAD_BUFFER = 1024 * 1024 ISO8601 = '%Y-%m-%dT%H:%M:%SZ' SIGV4_TIMESTAMP = '%Y%m%dT%H%M%SZ' SIGNED_HEADERS_BLACKLIST = [ 'expect', 'transfer-encoding', 'user-agent', 'x-amzn-trace-id', ] UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD' STREAMING_UNSIGNED_PAYLOAD_TRAILER = 'STREAMING-UNSIGNED-PAYLOAD-TRAILER' def _host_from_url(url): # Given URL, derive value for host header. Ensure that value: # 1) is lowercase # 2) excludes port, if it was the default port # 3) excludes userinfo url_parts = urlsplit(url) host = url_parts.hostname # urlsplit's hostname is always lowercase if is_valid_ipv6_endpoint_url(url): host = f'[{host}]' default_ports = { 'http': 80, 'https': 443, } if url_parts.port is not None: if url_parts.port != default_ports.get(url_parts.scheme): host = '%s:%d' % (host, url_parts.port) return host def _get_body_as_dict(request): # For query services, request.data is form-encoded and is already a # dict, but for other services such as rest-json it could be a json # string or bytes. In those cases we attempt to load the data as a # dict. data = request.data if isinstance(data, bytes): data = json.loads(data.decode('utf-8')) elif isinstance(data, str): data = json.loads(data) return data class BaseSigner: REQUIRES_REGION = False REQUIRES_TOKEN = False def add_auth(self, request): raise NotImplementedError("add_auth") class TokenSigner(BaseSigner): REQUIRES_TOKEN = True """ Signers that expect an authorization token to perform the authorization """ def __init__(self, auth_token): self.auth_token = auth_token class SigV2Auth(BaseSigner): """ Sign a request with Signature V2. """ def __init__(self, credentials): self.credentials = credentials def calc_signature(self, request, params): logger.debug("Calculating signature using v2 auth.") split = urlsplit(request.url) path = split.path if len(path) == 0: path = '/' string_to_sign = f"{request.method}\n{split.netloc}\n{path}\n" lhmac = hmac.new( self.credentials.secret_key.encode("utf-8"), digestmod=sha256 ) pairs = [] for key in sorted(params): # Any previous signature should not be a part of this # one, so we skip that particular key. This prevents # issues during retries. if key == 'Signature': continue value = str(params[key]) quoted_key = quote(key.encode('utf-8'), safe='') quoted_value = quote(value.encode('utf-8'), safe='-_~') pairs.append(f'{quoted_key}={quoted_value}') qs = '&'.join(pairs) string_to_sign += qs logger.debug('String to sign: %s', string_to_sign) lhmac.update(string_to_sign.encode('utf-8')) b64 = base64.b64encode(lhmac.digest()).strip().decode('utf-8') return (qs, b64) def add_auth(self, request): # The auth handler is the last thing called in the # preparation phase of a prepared request. # Because of this we have to parse the query params # from the request body so we can update them with # the sigv2 auth params. if self.credentials is None: raise NoCredentialsError() if request.data: # POST params = request.data else: # GET params = request.params params['AWSAccessKeyId'] = self.credentials.access_key params['SignatureVersion'] = '2' params['SignatureMethod'] = 'HmacSHA256' params['Timestamp'] = time.strftime(ISO8601, time.gmtime()) if self.credentials.token: params['SecurityToken'] = self.credentials.token qs, signature = self.calc_signature(request, params) params['Signature'] = signature return request class SigV3Auth(BaseSigner): def __init__(self, credentials): self.credentials = credentials def add_auth(self, request): if self.credentials is None: raise NoCredentialsError() if 'Date' in request.headers: del request.headers['Date'] request.headers['Date'] = formatdate(usegmt=True) if self.credentials.token: if 'X-Amz-Security-Token' in request.headers: del request.headers['X-Amz-Security-Token'] request.headers['X-Amz-Security-Token'] = self.credentials.token new_hmac = hmac.new( self.credentials.secret_key.encode('utf-8'), digestmod=sha256 ) new_hmac.update(request.headers['Date'].encode('utf-8')) encoded_signature = encodebytes(new_hmac.digest()).strip() signature = ( f"AWS3-HTTPS AWSAccessKeyId={self.credentials.access_key}," f"Algorithm=HmacSHA256,Signature={encoded_signature.decode('utf-8')}" ) if 'X-Amzn-Authorization' in request.headers: del request.headers['X-Amzn-Authorization'] request.headers['X-Amzn-Authorization'] = signature class SigV4Auth(BaseSigner): """ Sign a request with Signature V4. """ REQUIRES_REGION = True def __init__(self, credentials, service_name, region_name): self.credentials = credentials # We initialize these value here so the unit tests can have # valid values. But these will get overriden in ``add_auth`` # later for real requests. self._region_name = region_name self._service_name = service_name def _sign(self, key, msg, hex=False): if hex: sig = hmac.new(key, msg.encode('utf-8'), sha256).hexdigest() else: sig = hmac.new(key, msg.encode('utf-8'), sha256).digest() return sig def headers_to_sign(self, request): """ Select the headers from the request that need to be included in the StringToSign. """ header_map = HTTPHeaders() for name, value in request.headers.items(): lname = name.lower() if lname not in SIGNED_HEADERS_BLACKLIST: header_map[lname] = value if 'host' not in header_map: # TODO: We should set the host ourselves, instead of relying on our # HTTP client to set it for us. header_map['host'] = _host_from_url(request.url) return header_map def canonical_query_string(self, request): # The query string can come from two parts. One is the # params attribute of the request. The other is from the request # url (in which case we have to re-split the url into its components # and parse out the query string component). if request.params: return self._canonical_query_string_params(request.params) else: return self._canonical_query_string_url(urlsplit(request.url)) def _canonical_query_string_params(self, params): # [(key, value), (key2, value2)] key_val_pairs = [] if isinstance(params, Mapping): params = params.items() for key, value in params: key_val_pairs.append( (quote(key, safe='-_.~'), quote(str(value), safe='-_.~')) ) sorted_key_vals = [] # Sort by the URI-encoded key names, and in the case of # repeated keys, then sort by the value. for key, value in sorted(key_val_pairs): sorted_key_vals.append(f'{key}={value}') canonical_query_string = '&'.join(sorted_key_vals) return canonical_query_string def _canonical_query_string_url(self, parts): canonical_query_string = '' if parts.query: # [(key, value), (key2, value2)] key_val_pairs = [] for pair in parts.query.split('&'): key, _, value = pair.partition('=') key_val_pairs.append((key, value)) sorted_key_vals = [] # Sort by the URI-encoded key names, and in the case of # repeated keys, then sort by the value. for key, value in sorted(key_val_pairs): sorted_key_vals.append(f'{key}={value}') canonical_query_string = '&'.join(sorted_key_vals) return canonical_query_string def canonical_headers(self, headers_to_sign): """ Return the headers that need to be included in the StringToSign in their canonical form by converting all header keys to lower case, sorting them in alphabetical order and then joining them into a string, separated by newlines. """ headers = [] sorted_header_names = sorted(set(headers_to_sign)) for key in sorted_header_names: value = ','.join( self._header_value(v) for v in headers_to_sign.get_all(key) ) headers.append(f'{key}:{ensure_unicode(value)}') return '\n'.join(headers) def _header_value(self, value): # From the sigv4 docs: # Lowercase(HeaderName) + ':' + Trimall(HeaderValue) # # The Trimall function removes excess white space before and after # values, and converts sequential spaces to a single space. return ' '.join(value.split()) def signed_headers(self, headers_to_sign): headers = sorted(n.lower().strip() for n in set(headers_to_sign)) return ';'.join(headers) def _is_streaming_checksum_payload(self, request): checksum_context = request.context.get('checksum', {}) algorithm = checksum_context.get('request_algorithm') return isinstance(algorithm, dict) and algorithm.get('in') == 'trailer' def payload(self, request): if self._is_streaming_checksum_payload(request): return STREAMING_UNSIGNED_PAYLOAD_TRAILER elif not self._should_sha256_sign_payload(request): # When payload signing is disabled, we use this static string in # place of the payload checksum. return UNSIGNED_PAYLOAD request_body = request.body if request_body and hasattr(request_body, 'seek'): position = request_body.tell() read_chunksize = functools.partial( request_body.read, PAYLOAD_BUFFER ) checksum = sha256() for chunk in iter(read_chunksize, b''): checksum.update(chunk) hex_checksum = checksum.hexdigest() request_body.seek(position) return hex_checksum elif request_body: # The request serialization has ensured that # request.body is a bytes() type. return sha256(request_body).hexdigest() else: return EMPTY_SHA256_HASH def _should_sha256_sign_payload(self, request): # Payloads will always be signed over insecure connections. if not request.url.startswith('https'): return True # Certain operations may have payload signing disabled by default. # Since we don't have access to the operation model, we pass in this # bit of metadata through the request context. return request.context.get('payload_signing_enabled', True) def canonical_request(self, request): cr = [request.method.upper()] path = self._normalize_url_path(urlsplit(request.url).path) cr.append(path) cr.append(self.canonical_query_string(request)) headers_to_sign = self.headers_to_sign(request) cr.append(self.canonical_headers(headers_to_sign) + '\n') cr.append(self.signed_headers(headers_to_sign)) if 'X-Amz-Content-SHA256' in request.headers: body_checksum = request.headers['X-Amz-Content-SHA256'] else: body_checksum = self.payload(request) cr.append(body_checksum) return '\n'.join(cr) def _normalize_url_path(self, path): normalized_path = quote(normalize_url_path(path), safe='/~') return normalized_path def scope(self, request): scope = [self.credentials.access_key] scope.append(request.context['timestamp'][0:8]) scope.append(self._region_name) scope.append(self._service_name) scope.append('aws4_request') return '/'.join(scope) def credential_scope(self, request): scope = [] scope.append(request.context['timestamp'][0:8]) scope.append(self._region_name) scope.append(self._service_name) scope.append('aws4_request') return '/'.join(scope) def string_to_sign(self, request, canonical_request): """ Return the canonical StringToSign as well as a dict containing the original version of all headers that were included in the StringToSign. """ sts = ['AWS4-HMAC-SHA256'] sts.append(request.context['timestamp']) sts.append(self.credential_scope(request)) sts.append(sha256(canonical_request.encode('utf-8')).hexdigest()) return '\n'.join(sts) def signature(self, string_to_sign, request): key = self.credentials.secret_key k_date = self._sign( (f"AWS4{key}").encode(), request.context["timestamp"][0:8] ) k_region = self._sign(k_date, self._region_name) k_service = self._sign(k_region, self._service_name) k_signing = self._sign(k_service, 'aws4_request') return self._sign(k_signing, string_to_sign, hex=True) def add_auth(self, request): if self.credentials is None: raise NoCredentialsError() datetime_now = datetime.datetime.utcnow() request.context['timestamp'] = datetime_now.strftime(SIGV4_TIMESTAMP) # This could be a retry. Make sure the previous # authorization header is removed first. self._modify_request_before_signing(request) canonical_request = self.canonical_request(request) logger.debug("Calculating signature using v4 auth.") logger.debug('CanonicalRequest:\n%s', canonical_request) string_to_sign = self.string_to_sign(request, canonical_request) logger.debug('StringToSign:\n%s', string_to_sign) signature = self.signature(string_to_sign, request) logger.debug('Signature:\n%s', signature) self._inject_signature_to_request(request, signature) def _inject_signature_to_request(self, request, signature): auth_str = [f'AWS4-HMAC-SHA256 Credential={self.scope(request)}'] headers_to_sign = self.headers_to_sign(request) auth_str.append( f"SignedHeaders={self.signed_headers(headers_to_sign)}" ) auth_str.append(f'Signature={signature}') request.headers['Authorization'] = ', '.join(auth_str) return request def _modify_request_before_signing(self, request): if 'Authorization' in request.headers: del request.headers['Authorization'] self._set_necessary_date_headers(request) if self.credentials.token: if 'X-Amz-Security-Token' in request.headers: del request.headers['X-Amz-Security-Token'] request.headers['X-Amz-Security-Token'] = self.credentials.token if not request.context.get('payload_signing_enabled', True): if 'X-Amz-Content-SHA256' in request.headers: del request.headers['X-Amz-Content-SHA256'] request.headers['X-Amz-Content-SHA256'] = UNSIGNED_PAYLOAD def _set_necessary_date_headers(self, request): # The spec allows for either the Date _or_ the X-Amz-Date value to be # used so we check both. If there's a Date header, we use the date # header. Otherwise we use the X-Amz-Date header. if 'Date' in request.headers: del request.headers['Date'] datetime_timestamp = datetime.datetime.strptime( request.context['timestamp'], SIGV4_TIMESTAMP ) request.headers['Date'] = formatdate( int(calendar.timegm(datetime_timestamp.timetuple())) ) if 'X-Amz-Date' in request.headers: del request.headers['X-Amz-Date'] else: if 'X-Amz-Date' in request.headers: del request.headers['X-Amz-Date'] request.headers['X-Amz-Date'] = request.context['timestamp'] class S3SigV4Auth(SigV4Auth): def _modify_request_before_signing(self, request): super()._modify_request_before_signing(request) if 'X-Amz-Content-SHA256' in request.headers: del request.headers['X-Amz-Content-SHA256'] request.headers['X-Amz-Content-SHA256'] = self.payload(request) def _should_sha256_sign_payload(self, request): # S3 allows optional body signing, so to minimize the performance # impact, we opt to not SHA256 sign the body on streaming uploads, # provided that we're on https. client_config = request.context.get('client_config') s3_config = getattr(client_config, 's3', None) # The config could be None if it isn't set, or if the customer sets it # to None. if s3_config is None: s3_config = {} # The explicit configuration takes precedence over any implicit # configuration. sign_payload = s3_config.get('payload_signing_enabled', None) if sign_payload is not None: return sign_payload # We require that both a checksum be present and https be enabled # to implicitly disable body signing. The combination of TLS and # a checksum is sufficiently secure and durable for us to be # confident in the request without body signing. checksum_header = 'Content-MD5' checksum_context = request.context.get('checksum', {}) algorithm = checksum_context.get('request_algorithm') if isinstance(algorithm, dict) and algorithm.get('in') == 'header': checksum_header = algorithm['name'] if ( not request.url.startswith("https") or checksum_header not in request.headers ): return True # If the input is streaming we disable body signing by default. if request.context.get('has_streaming_input', False): return False # If the S3-specific checks had no results, delegate to the generic # checks. return super()._should_sha256_sign_payload(request) def _normalize_url_path(self, path): # For S3, we do not normalize the path. return path class S3ExpressAuth(S3SigV4Auth): REQUIRES_IDENTITY_CACHE = True def __init__( self, credentials, service_name, region_name, , identity_cache ): super().__init__(credentials, service_name, region_name) self._identity_cache = identity_cache def add_auth(self, request): super().add_auth(request) def _modify_request_before_signing(self, request): super()._modify_request_before_signing(request) if 'x-amz-s3session-token' not in request.headers: request.headers['x-amz-s3session-token'] = self.credentials.token # S3Express does not support STS' X-Amz-Security-Token if 'X-Amz-Security-Token' in request.headers: del request.headers['X-Amz-Security-Token'] class S3ExpressPostAuth(S3ExpressAuth): REQUIRES_IDENTITY_CACHE = True def add_auth(self, request): datetime_now = datetime.datetime.utcnow() request.context['timestamp'] = datetime_now.strftime(SIGV4_TIMESTAMP) fields = {} if request.context.get('s3-presign-post-fields', None) is not None: fields = request.context['s3-presign-post-fields'] policy = {} conditions = [] if request.context.get('s3-presign-post-policy', None) is not None: policy = request.context['s3-presign-post-policy'] if policy.get('conditions', None) is not None: conditions = policy['conditions'] policy['conditions'] = conditions fields['x-amz-algorithm'] = 'AWS4-HMAC-SHA256' fields['x-amz-credential'] = self.scope(request) fields['x-amz-date'] = request.context['timestamp'] conditions.append({'x-amz-algorithm': 'AWS4-HMAC-SHA256'}) conditions.append({'x-amz-credential': self.scope(request)}) conditions.append({'x-amz-date': request.context['timestamp']}) if self.credentials.token is not None: fields['X-Amz-S3session-Token'] = self.credentials.token conditions.append( {'X-Amz-S3session-Token': self.credentials.token} ) # Dump the base64 encoded policy into the fields dictionary. fields['policy'] = base64.b64encode( json.dumps(policy).encode('utf-8') ).decode('utf-8') fields['x-amz-signature'] = self.signature(fields['policy'], request) request.context['s3-presign-post-fields'] = fields request.context['s3-presign-post-policy'] = policy class S3ExpressQueryAuth(S3ExpressAuth): DEFAULT_EXPIRES = 300 REQUIRES_IDENTITY_CACHE = True def __init__( self, credentials, service_name, region_name, , identity_cache, expires=DEFAULT_EXPIRES, ): super().__init__( credentials, service_name, region_name, identity_cache=identity_cache, ) self._expires = expires def _modify_request_before_signing(self, request): # We automatically set this header, so if it's the auto-set value we # want to get rid of it since it doesn't make sense for presigned urls. content_type = request.headers.get('content-type') blocklisted_content_type = ( 'application/x-www-form-urlencoded; charset=utf-8' ) if content_type == blocklisted_content_type: del request.headers['content-type'] # Note that we're not including X-Amz-Signature. # From the docs: "The Canonical Query String must include all the query # parameters from the preceding table except for X-Amz-Signature. signed_headers = self.signed_headers(self.headers_to_sign(request)) auth_params = { 'X-Amz-Algorithm': 'AWS4-HMAC-SHA256', 'X-Amz-Credential': self.scope(request), 'X-Amz-Date': request.context['timestamp'], 'X-Amz-Expires': self._expires, 'X-Amz-SignedHeaders': signed_headers, } if self.credentials.token is not None: auth_params['X-Amz-S3session-Token'] = self.credentials.token # Now parse the original query string to a dict, inject our new query # params, and serialize back to a query string. url_parts = urlsplit(request.url) # parse_qs makes each value a list, but in our case we know we won't # have repeated keys so we know we have single element lists which we # can convert back to scalar values. query_string_parts = parse_qs(url_parts.query, keep_blank_values=True) query_dict = {k: v[0] for k, v in query_string_parts.items()} if request.params: query_dict.update(request.params) request.params = {} # The spec is particular about this. It has to be: # https://<endpoint>?<operation params>&<auth params> # You can't mix the two types of params together, i.e just keep doing # new_query_params.update(op_params) # new_query_params.update(auth_params) # percent_encode_sequence(new_query_params) operation_params = '' if request.data: # We also need to move the body params into the query string. To # do this, we first have to convert it to a dict. query_dict.update(_get_body_as_dict(request)) request.data = '' if query_dict: operation_params = percent_encode_sequence(query_dict) + '&' new_query_string = ( f"{operation_params}{percent_encode_sequence(auth_params)}" ) # url_parts is a tuple (and therefore immutable) so we need to create # a new url_parts with the new query string. # <part> - <index> # scheme - 0 # netloc - 1 # path - 2 # query - 3 <-- we're replacing this. # fragment - 4 p = url_parts new_url_parts = (p[0], p[1], p[2], new_query_string, p[4]) request.url = urlunsplit(new_url_parts) def _inject_signature_to_request(self, request, signature): # Rather than calculating an "Authorization" header, for the query # param quth, we just append an 'X-Amz-Signature' param to the end # of the query string. request.url += f'&X-Amz-Signature={signature}' def _normalize_url_path(self, path): # For S3, we do not normalize the path. return path def payload(self, request): # From the doc link above: # "You don't include a payload hash in the Canonical Request, because # when you create a presigned URL, you don't know anything about the # payload. Instead, you use a constant string "UNSIGNED-PAYLOAD". return UNSIGNED_PAYLOAD class SigV4QueryAuth(SigV4Auth): DEFAULT_EXPIRES = 3600 def __init__( self, credentials, service_name, region_name, expires=DEFAULT_EXPIRES ): super().__init__(credentials, service_name, region_name) self._expires = expires def _modify_request_before_signing(self, request): # We automatically set this header, so if it's the auto-set value we # want to get rid of it since it doesn't make sense for presigned urls. content_type = request.headers.get('content-type') blacklisted_content_type = ( 'application/x-www-form-urlencoded; charset=utf-8' ) if content_type == blacklisted_content_type: del request.headers['content-type'] # Note that we're not including X-Amz-Signature. # From the docs: "The Canonical Query String must include all the query # parameters from the preceding table except for X-Amz-Signature. signed_headers = self.signed_headers(self.headers_to_sign(request)) auth_params = { 'X-Amz-Algorithm': 'AWS4-HMAC-SHA256', 'X-Amz-Credential': self.scope(request), 'X-Amz-Date': request.context['timestamp'], 'X-Amz-Expires': self._expires, 'X-Amz-SignedHeaders': signed_headers, } if self.credentials.token is not None: auth_params['X-Amz-Security-Token'] = self.credentials.token # Now parse the original query string to a dict, inject our new query # params, and serialize back to a query string. url_parts = urlsplit(request.url) # parse_qs makes each value a list, but in our case we know we won't # have repeated keys so we know we have single element lists which we # can convert back to scalar values. query_string_parts = parse_qs(url_parts.query, keep_blank_values=True) query_dict = {k: v[0] for k, v in query_string_parts.items()} if request.params: query_dict.update(request.params) request.params = {} # The spec is particular about this. It has to be: # https://<endpoint>?<operation params>&<auth params> # You can't mix the two types of params together, i.e just keep doing # new_query_params.update(op_params) # new_query_params.update(auth_params) # percent_encode_sequence(new_query_params) operation_params = '' if request.data: # We also need to move the body params into the query string. To # do this, we first have to convert it to a dict. query_dict.update(_get_body_as_dict(request)) request.data = '' if query_dict: operation_params = percent_encode_sequence(query_dict) + '&' new_query_string = ( f"{operation_params}{percent_encode_sequence(auth_params)}" ) # url_parts is a tuple (and therefore immutable) so we need to create # a new url_parts with the new query string. # <part> - <index> # scheme - 0 # netloc - 1 # path - 2 # query - 3 <-- we're replacing this. # fragment - 4 p = url_parts new_url_parts = (p[0], p[1], p[2], new_query_string, p[4]) request.url = urlunsplit(new_url_parts) def _inject_signature_to_request(self, request, signature): # Rather than calculating an "Authorization" header, for the query # param quth, we just append an 'X-Amz-Signature' param to the end # of the query string. request.url += f'&X-Amz-Signature={signature}' class S3SigV4QueryAuth(SigV4QueryAuth): """S3 SigV4 auth using query parameters. This signer will sign a request using query parameters and signature version 4, i.e a "presigned url" signer. Based off of: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html """ def _normalize_url_path(self, path): # For S3, we do not normalize the path. return path def payload(self, request): # From the doc link above: # "You don't include a payload hash in the Canonical Request, because # when you create a presigned URL, you don't know anything about the # payload. Instead, you use a constant string "UNSIGNED-PAYLOAD". return UNSIGNED_PAYLOAD class S3SigV4PostAuth(SigV4Auth): """ Presigns a s3 post Implementation doc here: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-UsingHTTPPOST.html """ def add_auth(self, request): datetime_now = datetime.datetime.utcnow() request.context['timestamp'] = datetime_now.strftime(SIGV4_TIMESTAMP) fields = {} if request.context.get('s3-presign-post-fields', None) is not None: fields = request.context['s3-presign-post-fields'] policy = {} conditions = [] if request.context.get('s3-presign-post-policy', None) is not None: policy = request.context['s3-presign-post-policy'] if policy.get('conditions', None) is not None: conditions = policy['conditions'] policy['conditions'] = conditions fields['x-amz-algorithm'] = 'AWS4-HMAC-SHA256' fields['x-amz-credential'] = self.scope(request) fields['x-amz-date'] = request.context['timestamp'] conditions.append({'x-amz-algorithm': 'AWS4-HMAC-SHA256'}) conditions.append({'x-amz-credential': self.scope(request)}) conditions.append({'x-amz-date': request.context['timestamp']}) if self.credentials.token is not None: fields['x-amz-security-token'] = self.credentials.token conditions.append({'x-amz-security-token': self.credentials.token}) # Dump the base64 encoded policy into the fields dictionary. fields['policy'] = base64.b64encode( json.dumps(policy).encode('utf-8') ).decode('utf-8') fields['x-amz-signature'] = self.signature(fields['policy'], request) request.context['s3-presign-post-fields'] = fields request.context['s3-presign-post-policy'] = policy class HmacV1Auth(BaseSigner): # List of Query String Arguments of Interest QSAOfInterest = [ 'accelerate', 'acl', 'cors', 'defaultObjectAcl', 'location', 'logging', 'partNumber', 'policy', 'requestPayment', 'torrent', 'versioning', 'versionId', 'versions', 'website', 'uploads', 'uploadId', 'response-content-type', 'response-content-language', 'response-expires', 'response-cache-control', 'response-content-disposition', 'response-content-encoding', 'delete', 'lifecycle', 'tagging', 'restore', 'storageClass', 'notification', 'replication', 'requestPayment', 'analytics', 'metrics', 'inventory', 'select', 'select-type', 'object-lock', ] def __init__(self, credentials, service_name=None, region_name=None): self.credentials = credentials def sign_string(self, string_to_sign): new_hmac = hmac.new( self.credentials.secret_key.encode('utf-8'), digestmod=sha1 ) new_hmac.update(string_to_sign.encode('utf-8')) return encodebytes(new_hmac.digest()).strip().decode('utf-8') def canonical_standard_headers(self, headers): interesting_headers = ['content-md5', 'content-type', 'date'] hoi = [] if 'Date' in headers: del headers['Date'] headers['Date'] = self._get_date() for ih in interesting_headers: found = False for key in headers: lk = key.lower() if headers[key] is not None and lk == ih: hoi.append(headers[key].strip()) found = True if not found: hoi.append('') return '\n'.join(hoi) def canonical_custom_headers(self, headers): hoi = [] custom_headers = {} for key in headers: lk = key.lower() if headers[key] is not None: if lk.startswith('x-amz-'): custom_headers[lk] = ','.join( v.strip() for v in headers.get_all(key) ) sorted_header_keys = sorted(custom_headers.keys()) for key in sorted_header_keys: hoi.append(f"{key}:{custom_headers[key]}") return '\n'.join(hoi) def unquote_v(self, nv): """ TODO: Do we need this? """ if len(nv) == 1: return nv else: return (nv[0], unquote(nv[1])) def canonical_resource(self, split, auth_path=None): # don't include anything after the first ? in the resource... # unless it is one of the QSA of interest, defined above # NOTE: # The path in the canonical resource should always be the # full path including the bucket name, even for virtual-hosting # style addressing. The ``auth_path`` keeps track of the full # path for the canonical resource and would be passed in if # the client was using virtual-hosting style. if auth_path is not None: buf = auth_path else: buf = split.path if split.query: qsa = split.query.split('&') qsa = [a.split('=', 1) for a in qsa] qsa = [ self.unquote_v(a) for a in qsa if a[0] in self.QSAOfInterest ] if len(qsa) > 0: qsa.sort(key=itemgetter(0)) qsa = ['='.join(a) for a in qsa] buf += '?' buf += '&'.join(qsa) return buf def canonical_string( self, method, split, headers, expires=None, auth_path=None ): cs = method.upper() + '\n' cs += self.canonical_standard_headers(headers) + '\n' custom_headers = self.canonical_custom_headers(headers) if custom_headers: cs += custom_headers + '\n' cs += self.canonical_resource(split, auth_path=auth_path) return cs def get_signature( self, method, split, headers, expires=None, auth_path=None ): if self.credentials.token: del headers['x-amz-security-token'] headers['x-amz-security-token'] = self.credentials.token string_to_sign = self.canonical_string( method, split, headers, auth_path=auth_path ) logger.debug(f'StringToSign:\n{string_to_sign}') return self.sign_string(string_to_sign) def add_auth(self, request): if self.credentials is None: raise NoCredentialsError logger.debug("Calculating signature using hmacv1 auth.") split = urlsplit(request.url) logger.debug(f'HTTP request method: {request.method}') signature = self.get_signature( request.method, split, request.headers, auth_path=request.auth_path ) self._inject_signature(request, signature) def _get_date(self): return formatdate(usegmt=True) def _inject_signature(self, request, signature): if 'Authorization' in request.headers: # We have to do this because request.headers is not # normal dictionary. It has the (unintuitive) behavior # of aggregating repeated setattr calls for the same # key value. For example: # headers['foo'] = 'a'; headers['foo'] = 'b' # list(headers) will print ['foo', 'foo']. del request.headers['Authorization'] auth_header = f"AWS {self.credentials.access_key}:{signature}" request.headers['Authorization'] = auth_header class HmacV1QueryAuth(HmacV1Auth): """ Generates a presigned request for s3. Spec from this document: http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html #RESTAuthenticationQueryStringAuth """ DEFAULT_EXPIRES = 3600 def __init__(self, credentials, expires=DEFAULT_EXPIRES): self.credentials = credentials self._expires = expires def _get_date(self): return str(int(time.time() + int(self._expires))) def _inject_signature(self, request, signature): query_dict = {} query_dict['AWSAccessKeyId'] = self.credentials.access_key query_dict['Signature'] = signature for header_key in request.headers: lk = header_key.lower() # For query string requests, Expires is used instead of the # Date header. if header_key == 'Date': query_dict['Expires'] = request.headers['Date'] # We only want to include relevant headers in the query string. # These can be anything that starts with x-amz, is Content-MD5, # or is Content-Type. elif lk.startswith('x-amz-') or lk in ( 'content-md5', 'content-type', ): query_dict[lk] = request.headers[lk] # Combine all of the identified headers into an encoded # query string new_query_string = percent_encode_sequence(query_dict) # Create a new url with the presigned url. p = urlsplit(request.url) if p[3]: # If there was a pre-existing query string, we should # add that back before injecting the new query string. new_query_string = f'{p[3]}&{new_query_string}' new_url_parts = (p[0], p[1], p[2], new_query_string, p[4]) request.url = urlunsplit(new_url_parts) class HmacV1PostAuth(HmacV1Auth): """ Generates a presigned post for s3. Spec from this document: http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingHTTPPOST.html """ def add_auth(self, request): fields = {} if request.context.get('s3-presign-post-fields', None) is not None: fields = request.context['s3-presign-post-fields'] policy = {} conditions = [] if request.context.get('s3-presign-post-policy', None) is not None: policy = request.context['s3-presign-post-policy'] if policy.get('conditions', None) is not None: conditions = policy['conditions'] policy['conditions'] = conditions fields['AWSAccessKeyId'] = self.credentials.access_key if self.credentials.token is not None: fields['x-amz-security-token'] = self.credentials.token conditions.append({'x-amz-security-token': self.credentials.token}) # Dump the base64 encoded policy into the fields dictionary. fields['policy'] = base64.b64encode( json.dumps(policy).encode('utf-8') ).decode('utf-8') fields['signature'] = self.sign_string(fields['policy']) request.context['s3-presign-post-fields'] = fields request.context['s3-presign-post-policy'] = policy class BearerAuth(TokenSigner): """ Performs bearer token authorization by placing the bearer token in the Authorization header as specified by Section 2.1 of RFC 6750. https://datatracker.ietf.org/doc/html/rfc6750#section-2.1 """ def add_auth(self, request): if self.auth_token is None: raise NoAuthTokenError() auth_header = f'Bearer {self.auth_token.token}' if 'Authorization' in request.headers: del request.headers['Authorization'] request.headers['Authorization'] = auth_header def resolve_auth_type(auth_trait): for auth_type in auth_trait: if auth_type == 'smithy.api#noAuth': return AUTH_TYPE_TO_SIGNATURE_VERSION[auth_type] elif auth_type in AUTH_TYPE_TO_SIGNATURE_VERSION: signature_version = AUTH_TYPE_TO_SIGNATURE_VERSION[auth_type] if signature_version in AUTH_TYPE_MAPS: return signature_version else: raise UnknownSignatureVersionError(signature_version=auth_type) raise UnsupportedSignatureVersionError(signature_version=auth_trait) AUTH_TYPE_MAPS = { 'v2': SigV2Auth, 'v3': SigV3Auth, 'v3https': SigV3Auth, 's3': HmacV1Auth, 's3-query': HmacV1QueryAuth, 's3-presign-post': HmacV1PostAuth, 's3v4-presign-post': S3SigV4PostAuth, 'v4-s3express': S3ExpressAuth, 'v4-s3express-query': S3ExpressQueryAuth, 'v4-s3express-presign-post': S3ExpressPostAuth, 'bearer': BearerAuth, } # Define v4 signers depending on if CRT is present if HAS_CRT: from botocore.crt.auth import CRT_AUTH_TYPE_MAPS AUTH_TYPE_MAPS.update(CRT_AUTH_TYPE_MAPS) else: AUTH_TYPE_MAPS.update( { 'v4': SigV4Auth, 'v4-query': SigV4QueryAuth, 's3v4': S3SigV4Auth, 's3v4-query': S3SigV4QueryAuth, } ) AUTH_TYPE_TO_SIGNATURE_VERSION = { 'aws.auth#sigv4': 'v4', 'aws.auth#sigv4a': 'v4a', 'smithy.api#httpBearerAuth': 'bearer', 'smithy.api#noAuth': 'none', }	43.59 KB	2025-05-25 12:26
📄 awsrequest.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import functools import logging from collections.abc import Mapping import urllib3.util from urllib3.connection import HTTPConnection, VerifiedHTTPSConnection from urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool import botocore.utils from botocore.compat import ( HTTPHeaders, HTTPResponse, MutableMapping, urlencode, urlparse, urlsplit, urlunsplit, ) from botocore.exceptions import UnseekableStreamError logger = logging.getLogger(__name__) class AWSHTTPResponse(HTTPResponse): # The args, kwargs is used because the args are slightly # different in py2.6 than in py2.7/py3. def __init__(self, args, *kwargs): self._status_tuple = kwargs.pop('status_tuple') HTTPResponse.__init__(self, args, *kwargs) def _read_status(self): if self._status_tuple is not None: status_tuple = self._status_tuple self._status_tuple = None return status_tuple else: return HTTPResponse._read_status(self) class AWSConnection: """Mixin for HTTPConnection that supports Expect 100-continue. This when mixed with a subclass of httplib.HTTPConnection (though technically we subclass from urllib3, which subclasses httplib.HTTPConnection) and we only override this class to support Expect 100-continue, which we need for S3. As far as I can tell, this is general purpose enough to not be specific to S3, but I'm being tentative and keeping it in botocore because I've only tested this against AWS services. """ def __init__(self, args, *kwargs): super().__init__(args, *kwargs) self._original_response_cls = self.response_class # This variable is set when we receive an early response from the # server. If this value is set to True, any calls to send() are noops. # This value is reset to false every time _send_request is called. # This is to workaround changes in urllib3 2.0 which uses separate # send() calls in request() instead of delegating to endheaders(), # which is where the body is sent in CPython's HTTPConnection. self._response_received = False self._expect_header_set = False self._send_called = False def close(self): super().close() # Reset all of our instance state we were tracking. self._response_received = False self._expect_header_set = False self._send_called = False self.response_class = self._original_response_cls def request(self, method, url, body=None, headers=None, args, *kwargs): if headers is None: headers = {} self._response_received = False if headers.get('Expect', b'') == b'100-continue': self._expect_header_set = True else: self._expect_header_set = False self.response_class = self._original_response_cls rval = super().request(method, url, body, headers, args, *kwargs) self._expect_header_set = False return rval def _convert_to_bytes(self, mixed_buffer): # Take a list of mixed str/bytes and convert it # all into a single bytestring. # Any str will be encoded as utf-8. bytes_buffer = [] for chunk in mixed_buffer: if isinstance(chunk, str): bytes_buffer.append(chunk.encode('utf-8')) else: bytes_buffer.append(chunk) msg = b"\r\n".join(bytes_buffer) return msg def _send_output(self, message_body=None, args, *kwargs): self._buffer.extend((b"", b"")) msg = self._convert_to_bytes(self._buffer) del self._buffer[:] # If msg and message_body are sent in a single send() call, # it will avoid performance problems caused by the interaction # between delayed ack and the Nagle algorithm. if isinstance(message_body, bytes): msg += message_body message_body = None self.send(msg) if self._expect_header_set: # This is our custom behavior. If the Expect header was # set, it will trigger this custom behavior. logger.debug("Waiting for 100 Continue response.") # Wait for 1 second for the server to send a response. if urllib3.util.wait_for_read(self.sock, 1): self._handle_expect_response(message_body) return else: # From the RFC: # Because of the presence of older implementations, the # protocol allows ambiguous situations in which a client may # send "Expect: 100-continue" without receiving either a 417 # (Expectation Failed) status or a 100 (Continue) status. # Therefore, when a client sends this header field to an origin # server (possibly via a proxy) from which it has never seen a # 100 (Continue) status, the client SHOULD NOT wait for an # indefinite period before sending the request body. logger.debug( "No response seen from server, continuing to " "send the response body." ) if message_body is not None: # message_body was not a string (i.e. it is a file), and # we must run the risk of Nagle. self.send(message_body) def _consume_headers(self, fp): # Most servers (including S3) will just return # the CLRF after the 100 continue response. However, # some servers (I've specifically seen this for squid when # used as a straight HTTP proxy) will also inject a # Connection: keep-alive header. To account for this # we'll read until we read '\r\n', and ignore any headers # that come immediately after the 100 continue response. current = None while current != b'\r\n': current = fp.readline() def _handle_expect_response(self, message_body): # This is called when we sent the request headers containing # an Expect: 100-continue header and received a response. # We now need to figure out what to do. fp = self.sock.makefile('rb', 0) try: maybe_status_line = fp.readline() parts = maybe_status_line.split(None, 2) if self._is_100_continue_status(maybe_status_line): self._consume_headers(fp) logger.debug( "100 Continue response seen, now sending request body." ) self._send_message_body(message_body) elif len(parts) == 3 and parts[0].startswith(b'HTTP/'): # From the RFC: # Requirements for HTTP/1.1 origin servers: # # - Upon receiving a request which includes an Expect # request-header field with the "100-continue" # expectation, an origin server MUST either respond with # 100 (Continue) status and continue to read from the # input stream, or respond with a final status code. # # So if we don't get a 100 Continue response, then # whatever the server has sent back is the final response # and don't send the message_body. logger.debug( "Received a non 100 Continue response " "from the server, NOT sending request body." ) status_tuple = ( parts[0].decode('ascii'), int(parts[1]), parts[2].decode('ascii'), ) response_class = functools.partial( AWSHTTPResponse, status_tuple=status_tuple ) self.response_class = response_class self._response_received = True finally: fp.close() def _send_message_body(self, message_body): if message_body is not None: self.send(message_body) def send(self, str): if self._response_received: if not self._send_called: # urllib3 2.0 chunks and calls send potentially # thousands of times inside `request` unlike the # standard library. Only log this once for sanity. logger.debug( "send() called, but response already received. " "Not sending data." ) self._send_called = True return return super().send(str) def _is_100_continue_status(self, maybe_status_line): parts = maybe_status_line.split(None, 2) # Check for HTTP/<version> 100 Continue\r\n return ( len(parts) >= 3 and parts[0].startswith(b'HTTP/') and parts[1] == b'100' ) class AWSHTTPConnection(AWSConnection, HTTPConnection): """An HTTPConnection that supports 100 Continue behavior.""" class AWSHTTPSConnection(AWSConnection, VerifiedHTTPSConnection): """An HTTPSConnection that supports 100 Continue behavior.""" class AWSHTTPConnectionPool(HTTPConnectionPool): ConnectionCls = AWSHTTPConnection class AWSHTTPSConnectionPool(HTTPSConnectionPool): ConnectionCls = AWSHTTPSConnection def prepare_request_dict( request_dict, endpoint_url, context=None, user_agent=None ): """ This method prepares a request dict to be created into an AWSRequestObject. This prepares the request dict by adding the url and the user agent to the request dict. :type request_dict: dict :param request_dict: The request dict (created from the ``serialize`` module). :type user_agent: string :param user_agent: The user agent to use for this request. :type endpoint_url: string :param endpoint_url: The full endpoint url, which contains at least the scheme, the hostname, and optionally any path components. """ r = request_dict if user_agent is not None: headers = r['headers'] headers['User-Agent'] = user_agent host_prefix = r.get('host_prefix') url = _urljoin(endpoint_url, r['url_path'], host_prefix) if r['query_string']: # NOTE: This is to avoid circular import with utils. This is being # done to avoid moving classes to different modules as to not cause # breaking chainges. percent_encode_sequence = botocore.utils.percent_encode_sequence encoded_query_string = percent_encode_sequence(r['query_string']) if '?' not in url: url += f'?{encoded_query_string}' else: url += f'&{encoded_query_string}' r['url'] = url r['context'] = context if context is None: r['context'] = {} def create_request_object(request_dict): """ This method takes a request dict and creates an AWSRequest object from it. :type request_dict: dict :param request_dict: The request dict (created from the ``prepare_request_dict`` method). :rtype: ``botocore.awsrequest.AWSRequest`` :return: An AWSRequest object based on the request_dict. """ r = request_dict request_object = AWSRequest( method=r['method'], url=r['url'], data=r['body'], headers=r['headers'], auth_path=r.get('auth_path'), ) request_object.context = r['context'] return request_object def _urljoin(endpoint_url, url_path, host_prefix): p = urlsplit(endpoint_url) # <part> - <index> # scheme - p[0] # netloc - p[1] # path - p[2] # query - p[3] # fragment - p[4] if not url_path or url_path == '/': # If there's no path component, ensure the URL ends with # a '/' for backwards compatibility. if not p[2]: new_path = '/' else: new_path = p[2] elif p[2].endswith('/') and url_path.startswith('/'): new_path = p[2][:-1] + url_path else: new_path = p[2] + url_path new_netloc = p[1] if host_prefix is not None: new_netloc = host_prefix + new_netloc reconstructed = urlunsplit((p[0], new_netloc, new_path, p[3], p[4])) return reconstructed class AWSRequestPreparer: """ This class performs preparation on AWSRequest objects similar to that of the PreparedRequest class does in the requests library. However, the logic has been boiled down to meet the specific use cases in botocore. Of note there are the following differences: This class does not heavily prepare the URL. Requests performed many validations and corrections to ensure the URL is properly formatted. Botocore either performs these validations elsewhere or otherwise consistently provides well formatted URLs. This class does not heavily prepare the body. Body preperation is simple and supports only the cases that we document: bytes and file-like objects to determine the content-length. This will also additionally prepare a body that is a dict to be url encoded params string as some signers rely on this. Finally, this class does not support multipart file uploads. This class does not prepare the method, auth or cookies. """ def prepare(self, original): method = original.method url = self._prepare_url(original) body = self._prepare_body(original) headers = self._prepare_headers(original, body) stream_output = original.stream_output return AWSPreparedRequest(method, url, headers, body, stream_output) def _prepare_url(self, original): url = original.url if original.params: url_parts = urlparse(url) delim = '&' if url_parts.query else '?' if isinstance(original.params, Mapping): params_to_encode = list(original.params.items()) else: params_to_encode = original.params params = urlencode(params_to_encode, doseq=True) url = delim.join((url, params)) return url def _prepare_headers(self, original, prepared_body=None): headers = HeadersDict(original.headers.items()) # If the transfer encoding or content length is already set, use that if 'Transfer-Encoding' in headers or 'Content-Length' in headers: return headers # Ensure we set the content length when it is expected if original.method not in ('GET', 'HEAD', 'OPTIONS'): length = self._determine_content_length(prepared_body) if length is not None: headers['Content-Length'] = str(length) else: # Failed to determine content length, using chunked # NOTE: This shouldn't ever happen in practice body_type = type(prepared_body) logger.debug('Failed to determine length of %s', body_type) headers['Transfer-Encoding'] = 'chunked' return headers def _to_utf8(self, item): key, value = item if isinstance(key, str): key = key.encode('utf-8') if isinstance(value, str): value = value.encode('utf-8') return key, value def _prepare_body(self, original): """Prepares the given HTTP body data.""" body = original.data if body == b'': body = None if isinstance(body, dict): params = [self._to_utf8(item) for item in body.items()] body = urlencode(params, doseq=True) return body def _determine_content_length(self, body): return botocore.utils.determine_content_length(body) class AWSRequest: """Represents the elements of an HTTP request. This class was originally inspired by requests.models.Request, but has been boiled down to meet the specific use cases in botocore. That being said this class (even in requests) is effectively a named-tuple. """ _REQUEST_PREPARER_CLS = AWSRequestPreparer def __init__( self, method=None, url=None, headers=None, data=None, params=None, auth_path=None, stream_output=False, ): self._request_preparer = self._REQUEST_PREPARER_CLS() # Default empty dicts for dict params. params = {} if params is None else params self.method = method self.url = url self.headers = HTTPHeaders() self.data = data self.params = params self.auth_path = auth_path self.stream_output = stream_output if headers is not None: for key, value in headers.items(): self.headers[key] = value # This is a dictionary to hold information that is used when # processing the request. What is inside of ``context`` is open-ended. # For example, it may have a timestamp key that is used for holding # what the timestamp is when signing the request. Note that none # of the information that is inside of ``context`` is directly # sent over the wire; the information is only used to assist in # creating what is sent over the wire. self.context = {} def prepare(self): """Constructs a :class:`AWSPreparedRequest <AWSPreparedRequest>`.""" return self._request_preparer.prepare(self) @property def body(self): body = self.prepare().body if isinstance(body, str): body = body.encode('utf-8') return body class AWSPreparedRequest: """A data class representing a finalized request to be sent over the wire. Requests at this stage should be treated as final, and the properties of the request should not be modified. :ivar method: The HTTP Method :ivar url: The full url :ivar headers: The HTTP headers to send. :ivar body: The HTTP body. :ivar stream_output: If the response for this request should be streamed. """ def __init__(self, method, url, headers, body, stream_output): self.method = method self.url = url self.headers = headers self.body = body self.stream_output = stream_output def __repr__(self): fmt = ( '<AWSPreparedRequest stream_output=%s, method=%s, url=%s, ' 'headers=%s>' ) return fmt % (self.stream_output, self.method, self.url, self.headers) def reset_stream(self): """Resets the streaming body to it's initial position. If the request contains a streaming body (a streamable file-like object) seek to the object's initial position to ensure the entire contents of the object is sent. This is a no-op for static bytes-like body types. """ # Trying to reset a stream when there is a no stream will # just immediately return. It's not an error, it will produce # the same result as if we had actually reset the stream (we'll send # the entire body contents again if we need to). # Same case if the body is a string/bytes/bytearray type. non_seekable_types = (bytes, str, bytearray) if self.body is None or isinstance(self.body, non_seekable_types): return try: logger.debug("Rewinding stream: %s", self.body) self.body.seek(0) except Exception as e: logger.debug("Unable to rewind stream: %s", e) raise UnseekableStreamError(stream_object=self.body) class AWSResponse: """A data class representing an HTTP response. This class was originally inspired by requests.models.Response, but has been boiled down to meet the specific use cases in botocore. This has effectively been reduced to a named tuple. :ivar url: The full url. :ivar status_code: The status code of the HTTP response. :ivar headers: The HTTP headers received. :ivar body: The HTTP response body. """ def __init__(self, url, status_code, headers, raw): self.url = url self.status_code = status_code self.headers = HeadersDict(headers) self.raw = raw self._content = None @property def content(self): """Content of the response as bytes.""" if self._content is None: # Read the contents. # NOTE: requests would attempt to call stream and fall back # to a custom generator that would call read in a loop, but # we don't rely on this behavior self._content = b''.join(self.raw.stream()) or b'' return self._content @property def text(self): """Content of the response as a proper text type. Uses the encoding type provided in the reponse headers to decode the response content into a proper text type. If the encoding is not present in the headers, UTF-8 is used as a default. """ encoding = botocore.utils.get_encoding_from_headers(self.headers) if encoding: return self.content.decode(encoding) else: return self.content.decode('utf-8') class _HeaderKey: def __init__(self, key): self._key = key self._lower = key.lower() def __hash__(self): return hash(self._lower) def __eq__(self, other): return isinstance(other, _HeaderKey) and self._lower == other._lower def __str__(self): return self._key def __repr__(self): return repr(self._key) class HeadersDict(MutableMapping): """A case-insenseitive dictionary to represent HTTP headers.""" def __init__(self, args, *kwargs): self._dict = {} self.update(args, **kwargs) def __setitem__(self, key, value): self._dict[_HeaderKey(key)] = value def __getitem__(self, key): return self._dict[_HeaderKey(key)] def __delitem__(self, key): del self._dict[_HeaderKey(key)] def __iter__(self): return (str(key) for key in self._dict) def __len__(self): return len(self._dict) def __repr__(self): return repr(self._dict) def copy(self): return HeadersDict(self.items())	22.61 KB	2025-05-25 12:26
📄 cacert.pem # Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA # Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA # Label: "GlobalSign Root CA" # Serial: 4835703278459707669005204 # MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a # SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c # SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99 -----BEGIN CERTIFICATE----- MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp 1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8 9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE 38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A== -----END CERTIFICATE----- # Issuer: CN=GlobalSign O=GlobalSign OU=GlobalSign Root CA - R2 # Subject: CN=GlobalSign O=GlobalSign OU=GlobalSign Root CA - R2 # Label: "GlobalSign Root CA - R2" # Serial: 4835703278459682885658125 # MD5 Fingerprint: 94:14:77:7e:3e:5e:fd:8f:30:bd:41:b0:cf:e7:d0:30 # SHA1 Fingerprint: 75:e0:ab:b6:13:85:12:27:1c:04:f8:5f:dd:de:38:e4:b7:24:2e:fe # SHA256 Fingerprint: ca:42:dd:41:74:5f:d0:b8:1e:b9:02:36:2c:f9:d8:bf:71:9d:a1:bd:1b:1e:fc:94:6f:5b:4c:99:f4:2c:1b:9e -----BEGIN CERTIFICATE----- MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4G A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1 MDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAKbPJA6+Lm8omUVCxKs+IVSbC9N/hHD6ErPL v4dfxn+G07IwXNb9rfF73OX4YJYJkhD10FPe+3t+c4isUoh7SqbKSaZeqKeMWhG8 eoLrvozps6yWJQeXSpkqBy+0Hne/ig+1AnwblrjFuTosvNYSuetZfeLQBoZfXklq tTleiDTsvHgMCJiEbKjNS7SgfQx5TfC4LcshytVsW33hoCmEofnTlEnLJGKRILzd C9XZzPnqJworc5HGnRusyMvo4KD0L5CLTfuwNhv2GXqF4G3yYROIXJ/gkwpRl4pa zq+r1feqCapgvdzZX99yqWATXgAByUr6P6TqBwMhAo6CygPCm48CAwEAAaOBnDCB mTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm+IH V2ccHsBqBt5ZtJot39wZhi4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5n bG9iYWxzaWduLm5ldC9yb290LXIyLmNybDAfBgNVHSMEGDAWgBSb4gdXZxwewGoG 3lm0mi3f3BmGLjANBgkqhkiG9w0BAQUFAAOCAQEAmYFThxxol4aR7OBKuEQLq4Gs J0/WwbgcQ3izDJr86iw8bmEbTUsp9Z8FHSbBuOmDAGJFtqkIk7mpM0sYmsL4h4hO 291xNBrBVNpGP+DTKqttVCL1OmLNIG+6KYnX3ZHu01yiPqFbQfXf5WRDLenVOavS ot+3i9DAgBkcRcAtjOj4LaR0VknFBbVPFd5uRHg5h6h+u/N5GJG79G+dwfCMNYxd AfvDbbnvRG15RjF+Cv6pgsH/76tuIMRQyV+dTZsXjAzlAcmgQWpzU/qlULRuJQ/7 TBj0/VLZjmmx6BEP3ojY+x1J96relc8geMJgEtslQIxq/H5COEBkEveegeGTLg== -----END CERTIFICATE----- # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G3 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 1999 VeriSign, Inc. - For authorized use only # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G3 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 1999 VeriSign, Inc. - For authorized use only # Label: "Verisign Class 3 Public Primary Certification Authority - G3" # Serial: 206684696279472310254277870180966723415 # MD5 Fingerprint: cd:68:b6:a7:c7:c4:ce:75:e0:1d:4f:57:44:61:92:09 # SHA1 Fingerprint: 13:2d:0d:45:53:4b:69:97:cd:b2:d5:c3:39:e2:55:76:60:9b:5c:c6 # SHA256 Fingerprint: eb:04:cf:5e:b1:f3:9a:fa:76:2f:2b:b1:20:f2:96:cb:a5:20:c1:b9:7d:b1:58:95:65:b8:1c:b9:a1:7b:72:44 -----BEGIN CERTIFICATE----- MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te 2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC /Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ== -----END CERTIFICATE----- # Issuer: CN=Entrust.net Certification Authority (2048) O=Entrust.net OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)/(c) 1999 Entrust.net Limited # Subject: CN=Entrust.net Certification Authority (2048) O=Entrust.net OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)/(c) 1999 Entrust.net Limited # Label: "Entrust.net Premium 2048 Secure Server CA" # Serial: 946069240 # MD5 Fingerprint: ee:29:31:bc:32:7e:9a:e6:e8:b5:f7:51:b4:34:71:90 # SHA1 Fingerprint: 50:30:06:09:1d:97:d4:f5:ae:39:f7:cb:e7:92:7d:7d:65:2d:34:31 # SHA256 Fingerprint: 6d:c4:71:72:e0:1c:bc:b0:bf:62:58:0d:89:5f:e2:b8:ac:9a:d4:f8:73:80:1e:0c:10:b9:c8:37:d2:1e:b1:77 -----BEGIN CERTIFICATE----- MIIEKjCCAxKgAwIBAgIEOGPe+DANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5 IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQxNzUwNTFaFw0yOTA3 MjQxNDE1MTJaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3 LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp YWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG A1UEAxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArU1LqRKGsuqjIAcVFmQq K0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOLGp18EzoOH1u3Hs/lJBQe sYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSrhRSGlVuX MlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVT XTzWnLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/ HoZdenoVve8AjhUiVBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH 4QIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV HQ4EFgQUVeSB0RGAvtiJuQijMfmhJAkWuXAwDQYJKoZIhvcNAQEFBQADggEBADub j1abMOdTmXx6eadNl9cZlZD7Bh/KM3xGY4+WZiT6QBshJ8rmcnPyT/4xmf3IDExo U8aAghOY+rat2l098c5u9hURlIIM7j+VrxGrD9cv3h8Dj1csHsm7mhpElesYT6Yf zX1XEC+bBAlahLVu2B064dae0Wx5XnkcFMXj0EyTO2U87d89vqbllRrDtRnDvV5b u/8j72gZyxKTJ1wDLW8w0B62GqzeWvfRqqgnpv55gcR5mTNXuhKwqeBCbJPKVt7+ bYQLCIt+jerXmCHG8+c8eS9enNFMFY3h7CI3zJpDC5fcgJCNs2ebb0gIFVbPv/Er fF6adulZkMV8gzURZVE= -----END CERTIFICATE----- # Issuer: CN=Baltimore CyberTrust Root O=Baltimore OU=CyberTrust # Subject: CN=Baltimore CyberTrust Root O=Baltimore OU=CyberTrust # Label: "Baltimore CyberTrust Root" # Serial: 33554617 # MD5 Fingerprint: ac:b6:94:a5:9c:17:e0:d7:91:52:9b:b1:97:06:a6:e4 # SHA1 Fingerprint: d4:de:20:d0:5e:66:fc:53:fe:1a:50:88:2c:78:db:28:52:ca:e4:74 # SHA256 Fingerprint: 16:af:57:a9:f6:76:b0:ab:12:60:95:aa:5e:ba:de:f2:2a:b3:11:19:d6:44:ac:95:cd:4b:93:db:f3:f2:6a:eb -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1 BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3 DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92 9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0 Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp -----END CERTIFICATE----- # Issuer: CN=AddTrust External CA Root O=AddTrust AB OU=AddTrust External TTP Network # Subject: CN=AddTrust External CA Root O=AddTrust AB OU=AddTrust External TTP Network # Label: "AddTrust External Root" # Serial: 1 # MD5 Fingerprint: 1d:35:54:04:85:78:b0:3f:42:42:4d:bf:20:73:0a:3f # SHA1 Fingerprint: 02:fa:f3:e2:91:43:54:68:60:78:57:69:4d:f5:e4:5b:68:85:18:68 # SHA256 Fingerprint: 68:7f:a4:51:38:22:78:ff:f0:c8:b1:1f:8d:43:d5:76:67:1c:6e:b2:bc:ea:b4:13:fb:83:d9:65:d0:6d:2f:f2 -----BEGIN CERTIFICATE----- MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290 MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9 uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0 WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0 Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5 6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ= -----END CERTIFICATE----- # Issuer: CN=Entrust Root Certification Authority O=Entrust, Inc. OU=www.entrust.net/CPS is incorporated by reference/(c) 2006 Entrust, Inc. # Subject: CN=Entrust Root Certification Authority O=Entrust, Inc. OU=www.entrust.net/CPS is incorporated by reference/(c) 2006 Entrust, Inc. # Label: "Entrust Root Certification Authority" # Serial: 1164660820 # MD5 Fingerprint: d6:a5:c3:ed:5d:dd:3e:00:c1:3d:87:92:1f:1d:3f:e4 # SHA1 Fingerprint: b3:1e:b1:b7:40:e3:6c:84:02:da:dc:37:d4:4d:f5:d4:67:49:52:f9 # SHA256 Fingerprint: 73:c1:76:43:4f:1b:c6:d5:ad:f4:5b:0e:76:e7:27:28:7c:8d:e5:76:16:c1:e6:e6:14:1a:2b:2c:bc:7d:8e:4c -----BEGIN CERTIFICATE----- MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMC VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0 Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW KGMpIDIwMDYgRW50cnVzdCwgSW5jLjEtMCsGA1UEAxMkRW50cnVzdCBSb290IENl cnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEyNzIwMjM0MloXDTI2MTEyNzIw NTM0MlowgbAxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSBy ZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDA2IEVudHJ1c3QsIEluYy4xLTArBgNV BAMTJEVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJ KoZIhvcNAQEBBQADggEPADCCAQoCggEBALaVtkNC+sZtKm9I35RMOVcF7sN5EUFo Nu3s/poBj6E4KPz3EEZmLk0eGrEaTsbRwJWIsMn/MYszA9u3g3s+IIRe7bJWKKf4 4LlAcTfFy0cOlypowCKVYhXbR9n10Cv/gkvJrT7eTNuQgFA/CYqEAOwwCj0Yzfv9 KlmaI5UXLEWeH25DeW0MXJj+SKfFI0dcXv1u5x609mhF0YaDW6KKjbHjKYD+JXGI rb68j6xSlkuqUY3kEzEZ6E5Nn9uss2rVvDlUccp6en+Q3X0dgNmBu1kmwhH+5pPi 94DkZfs0Nw4pgHBNrziGLp5/V6+eF67rHMsoIV+2HNjnogQi+dPa2MsCAwEAAaOB sDCBrTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zArBgNVHRAEJDAi gA8yMDA2MTEyNzIwMjM0MlqBDzIwMjYxMTI3MjA1MzQyWjAfBgNVHSMEGDAWgBRo kORnpKZTgMeGZqTx90tD+4S9bTAdBgNVHQ4EFgQUaJDkZ6SmU4DHhmak8fdLQ/uE vW0wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqGSIb3DQEBBQUA A4IBAQCT1DCw1wMgKtD5Y+iRDAUgqV8ZyntyTtSx29CW+1RaGSwMCPeyvIWonX9t O1KzKtvn1ISMY/YPyyYBkVBs9F8U4pN0wBOeMDpQ47RgxRzwIkSNcUesyBrJ6Zua AGAT/3B+XxFNSRuzFVJ7yVTav52Vr2ua2J7p8eRDjeIRRDq/r72DQnNSi6q7pynP 9WQcCk3RvKqsnyrQ/39/2n3qse0wJcGE2jTSW3iDVuycNsMm4hH2Z0kdkquM++v/ eu6FSqdQgPCnXEqULl8FmTxSQeDNtGPPAUO6nIPcj2A781q0tHuu2guQOHXvgR1m 0vdXcDazv/wor3ElhVsT/h5/WrQ8 -----END CERTIFICATE----- # Issuer: CN=GeoTrust Global CA O=GeoTrust Inc. # Subject: CN=GeoTrust Global CA O=GeoTrust Inc. # Label: "GeoTrust Global CA" # Serial: 144470 # MD5 Fingerprint: f7:75:ab:29:fb:51:4e:b7:77:5e:ff:05:3c:99:8e:f5 # SHA1 Fingerprint: de:28:f4:a4:ff:e5:b9:2f:a3:c5:03:d1:a3:49:a7:f9:96:2a:82:12 # SHA256 Fingerprint: ff:85:6a:2d:25:1d:cd:88:d3:66:56:f4:50:12:67:98:cf:ab:aa:de:40:79:9c:72:2d:e4:d2:b5:db:36:a7:3a -----BEGIN CERTIFICATE----- MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9 9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU 1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+ bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV 5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw== -----END CERTIFICATE----- # Issuer: CN=GeoTrust Universal CA O=GeoTrust Inc. # Subject: CN=GeoTrust Universal CA O=GeoTrust Inc. # Label: "GeoTrust Universal CA" # Serial: 1 # MD5 Fingerprint: 92:65:58:8b:a2:1a:31:72:73:68:5c:b4:a5:7a:07:48 # SHA1 Fingerprint: e6:21:f3:35:43:79:05:9a:4b:68:30:9d:8a:2f:74:22:15:87:ec:79 # SHA256 Fingerprint: a0:45:9b:9f:63:b2:25:59:f5:fa:5d:4c:6d:b3:f9:f7:2f:f1:93:42:03:35:78:f0:73:bf:1d:1b:46:cb:b9:12 -----BEGIN CERTIFICATE----- MIIFaDCCA1CgAwIBAgIBATANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJVUzEW MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEeMBwGA1UEAxMVR2VvVHJ1c3QgVW5pdmVy c2FsIENBMB4XDTA0MDMwNDA1MDAwMFoXDTI5MDMwNDA1MDAwMFowRTELMAkGA1UE BhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xHjAcBgNVBAMTFUdlb1RydXN0 IFVuaXZlcnNhbCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKYV VaCjxuAfjJ0hUNfBvitbtaSeodlyWL0AG0y/YckUHUWCq8YdgNY96xCcOq9tJPi8 cQGeBvV8Xx7BDlXKg5pZMK4ZyzBIle0iN430SppyZj6tlcDgFgDgEB8rMQ7XlFTT QjOgNB0eRXbdT8oYN+yFFXoZCPzVx5zw8qkuEKmS5j1YPakWaDwvdSEYfyh3peFh F7em6fgemdtzbvQKoiFs7tqqhZJmr/Z6a4LauiIINQ/PQvE1+mrufislzDoR5G2v c7J2Ha3QsnhnGqQ5HFELZ1aD/ThdDc7d8Lsrlh/eezJS/R27tQahsiFepdaVaH/w mZ7cRQg+59IJDTWU3YBOU5fXtQlEIGQWFwMCTFMNaN7VqnJNk22CDtucvc+081xd VHppCZbW2xHBjXWotM85yM48vCR85mLK4b19p71XZQvk/iXttmkQ3CgaRr0BHdCX teGYO8A3ZNY9lO4L4fUorgtWv3GLIylBjobFS1J72HGrH4oVpjuDWtdYAVHGTEHZ f9hBZ3KiKN9gg6meyHv8U3NyWfWTehd2Ds735VzZC1U0oqpbtWpU5xPKV+yXbfRe Bi9Fi1jUIxaS5BZuKGNZMN9QAZxjiRqf2xeUgnA3wySemkfWWspOqGmJch+RbNt+ nhutxx9z3SxPGWX9f5NAEC7S8O08ni4oPmkmM8V7AgMBAAGjYzBhMA8GA1UdEwEB /wQFMAMBAf8wHQYDVR0OBBYEFNq7LqqwDLiIJlF0XG0D08DYj3rWMB8GA1UdIwQY MBaAFNq7LqqwDLiIJlF0XG0D08DYj3rWMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG 9w0BAQUFAAOCAgEAMXjmx7XfuJRAyXHEqDXsRh3ChfMoWIawC/yOsjmPRFWrZIRc aanQmjg8+uUfNeVE44B5lGiku8SfPeE0zTBGi1QrlaXv9z+ZhP015s8xxtxqv6fX IwjhmF7DWgh2qaavdy+3YL1ERmrvl/9zlcGO6JP7/TG37FcREUWbMPEaiDnBTzyn ANXH/KttgCJwpQzgXQQpAvvLoJHRfNbDflDVnVi+QTjruXU8FdmbyUqDWcDaU/0z uzYYm4UPFd3uLax2k7nZAY1IEKj79TiG8dsKxr2EoyNB3tZ3b4XUhRxQ4K5RirqN Pnbiucon8l+f725ZDQbYKxek0nxru18UGkiPGkzns0ccjkxFKyDuSN/n3QmOGKja QI2SJhFTYXNd673nxE0pN2HrrDktZy4W1vUAg4WhzH92xH3kt0tm7wNFYGm2DFKW koRepqO1pD4r2czYG0eq8kTaT/kD6PAUyz/zg97QwVTjt+gKN02LIFkDMBmhLMi9 ER/frslKxfMnZmaGrGiR/9nmUxwPi1xpZQomyB40w11Re9epnAahNt3ViZS82eQt DF4JbAiXfKM9fJP/P6EUp8+1Xevb2xzEdt+Iub1FBZUbrvxGakyvSOPOrg/Sfuvm bJxPgWp6ZKy7PtXny3YuxadIwVyQD8vIP/rmMuGNG2+k5o7Y+SlIis5z/iw= -----END CERTIFICATE----- # Issuer: CN=GeoTrust Universal CA 2 O=GeoTrust Inc. # Subject: CN=GeoTrust Universal CA 2 O=GeoTrust Inc. # Label: "GeoTrust Universal CA 2" # Serial: 1 # MD5 Fingerprint: 34:fc:b8:d0:36:db:9e:14:b3:c2:f2:db:8f:e4:94:c7 # SHA1 Fingerprint: 37:9a:19:7b:41:85:45:35:0c:a6:03:69:f3:3c:2e:af:47:4f:20:79 # SHA256 Fingerprint: a0:23:4f:3b:c8:52:7c:a5:62:8e:ec:81:ad:5d:69:89:5d:a5:68:0d:c9:1d:1c:b8:47:7f:33:f8:78:b9:5b:0b -----BEGIN CERTIFICATE----- MIIFbDCCA1SgAwIBAgIBATANBgkqhkiG9w0BAQUFADBHMQswCQYDVQQGEwJVUzEW MBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1c3QgVW5pdmVy c2FsIENBIDIwHhcNMDQwMzA0MDUwMDAwWhcNMjkwMzA0MDUwMDAwWjBHMQswCQYD VQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEgMB4GA1UEAxMXR2VvVHJ1 c3QgVW5pdmVyc2FsIENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC AQCzVFLByT7y2dyxUxpZKeexw0Uo5dfR7cXFS6GqdHtXr0om/Nj1XqduGdt0DE81 WzILAePb63p3NeqqWuDW6KFXlPCQo3RWlEQwAx5cTiuFJnSCegx2oG9NzkEtoBUG FF+3Qs17j1hhNNwqCPkuwwGmIkQcTAeC5lvO0Ep8BNMZcyfwqph/Lq9O64ceJHdq XbboW0W63MOhBW9Wjo8QJqVJwy7XQYci4E+GymC16qFjwAGXEHm9ADwSbSsVsaxL se4YuU6W3Nx2/zu+z18DwPw76L5GG//aQMJS9/7jOvdqdzXQ2o3rXhhqMcceujwb KNZrVMaqW9eiLBsZzKIC9ptZvTdrhrVtgrrY6slWvKk2WP0+GfPtDCapkzj4T8Fd IgbQl+rhrcZV4IErKIM6+vR7IVEAvlI4zs1meaj0gVbi0IMJR1FbUGrP20gaXT73 y/Zl92zxlfgCOzJWgjl6W70viRu/obTo/3+NjN8D8WBOWBFM66M/ECuDmgFz2ZRt hAAnZqzwcEAJQpKtT5MNYQlRJNiS1QuUYbKHsu3/mjX/hVTK7URDrBs8FmtISgoc QIgfksILAAX/8sgCSqSqqcyZlpwvWOB94b67B9xfBHJcMTTD7F8t4D1kkCLm0ey4 Lt1ZrtmhN79UNdxzMk+MBB4zsslG8dhcyFVQyWi9qLo2CQIDAQABo2MwYTAPBgNV HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR281Xh+qQ2+/CfXGJx7Tz0RzgQKzAfBgNV HSMEGDAWgBR281Xh+qQ2+/CfXGJx7Tz0RzgQKzAOBgNVHQ8BAf8EBAMCAYYwDQYJ KoZIhvcNAQEFBQADggIBAGbBxiPz2eAubl/oz66wsCVNK/g7WJtAJDday6sWSf+z dXkzoS9tcBc0kf5nfo/sm+VegqlVHy/c1FEHEv6sFj4sNcZj/NwQ6w2jqtB8zNHQ L1EuxBRa3ugZ4T7GzKQp5y6EqgYweHZUcyiYWTjgAA1i00J9IZ+uPTqM1fp3DRgr Fg5fNuH8KrUwJM/gYwx7WBr+mbpCErGR9Hxo4sjoryzqyX6uuyo9DRXcNJW2GHSo ag/HtPQTxORb7QrSpJdMKu0vbBKJPfEncKpqA1Ihn0CoZ1Dy81of398j9tx4TuaY T1U6U+Pv8vSfx3zYWK8pIpe44L2RLrB27FcRz+8pRPPphXpgY+RdM4kX2TGq2tbz GDVyz4crL2MjhF2EjD9XoIj8mZEoJmmZ1I+XRL6O1UixpCgp8RW04eWe3fiPpm8m 1wk8OhwRDqZsN/etRIcsKMfYdIKz0G9KV7s1KSegi+ghp4dkNl3M2Basx7InQJJV OCiNUW7dFGdTbHFcJoRNdVq2fmBWqU2t+5sel/MN2dKXVHfaPRK34B7vCAas+YWH 6aLcr34YEoP9VhdBLtUpgn2Z9DH2canPLAEnpQW5qrJITirvn5NSUZU8UnOOVkwX QMAJKOSLakhT2+zNVVXxxvjpoixMptEmX36vWkzaH6byHCx+rgIW0lbQL1dTR+iS -----END CERTIFICATE----- # Issuer: CN=Visa eCommerce Root O=VISA OU=Visa International Service Association # Subject: CN=Visa eCommerce Root O=VISA OU=Visa International Service Association # Label: "Visa eCommerce Root" # Serial: 25952180776285836048024890241505565794 # MD5 Fingerprint: fc:11:b8:d8:08:93:30:00:6d:23:f9:7e:eb:52:1e:02 # SHA1 Fingerprint: 70:17:9b:86:8c:00:a4:fa:60:91:52:22:3f:9f:3e:32:bd:e0:05:62 # SHA256 Fingerprint: 69:fa:c9:bd:55:fb:0a:c7:8d:53:bb:ee:5c:f1:d5:97:98:9f:d0:aa:ab:20:a2:51:51:bd:f1:73:3e:e7:d1:22 -----BEGIN CERTIFICATE----- MIIDojCCAoqgAwIBAgIQE4Y1TR0/BvLB+WUF1ZAcYjANBgkqhkiG9w0BAQUFADBr MQswCQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRl cm5hdGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNv bW1lcmNlIFJvb3QwHhcNMDIwNjI2MDIxODM2WhcNMjIwNjI0MDAxNjEyWjBrMQsw CQYDVQQGEwJVUzENMAsGA1UEChMEVklTQTEvMC0GA1UECxMmVmlzYSBJbnRlcm5h dGlvbmFsIFNlcnZpY2UgQXNzb2NpYXRpb24xHDAaBgNVBAMTE1Zpc2EgZUNvbW1l cmNlIFJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvV95WHm6h 2mCxlCfLF9sHP4CFT8icttD0b0/Pmdjh28JIXDqsOTPHH2qLJj0rNfVIsZHBAk4E lpF7sDPwsRROEW+1QK8bRaVK7362rPKgH1g/EkZgPI2h4H3PVz4zHvtH8aoVlwdV ZqW1LS7YgFmypw23RuwhY/81q6UCzyr0TP579ZRdhE2o8mCP2w4lPJ9zcc+U30rq 299yOIzzlr3xF7zSujtFWsan9sYXiwGd/BmoKoMWuDpI/k4+oKsGGelT84ATB+0t vz8KPFUgOSwsAGl0lUq8ILKpeeUYiZGo3BxN77t+Nwtd/jmliFKMAGzsGHxBvfaL dXe6YJ2E5/4tAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD AgEGMB0GA1UdDgQWBBQVOIMPPyw/cDMezUb+B4wg4NfDtzANBgkqhkiG9w0BAQUF AAOCAQEAX/FBfXxcCLkr4NWSR/pnXKUTwwMhmytMiUbPWU3J/qVAtmPN3XEolWcR zCSs00Rsca4BIGsDoo8Ytyk6feUWYFN4PMCvFYP3j1IzJL1kk5fui/fbGKhtcbP3 LBfQdCVp9/5rPJS+TUtBjE7ic9DjkCJzQ83z7+pzzkWKsKZJ/0x9nXGIxHYdkFsd 7v3M9+79YKWxehZx0RbQfBI8bGmX265fOZpwLwU8GUYEmSA20GBuYQa7FkKMcPcw ++DbZqMAAb3mLNqRX6BGi01qnD093QVG/na/oAo85ADmJ7f/hC3euiInlhBx6yLt 398znM/jra6O1I7mT1GvFpLgXPYHDw== -----END CERTIFICATE----- # Issuer: CN=AAA Certificate Services O=Comodo CA Limited # Subject: CN=AAA Certificate Services O=Comodo CA Limited # Label: "Comodo AAA Services root" # Serial: 1 # MD5 Fingerprint: 49:79:04:b0:eb:87:19:ac:47:b0:bc:11:51:9b:74:d0 # SHA1 Fingerprint: d1:eb:23:a4:6d:17:d6:8f:d9:25:64:c2:f1:f1:60:17:64:d8:e3:49 # SHA256 Fingerprint: d7:a7:a0:fb:5d:7e:27:31:d7:71:e9:48:4e:bc:de:f7:1d:5f:0c:3e:0a:29:48:78:2b:c8:3e:e0:ea:69:9e:f4 -----BEGIN CERTIFICATE----- MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe 3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== -----END CERTIFICATE----- # Issuer: CN=QuoVadis Root Certification Authority O=QuoVadis Limited OU=Root Certification Authority # Subject: CN=QuoVadis Root Certification Authority O=QuoVadis Limited OU=Root Certification Authority # Label: "QuoVadis Root CA" # Serial: 985026699 # MD5 Fingerprint: 27:de:36:fe:72:b7:00:03:00:9d:f4:f0:1e:6c:04:24 # SHA1 Fingerprint: de:3f:40:bd:50:93:d3:9b:6c:60:f6:da:bc:07:62:01:00:89:76:c9 # SHA256 Fingerprint: a4:5e:de:3b:bb:f0:9c:8a:e1:5c:72:ef:c0:72:68:d6:93:a2:1c:99:6f:d5:1e:67:ca:07:94:60:fd:6d:88:73 -----BEGIN CERTIFICATE----- MIIF0DCCBLigAwIBAgIEOrZQizANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJC TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDElMCMGA1UECxMcUm9vdCBDZXJ0 aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMlUXVvVmFkaXMgUm9vdCBDZXJ0 aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMTAzMTkxODMzMzNaFw0yMTAzMTcxODMz MzNaMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMSUw IwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYDVQQDEyVR dW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2G1lVO6V/z68mcLOhrfEYBklbTRvM16z/Yp li4kVEAkOPcahdxYTMukJ0KX0J+DisPkBgNbAKVRHnAEdOLB1Dqr1607BxgFjv2D rOpm2RgbaIr1VxqYuvXtdj182d6UajtLF8HVj71lODqV0D1VNk7feVcxKh7YWWVJ WCCYfqtffp/p1k3sg3Spx2zY7ilKhSoGFPlU5tPaZQeLYzcS19Dsw3sgQUSj7cug F+FxZc4dZjH3dgEZyH0DWLaVSR2mEiboxgx24ONmy+pdpibu5cxfvWenAScOospU xbF6lR1xHkopigPcakXBpBlebzbNw6Kwt/5cOOJSvPhEQ+aQuwIDAQABo4ICUjCC Ak4wPQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwczovL29jc3AucXVv dmFkaXNvZmZzaG9yZS5jb20wDwYDVR0TAQH/BAUwAwEB/zCCARoGA1UdIASCAREw ggENMIIBCQYJKwYBBAG+WAABMIH7MIHUBggrBgEFBQcCAjCBxxqBxFJlbGlhbmNl IG9uIHRoZSBRdW9WYWRpcyBSb290IENlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBh c3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFy ZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRpb24gcHJh Y3RpY2VzLCBhbmQgdGhlIFF1b1ZhZGlzIENlcnRpZmljYXRlIFBvbGljeS4wIgYI KwYBBQUHAgEWFmh0dHA6Ly93d3cucXVvdmFkaXMuYm0wHQYDVR0OBBYEFItLbe3T KbkGGew5Oanwl4Rqy+/fMIGuBgNVHSMEgaYwgaOAFItLbe3TKbkGGew5Oanwl4Rq y+/foYGEpIGBMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1p dGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYD VQQDEyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggQ6tlCL MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAitQUtf70mpKnGdSk fnIYj9lofFIk3WdvOXrEql494liwTXCYhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf8 7C9TqnN7Az10buYWnuulLsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1R cHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2xgI4JVrmcGmD+XcHXetwReNDWXcG31a0y mQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi5upZIof4l/UO/erMkqQW xFIY6iHOsfHmhIHluqmGKPJDWl0Snawe2ajlCmqnf6CHKc/yiU3U7MXi5nrQNiOK SnQ2+Q== -----END CERTIFICATE----- # Issuer: CN=QuoVadis Root CA 2 O=QuoVadis Limited # Subject: CN=QuoVadis Root CA 2 O=QuoVadis Limited # Label: "QuoVadis Root CA 2" # Serial: 1289 # MD5 Fingerprint: 5e:39:7b:dd:f8:ba:ec:82:e9:ac:62:ba:0c:54:00:2b # SHA1 Fingerprint: ca:3a:fb:cf:12:40:36:4b:44:b2:16:20:88:80:48:39:19:93:7c:f7 # SHA256 Fingerprint: 85:a0:dd:7d:d7:20:ad:b7:ff:05:f8:3d:54:2b:20:9d:c7:ff:45:28:f7:d6:77:b1:83:89:fe:a5:e5:c4:9e:86 -----BEGIN CERTIFICATE----- MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv b3QgQ0EgMjAeFw0wNjExMjQxODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNV BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W YWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCa GMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6XJxg Fyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55J WpzmM+Yklvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bB rrcCaoF6qUWD4gXmuVbBlDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp +ARz8un+XJiM9XOva7R+zdRcAitMOeGylZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1 ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt66/3FsvbzSUr5R/7mp/i Ucw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1JdxnwQ5hYIiz PtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og /zOhD7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UH oycR7hYQe7xFSkyyBNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuI yV77zGHcizN300QyNQliBJIWENieJ0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1Ud EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBQahGK8SEwzJQTU7tD2 A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGUa6FJpEcwRTEL MAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2f BluornFdLwUvZ+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzn g/iN/Ae42l9NLmeyhP3ZRPx3UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2Bl fF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodmVjB3pjd4M1IQWK4/YY7yarHvGH5K WWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK+JDSV6IZUaUtl0Ha B0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrWIozc hLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPR TUIZ3Ph1WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWD mbA4CD/pXvk1B+TJYm5Xf6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0Z ohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y 4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8VCLAAVBpQ570su9t+Oza 8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u -----END CERTIFICATE----- # Issuer: CN=QuoVadis Root CA 3 O=QuoVadis Limited # Subject: CN=QuoVadis Root CA 3 O=QuoVadis Limited # Label: "QuoVadis Root CA 3" # Serial: 1478 # MD5 Fingerprint: 31:85:3c:62:94:97:63:b9:aa:fd:89:4e:af:6f:e0:cf # SHA1 Fingerprint: 1f:49:14:f7:d8:74:95:1d:dd:ae:02:c0:be:fd:3a:2d:82:75:51:85 # SHA256 Fingerprint: 18:f1:fc:7f:20:5d:f8:ad:dd:eb:7f:e0:07:dd:57:e3:af:37:5a:9c:4d:8d:73:54:6b:f4:f1:fe:d1:e1:8d:35 -----BEGIN CERTIFICATE----- MIIGnTCCBIWgAwIBAgICBcYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv b3QgQ0EgMzAeFw0wNjExMjQxOTExMjNaFw0zMTExMjQxOTA2NDRaMEUxCzAJBgNV BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W YWRpcyBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDM V0IWVJzmmNPTTe7+7cefQzlKZbPoFog02w1ZkXTPkrgEQK0CSzGrvI2RaNggDhoB 4hp7Thdd4oq3P5kazethq8Jlph+3t723j/z9cI8LoGe+AaJZz3HmDyl2/7FWeUUr H556VOijKTVopAFPD6QuN+8bv+OPEKhyq1hX51SGyMnzW9os2l2ObjyjPtr7guXd 8lyyBTNvijbO0BNO/79KDDRMpsMhvVAEVeuxu537RR5kFd5VAYwCdrXLoT9Cabwv vWhDFlaJKjdhkf2mrk7AyxRllDdLkgbvBNDInIjbC3uBr7E9KsRlOni27tyAsdLT mZw67mtaa7ONt9XOnMK+pUsvFrGeaDsGb659n/je7Mwpp5ijJUMv7/FfJuGITfhe btfZFG4ZM2mnO4SJk8RTVROhUXhA+LjJou57ulJCg54U7QVSWllWp5f8nT8KKdjc T5EOE7zelaTfi5m+rJsziO+1ga8bxiJTyPbH7pcUsMV8eFLI8M5ud2CEpukqdiDt WAEXMJPpGovgc2PZapKUSU60rUqFxKMiMPwJ7Wgic6aIDFUhWMXhOp8q3crhkODZ c6tsgLjoC2SToJyMGf+z0gzskSaHirOi4XCPLArlzW1oUevaPwV/izLmE1xr/l9A 4iLItLRkT9a6fUg+qGkM17uGcclzuD87nSVL2v9A6wIDAQABo4IBlTCCAZEwDwYD VR0TAQH/BAUwAwEB/zCB4QYDVR0gBIHZMIHWMIHTBgkrBgEEAb5YAAMwgcUwgZMG CCsGAQUFBwICMIGGGoGDQW55IHVzZSBvZiB0aGlzIENlcnRpZmljYXRlIGNvbnN0 aXR1dGVzIGFjY2VwdGFuY2Ugb2YgdGhlIFF1b1ZhZGlzIFJvb3QgQ0EgMyBDZXJ0 aWZpY2F0ZSBQb2xpY3kgLyBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu dC4wLQYIKwYBBQUHAgEWIWh0dHA6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL2Nw czALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFPLAE+CCQz777i9nMpY1XNu4ywLQMG4G A1UdIwRnMGWAFPLAE+CCQz777i9nMpY1XNu4ywLQoUmkRzBFMQswCQYDVQQGEwJC TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg Um9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0 7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem d1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62Iix2rFo1bZhfZFvSLgNLd +LJ2w/w4E6oM3kJpK27zPOuAJ9v1pkQNn1pVWQvVDVJIxa6f8i+AxeoyUDUSly7B 4f/xI4hROJ/yZlZ25w9Rl6VSDE1JUZU2Pb+iSwwQHYaZTKrzchGT5Or2m9qoXadN t54CrnMAyNojA+j56hl0YgCUyyIgvpSnWbWCar6ZeXqp8kokUvd0/bpO5qgdAm6x DYBEwa7TIzdfu4V8K5Iu6H6li92Z4b8nby1dqnuH/grdS/yO9SbkbnBCbjPsMZ57 k8HkyWkaPcBrTiJt7qtYTcbQQcEr6k8Sh17rRdhs9ZgC06DYVYoGmRmioHfRMJ6s zHXug/WwYjnPbFfiTNKRCw51KBuav/0aQ/HKd/s7j2G4aSgWQgRecCocIdiP4b0j Wy10QJLZYxkNc91pvGJHvOB0K7Lrfb5BG7XARsWhIstfTsEokt4YutUqKLsRixeT mJlglFwjz1onl14LBQaTNx47aTbrqZ5hHY8y2o4M1nQ+ewkk2gF3R8Q7zTSMmfXK 4SVhM7JZG+Ju1zdXtg2pEto= -----END CERTIFICATE----- # Issuer: O=SECOM Trust.net OU=Security Communication RootCA1 # Subject: O=SECOM Trust.net OU=Security Communication RootCA1 # Label: "Security Communication Root CA" # Serial: 0 # MD5 Fingerprint: f1:bc:63:6a:54:e0:b5:27:f5:cd:e7:1a:e3:4d:6e:4a # SHA1 Fingerprint: 36:b1:2b:49:f9:81:9e:d7:4c:9e:bc:38:0f:c6:56:8f:5d:ac:b2:f7 # SHA256 Fingerprint: e7:5e:72:ed:9f:56:0e:ec:6e:b4:80:00:73:a4:3f:c3:ad:19:19:5a:39:22:82:01:78:95:97:4a:99:02:6b:6c -----BEGIN CERTIFICATE----- MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5 WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8 9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9 Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5 Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw== -----END CERTIFICATE----- # Issuer: CN=Sonera Class2 CA O=Sonera # Subject: CN=Sonera Class2 CA O=Sonera # Label: "Sonera Class 2 Root CA" # Serial: 29 # MD5 Fingerprint: a3:ec:75:0f:2e:88:df:fa:48:01:4e:0b:5c:48:6f:fb # SHA1 Fingerprint: 37:f7:6d:e6:07:7c:90:c5:b1:3e:93:1a:b7:41:10:b4:f2:e4:9a:27 # SHA256 Fingerprint: 79:08:b4:03:14:c1:38:10:0b:51:8d:07:35:80:7f:fb:fc:f8:51:8a:00:95:33:71:05:ba:38:6b:15:3d:d9:27 -----BEGIN CERTIFICATE----- MIIDIDCCAgigAwIBAgIBHTANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEP MA0GA1UEChMGU29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MyIENBMB4XDTAx MDQwNjA3Mjk0MFoXDTIxMDQwNjA3Mjk0MFowOTELMAkGA1UEBhMCRkkxDzANBgNV BAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJhIENsYXNzMiBDQTCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAJAXSjWdyvANlsdE+hY3/Ei9vX+ALTU74W+o Z6m/AxxNjG8yR9VBaKQTBME1DJqEQ/xcHf+Js+gXGM2RX/uJ4+q/Tl18GybTdXnt 5oTjV+WtKcT0OijnpXuENmmz/V52vaMtmdOQTiMofRhj8VQ7Jp12W5dCsv+u8E7s 3TmVToMGf+dJQMjFAbJUWmYdPfz56TwKnoG4cPABi+QjVHzIrviQHgCWctRUz2Ej vOr7nQKV0ba5cTppCD8PtOFCx4j1P5iop7oc4HFx71hXgVB6XGt0Rg6DA5jDjqhu 8nYybieDwnPz3BjotJPqdURrBGAgcVeHnfO+oJAjPYok4doh28MCAwEAAaMzMDEw DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISqCqWITTXjwwCwYDVR0PBAQDAgEG MA0GCSqGSIb3DQEBBQUAA4IBAQBazof5FnIVV0sd2ZvnoiYw7JNn39Yt0jSv9zil zqsWuasvfDXLrNAPtEwr/IDva4yRXzZ299uzGxnq9LIR/WFxRL8oszodv7ND6J+/ 3DEIcbCdjdY0RzKQxmUk96BKfARzjzlvF4xytb1LyHr4e4PDKE6cCepnP7JnBBvD FNr450kkkdAdavphOe9r5yF1BgfYErQhIHBCcYHaPJo2vqZbDWpsmh+Re/n570K6 Tk6ezAyNlNzZRZxe7EJQY670XcSxEtzKO6gunRRaBXW37Ndj4ro1tgQIkejanZz2 ZrUYrAqmVCY0M9IbwdR/GjqOC6oybtv8TyWf2TLHllpwrN9M -----END CERTIFICATE----- # Issuer: CN=XRamp Global Certification Authority O=XRamp Security Services Inc OU=www.xrampsecurity.com # Subject: CN=XRamp Global Certification Authority O=XRamp Security Services Inc OU=www.xrampsecurity.com # Label: "XRamp Global CA Root" # Serial: 107108908803651509692980124233745014957 # MD5 Fingerprint: a1:0b:44:b3:ca:10:d8:00:6e:9d:0f:d8:0f:92:0a:d1 # SHA1 Fingerprint: b8:01:86:d1:eb:9c:86:a5:41:04:cf:30:54:f3:4c:52:b7:e5:58:c6 # SHA256 Fingerprint: ce:cd:dc:90:50:99:d8:da:df:c5:b1:d2:09:b7:37:cb:e2:c1:8c:fb:2c:10:c0:ff:0b:cf:0d:32:86:fc:1a:a2 -----BEGIN CERTIFICATE----- MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCB gjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEk MCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRY UmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQxMTAxMTcx NDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3 dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2Vy dmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS6 38eMpSe2OAtp87ZOqCwuIR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCP KZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMxfoArtYzAQDsRhtDLooY2YKTVMIJt2W7Q DxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FEzG+gSqmUsE3a56k0enI4 qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqsAxcZZPRa JSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNVi PvryxS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASs jVy16bYbMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0 eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQEwDQYJKoZIhvcNAQEFBQAD ggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc/Kh4ZzXxHfAR vbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLa IR9NmXmd4c8nnxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSy i6mx5O+aGtA9aZnuqCij4Tyz8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQ O+7ETPTsJ3xCwnR8gooJybQDJbw= -----END CERTIFICATE----- # Issuer: O=The Go Daddy Group, Inc. OU=Go Daddy Class 2 Certification Authority # Subject: O=The Go Daddy Group, Inc. OU=Go Daddy Class 2 Certification Authority # Label: "Go Daddy Class 2 CA" # Serial: 0 # MD5 Fingerprint: 91:de:06:25:ab:da:fd:32:17:0c:bb:25:17:2a:84:67 # SHA1 Fingerprint: 27:96:ba:e6:3f:18:01:e2:77:26:1b:a0:d7:77:70:02:8f:20:ee:e4 # SHA256 Fingerprint: c3:84:6b:f2:4b:9e:93:ca:64:27:4c:0e:c6:7c:1e:cc:5e:02:4f:fc:ac:d2:d7:40:19:35:0e:81:fe:54:6a:e4 -----BEGIN CERTIFICATE----- MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3 MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+ YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h /t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5 IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf ReYNnyicsbkqWletNw+vHX/bvZ8= -----END CERTIFICATE----- # Issuer: O=Starfield Technologies, Inc. OU=Starfield Class 2 Certification Authority # Subject: O=Starfield Technologies, Inc. OU=Starfield Class 2 Certification Authority # Label: "Starfield Class 2 CA" # Serial: 0 # MD5 Fingerprint: 32:4a:4b:bb:c8:63:69:9b:be:74:9a:c6:dd:1d:46:24 # SHA1 Fingerprint: ad:7e:1c:28:b0:64:ef:8f:60:03:40:20:14:c3:d0:e3:37:0e:b5:8a # SHA256 Fingerprint: 14:65:fa:20:53:97:b8:76:fa:a6:f0:a9:95:8e:55:90:e4:0f:cc:7f:aa:4f:b7:c2:c8:67:75:21:fb:5f:b6:58 -----BEGIN CERTIFICATE----- MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3 DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf 8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN +lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0 X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA 1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0 YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAsTKVN0YXJmaWVsZCBD bGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8w DQYJKoZIhvcNAQEFBQADggEBAAWdP4id0ckaVaGsafPzWdqbAYcaT1epoXkJKtv3 L7IezMdeatiDh6GX70k1PncGQVhiv45YuApnP+yz3SFmH8lU+nLMPUxA2IGvd56D eruix/U0F47ZEUD0/CwqTRV/p2JdLiXTAAsgGh1o+Re49L2L7ShZ3U0WixeDyLJl xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynp VSJYACPq4xJDKVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEY WQPJIrSPnNVeKtelttQKbfi3QBFGmh95DmK/D5fs4C8fF5Q= -----END CERTIFICATE----- # Issuer: O=Government Root Certification Authority # Subject: O=Government Root Certification Authority # Label: "Taiwan GRCA" # Serial: 42023070807708724159991140556527066870 # MD5 Fingerprint: 37:85:44:53:32:45:1f:20:f0:f3:95:e1:25:c4:43:4e # SHA1 Fingerprint: f4:8b:11:bf:de:ab:be:94:54:20:71:e6:41:de:6b:be:88:2b:40:b9 # SHA256 Fingerprint: 76:00:29:5e:ef:e8:5b:9e:1f:d6:24:db:76:06:2a:aa:ae:59:81:8a:54:d2:77:4c:d4:c0:b2:c0:11:31:e1:b3 -----BEGIN CERTIFICATE----- MIIFcjCCA1qgAwIBAgIQH51ZWtcvwgZEpYAIaeNe9jANBgkqhkiG9w0BAQUFADA/ MQswCQYDVQQGEwJUVzEwMC4GA1UECgwnR292ZXJubWVudCBSb290IENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MB4XDTAyMTIwNTEzMjMzM1oXDTMyMTIwNTEzMjMzM1ow PzELMAkGA1UEBhMCVFcxMDAuBgNVBAoMJ0dvdmVybm1lbnQgUm9vdCBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB AJoluOzMonWoe/fOW1mKydGGEghU7Jzy50b2iPN86aXfTEc2pBsBHH8eV4qNw8XR IePaJD9IK/ufLqGU5ywck9G/GwGHU5nOp/UKIXZ3/6m3xnOUT0b3EEk3+qhZSV1q gQdW8or5BtD3cCJNtLdBuTK4sfCxw5w/cP1T3YGq2GN49thTbqGsaoQkclSGxtKy yhwOeYHWtXBiCAEuTk8O1RGvqa/lmr/czIdtJuTJV6L7lvnM4T9TjGxMfptTCAts F/tnyMKtsc2AtJfcdgEWFelq16TheEfOhtX7MfP6Mb40qij7cEwdScevLJ1tZqa2 jWR+tSBqnTuBto9AAGdLiYa4zGX+FVPpBMHWXx1E1wovJ5pGfaENda1UhhXcSTvx ls4Pm6Dso3pdvtUqdULle96ltqqvKKyskKw4t9VoNSZ63Pc78/1Fm9G7Q3hub/FC VGqY8A2tl+lSXunVanLeavcbYBT0peS2cWeqH+riTcFCQP5nRhc4L0c/cZyu5SHK YS1tB6iEfC3uUSXxY5Ce/eFXiGvviiNtsea9P63RPZYLhY3Naye7twWb7LuRqQoH EgKXTiCQ8P8NHuJBO9NAOueNXdpm5AKwB1KYXA6OM5zCppX7VRluTI6uSw+9wThN Xo+EHWbNxWCWtFJaBYmOlXqYwZE8lSOyDvR5tMl8wUohAgMBAAGjajBoMB0GA1Ud DgQWBBTMzO/MKWCkO7GStjz6MmKPrCUVOzAMBgNVHRMEBTADAQH/MDkGBGcqBwAE MTAvMC0CAQAwCQYFKw4DAhoFADAHBgVnKgMAAAQUA5vwIhP/lSg209yewDL7MTqK UWUwDQYJKoZIhvcNAQEFBQADggIBAECASvomyc5eMN1PhnR2WPWus4MzeKR6dBcZ TulStbngCnRiqmjKeKBMmo4sIy7VahIkv9Ro04rQ2JyftB8M3jh+Vzj8jeJPXgyf qzvS/3WXy6TjZwj/5cAWtUgBfen5Cv8b5Wppv3ghqMKnI6mGq3ZW6A4M9hPdKmaK ZEk9GhiHkASfQlK3T8v+R0F2Ne//AHY2RTKbxkaFXeIksB7jSJaYV0eUVXoPQbFE JPPB/hprv4j9wabak2BegUqZIJxIZhm1AHlUD7gsL0u8qV1bYH+Mh6XgUmMqvtg7 hUAV/h62ZT/FS9p+tXo1KaMuephgIqP0fSdOLeq0dDzpD6QzDxARvBMB1uUO07+1 EqLhRSPAzAhuYbeJq4PjJB7mXQfnHyA+z2fI56wwbSdLaG5LKlwCCDTb+HbkZ6Mm nD+iMsJKxYEYMRBWqoTvLQr/uB930r+lWKBi5NdLkXWNiYCYfm3LU05er/ayl4WX udpVBrkk7tfGOB5jGxI7leFYrPLfhNVfmS8NVVvmONsuP3LpSIXLuykTjx44Vbnz ssQwmSNOXfJIoRIM3BKQCZBUkQM8R+XVyWXgt0t97EfTsws+rZ7QdAAO671RrcDe LMDDav7v3Aun+kbfYNucpllQdSNpc5Oy+fwC00fmcc4QAu4njIT/rEUNE1yDMuAl pYYsfPQS -----END CERTIFICATE----- # Issuer: CN=DigiCert Assured ID Root CA O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Assured ID Root CA O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Assured ID Root CA" # Serial: 17154717934120587862167794914071425081 # MD5 Fingerprint: 87:ce:0b:7b:2a:0e:49:00:e1:58:71:9b:37:a8:93:72 # SHA1 Fingerprint: 05:63:b8:63:0d:62:d7:5a:bb:c8:ab:1e:4b:df:b5:a8:99:b2:4d:43 # SHA256 Fingerprint: 3e:90:99:b5:01:5e:8f:48:6c:00:bc:ea:9d:11:1e:e7:21:fa:ba:35:5a:89:bc:f1:df:69:56:1e:3d:c6:32:5c -----BEGIN CERTIFICATE----- MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+ wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4 VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/ AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe +o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g== -----END CERTIFICATE----- # Issuer: CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Global Root CA" # Serial: 10944719598952040374951832963794454346 # MD5 Fingerprint: 79:e4:a9:84:0d:7d:3a:96:d7:c0:4f:e2:43:4c:89:2e # SHA1 Fingerprint: a8:98:5d:3a:65:e5:e5:c4:b2:d7:d6:6d:40:c6:dd:2f:b1:9c:54:36 # SHA256 Fingerprint: 43:48:a0:e9:44:4c:78:cb:26:5e:05:8d:5e:89:44:b4:d8:4f:96:62:bd:26:db:25:7f:89:34:a4:43:c7:01:61 -----BEGIN CERTIFICATE----- MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97 nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt 43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4 gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg 06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= -----END CERTIFICATE----- # Issuer: CN=DigiCert High Assurance EV Root CA O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert High Assurance EV Root CA O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert High Assurance EV Root CA" # Serial: 3553400076410547919724730734378100087 # MD5 Fingerprint: d4:74:de:57:5c:39:b2:d3:9c:85:83:c5:c0:65:49:8a # SHA1 Fingerprint: 5f:b7:ee:06:33:e2:59:db:ad:0c:4c:9a:e6:d3:8f:1a:61:c7:dc:25 # SHA256 Fingerprint: 74:31:e5:f4:c3:c1:ce:46:90:77:4f:0b:61:e0:54:40:88:3b:a9:a0:1e:d0:0b:a6:ab:d7:80:6e:d3:b1:18:cf -----BEGIN CERTIFICATE----- MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm +9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep +OkuE6N36B9K -----END CERTIFICATE----- # Issuer: CN=Class 2 Primary CA O=Certplus # Subject: CN=Class 2 Primary CA O=Certplus # Label: "Certplus Class 2 Primary CA" # Serial: 177770208045934040241468760488327595043 # MD5 Fingerprint: 88:2c:8c:52:b8:a2:3c:f3:f7:bb:03:ea:ae:ac:42:0b # SHA1 Fingerprint: 74:20:74:41:72:9c:dd:92:ec:79:31:d8:23:10:8d:c2:81:92:e2:bb # SHA256 Fingerprint: 0f:99:3c:8a:ef:97:ba:af:56:87:14:0e:d5:9a:d1:82:1b:b4:af:ac:f0:aa:9a:58:b5:d5:7a:33:8a:3a:fb:cb -----BEGIN CERTIFICATE----- MIIDkjCCAnqgAwIBAgIRAIW9S/PY2uNp9pTXX8OlRCMwDQYJKoZIhvcNAQEFBQAw PTELMAkGA1UEBhMCRlIxETAPBgNVBAoTCENlcnRwbHVzMRswGQYDVQQDExJDbGFz cyAyIFByaW1hcnkgQ0EwHhcNOTkwNzA3MTcwNTAwWhcNMTkwNzA2MjM1OTU5WjA9 MQswCQYDVQQGEwJGUjERMA8GA1UEChMIQ2VydHBsdXMxGzAZBgNVBAMTEkNsYXNz IDIgUHJpbWFyeSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxQ ltAS+DXSCHh6tlJw/W/uz7kRy1134ezpfgSN1sxvc0NXYKwzCkTsA18cgCSR5aiR VhKC9+Ar9NuuYS6JEI1rbLqzAr3VNsVINyPi8Fo3UjMXEuLRYE2+L0ER4/YXJQyL kcAbmXuZVg2v7tK8R1fjeUl7NIknJITesezpWE7+Tt9avkGtrAjFGA7v0lPubNCd EgETjdyAYveVqUSISnFOYFWe2yMZeVYHDD9jC1yw4r5+FfyUM1hBOHTE4Y+L3yas H7WLO7dDWWuwJKZtkIvEcupdM5i3y95ee++U8Rs+yskhwcWYAqqi9lt3m/V+llU0 HGdpwPFC40es/CgcZlUCAwEAAaOBjDCBiTAPBgNVHRMECDAGAQH/AgEKMAsGA1Ud DwQEAwIBBjAdBgNVHQ4EFgQU43Mt38sOKAze3bOkynm4jrvoMIkwEQYJYIZIAYb4 QgEBBAQDAgEGMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly93d3cuY2VydHBsdXMu Y29tL0NSTC9jbGFzczIuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQCnVM+IRBnL39R/ AN9WM2K191EBkOvDP9GIROkkXe/nFL0gt5o8AP5tn9uQ3Nf0YtaLcF3n5QRIqWh8 yfFC82x/xXp8HVGIutIKPidd3i1RTtMTZGnkLuPT55sJmabglZvOGtd/vjzOUrMR FcEPF80Du5wlFbqidon8BvEY0JNLDnyCt6X09l/+7UCmnYR0ObncHoUW2ikbhiMA ybuJfm6AiB4vFLQDJKgybwOaRywwvlbGp0ICcBvqQNi6BQNwB6SW//1IMwrh3KWB kJtN3X3n57LNXMhqlfil9o3EXXgIvnsG1knPGTZQIy4I5p4FTUcY1Rbpsda2ENW7 l7+ijrRU -----END CERTIFICATE----- # Issuer: CN=DST Root CA X3 O=Digital Signature Trust Co. # Subject: CN=DST Root CA X3 O=Digital Signature Trust Co. # Label: "DST Root CA X3" # Serial: 91299735575339953335919266965803778155 # MD5 Fingerprint: 41:03:52:dc:0f:f7:50:1b:16:f0:02:8e:ba:6f:45:c5 # SHA1 Fingerprint: da:c9:02:4f:54:d8:f6:df:94:93:5f:b1:73:26:38:ca:6a:d7:7c:13 # SHA256 Fingerprint: 06:87:26:03:31:a7:24:03:d9:09:f1:05:e6:9b:cf:0d:32:e1:bd:24:93:ff:c6:d9:20:6d:11:bc:d6:77:07:39 -----BEGIN CERTIFICATE----- MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw 7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69 ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5 JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ -----END CERTIFICATE----- # Issuer: CN=SwissSign Gold CA - G2 O=SwissSign AG # Subject: CN=SwissSign Gold CA - G2 O=SwissSign AG # Label: "SwissSign Gold CA - G2" # Serial: 13492815561806991280 # MD5 Fingerprint: 24:77:d9:a8:91:d1:3b:fa:88:2d:c2:ff:f8:cd:33:93 # SHA1 Fingerprint: d8:c5:38:8a:b7:30:1b:1b:6e:d4:7a:e6:45:25:3a:6f:9f:1a:27:61 # SHA256 Fingerprint: 62:dd:0b:e9:b9:f5:0a:16:3e:a0:f8:e7:5c:05:3b:1e:ca:57:ea:55:c8:68:8f:64:7c:68:81:f2:c8:35:7b:95 -----BEGIN CERTIFICATE----- MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV BAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMTFlN3aXNzU2ln biBHb2xkIENBIC0gRzIwHhcNMDYxMDI1MDgzMDM1WhcNMzYxMDI1MDgzMDM1WjBF MQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMR8wHQYDVQQDExZT d2lzc1NpZ24gR29sZCBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC CgKCAgEAr+TufoskDhJuqVAtFkQ7kpJcyrhdhJJCEyq8ZVeCQD5XJM1QiyUqt2/8 76LQwB8CJEoTlo8jE+YoWACjR8cGp4QjK7u9lit/VcyLwVcfDmJlD909Vopz2q5+ bbqBHH5CjCA12UNNhPqE21Is8w4ndwtrvxEvcnifLtg+5hg3Wipy+dpikJKVyh+c 6bM8K8vzARO/Ws/BtQpgvd21mWRTuKCWs2/iJneRjOBiEAKfNA+k1ZIzUd6+jbqE emA8atufK+ze3gE/bk3lUIbLtK/tREDFylqM2tIrfKjuvqblCqoOpd8FUrdVxyJd MmqXl2MT28nbeTZ7hTpKxVKJ+STnnXepgv9VHKVxaSvRAiTysybUa9oEVeXBCsdt MDeQKuSeFDNeFhdVxVu1yzSJkvGdJo+hB9TGsnhQ2wwMC3wLjEHXuendjIj3o02y MszYF9rNt85mndT9Xv+9lz4pded+p2JYryU0pUHHPbwNUMoDAw8IWh+Vc3hiv69y FGkOpeUDDniOJihC8AcLYiAQZzlG+qkDzAQ4embvIIO1jEpWjpEA/I5cgt6IoMPi aG59je883WX0XaxR7ySArqpWl2/5rX3aYT+YdzylkbYcjCbaZaIJbcHiVOO5ykxM gI93e2CaHt+28kgeDrpOVG2Y4OGiGqJ3UM/EY5LsRxmd6+ZrzsECAwEAAaOBrDCB qTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWyV7 lqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn 8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov L3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6 45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD2StiGwC5+OlgzczO UYrHUDFu4Up+GC9pWbY9ZIEr44OE5iKHjn3g7gKZYbge9LgriBIWhMIxkziWMaa5 O1M/wySTVltpkuzFwbs4AOPsF6m43Md8AYOfMke6UiI0HTJ6CVanfCU2qT1L2sCC bwq7EsiHSycR+R4tx5M/nttfJmtS2S6K8RTGRI0Vqbe/vd6mGu6uLftIdxf+u+yv GPUqUfA5hJeVbG4bwyvEdGB5JbAKJ9/fXtI5z0V9QkvfsywexcZdylU6oJxpmo/a 77KwPJ+HbBIrZXAVUjEaJM9vMSNQH4xPjyPDdEFjHFWoFN0+4FFQz/EbMFYOkrCC hdiDyyJkvC24JdVUorgG6q2SpCSgwYa1ShNqR88uC1aVVMvOmttqtKay20EIhid3 92qgQmwLOM7XdVAyksLfKzAiSNDVQTglXaTpXZ/GlHXQRf0wl0OPkKsKx4ZzYEpp Ld6leNcG2mqeSz53OiATIgHQv2ieY2BrNU0LbbqhPcCT4H8js1WtciVORvnSFu+w ZMEBnunKoGqYDs/YYPIvSbjkQuE4NRb0yG5P94FW6LqjviOvrv1vA+ACOzB2+htt Qc8Bsem4yWb02ybzOqR08kkkW8mw0FfB+j564ZfJ -----END CERTIFICATE----- # Issuer: CN=SwissSign Silver CA - G2 O=SwissSign AG # Subject: CN=SwissSign Silver CA - G2 O=SwissSign AG # Label: "SwissSign Silver CA - G2" # Serial: 5700383053117599563 # MD5 Fingerprint: e0:06:a1:c9:7d:cf:c9:fc:0d:c0:56:75:96:d8:62:13 # SHA1 Fingerprint: 9b:aa:e5:9f:56:ee:21:cb:43:5a:be:25:93:df:a7:f0:40:d1:1d:cb # SHA256 Fingerprint: be:6c:4d:a2:bb:b9:ba:59:b6:f3:93:97:68:37:42:46:c3:c0:05:99:3f:a9:8f:02:0d:1d:ed:be:d4:8a:81:d5 -----BEGIN CERTIFICATE----- MIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UE BhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWdu IFNpbHZlciBDQSAtIEcyMB4XDTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0Nlow RzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMY U3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A MIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644N0Mv Fz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gREpzn5/ASLHvGiTSf5YXu6t+WiE7br YT7QbNHm+/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieF nbAVlDLaYQ1HTWBCrpJH6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH 6ATK72oxh9TAtvmUcXtnZLi2kUpCe2UuMGoM9ZDulebyzYLs2aFK7PayS+VFheZt eJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5hqAaEuSh6XzjZG6k4sIN/ c8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0mRmrVn5bi4Y5FZGkECwJ MoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRH HTBsROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTf jNFusB3hB48IHpmccelM2KX3RxIfdNFRnobzwqIjQAtz20um53MGjMGg6cFZrEb6 5i/4z3GcRm25xBWNOHkDRUjvxF3XCO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOB rDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU F6DNweRBtjpbO8tFnb0cwpj6hlgwHwYDVR0jBBgwFoAUF6DNweRBtjpbO8tFnb0c wpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0 cDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIB AHPGgeAn0i0P4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShp WJHckRE1qTodvBqlYJ7YH39FkWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9 xCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/L3XWgwF15kIwb4FDm3jH+mHtwX6WQ 2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx/uNncqCxv1yL5PqZ IseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFaDGi8 aRl5xB9+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2X em1ZqSqPe97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQR dAtq/gsD/KNVV4n+SsuuWxcFyPKNIzFTONItaj+CuY0IavdeQXRuwxF+B6wpYJE/ OMpXEA29MC/HpeZBoNquBYeaoKRlbEwJDIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+ hAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ubDgEj8Z+7fNzcbBGXJbLy tGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u -----END CERTIFICATE----- # Issuer: CN=GeoTrust Primary Certification Authority O=GeoTrust Inc. # Subject: CN=GeoTrust Primary Certification Authority O=GeoTrust Inc. # Label: "GeoTrust Primary Certification Authority" # Serial: 32798226551256963324313806436981982369 # MD5 Fingerprint: 02:26:c3:01:5e:08:30:37:43:a9:d0:7d:cf:37:e6:bf # SHA1 Fingerprint: 32:3c:11:8e:1b:f7:b8:b6:52:54:e2:e2:10:0d:d6:02:90:37:f0:96 # SHA256 Fingerprint: 37:d5:10:06:c5:12:ea:ab:62:64:21:f1:ec:8c:92:01:3f:c5:f8:2a:e9:8e:e5:33:eb:46:19:b8:de:b4:d0:6c -----BEGIN CERTIFICATE----- MIIDfDCCAmSgAwIBAgIQGKy1av1pthU6Y2yv2vrEoTANBgkqhkiG9w0BAQUFADBY MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjExMC8GA1UEAxMo R2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEx MjcwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQK Ew1HZW9UcnVzdCBJbmMuMTEwLwYDVQQDEyhHZW9UcnVzdCBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAvrgVe//UfH1nrYNke8hCUy3f9oQIIGHWAVlqnEQRr+92/ZV+zmEwu3qDXwK9 AWbK7hWNb6EwnL2hhZ6UOvNWiAAxz9juapYC2e0DjPt1befquFUWBRaa9OBesYjA ZIVcFU2Ix7e64HXprQU9nceJSOC7KMgD4TCTZF5SwFlwIjVXiIrxlQqD17wxcwE0 7e9GceBrAqg1cmuXm2bgyxx5X9gaBGgeRwLmnWDiNpcB3841kt++Z8dtd1k7j53W kBWUvEI0EME5+bEnPn7WinXFsq+W06Lem+SYvn3h6YGttm/81w7a4DSwDRp35+MI mO9Y+pyEtzavwt+s0vQQBnBxNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4G A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQULNVQQZcVi/CPNmFbSvtr2ZnJM5IwDQYJ KoZIhvcNAQEFBQADggEBAFpwfyzdtzRP9YZRqSa+S7iq8XEN3GHHoOo0Hnp3DwQ1 6CePbJC/kRYkRj5KTs4rFtULUh38H2eiAkUxT87z+gOneZ1TatnaYzr4gNfTmeGl 4b7UVXGYNTq+k+qurUKykG/g/CFNNWMziUnWm07Kx+dOCQD32sfvmWKZd7aVIl6K oKv0uHiYyjgZmclynnjNS6yvGaBzEi38wkG6gZHaFloxt/m0cYASSJlyc1pZU8Fj UjPtp8nSOQJw+uCxQmYpqptR7TBUIhRf2asdweSU8Pj1K/fqynhG1riR/aYNKxoU AT6A8EKglQdebc3MS6RFjasS6LPeWuWgfOgPIh1a6Vk= -----END CERTIFICATE----- # Issuer: CN=thawte Primary Root CA O=thawte, Inc. OU=Certification Services Division/(c) 2006 thawte, Inc. - For authorized use only # Subject: CN=thawte Primary Root CA O=thawte, Inc. OU=Certification Services Division/(c) 2006 thawte, Inc. - For authorized use only # Label: "thawte Primary Root CA" # Serial: 69529181992039203566298953787712940909 # MD5 Fingerprint: 8c:ca:dc:0b:22:ce:f5:be:72:ac:41:1a:11:a8:d8:12 # SHA1 Fingerprint: 91:c6:d6:ee:3e:8a:c8:63:84:e5:48:c2:99:29:5c:75:6c:81:7b:81 # SHA256 Fingerprint: 8d:72:2f:81:a9:c1:13:c0:79:1d:f1:36:a2:96:6d:b2:6c:95:0a:97:1d:b4:6b:41:99:f4:ea:54:b7:8b:fb:9f -----BEGIN CERTIFICATE----- MIIEIDCCAwigAwIBAgIQNE7VVyDV7exJ9C/ON9srbTANBgkqhkiG9w0BAQUFADCB qTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw MDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHzAdBgNV BAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMDYxMTE3MDAwMDAwWhcNMzYw NzE2MjM1OTU5WjCBqTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5j LjEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYG A1UECxMvKGMpIDIwMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNl IG9ubHkxHzAdBgNVBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsoPD7gFnUnMekz52hWXMJEEUMDSxuaPFs W0hoSVk3/AszGcJ3f8wQLZU0HObrTQmnHNK4yZc2AreJ1CRfBsDMRJSUjQJib+ta 3RGNKJpchJAQeg29dGYvajig4tVUROsdB58Hum/u6f1OCyn1PoSgAfGcq/gcfomk 6KHYcWUNo1F77rzSImANuVud37r8UVsLr5iy6S7pBOhih94ryNdOwUxkHt3Ph1i6 Sk/KaAcdHJ1KxtUvkcx8cXIcxcBn6zL9yZJclNqFwJu/U30rCfSMnZEfl2pSy94J NqR32HuHUETVPm4pafs5SSYeCaWAe0At6+gnhcn+Yf1+5nyXHdWdAgMBAAGjQjBA MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBR7W0XP r87Lev0xkhpqtvNG61dIUDANBgkqhkiG9w0BAQUFAAOCAQEAeRHAS7ORtvzw6WfU DW5FvlXok9LOAz/t2iWwHVfLHjp2oEzsUHboZHIMpKnxuIvW1oeEuzLlQRHAd9mz YJ3rG9XRbkREqaYB7FViHXe4XI5ISXycO1cRrK1zN44veFyQaEfZYGDm/Ac9IiAX xPcW6cTYcvnIc3zfFi8VqT79aie2oetaupgf1eNNZAqdE8hhuvU5HIe6uL17In/2 /qxAeeWsEG89jxt5dovEN7MhGITlNgDrYyCZuen+MwS7QcjBAvlEYyCegc5C09Y/ LHbTY5xZ3Y+m4Q6gLkH3LpVHz7z9M/P2C2F+fpErgUfCJzDupxBdN49cOSvkBPB7 jVaMaA== -----END CERTIFICATE----- # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G5 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2006 VeriSign, Inc. - For authorized use only # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2006 VeriSign, Inc. - For authorized use only # Label: "VeriSign Class 3 Public Primary Certification Authority - G5" # Serial: 33037644167568058970164719475676101450 # MD5 Fingerprint: cb:17:e4:31:67:3e:e2:09:fe:45:57:93:f3:0a:fa:1c # SHA1 Fingerprint: 4e:b6:d5:78:49:9b:1c:cf:5f:58:1e:ad:56:be:3d:9b:67:44:a5:e5 # SHA256 Fingerprint: 9a:cf:ab:7e:43:c8:d8:80:d0:6b:26:2a:94:de:ee:e4:b4:65:99:89:c3:d0:ca:f1:9b:af:64:05:e4:1a:b7:df -----BEGIN CERTIFICATE----- MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0 aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1 nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+ rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/ NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y 5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ 4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq -----END CERTIFICATE----- # Issuer: CN=SecureTrust CA O=SecureTrust Corporation # Subject: CN=SecureTrust CA O=SecureTrust Corporation # Label: "SecureTrust CA" # Serial: 17199774589125277788362757014266862032 # MD5 Fingerprint: dc:32:c3:a7:6d:25:57:c7:68:09:9d:ea:2d:a9:a2:d1 # SHA1 Fingerprint: 87:82:c6:c3:04:35:3b:cf:d2:96:92:d2:59:3e:7d:44:d9:34:ff:11 # SHA256 Fingerprint: f1:c1:b5:0a:e5:a2:0d:d8:03:0e:c9:f6:bc:24:82:3d:d3:67:b5:25:57:59:b4:e7:1b:61:fc:e9:f7:37:5d:73 -----BEGIN CERTIFICATE----- MIIDuDCCAqCgAwIBAgIQDPCOXAgWpa1Cf/DrJxhZ0DANBgkqhkiG9w0BAQUFADBI MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x FzAVBgNVBAMTDlNlY3VyZVRydXN0IENBMB4XDTA2MTEwNzE5MzExOFoXDTI5MTIz MTE5NDA1NVowSDELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1NlY3VyZVRydXN0IENv cnBvcmF0aW9uMRcwFQYDVQQDEw5TZWN1cmVUcnVzdCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAKukgeWVzfX2FI7CT8rU4niVWJxB4Q2ZQCQXOZEz Zum+4YOvYlyJ0fwkW2Gz4BERQRwdbvC4u/jep4G6pkjGnx29vo6pQT64lO0pGtSO 0gMdA+9tDWccV9cGrcrI9f4Or2YlSASWC12juhbDCE/RRvgUXPLIXgGZbf2IzIao wW8xQmxSPmjL8xk037uHGFaAJsTQ3MBv396gwpEWoGQRS0S8Hvbn+mPeZqx2pHGj 7DaUaHp3pLHnDi+BeuK1cobvomuL8A/b01k/unK8RCSc43Oz969XL0Imnal0ugBS 8kvNU3xHCzaFDmapCJcWNFfBZveA4+1wVMeT4C4oFVmHursCAwEAAaOBnTCBmjAT BgkrBgEEAYI3FAIEBh4EAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB /zAdBgNVHQ4EFgQUQjK2FvoE/f5dS3rD/fdMQB1aQ68wNAYDVR0fBC0wKzApoCeg JYYjaHR0cDovL2NybC5zZWN1cmV0cnVzdC5jb20vU1RDQS5jcmwwEAYJKwYBBAGC NxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBADDtT0rhWDpSclu1pqNlGKa7UTt3 6Z3q059c4EVlew3KW+JwULKUBRSuSceNQQcSc5R+DCMh/bwQf2AQWnL1mA6s7Ll/ 3XpvXdMc9P+IBWlCqQVxyLesJugutIxq/3HcuLHfmbx8IVQr5Fiiu1cprp6poxkm D5kuCLDv/WnPmRoJjeOnnyvJNjR7JLN4TJUXpAYmHrZkUjZfYGfZnMUFdAvnZyPS CPyI6a6Lf+Ew9Dd+/cYy2i2eRDAwbO4H3tI0/NL/QPZL9GZGBlSm8jIKYyYwa5vR 3ItHuuG51WLQoqD0ZwV4KWMabwTW+MZMo5qxN7SN5ShLHZ4swrhovO0C7jE= -----END CERTIFICATE----- # Issuer: CN=Secure Global CA O=SecureTrust Corporation # Subject: CN=Secure Global CA O=SecureTrust Corporation # Label: "Secure Global CA" # Serial: 9751836167731051554232119481456978597 # MD5 Fingerprint: cf:f4:27:0d:d4:ed:dc:65:16:49:6d:3d:da:bf:6e:de # SHA1 Fingerprint: 3a:44:73:5a:e5:81:90:1f:24:86:61:46:1e:3b:9c:c4:5f:f5:3a:1b # SHA256 Fingerprint: 42:00:f5:04:3a:c8:59:0e:bb:52:7d:20:9e:d1:50:30:29:fb:cb:d4:1c:a1:b5:06:ec:27:f1:5a:de:7d:ac:69 -----BEGIN CERTIFICATE----- MIIDvDCCAqSgAwIBAgIQB1YipOjUiolN9BPI8PjqpTANBgkqhkiG9w0BAQUFADBK MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x GTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwHhcNMDYxMTA3MTk0MjI4WhcNMjkx MjMxMTk1MjA2WjBKMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3Qg Q29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNS7YrGxVaQZx5RNoJLNP2MwhR/jxYDiJ iQPpvepeRlMJ3Fz1Wuj3RSoC6zFh1ykzTM7HfAo3fg+6MpjhHZevj8fcyTiW89sa /FHtaMbQbqR8JNGuQsiWUGMu4P51/pinX0kuleM5M2SOHqRfkNJnPLLZ/kG5VacJ jnIFHovdRIWCQtBJwB1g8NEXLJXr9qXBkqPFwqcIYA1gBBCWeZ4WNOaptvolRTnI HmX5k/Wq8VLcmZg9pYYaDDUz+kulBAYVHDGA76oYa8J719rO+TMg1fW9ajMtgQT7 sFzUnKPiXB3jqUJ1XnvUd+85VLrJChgbEplJL4hL/VBi0XPnj3pDAgMBAAGjgZ0w gZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFK9EBMJBfkiD2045AuzshHrmzsmkMDQGA1UdHwQtMCsw KaAnoCWGI2h0dHA6Ly9jcmwuc2VjdXJldHJ1c3QuY29tL1NHQ0EuY3JsMBAGCSsG AQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBBQUAA4IBAQBjGghAfaReUw132HquHw0L URYD7xh8yOOvaliTFGCRsoTciE6+OYo68+aCiV0BN7OrJKQVDpI1WkpEXk5X+nXO H0jOZvQ8QCaSmGwb7iRGDBezUqXbpZGRzzfTb+cnCDpOGR86p1hcF895P4vkp9Mm I50mD1hp/Ed+stCNi5O/KU9DaXR2Z0vPB4zmAve14bRDtUstFJ/53CYNv6ZHdAbY iNE6KTCEztI5gGIbqMdXSbxqVVFnFUq+NQfk1XWYN3kwFNspnWzFacxHVaIw98xc f8LDmBxrThaA63p4ZUWiABqvDA1VZDRIuJK58bRQKfJPIx/abKwfROHdI3hRW8cW -----END CERTIFICATE----- # Issuer: CN=COMODO Certification Authority O=COMODO CA Limited # Subject: CN=COMODO Certification Authority O=COMODO CA Limited # Label: "COMODO Certification Authority" # Serial: 104350513648249232941998508985834464573 # MD5 Fingerprint: 5c:48:dc:f7:42:72:ec:56:94:6d:1c:cc:71:35:80:75 # SHA1 Fingerprint: 66:31:bf:9e:f7:4f:9e:b6:c9:d5:a6:0c:ba:6a:be:d1:f7:bd:ef:7b # SHA256 Fingerprint: 0c:2c:d6:3d:f7:80:6f:a3:99:ed:e8:09:11:6b:57:5b:f8:79:89:f0:65:18:f9:80:8c:86:05:03:17:8b:af:66 -----BEGIN CERTIFICATE----- MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB gTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNV BAMTHkNPTU9ETyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEyMDEwMDAw MDBaFw0yOTEyMzEyMzU5NTlaMIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P RE8gQ0EgTGltaXRlZDEnMCUGA1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0 aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ECLi3LjkRv3 UcEbVASY06m/weaKXTuH+7uIzg3jLz8GlvCiKVCZrts7oVewdFFxze1CkU1B/qnI 2GqGd0S7WWaXUF601CxwRM/aN5VCaTwwxHGzUvAhTaHYujl8HJ6jJJ3ygxaYqhZ8 Q5sVW7euNJH+1GImGEaaP+vB+fGQV+useg2L23IwambV4EajcNxo2f8ESIl33rXp +2dtQem8Ob0y2WIC8bGoPW43nOIv4tOiJovGuFVDiOEjPqXSJDlqR6sA1KGzqSX+ DT+nHbrTUcELpNqsOO9VUCQFZUaTNE8tja3G1CEZ0o7KBWFxB3NH5YoZEr0ETc5O nKVIrLsm9wIDAQABo4GOMIGLMB0GA1UdDgQWBBQLWOWLxkwVN6RAqTCpIb5HNlpW /zAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zBJBgNVHR8EQjBAMD6g PKA6hjhodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DZXJ0aWZpY2F0aW9u QXV0aG9yaXR5LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAPpiem/Yb6dc5t3iuHXIY SdOH5EOC6z/JqvWote9VfCFSZfnVDeFs9D6Mk3ORLgLETgdxb8CPOGEIqB6BCsAv IC9Bi5HcSEW88cbeunZrM8gALTFGTO3nnc+IlP8zwFboJIYmuNg4ON8qa90SzMc/ RxdMosIGlgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4 zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd BA6+C4OmF4O5MBKgxTMVBbkN+8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IB ZQ== -----END CERTIFICATE----- # Issuer: CN=Network Solutions Certificate Authority O=Network Solutions L.L.C. # Subject: CN=Network Solutions Certificate Authority O=Network Solutions L.L.C. # Label: "Network Solutions Certificate Authority" # Serial: 116697915152937497490437556386812487904 # MD5 Fingerprint: d3:f3:a6:16:c0:fa:6b:1d:59:b1:2d:96:4d:0e:11:2e # SHA1 Fingerprint: 74:f8:a3:c3:ef:e7:b3:90:06:4b:83:90:3c:21:64:60:20:e5:df:ce # SHA256 Fingerprint: 15:f0:ba:00:a3:ac:7a:f3:ac:88:4c:07:2b:10:11:a0:77:bd:77:c0:97:f4:01:64:b2:f8:59:8a:bd:83:86:0c -----BEGIN CERTIFICATE----- MIID5jCCAs6gAwIBAgIQV8szb8JcFuZHFhfjkDFo4DANBgkqhkiG9w0BAQUFADBi MQswCQYDVQQGEwJVUzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMu MTAwLgYDVQQDEydOZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3Jp dHkwHhcNMDYxMjAxMDAwMDAwWhcNMjkxMjMxMjM1OTU5WjBiMQswCQYDVQQGEwJV UzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMuMTAwLgYDVQQDEydO ZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkvH6SMG3G2I4rC7xGzuAnlt7e+foS0zwz c7MEL7xxjOWftiJgPl9dzgn/ggwbmlFQGiaJ3dVhXRncEg8tCqJDXRfQNJIg6nPP OCwGJgl6cvf6UDL4wpPTaaIjzkGxzOTVHzbRijr4jGPiFFlp7Q3Tf2vouAPlT2rl mGNpSAW+Lv8ztumXWWn4Zxmuk2GWRBXTcrA/vGp97Eh/jcOrqnErU2lBUzS1sLnF BgrEsEX1QV1uiUV7PTsmjHTC5dLRfbIR1PtYMiKagMnc/Qzpf14Dl847ABSHJ3A4 qY5usyd2mFHgBeMhqxrVhSI8KbWaFsWAqPS7azCPL0YCorEMIuDTAgMBAAGjgZcw gZQwHQYDVR0OBBYEFCEwyfsA106Y2oeqKtCnLrFAMadMMA4GA1UdDwEB/wQEAwIB BjAPBgNVHRMBAf8EBTADAQH/MFIGA1UdHwRLMEkwR6BFoEOGQWh0dHA6Ly9jcmwu bmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zQ2VydGlmaWNhdGVBdXRob3Jp dHkuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQC7rkvnt1frf6ott3NHhWrB5KUd5Oc8 6fRZZXe1eltajSU24HqXLjjAV2CDmAaDn7l2em5Q4LqILPxFzBiwmZVRDuwduIj/ h1AcgsLj4DKAv6ALR8jDMe+ZZzKATxcheQxpXN5eNK4CtSbqUN9/GGUsyfJj4akH /nxxH2szJGoeBfcFaMBqEssuXmHLrijTfsK0ZpEmXzwuJF/LWA/rKOyvEZbz3Htv wKeI8lN3s2Berq4o2jUsbzRF0ybh3uxbTydrFny9RAQYgrOJeRcQcT16ohZO9QHN pGxlaKFJdlxDydi8NmdspZS11My5vWo1ViHe2MPr+8ukYEywVaCge1ey -----END CERTIFICATE----- # Issuer: CN=COMODO ECC Certification Authority O=COMODO CA Limited # Subject: CN=COMODO ECC Certification Authority O=COMODO CA Limited # Label: "COMODO ECC Certification Authority" # Serial: 41578283867086692638256921589707938090 # MD5 Fingerprint: 7c:62:ff:74:9d:31:53:5e:68:4a:d5:78:aa:1e:bf:23 # SHA1 Fingerprint: 9f:74:4e:9f:2b:4d:ba:ec:0f:31:2c:50:b6:56:3b:8e:2d:93:c3:11 # SHA256 Fingerprint: 17:93:92:7a:06:14:54:97:89:ad:ce:2f:8f:34:f7:f0:b6:6d:0f:3a:e3:a3:b8:4d:21:ec:15:db:ba:4f:ad:c7 -----BEGIN CERTIFICATE----- MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTEL MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE BxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMT IkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwMzA2MDAw MDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09N T0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlv biBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQDR3svdcmCFYX7deSR FtSrYpn1PlILBs5BAH+X4QokPB0BBO490o0JlwzgdeT6+3eKKvUDYEs2ixYjFq0J cfRK9ChQtP6IHG4/bC8vCVlbpVsLM5niwz2J+Wos77LTBumjQjBAMB0GA1UdDgQW BBR1cacZSBm8nZ3qQUfflMRId5nTeTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/ BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjEA7wNbeqy3eApyt4jf/7VGFAkK+qDm fQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdv GDeAU/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY= -----END CERTIFICATE----- # Issuer: CN=OISTE WISeKey Global Root GA CA O=WISeKey OU=Copyright (c) 2005/OISTE Foundation Endorsed # Subject: CN=OISTE WISeKey Global Root GA CA O=WISeKey OU=Copyright (c) 2005/OISTE Foundation Endorsed # Label: "OISTE WISeKey Global Root GA CA" # Serial: 86718877871133159090080555911823548314 # MD5 Fingerprint: bc:6c:51:33:a7:e9:d3:66:63:54:15:72:1b:21:92:93 # SHA1 Fingerprint: 59:22:a1:e1:5a:ea:16:35:21:f8:98:39:6a:46:46:b0:44:1b:0f:a9 # SHA256 Fingerprint: 41:c9:23:86:6a:b4:ca:d6:b7:ad:57:80:81:58:2e:02:07:97:a6:cb:df:4f:ff:78:ce:83:96:b3:89:37:d7:f5 -----BEGIN CERTIFICATE----- MIID8TCCAtmgAwIBAgIQQT1yx/RrH4FDffHSKFTfmjANBgkqhkiG9w0BAQUFADCB ijELMAkGA1UEBhMCQ0gxEDAOBgNVBAoTB1dJU2VLZXkxGzAZBgNVBAsTEkNvcHly aWdodCAoYykgMjAwNTEiMCAGA1UECxMZT0lTVEUgRm91bmRhdGlvbiBFbmRvcnNl ZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwgUm9vdCBHQSBDQTAeFw0w NTEyMTExNjAzNDRaFw0zNzEyMTExNjA5NTFaMIGKMQswCQYDVQQGEwJDSDEQMA4G A1UEChMHV0lTZUtleTEbMBkGA1UECxMSQ29weXJpZ2h0IChjKSAyMDA1MSIwIAYD VQQLExlPSVNURSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBX SVNlS2V5IEdsb2JhbCBSb290IEdBIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAy0+zAJs9Nt350UlqaxBJH+zYK7LG+DKBKUOVTJoZIyEVRd7jyBxR VVuuk+g3/ytr6dTqvirdqFEr12bDYVxgAsj1znJ7O7jyTmUIms2kahnBAbtzptf2 w93NvKSLtZlhuAGio9RN1AU9ka34tAhxZK9w8RxrfvbDd50kc3vkDIzh2TbhmYsF mQvtRTEJysIA2/dyoJaqlYfQjse2YXMNdmaM3Bu0Y6Kff5MTMPGhJ9vZ/yxViJGg 4E8HsChWjBgbl0SOid3gF27nKu+POQoxhILYQBRJLnpB5Kf+42TMwVlxSywhp1t9 4B3RLoGbw9ho972WG6xwsRYUC9tguSYBBQIDAQABo1EwTzALBgNVHQ8EBAMCAYYw DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUswN+rja8sHnR3JQmthG+IbJphpQw EAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBAEuh/wuHbrP5wUOx SPMowB0uyQlB+pQAHKSkq0lPjz0e701vvbyk9vImMMkQyh2I+3QZH4VFvbBsUfk2 ftv1TDI6QU9bR8/oCy22xBmddMVHxjtqD6wU2zz0c5ypBd8A3HR4+vg1YFkCExh8 vPtNsCBtQ7tgMHpnM1zFmdH4LTlSc/uMqpclXHLZCB6rTjzjgTGfA6b7wP4piFXa hNVQA7bihKOmNqoROgHhGEvWRGizPflTdISzRpFGlgC3gCy24eMQ4tui5yiPAZZi Fj4A4xylNoEYokxSdsARo27mHbrjWr42U8U+dY+GaSlYU7Wcu2+fXMUY7N0v4ZjJ /L7fCg0= -----END CERTIFICATE----- # Issuer: CN=Certigna O=Dhimyotis # Subject: CN=Certigna O=Dhimyotis # Label: "Certigna" # Serial: 18364802974209362175 # MD5 Fingerprint: ab:57:a6:5b:7d:42:82:19:b5:d8:58:26:28:5e:fd:ff # SHA1 Fingerprint: b1:2e:13:63:45:86:a4:6f:1a:b2:60:68:37:58:2d:c4:ac:fd:94:97 # SHA256 Fingerprint: e3:b6:a2:db:2e:d7:ce:48:84:2f:7a:c5:32:41:c7:b7:1d:54:14:4b:fb:40:c1:1f:3f:1d:0b:42:f5:ee:a1:2d -----BEGIN CERTIFICATE----- MIIDqDCCApCgAwIBAgIJAP7c4wEPyUj/MA0GCSqGSIb3DQEBBQUAMDQxCzAJBgNV BAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hMB4X DTA3MDYyOTE1MTMwNVoXDTI3MDYyOTE1MTMwNVowNDELMAkGA1UEBhMCRlIxEjAQ BgNVBAoMCURoaW15b3RpczERMA8GA1UEAwwIQ2VydGlnbmEwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDIaPHJ1tazNHUmgh7stL7qXOEm7RFHYeGifBZ4 QCHkYJ5ayGPhxLGWkv8YbWkj4Sti993iNi+RB7lIzw7sebYs5zRLcAglozyHGxny gQcPOJAZ0xH+hrTy0V4eHpbNgGzOOzGTtvKg0KmVEn2lmsxryIRWijOp5yIVUxbw zBfsV1/pogqYCd7jX5xv3EjjhQsVWqa6n6xI4wmy9/Qy3l40vhx4XUJbzg4ij02Q 130yGLMLLGq/jj8UEYkgDncUtT2UCIf3JR7VsmAA7G8qKCVuKj4YYxclPz5EIBb2 JsglrgVKtOdjLPOMFlN+XPsRGgjBRmKfIrjxwo1p3Po6WAbfAgMBAAGjgbwwgbkw DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGu3+QTmQtCRZvgHyUtVF9lo53BEw ZAYDVR0jBF0wW4AUGu3+QTmQtCRZvgHyUtVF9lo53BGhOKQ2MDQxCzAJBgNVBAYT AkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hggkA/tzj AQ/JSP8wDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG 9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h bV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc fca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu HWhBp6pX6FOqB9IG9tUUBguRA3UsbHK1YZWaDYu5Def131TN3ubY1gkIl2PlwS6w t0QmwCbAr1UwnjvVNioZBPRcHv/PLLf/0P2HQBHVESO7SMAhqaQoLf0V+LBOK/Qw WyH8EZE0vkHve52Xdf+XlcCWWC/qu0bXu+TZLg== -----END CERTIFICATE----- # Issuer: CN=Deutsche Telekom Root CA 2 O=Deutsche Telekom AG OU=T-TeleSec Trust Center # Subject: CN=Deutsche Telekom Root CA 2 O=Deutsche Telekom AG OU=T-TeleSec Trust Center # Label: "Deutsche Telekom Root CA 2" # Serial: 38 # MD5 Fingerprint: 74:01:4a:91:b1:08:c4:58:ce:47:cd:f0:dd:11:53:08 # SHA1 Fingerprint: 85:a4:08:c0:9c:19:3e:5d:51:58:7d:cd:d6:13:30:fd:8c:de:37:bf # SHA256 Fingerprint: b6:19:1a:50:d0:c3:97:7f:7d:a9:9b:cd:aa:c8:6a:22:7d:ae:b9:67:9e:c7:0b:a3:b0:c9:d9:22:71:c1:70:d3 -----BEGIN CERTIFICATE----- MIIDnzCCAoegAwIBAgIBJjANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJERTEc MBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxlU2Vj IFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290IENB IDIwHhcNOTkwNzA5MTIxMTAwWhcNMTkwNzA5MjM1OTAwWjBxMQswCQYDVQQGEwJE RTEcMBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEfMB0GA1UECxMWVC1UZWxl U2VjIFRydXN0IENlbnRlcjEjMCEGA1UEAxMaRGV1dHNjaGUgVGVsZWtvbSBSb290 IENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrC6M14IspFLEU ha88EOQ5bzVdSq7d6mGNlUn0b2SjGmBmpKlAIoTZ1KXleJMOaAGtuU1cOs7TuKhC QN/Po7qCWWqSG6wcmtoIKyUn+WkjR/Hg6yx6m/UTAtB+NHzCnjwAWav12gz1Mjwr rFDa1sPeg5TKqAyZMg4ISFZbavva4VhYAUlfckE8FQYBjl2tqriTtM2e66foai1S NNs671x1Udrb8zH57nGYMsRUFUQM+ZtV7a3fGAigo4aKSe5TBY8ZTNXeWHmb0moc QqvF1afPaA+W5OFhmHZhyJF81j4A4pFQh+GdCuatl9Idxjp9y7zaAzTVjlsB9WoH txa2bkp/AgMBAAGjQjBAMB0GA1UdDgQWBBQxw3kbuvVT1xfgiXotF2wKsyudMzAP BgNVHRMECDAGAQH/AgEFMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC AQEAlGRZrTlk5ynrE/5aw4sTV8gEJPB0d8Bg42f76Ymmg7+Wgnxu1MM9756Abrsp tJh6sTtU6zkXR34ajgv8HzFZMQSyzhfzLMdiNlXiItiJVbSYSKpk+tYcNthEeFpa IzpXl/V6ME+un2pMSyuOoAPjPuCp1NJ70rOo4nI8rZ7/gFnkm0W09juwzTkZmDLl 6iFhkOQxIY40sfcvNUqFENrnijchvllj4PKFiDFT1FQUhXB59C4Gdyd1Lx+4ivn+ xbrYNuSD7Odlt79jWvNGr4GUN9RBjNYj1h7P9WgbRGOiWrqnNVmh5XAFmw4jV5mU Cm26OWMohpLzGITY+9HPBVZkVw== -----END CERTIFICATE----- # Issuer: CN=Cybertrust Global Root O=Cybertrust, Inc # Subject: CN=Cybertrust Global Root O=Cybertrust, Inc # Label: "Cybertrust Global Root" # Serial: 4835703278459682877484360 # MD5 Fingerprint: 72:e4:4a:87:e3:69:40:80:77:ea:bc:e3:f4:ff:f0:e1 # SHA1 Fingerprint: 5f:43:e5:b1:bf:f8:78:8c:ac:1c:c7:ca:4a:9a:c6:22:2b:cc:34:c6 # SHA256 Fingerprint: 96:0a:df:00:63:e9:63:56:75:0c:29:65:dd:0a:08:67:da:0b:9c:bd:6e:77:71:4a:ea:fb:23:49:ab:39:3d:a3 -----BEGIN CERTIFICATE----- MIIDoTCCAomgAwIBAgILBAAAAAABD4WqLUgwDQYJKoZIhvcNAQEFBQAwOzEYMBYG A1UEChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2Jh bCBSb290MB4XDTA2MTIxNTA4MDAwMFoXDTIxMTIxNTA4MDAwMFowOzEYMBYGA1UE ChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2JhbCBS b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+Mi8vRRQZhP/8NN5 7CPytxrHjoXxEnOmGaoQ25yiZXRadz5RfVb23CO21O1fWLE3TdVJDm71aofW0ozS J8bi/zafmGWgE07GKmSb1ZASzxQG9Dvj1Ci+6A74q05IlG2OlTEQXO2iLb3VOm2y HLtgwEZLAfVJrn5GitB0jaEMAs7u/OePuGtm839EAL9mJRQr3RAwHQeWP032a7iP t3sMpTjr3kfb1V05/Iin89cqdPHoWqI7n1C6poxFNcJQZZXcY4Lv3b93TZxiyWNz FtApD0mpSPCzqrdsxacwOUBdrsTiXSZT8M4cIwhhqJQZugRiQOwfOHB3EgZxpzAY XSUnpQIDAQABo4GlMIGiMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/ MB0GA1UdDgQWBBS2CHsNesysIEyGVjJez6tuhS1wVzA/BgNVHR8EODA2MDSgMqAw hi5odHRwOi8vd3d3Mi5wdWJsaWMtdHJ1c3QuY29tL2NybC9jdC9jdHJvb3QuY3Js MB8GA1UdIwQYMBaAFLYIew16zKwgTIZWMl7Pq26FLXBXMA0GCSqGSIb3DQEBBQUA A4IBAQBW7wojoFROlZfJ+InaRcHUowAl9B8Tq7ejhVhpwjCt2BWKLePJzYFa+HMj Wqd8BfP9IjsO0QbE2zZMcwSO5bAi5MXzLqXZI+O4Tkogp24CJJ8iYGd7ix1yCcUx XOl5n4BHPa2hCwcUPUf/A2kaDAtE52Mlp3+yybh2hO0j9n0Hq0V+09+zv+mKts2o omcrUtW3ZfA5TGOgkXmTUg9U3YO7n9GPp1Nzw8v/MOx8BLjYRB+TX3EJIrduPuoc A06dGiBh+4E37F78CkWr1+cXVdCg6mCbpvbjjFspwgZgFJ0tl0ypkxWdYcQBX0jW WL1WMRJOEcgh4LMRkWXbtKaIOM5V -----END CERTIFICATE----- # Issuer: O=Chunghwa Telecom Co., Ltd. OU=ePKI Root Certification Authority # Subject: O=Chunghwa Telecom Co., Ltd. OU=ePKI Root Certification Authority # Label: "ePKI Root Certification Authority" # Serial: 28956088682735189655030529057352760477 # MD5 Fingerprint: 1b:2e:00:ca:26:06:90:3d:ad:fe:6f:15:68:d3:6b:b3 # SHA1 Fingerprint: 67:65:0d:f1:7e:8e:7e:5b:82:40:a4:f4:56:4b:cf:e2:3d:69:c6:f0 # SHA256 Fingerprint: c0:a6:f4:dc:63:a2:4b:fd:cf:54:ef:2a:6a:08:2a:0a:72:de:35:80:3e:2f:f5:ff:52:7a:e5:d8:72:06:df:d5 -----BEGIN CERTIFICATE----- MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBe MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0 ZC4xKjAoBgNVBAsMIWVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0wNDEyMjAwMjMxMjdaFw0zNDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYTAlRXMSMw IQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEqMCgGA1UECwwhZVBL SSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEF AAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEhajfqhFAH SyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrBp0xtInAh ijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3X DZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1 TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SXDrkb5wdJ fzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0OWQqraffA sgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uU WH1+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6ebClAZLS nT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iVBmoKs2pH dmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+XkwY63I2binZB1NJip NiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3pyKdVDEC AwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMAwGA1UdEwQF MAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLH ClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB uvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl PwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP JXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrsStZf0X4OFunHB2WyBEXYKCrC/ gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltabrNMdjmEPNXubrjlpC2JgQCA2 j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc7b3jajWvY9+rGNm6 5ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8GrBQAuUB o2M3IUxExJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS /jQ6fbjpKdx2qcgw+BRxgMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2z Gp1iro2C6pSe3VkQw63d4k3jMdXH7OjysP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTE W9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmODBCEIZ43ygknQW/2xzQ+D hNQ+IIX3Sj0rnP0qCglN6oH4EZw= -----END CERTIFICATE----- # Issuer: O=certSIGN OU=certSIGN ROOT CA # Subject: O=certSIGN OU=certSIGN ROOT CA # Label: "certSIGN ROOT CA" # Serial: 35210227249154 # MD5 Fingerprint: 18:98:c0:d6:e9:3a:fc:f9:b0:f5:0c:f7:4b:01:44:17 # SHA1 Fingerprint: fa:b7:ee:36:97:26:62:fb:2d:b0:2a:f6:bf:03:fd:e8:7c:4b:2f:9b # SHA256 Fingerprint: ea:a9:62:c4:fa:4a:6b:af:eb:e4:15:19:6d:35:1c:cd:88:8d:4f:53:f3:fa:8a:e6:d7:c4:66:a9:4e:60:42:bb -----BEGIN CERTIFICATE----- MIIDODCCAiCgAwIBAgIGIAYFFnACMA0GCSqGSIb3DQEBBQUAMDsxCzAJBgNVBAYT AlJPMREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBD QTAeFw0wNjA3MDQxNzIwMDRaFw0zMTA3MDQxNzIwMDRaMDsxCzAJBgNVBAYTAlJP MREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALczuX7IJUqOtdu0KBuqV5Do 0SLTZLrTk+jUrIZhQGpgV2hUhE28alQCBf/fm5oqrl0Hj0rDKH/v+yv6efHHrfAQ UySQi2bJqIirr1qjAOm+ukbuW3N7LBeCgV5iLKECZbO9xSsAfsT8AzNXDe3i+s5d RdY4zTW2ssHQnIFKquSyAVwdj1+ZxLGt24gh65AIgoDzMKND5pCCrlUoSe1b16kQ OA7+j0xbm0bqQfWwCHTD0IgztnzXdN/chNFDDnU5oSVAKOp4yw4sLjmdjItuFhwv JoIQ4uNllAoEwF73XVv4EOLQunpL+943AAAaWyjj0pxzPjKHmKHJUS/X3qwzs08C AwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0O BBYEFOCMm9slSbPxfIbWskKHC9BroNnkMA0GCSqGSIb3DQEBBQUAA4IBAQA+0hyJ LjX8+HXd5n9liPRyTMks1zJO890ZeUe9jjtbkw9QSSQTaxQGcu8J06Gh40CEyecY MnQ8SG4Pn0vU9x7Tk4ZkVJdjclDVVc/6IJMCopvDI5NOFlV2oHB5bc0hH88vLbwZ 44gx+FkagQnIl6Z0x2DEW8xXjrJ1/RsCCdtZb3KTafcxQdaIOL+Hsr0Wefmq5L6I Jd1hJyMctTEHBDa0GpC9oHRxUIltvBTjD4au8as+x6AJzKNI0eDbZOeStc+vckNw i/nDhDwTqn6Sm1dTk/pwwpEOMfmbZ13pljheX7NzTogVZ96edhBiIL5VaZVDADlN 9u6wWk5JRFRYX0KD -----END CERTIFICATE----- # Issuer: CN=GeoTrust Primary Certification Authority - G3 O=GeoTrust Inc. OU=(c) 2008 GeoTrust Inc. - For authorized use only # Subject: CN=GeoTrust Primary Certification Authority - G3 O=GeoTrust Inc. OU=(c) 2008 GeoTrust Inc. - For authorized use only # Label: "GeoTrust Primary Certification Authority - G3" # Serial: 28809105769928564313984085209975885599 # MD5 Fingerprint: b5:e8:34:36:c9:10:44:58:48:70:6d:2e:83:d4:b8:05 # SHA1 Fingerprint: 03:9e:ed:b8:0b:e7:a0:3c:69:53:89:3b:20:d2:d9:32:3a:4c:2a:fd # SHA256 Fingerprint: b4:78:b8:12:25:0d:f8:78:63:5c:2a:a7:ec:7d:15:5e:aa:62:5e:e8:29:16:e2:cd:29:43:61:88:6c:d1:fb:d4 -----BEGIN CERTIFICATE----- MIID/jCCAuagAwIBAgIQFaxulBmyeUtB9iepwxgPHzANBgkqhkiG9w0BAQsFADCB mDELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsT MChjKSAyMDA4IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s eTE2MDQGA1UEAxMtR2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eSAtIEczMB4XDTA4MDQwMjAwMDAwMFoXDTM3MTIwMTIzNTk1OVowgZgxCzAJ BgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTkwNwYDVQQLEzAoYykg MjAwOCBHZW9UcnVzdCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxNjA0 BgNVBAMTLUdlb1RydXN0IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANziXmJYHTNXOTIz +uvLh4yn1ErdBojqZI4xmKU4kB6Yzy5jK/BGvESyiaHAKAxJcCGVn2TAppMSAmUm hsalifD614SgcK9PGpc/BkTVyetyEH3kMSj7HGHmKAdEc5IiaacDiGydY8hS2pgn 5whMcD60yRLBxWeDXTPzAxHsatBT4tG6NmCUgLthY2xbF37fQJQeqw3CIShwiP/W JmxsYAQlTlV+fe+/lEjetx3dcI0FX4ilm/LC7urRQEFtYjgdVgbFA0dRIBn8exAL DmKudlW/X3e+PkkBUz2YJQN2JFodtNuJ6nnltrM7P7pMKEF/BqxqjsHQ9gUdfeZC huOl1UcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw HQYDVR0OBBYEFMR5yo6hTgMdHNxr2zFblD4/MH8tMA0GCSqGSIb3DQEBCwUAA4IB AQAtxRPPVoB7eni9n64smefv2t+UXglpp+duaIy9cr5HqQ6XErhK8WTTOd8lNNTB zU6B8A8ExCSzNJbGpqow32hhc9f5joWJ7w5elShKKiePEI4ufIbEAp7aDHdlDkQN kv39sxY2+hENHYwOB4lqKVb3cvTdFZx3NWZXqxNT2I7BQMXXExZacse3aQHEerGD AWh9jUGhlBjBJVz88P6DAod8DQ3PLghcSkANPuyBYeYk28rgDi0Hsj5W3I31QYUH SJsMC8tJP33st/3LjWeJGqvtux6jAAgIFyqCXDFdRootD4abdNlF+9RAsXqqaC2G spki4cErx5z481+oghLrGREt -----END CERTIFICATE----- # Issuer: CN=thawte Primary Root CA - G2 O=thawte, Inc. OU=(c) 2007 thawte, Inc. - For authorized use only # Subject: CN=thawte Primary Root CA - G2 O=thawte, Inc. OU=(c) 2007 thawte, Inc. - For authorized use only # Label: "thawte Primary Root CA - G2" # Serial: 71758320672825410020661621085256472406 # MD5 Fingerprint: 74:9d:ea:60:24:c4:fd:22:53:3e:cc:3a:72:d9:29:4f # SHA1 Fingerprint: aa:db:bc:22:23:8f:c4:01:a1:27:bb:38:dd:f4:1d:db:08:9e:f0:12 # SHA256 Fingerprint: a4:31:0d:50:af:18:a6:44:71:90:37:2a:86:af:af:8b:95:1f:fb:43:1d:83:7f:1e:56:88:b4:59:71:ed:15:57 -----BEGIN CERTIFICATE----- MIICiDCCAg2gAwIBAgIQNfwmXNmET8k9Jj1Xm67XVjAKBggqhkjOPQQDAzCBhDEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjE4MDYGA1UECxMvKGMp IDIwMDcgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAi BgNVBAMTG3RoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EgLSBHMjAeFw0wNzExMDUwMDAw MDBaFw0zODAxMTgyMzU5NTlaMIGEMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhh d3RlLCBJbmMuMTgwNgYDVQQLEy8oYykgMjAwNyB0aGF3dGUsIEluYy4gLSBGb3Ig YXV0aG9yaXplZCB1c2Ugb25seTEkMCIGA1UEAxMbdGhhd3RlIFByaW1hcnkgUm9v dCBDQSAtIEcyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEotWcgnuVnfFSeIf+iha/ BebfowJPDQfGAFG6DAJSLSKkQjnE/o/qycG+1E3/n3qe4rF8mq2nhglzh9HnmuN6 papu+7qzcMBniKI11KOasf2twu8x+qi58/sIxpHR+ymVo0IwQDAPBgNVHRMBAf8E BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUmtgAMADna3+FGO6Lts6K DPgR4bswCgYIKoZIzj0EAwMDaQAwZgIxAN344FdHW6fmCsO99YCKlzUNG4k8VIZ3 KMqh9HneteY4sPBlcIx/AlTCv//YoT7ZzwIxAMSNlPzcU9LcnXgWHxUzI1NS41ox XZ3Krr0TKUQNJ1uo52icEvdYPy5yAlejj6EULg== -----END CERTIFICATE----- # Issuer: CN=thawte Primary Root CA - G3 O=thawte, Inc. OU=Certification Services Division/(c) 2008 thawte, Inc. - For authorized use only # Subject: CN=thawte Primary Root CA - G3 O=thawte, Inc. OU=Certification Services Division/(c) 2008 thawte, Inc. - For authorized use only # Label: "thawte Primary Root CA - G3" # Serial: 127614157056681299805556476275995414779 # MD5 Fingerprint: fb:1b:5d:43:8a:94:cd:44:c6:76:f2:43:4b:47:e7:31 # SHA1 Fingerprint: f1:8b:53:8d:1b:e9:03:b6:a6:f0:56:43:5b:17:15:89:ca:f3:6b:f2 # SHA256 Fingerprint: 4b:03:f4:58:07:ad:70:f2:1b:fc:2c:ae:71:c9:fd:e4:60:4c:06:4c:f5:ff:b6:86:ba:e5:db:aa:d7:fd:d3:4c -----BEGIN CERTIFICATE----- MIIEKjCCAxKgAwIBAgIQYAGXt0an6rS0mtZLL/eQ+zANBgkqhkiG9w0BAQsFADCB rjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw MDggdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAiBgNV BAMTG3RoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EgLSBHMzAeFw0wODA0MDIwMDAwMDBa Fw0zNzEyMDEyMzU5NTlaMIGuMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3Rl LCBJbmMuMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9u MTgwNgYDVQQLEy8oYykgMjAwOCB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXpl ZCB1c2Ugb25seTEkMCIGA1UEAxMbdGhhd3RlIFByaW1hcnkgUm9vdCBDQSAtIEcz MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsr8nLPvb2FvdeHsbnndm gcs+vHyu86YnmjSjaDFxODNi5PNxZnmxqWWjpYvVj2AtP0LMqmsywCPLLEHd5N/8 YZzic7IilRFDGF/Eth9XbAoFWCLINkw6fKXRz4aviKdEAhN0cXMKQlkC+BsUa0Lf b1+6a4KinVvnSr0eAXLbS3ToO39/fR8EtCab4LRarEc9VbjXsCZSKAExQGbY2SS9 9irY7CFJXJv2eul/VTV+lmuNk5Mny5K76qxAwJ/C+IDPXfRa3M50hqY+bAtTyr2S zhkGcuYMXDhpxwTWvGzOW/b3aJzcJRVIiKHpqfiYnODz1TEoYRFsZ5aNOZnLwkUk OQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV HQ4EFgQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8wDQYJKoZIhvcNAQELBQADggEBABpA 2JVlrAmSicY59BDlqQ5mU1143vokkbvnRFHfxhY0Cu9qRFHqKweKA3rD6z8KLFIW oCtDuSWQP3CpMyVtRRooOyfPqsMpQhvfO0zAMzRbQYi/aytlryjvsvXDqmbOe1bu t8jLZ8HJnBoYuMTDSQPxYA5QzUbF83d597YV4Djbxy8ooAw/dyZ02SUS2jHaGh7c KUGRIjxpp7sC8rZcJwOJ9Abqm+RyguOhCcHpABnTPtRwa7pxpqpYrvS76Wy274fM m7v/OeZWYdMKp8RcTGB7BXcmer/YB1IsYvdwY9k5vG8cwnncdimvzsUsZAReiDZu MdRAGmI0Nj81Aa6sY6A= -----END CERTIFICATE----- # Issuer: CN=GeoTrust Primary Certification Authority - G2 O=GeoTrust Inc. OU=(c) 2007 GeoTrust Inc. - For authorized use only # Subject: CN=GeoTrust Primary Certification Authority - G2 O=GeoTrust Inc. OU=(c) 2007 GeoTrust Inc. - For authorized use only # Label: "GeoTrust Primary Certification Authority - G2" # Serial: 80682863203381065782177908751794619243 # MD5 Fingerprint: 01:5e:d8:6b:bd:6f:3d:8e:a1:31:f8:12:e0:98:73:6a # SHA1 Fingerprint: 8d:17:84:d5:37:f3:03:7d:ec:70:fe:57:8b:51:9a:99:e6:10:d7:b0 # SHA256 Fingerprint: 5e:db:7a:c4:3b:82:a0:6a:87:61:e8:d7:be:49:79:eb:f2:61:1f:7d:d7:9b:f9:1c:1c:6b:56:6a:21:9e:d7:66 -----BEGIN CERTIFICATE----- MIICrjCCAjWgAwIBAgIQPLL0SAoA4v7rJDteYD7DazAKBggqhkjOPQQDAzCBmDEL MAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsTMChj KSAyMDA3IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTE2 MDQGA1UEAxMtR2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eSAtIEcyMB4XDTA3MTEwNTAwMDAwMFoXDTM4MDExODIzNTk1OVowgZgxCzAJBgNV BAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTkwNwYDVQQLEzAoYykgMjAw NyBHZW9UcnVzdCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxNjA0BgNV BAMTLUdlb1RydXN0IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH MjB2MBAGByqGSM49AgEGBSuBBAAiA2IABBWx6P0DFUPlrOuHNxFi79KDNlJ9RVcL So17VDs6bl8VAsBQps8lL33KSLjHUGMcKiEIfJo22Av+0SbFWDEwKCXzXV2juLal tJLtbCyf691DiaI8S0iRHVDsJt/WYC69IaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFBVfNVdRVfslsq0DafwBo/q+EVXVMAoG CCqGSM49BAMDA2cAMGQCMGSWWaboCd6LuvpaiIjwH5HTRqjySkwCY/tsXzjbLkGT qQ7mndwxHLKgpxgceeHHNgIwOlavmnRs9vuD4DPTCF+hnMJbn0bWtsuRBmOiBucz rD6ogRLQy7rQkgu2npaqBA+K -----END CERTIFICATE----- # Issuer: CN=VeriSign Universal Root Certification Authority O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2008 VeriSign, Inc. - For authorized use only # Subject: CN=VeriSign Universal Root Certification Authority O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2008 VeriSign, Inc. - For authorized use only # Label: "VeriSign Universal Root Certification Authority" # Serial: 85209574734084581917763752644031726877 # MD5 Fingerprint: 8e:ad:b5:01:aa:4d:81:e4:8c:1d:d1:e1:14:00:95:19 # SHA1 Fingerprint: 36:79:ca:35:66:87:72:30:4d:30:a5:fb:87:3b:0f:a7:7b:b7:0d:54 # SHA256 Fingerprint: 23:99:56:11:27:a5:71:25:de:8c:ef:ea:61:0d:df:2f:a0:78:b5:c8:06:7f:4e:82:82:90:bf:b8:60:e8:4b:3c -----BEGIN CERTIFICATE----- MIIEuTCCA6GgAwIBAgIQQBrEZCGzEyEDDrvkEhrFHTANBgkqhkiG9w0BAQsFADCB vTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwOCBWZXJp U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MTgwNgYDVQQDEy9W ZXJpU2lnbiBVbml2ZXJzYWwgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0wODA0MDIwMDAwMDBaFw0zNzEyMDEyMzU5NTlaMIG9MQswCQYDVQQGEwJVUzEX MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0 IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA4IFZlcmlTaWduLCBJbmMuIC0gRm9y IGF1dGhvcml6ZWQgdXNlIG9ubHkxODA2BgNVBAMTL1ZlcmlTaWduIFVuaXZlcnNh bCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAx2E3XrEBNNti1xWb/1hajCMj1mCOkdeQmIN65lgZOIzF 9uVkhbSicfvtvbnazU0AtMgtc6XHaXGVHzk8skQHnOgO+k1KxCHfKWGPMiJhgsWH H26MfF8WIFFE0XBPV+rjHOPMee5Y2A7Cs0WTwCznmhcrewA3ekEzeOEz4vMQGn+H LL729fdC4uW/h2KJXwBL38Xd5HVEMkE6HnFuacsLdUYI0crSK5XQz/u5QGtkjFdN /BMReYTtXlT2NJ8IAfMQJQYXStrxHXpma5hgZqTZ79IugvHw7wnqRMkVauIDbjPT rJ9VAMf2CGqUuV/c4DPxhGD5WycRtPwW8rtWaoAljQIDAQABo4GyMIGvMA8GA1Ud EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMG0GCCsGAQUFBwEMBGEwX6FdoFsw WTBXMFUWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFI/l0xqGrI2Oa8PPgGrUSBgs exkuMCUWI2h0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28uZ2lmMB0GA1Ud DgQWBBS2d/ppSEefUxLVwuoHMnYH0ZcHGTANBgkqhkiG9w0BAQsFAAOCAQEASvj4 sAPmLGd75JR3Y8xuTPl9Dg3cyLk1uXBPY/ok+myDjEedO2Pzmvl2MpWRsXe8rJq+ seQxIcaBlVZaDrHC1LGmWazxY8u4TB1ZkErvkBYoH1quEPuBUDgMbMzxPcP1Y+Oz 4yHJJDnp/RVmRvQbEdBNc6N9Rvk97ahfYtTxP/jgdFcrGJ2BtMQo2pSXpXDrrB2+ BxHw1dvd5Yzw1TKwg+ZX4o+/vqGqvz0dtdQ46tewXDpPaj+PwGZsY6rp2aQW9IHR lRQOfc2VNNnSj3BzgXucfr2YYdhFh5iQxeuGMMY1v/D/w1WIg0vvBZIGcfK4mJO3 7M2CYfE45k+XmCpajQ== -----END CERTIFICATE----- # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G4 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2007 VeriSign, Inc. - For authorized use only # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G4 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2007 VeriSign, Inc. - For authorized use only # Label: "VeriSign Class 3 Public Primary Certification Authority - G4" # Serial: 63143484348153506665311985501458640051 # MD5 Fingerprint: 3a:52:e1:e7:fd:6f:3a:e3:6f:f3:6f:99:1b:f9:22:41 # SHA1 Fingerprint: 22:d5:d8:df:8f:02:31:d1:8d:f7:9d:b7:cf:8a:2d:64:c9:3f:6c:3a # SHA256 Fingerprint: 69:dd:d7:ea:90:bb:57:c9:3e:13:5d:c8:5e:a6:fc:d5:48:0b:60:32:39:bd:c4:54:fc:75:8b:2a:26:cf:7f:79 -----BEGIN CERTIFICATE----- MIIDhDCCAwqgAwIBAgIQL4D+I4wOIg9IZxIokYesszAKBggqhkjOPQQDAzCByjEL MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNyBWZXJpU2ln biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y aXR5IC0gRzQwHhcNMDcxMTA1MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCByjELMAkG A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJp U2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNyBWZXJpU2lnbiwg SW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2ln biBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5 IC0gRzQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASnVnp8Utpkmw4tXNherJI9/gHm GUo9FANL+mAnINmDiWn6VMaaGF5VKmTeBvaNSjutEDxlPZCIBIngMGGzrl0Bp3ve fLK+ymVhAIau2o970ImtTR1ZmkGxvEeA3J5iw/mjgbIwga8wDwYDVR0TAQH/BAUw AwEB/zAOBgNVHQ8BAf8EBAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJ aW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYj aHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFLMW kf3upm7ktS5Jj4d4gYDs5bG1MAoGCCqGSM49BAMDA2gAMGUCMGYhDBgmYFo4e1ZC 4Kf8NoRRkSAsdk1DPcQdhCPQrNZ8NQbOzWm9kA3bbEhCHQ6qQgIxAJw9SDkjOVga FRJZap7v1VmyHVIsmXHNxynfGyphe3HR3vPA5Q06Sqotp9iGKt0uEA== -----END CERTIFICATE----- # Issuer: CN=NetLock Arany (Class Gold) F\u0151tan\xfas\xedtv\xe1ny O=NetLock Kft. OU=Tan\xfas\xedtv\xe1nykiad\xf3k (Certification Services) # Subject: CN=NetLock Arany (Class Gold) F\u0151tan\xfas\xedtv\xe1ny O=NetLock Kft. OU=Tan\xfas\xedtv\xe1nykiad\xf3k (Certification Services) # Label: "NetLock Arany (Class Gold) F\u0151tan\xfas\xedtv\xe1ny" # Serial: 80544274841616 # MD5 Fingerprint: c5:a1:b7:ff:73:dd:d6:d7:34:32:18:df:fc:3c:ad:88 # SHA1 Fingerprint: 06:08:3f:59:3f:15:a1:04:a0:69:a4:6b:a9:03:d0:06:b7:97:09:91 # SHA256 Fingerprint: 6c:61:da:c3:a2:de:f0:31:50:6b:e0:36:d2:a6:fe:40:19:94:fb:d1:3d:f9:c8:d4:66:59:92:74:c4:46:ec:98 -----BEGIN CERTIFICATE----- MIIEFTCCAv2gAwIBAgIGSUEs5AAQMA0GCSqGSIb3DQEBCwUAMIGnMQswCQYDVQQG EwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFTATBgNVBAoMDE5ldExvY2sgS2Z0LjE3 MDUGA1UECwwuVGFuw7pzw610dsOhbnlraWFkw7NrIChDZXJ0aWZpY2F0aW9uIFNl cnZpY2VzKTE1MDMGA1UEAwwsTmV0TG9jayBBcmFueSAoQ2xhc3MgR29sZCkgRsWR dGFuw7pzw610dsOhbnkwHhcNMDgxMjExMTUwODIxWhcNMjgxMjA2MTUwODIxWjCB pzELMAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxOZXRM b2NrIEtmdC4xNzA1BgNVBAsMLlRhbsO6c8OtdHbDoW55a2lhZMOzayAoQ2VydGlm aWNhdGlvbiBTZXJ2aWNlcykxNTAzBgNVBAMMLE5ldExvY2sgQXJhbnkgKENsYXNz IEdvbGQpIEbFkXRhbsO6c8OtdHbDoW55MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAxCRec75LbRTDofTjl5Bu0jBFHjzuZ9lk4BqKf8owyoPjIMHj9DrT lF8afFttvzBPhCf2nx9JvMaZCpDyD/V/Q4Q3Y1GLeqVw/HpYzY6b7cNGbIRwXdrz AZAj/E4wqX7hJ2Pn7WQ8oLjJM2P+FpD/sLj916jAwJRDC7bVWaaeVtAkH3B5r9s5 VA1lddkVQZQBr17s9o3x/61k/iCa11zr/qYfCGSji3ZVrR47KGAuhyXoqq8fxmRG ILdwfzzeSNuWU7c5d+Qa4scWhHaXWy+7GRWF+GmF9ZmnqfI0p6m2pgP8b4Y9VHx2 BJtr+UBdADTHLpl1neWIA6pN+APSQnbAGwIDAKiLo0UwQzASBgNVHRMBAf8ECDAG AQH/AgEEMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUzPpnk/C2uNClwB7zU/2M U9+D15YwDQYJKoZIhvcNAQELBQADggEBAKt/7hwWqZw8UQCgwBEIBaeZ5m8BiFRh bvG5GK1Krf6BQCOUL/t1fC8oS2IkgYIL9WHxHG64YTjrgfpioTtaYtOUZcTh5m2C +C8lcLIhJsFyUR+MLMOEkMNaj7rP9KdlpeuY0fsFskZ1FSNqb4VjMIDw1Z4fKRzC bLBQWV2QWzuoDTDPv31/zvGdg73JRm4gpvlhUbohL3u+pRVjodSVh/GeufOJ8z2F uLjbvrW5KfnaNwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2 XjG4Kvte9nHfRCaexOYNkbQudZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E= -----END CERTIFICATE----- # Issuer: CN=Staat der Nederlanden Root CA - G2 O=Staat der Nederlanden # Subject: CN=Staat der Nederlanden Root CA - G2 O=Staat der Nederlanden # Label: "Staat der Nederlanden Root CA - G2" # Serial: 10000012 # MD5 Fingerprint: 7c:a5:0f:f8:5b:9a:7d:6d:30:ae:54:5a:e3:42:a2:8a # SHA1 Fingerprint: 59:af:82:79:91:86:c7:b4:75:07:cb:cf:03:57:46:eb:04:dd:b7:16 # SHA256 Fingerprint: 66:8c:83:94:7d:a6:3b:72:4b:ec:e1:74:3c:31:a0:e6:ae:d0:db:8e:c5:b3:1b:e3:77:bb:78:4f:91:b6:71:6f -----BEGIN CERTIFICATE----- MIIFyjCCA7KgAwIBAgIEAJiWjDANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJO TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSswKQYDVQQDDCJTdGFh dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQSAtIEcyMB4XDTA4MDMyNjExMTgxN1oX DTIwMDMyNTExMDMxMFowWjELMAkGA1UEBhMCTkwxHjAcBgNVBAoMFVN0YWF0IGRl ciBOZWRlcmxhbmRlbjErMCkGA1UEAwwiU3RhYXQgZGVyIE5lZGVybGFuZGVuIFJv b3QgQ0EgLSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVZ5291 qj5LnLW4rJ4L5PnZyqtdj7U5EILXr1HgO+EASGrP2uEGQxGZqhQlEq0i6ABtQ8Sp uOUfiUtnvWFI7/3S4GCI5bkYYCjDdyutsDeqN95kWSpGV+RLufg3fNU254DBtvPU Z5uW6M7XxgpT0GtJlvOjCwV3SPcl5XCsMBQgJeN/dVrlSPhOewMHBPqCYYdu8DvE pMfQ9XQ+pV0aCPKbJdL2rAQmPlU6Yiile7Iwr/g3wtG61jj99O9JMDeZJiFIhQGp 5Rbn3JBV3w/oOM2ZNyFPXfUib2rFEhZgF1XyZWampzCROME4HYYEhLoaJXhena/M UGDWE4dS7WMfbWV9whUYdMrhfmQpjHLYFhN9C0lK8SgbIHRrxT3dsKpICT0ugpTN GmXZK4iambwYfp/ufWZ8Pr2UuIHOzZgweMFvZ9C+X+Bo7d7iscksWXiSqt8rYGPy 5V6548r6f1CGPqI0GAwJaCgRHOThuVw+R7oyPxjMW4T182t0xHJ04eOLoEq9jWYv 6q012iDTiIJh8BIitrzQ1aTsr1SIJSQ8p22xcik/Plemf1WvbibG/ufMQFxRRIEK eN5KzlW/HdXZt1bv8Hb/C3m1r737qWmRRpdogBQ2HbN/uymYNqUg+oJgYjOk7Na6 B6duxc8UpufWkjTYgfX8HV2qXB72o007uPc5AgMBAAGjgZcwgZQwDwYDVR0TAQH/ BAUwAwEB/zBSBgNVHSAESzBJMEcGBFUdIAAwPzA9BggrBgEFBQcCARYxaHR0cDov L3d3dy5wa2lvdmVyaGVpZC5ubC9wb2xpY2llcy9yb290LXBvbGljeS1HMjAOBgNV HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJFoMocVHYnitfGsNig0jQt8YojrMA0GCSqG SIb3DQEBCwUAA4ICAQCoQUpnKpKBglBu4dfYszk78wIVCVBR7y29JHuIhjv5tLyS CZa59sCrI2AGeYwRTlHSeYAz+51IvuxBQ4EffkdAHOV6CMqqi3WtFMTC6GY8ggen 5ieCWxjmD27ZUD6KQhgpxrRW/FYQoAUXvQwjf/ST7ZwaUb7dRUG/kSS0H4zpX897 IZmflZ85OkYcbPnNe5yQzSipx6lVu6xiNGI1E0sUOlWDuYaNkqbG9AclVMwWVxJK gnjIFNkXgiYtXSAfea7+1HAWFpWD2DU5/1JddRwWxRNVz0fMdWVSSt7wsKfkCpYL +63C4iWEst3kvX5ZbJvw8NjnyvLplzh+ib7M+zkXYT9y2zqR2GUBGR2tUKRXCnxL vJxxcypFURmFzI79R6d0lR2o0a9OF7FpJsKqeFdbxU2n5Z4FF5TKsl+gSRiNNOkm bEgeqmiSBeGCc1qb3AdbCG19ndeNIdn8FCCqwkXfP+cAslHkwvgFuXkajDTznlvk N1trSt8sV4pAWja63XVECDdCcAz+3F4hoKOKwJCcaNpQ5kUQR3i2TtJlycM33+FC Y7BXN0Ute4qcvwXqZVUz9zkQxSgqIXobisQk+T8VyJoVIPVVYpbtbZNQvOSqeK3Z ywplh6ZmwcSBo3c6WB4L7oOLnR7SUqTMHW+wmG2UMbX4cQrcufx9MmDm66+KAQ== -----END CERTIFICATE----- # Issuer: CN=SecureSign RootCA11 O=Japan Certification Services, Inc. # Subject: CN=SecureSign RootCA11 O=Japan Certification Services, Inc. # Label: "SecureSign RootCA11" # Serial: 1 # MD5 Fingerprint: b7:52:74:e2:92:b4:80:93:f2:75:e4:cc:d7:f2:ea:26 # SHA1 Fingerprint: 3b:c4:9f:48:f8:f3:73:a0:9c:1e:bd:f8:5b:b1:c3:65:c7:d8:11:b3 # SHA256 Fingerprint: bf:0f:ee:fb:9e:3a:58:1a:d5:f9:e9:db:75:89:98:57:43:d2:61:08:5c:4d:31:4f:6f:5d:72:59:aa:42:16:12 -----BEGIN CERTIFICATE----- MIIDbTCCAlWgAwIBAgIBATANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJKUDEr MCkGA1UEChMiSmFwYW4gQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcywgSW5jLjEcMBoG A1UEAxMTU2VjdXJlU2lnbiBSb290Q0ExMTAeFw0wOTA0MDgwNDU2NDdaFw0yOTA0 MDgwNDU2NDdaMFgxCzAJBgNVBAYTAkpQMSswKQYDVQQKEyJKYXBhbiBDZXJ0aWZp Y2F0aW9uIFNlcnZpY2VzLCBJbmMuMRwwGgYDVQQDExNTZWN1cmVTaWduIFJvb3RD QTExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/XeqpRyQBTvLTJsz i1oURaTnkBbR31fSIRCkF/3frNYfp+TbfPfs37gD2pRY/V1yfIw/XwFndBWW4wI8 h9uuywGOwvNmxoVF9ALGOrVisq/6nL+k5tSAMJjzDbaTj6nU2DbysPyKyiyhFTOV MdrAG/LuYpmGYz+/3ZMqg6h2uRMft85OQoWPIucuGvKVCbIFtUROd6EgvanyTgp9 UK31BQ1FT0Zx/Sg+U/sE2C3XZR1KG/rPO7AxmjVuyIsG0wCR8pQIZUyxNAYAeoni 8McDWc/V1uinMrPmmECGxc0nEovMe863ETxiYAcjPitAbpSACW22s293bzUIUPsC h8U+iQIDAQABo0IwQDAdBgNVHQ4EFgQUW/hNT7KlhtQ60vFjmqC+CfZXt94wDgYD VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEB AKChOBZmLqdWHyGcBvod7bkixTgm2E5P7KN/ed5GIaGHd48HCJqypMWvDzKYC3xm KbabfSVSSUOrTC4rbnpwrxYO4wJs+0LmGJ1F2FXI6Dvd5+H0LgscNFxsWEr7jIhQ X5Ucv+2rIrVls4W6ng+4reV6G4pQOh29Dbx7VFALuUKvVaAYga1lme++5Jy/xIWr QbJUb9wlze144o4MjQlJ3WN7WmmWAiGovVJZ6X01y8hSyn+B/tlr0/cR7SXf+Of5 pPpyl4RTDaXQMhhRdlkUbA/r7F+AjHVDg8OFmP9Mni0N5HeDk061lgeLKBObjBmN QSdJQO7e5iNEOdyhIta6A/I= -----END CERTIFICATE----- # Issuer: CN=Microsec e-Szigno Root CA 2009 O=Microsec Ltd. # Subject: CN=Microsec e-Szigno Root CA 2009 O=Microsec Ltd. # Label: "Microsec e-Szigno Root CA 2009" # Serial: 14014712776195784473 # MD5 Fingerprint: f8:49:f4:03:bc:44:2d:83:be:48:69:7d:29:64:fc:b1 # SHA1 Fingerprint: 89:df:74:fe:5c:f4:0f:4a:80:f9:e3:37:7d:54:da:91:e1:01:31:8e # SHA256 Fingerprint: 3c:5f:81:fe:a5:fa:b8:2c:64:bf:a2:ea:ec:af:cd:e8:e0:77:fc:86:20:a7:ca:e5:37:16:3d:f3:6e:db:f3:78 -----BEGIN CERTIFICATE----- MIIECjCCAvKgAwIBAgIJAMJ+QwRORz8ZMA0GCSqGSIb3DQEBCwUAMIGCMQswCQYD VQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFjAUBgNVBAoMDU1pY3Jvc2VjIEx0 ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G CSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y OTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx FjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3pp Z25vIFJvb3QgQ0EgMjAwOTEfMB0GCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5o dTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOn4j/NjrdqG2KfgQvvP kd6mJviZpWNwrZuuyjNAfW2WbqEORO7hE52UQlKavXWFdCyoDh2Tthi3jCyoz/tc cbna7P7ofo/kLx2yqHWH2Leh5TvPmUpG0IMZfcChEhyVbUr02MelTTMuhTlAdX4U fIASmFDHQWe4oIBhVKZsTh/gnQ4H6cm6M+f+wFUoLAKApxn1ntxVUwOXewdI/5n7 N4okxFnMUBBjjqqpGrCEGob5X7uxUG6k0QrM1XF+H6cbfPVTbiJfyyvm1HxdrtbC xkzlBQHZ7Vf8wSN5/PrIJIOV87VqUQHQd9bpEqH5GoP7ghu5sJf0dgYzQ0mg/wu1 +rUCAwEAAaOBgDB+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G A1UdDgQWBBTLD8bfQkPMPcu1SCOhGnqmKrs0aDAfBgNVHSMEGDAWgBTLD8bfQkPM Pcu1SCOhGnqmKrs0aDAbBgNVHREEFDASgRBpbmZvQGUtc3ppZ25vLmh1MA0GCSqG SIb3DQEBCwUAA4IBAQDJ0Q5eLtXMs3w+y/w9/w0olZMEyL/azXm4Q5DwpL7v8u8h mLzU1F0G9u5C7DBsoKqpyvGvivo/C3NqPuouQH4frlRheesuCDfXI/OMn74dseGk ddug4lQUsbocKaQY9hK6ohQU4zE1yED/t+AFdlfBHFny+L/k7SViXITwfn4fs775 tyERzAMBVnCnEJIeGzSBHq2cGsMEPO0CYdYeBvNfOofyK/FFh+U9rNHHV4S9a67c 2Pm2G2JwCz02yULyMtd6YebS2z3PyKnJm9zbWETXbzivf3jTo60adbocwTZ8jx5t HMN1Rq41Bab2XD0h7lbwyYIiLXpUq3DDfSJlgnCW -----END CERTIFICATE----- # Issuer: CN=GlobalSign O=GlobalSign OU=GlobalSign Root CA - R3 # Subject: CN=GlobalSign O=GlobalSign OU=GlobalSign Root CA - R3 # Label: "GlobalSign Root CA - R3" # Serial: 4835703278459759426209954 # MD5 Fingerprint: c5:df:b8:49:ca:05:13:55:ee:2d:ba:1a:c3:3e:b0:28 # SHA1 Fingerprint: d6:9b:56:11:48:f0:1c:77:c5:45:78:c1:09:26:df:5b:85:69:76:ad # SHA256 Fingerprint: cb:b5:22:d7:b7:f1:27:ad:6a:01:13:86:5b:df:1c:d4:10:2e:7d:07:59:af:63:5a:7c:f4:72:0d:c9:63:c5:3b -----BEGIN CERTIFICATE----- MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4 MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8 RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK 6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH WD9f -----END CERTIFICATE----- # Issuer: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 # Subject: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068 # Label: "Autoridad de Certificacion Firmaprofesional CIF A62634068" # Serial: 6047274297262753887 # MD5 Fingerprint: 73:3a:74:7a:ec:bb:a3:96:a6:c2:e4:e2:c8:9b:c0:c3 # SHA1 Fingerprint: ae:c5:fb:3f:c8:e1:bf:c4:e5:4f:03:07:5a:9a:e8:00:b7:f7:b6:fa # SHA256 Fingerprint: 04:04:80:28:bf:1f:28:64:d4:8f:9a:d4:d8:32:94:36:6a:82:88:56:55:3f:3b:14:30:3f:90:14:7f:5d:40:ef -----BEGIN CERTIFICATE----- MIIGFDCCA/ygAwIBAgIIU+w77vuySF8wDQYJKoZIhvcNAQEFBQAwUTELMAkGA1UE BhMCRVMxQjBABgNVBAMMOUF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1h cHJvZmVzaW9uYWwgQ0lGIEE2MjYzNDA2ODAeFw0wOTA1MjAwODM4MTVaFw0zMDEy MzEwODM4MTVaMFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUg Q2VydGlmaWNhY2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjgwggIi MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKlmuO6vj78aI14H9M2uDDUtd9 thDIAl6zQyrET2qyyhxdKJp4ERppWVevtSBC5IsP5t9bpgOSL/UR5GLXMnE42QQM cas9UX4PB99jBVzpv5RvwSmCwLTaUbDBPLutN0pcyvFLNg4kq7/DhHf9qFD0sefG L9ItWY16Ck6WaVICqjaY7Pz6FIMMNx/Jkjd/14Et5cS54D40/mf0PmbR0/RAz15i NA9wBj4gGFrO93IbJWyTdBSTo3OxDqqHECNZXyAFGUftaI6SEspd/NYrspI8IM/h X68gvqB2f3bl7BqGYTM+53u0P6APjqK5am+5hyZvQWyIplD9amML9ZMWGxmPsu2b m8mQ9QEM3xk9Dz44I8kvjwzRAv4bVdZO0I08r0+k8/6vKtMFnXkIoctXMbScyJCy Z/QYFpM6/EfY0XiWMR+6KwxfXZmtY4laJCB22N/9q06mIqqdXuYnin1oKaPnirja EbsXLZmdEyRG98Xi2J+Of8ePdG1asuhy9azuJBCtLxTa/y2aRnFHvkLfuwHb9H/T KI8xWVvTyQKmtFLKbpf7Q8UIJm+K9Lv9nyiqDdVF8xM6HdjAeI9BZzwelGSuewvF 6NkBiDkal4ZkQdU7hwxu+g/GvUgUvzlN1J5Bto+WHWOWk9mVBngxaJ43BjuAiUVh OSPHG0SjFeUc+JIwuwIDAQABo4HvMIHsMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYD VR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlzeurNR4APn7VdMActHNHDhpkLzCBpgYD VR0gBIGeMIGbMIGYBgRVHSAAMIGPMC8GCCsGAQUFBwIBFiNodHRwOi8vd3d3LmZp cm1hcHJvZmVzaW9uYWwuY29tL2NwczBcBggrBgEFBQcCAjBQHk4AUABhAHMAZQBv ACAAZABlACAAbABhACAAQgBvAG4AYQBuAG8AdgBhACAANAA3ACAAQgBhAHIAYwBl AGwAbwBuAGEAIAAwADgAMAAxADcwDQYJKoZIhvcNAQEFBQADggIBABd9oPm03cXF 661LJLWhAqvdpYhKsg9VSytXjDvlMd3+xDLx51tkljYyGOylMnfX40S2wBEqgLk9 am58m9Ot/MPWo+ZkKXzR4Tgegiv/J2Wv+xYVxC5xhOW1//qkR71kMrv2JYSiJ0L1 ILDCExARzRAVukKQKtJE4ZYm6zFIEv0q2skGz3QeqUvVhyj5eTSSPi5E6PaPT481 PyWzOdxjKpBrIF/EUhJOlywqrJ2X3kjyo2bbwtKDlaZmp54lD+kLM5FlClrD2VQS 3a/DTg4fJl4N3LON7NWBcN7STyQF82xO9UxJZo3R/9ILJUFI/lGExkKvgATP0H5k SeTy36LssUzAKh3ntLFlosS88Zj0qnAHY7S42jtM+kAiMFsRpvAFDsYCA0irhpuF 3dvd6qJ2gHN99ZwExEWN57kci57q13XRcrHedUTnQn3iV2t93Jm8PYMo6oCTjcVM ZcFwgbg4/EMxsvYDNEeyrPsiBsse3RdHHF9mudMaotoRsaS8I8nkvof/uZS2+F0g StRf571oe2XyFR7SOqkt6dhrJKyXWERHrVkY8SFlcN7ONGCoQPHzPKTDKCOM/icz Q0CgFzzr6juwcqajuUpLXhZI9LK8yIySxZ2frHI2vDSANGupi5LAuBft7HZT9SQB jLMi6Et8Vcad+qMUu2WFbm5PEn4KPJ2V -----END CERTIFICATE----- # Issuer: CN=Izenpe.com O=IZENPE S.A. # Subject: CN=Izenpe.com O=IZENPE S.A. # Label: "Izenpe.com" # Serial: 917563065490389241595536686991402621 # MD5 Fingerprint: a6:b0:cd:85:80:da:5c:50:34:a3:39:90:2f:55:67:73 # SHA1 Fingerprint: 2f:78:3d:25:52:18:a7:4a:65:39:71:b5:2c:a2:9c:45:15:6f:e9:19 # SHA256 Fingerprint: 25:30:cc:8e:98:32:15:02:ba:d9:6f:9b:1f:ba:1b:09:9e:2d:29:9e:0f:45:48:bb:91:4f:36:3b:c0:d4:53:1f -----BEGIN CERTIFICATE----- MIIF8TCCA9mgAwIBAgIQALC3WhZIX7/hy/WL1xnmfTANBgkqhkiG9w0BAQsFADA4 MQswCQYDVQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6 ZW5wZS5jb20wHhcNMDcxMjEzMTMwODI4WhcNMzcxMjEzMDgyNzI1WjA4MQswCQYD VQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6ZW5wZS5j b20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJ03rKDx6sp4boFmVq scIbRTJxldn+EFvMr+eleQGPicPK8lVx93e+d5TzcqQsRNiekpsUOqHnJJAKClaO xdgmlOHZSOEtPtoKct2jmRXagaKH9HtuJneJWK3W6wyyQXpzbm3benhB6QiIEn6H LmYRY2xU+zydcsC8Lv/Ct90NduM61/e0aL6i9eOBbsFGb12N4E3GVFWJGjMxCrFX uaOKmMPsOzTFlUFpfnXCPCDFYbpRR6AgkJOhkEvzTnyFRVSa0QUmQbC1TR0zvsQD yCV8wXDbO/QJLVQnSKwv4cSsPsjLkkxTOTcj7NMB+eAJRE1NZMDhDVqHIrytG6P+ JrUV86f8hBnp7KGItERphIPzidF0BqnMC9bC3ieFUCbKF7jJeodWLBoBHmy+E60Q rLUk9TiRodZL2vG70t5HtfG8gfZZa88ZU+mNFctKy6lvROUbQc/hhqfK0GqfvEyN BjNaooXlkDWgYlwWTvDjovoDGrQscbNYLN57C9saD+veIR8GdwYDsMnvmfzAuU8L hij+0rnq49qlw0dpEuDb8PYZi+17cNcC1u2HGCgsBCRMd+RIihrGO5rUD8r6ddIB QFqNeb+Lz0vPqhbBleStTIo+F5HUsWLlguWABKQDfo2/2n+iD5dPDNMN+9fR5XJ+ HMh3/1uaD7euBUbl8agW7EekFwIDAQABo4H2MIHzMIGwBgNVHREEgagwgaWBD2lu Zm9AaXplbnBlLmNvbaSBkTCBjjFHMEUGA1UECgw+SVpFTlBFIFMuQS4gLSBDSUYg QTAxMzM3MjYwLVJNZXJjLlZpdG9yaWEtR2FzdGVpeiBUMTA1NSBGNjIgUzgxQzBB BgNVBAkMOkF2ZGEgZGVsIE1lZGl0ZXJyYW5lbyBFdG9yYmlkZWEgMTQgLSAwMTAx MCBWaXRvcmlhLUdhc3RlaXowDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC AQYwHQYDVR0OBBYEFB0cZQ6o8iV7tJHP5LGx5r1VdGwFMA0GCSqGSIb3DQEBCwUA A4ICAQB4pgwWSp9MiDrAyw6lFn2fuUhfGI8NYjb2zRlrrKvV9pF9rnHzP7MOeIWb laQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56 awmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo JNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw LDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6kfLqCT VyvehQP5aTfLnnhqBbTFMXiJ7HqnheG5ezzevh55hM6fcA5ZwjUukCox2eRFekGk LhObNA5me0mrZJfQRsN5nXJQY6aYWwa9SG3YOYNw6DXwBdGqvOPbyALqfP2C2sJb UjWumDqtujWTI6cfSN01RpiyEGjkpTHCClguGYEQyVB1/OpaFs4R1+7vUIgtYf8/ QnMFlEPVjjxOAToZpR9GTnfQXeWBIiGH/pR9hNiTrdZoQ0iy2+tzJOeRf1SktoA+ naM8THLCV8Sg1Mw4J87VBp6iSNnpn86CcDaTmjvfliHjWbcM2pE38P1ZWrOZyGls QyYBNWNgVYkDOnXYukrZVP/u3oDYLdE41V4tC5h9Pmzb/CaIxw== -----END CERTIFICATE----- # Issuer: CN=Chambers of Commerce Root - 2008 O=AC Camerfirma S.A. # Subject: CN=Chambers of Commerce Root - 2008 O=AC Camerfirma S.A. # Label: "Chambers of Commerce Root - 2008" # Serial: 11806822484801597146 # MD5 Fingerprint: 5e:80:9e:84:5a:0e:65:0b:17:02:f3:55:18:2a:3e:d7 # SHA1 Fingerprint: 78:6a:74:ac:76:ab:14:7f:9c:6a:30:50:ba:9e:a8:7e:fe:9a:ce:3c # SHA256 Fingerprint: 06:3e:4a:fa:c4:91:df:d3:32:f3:08:9b:85:42:e9:46:17:d8:93:d7:fe:94:4e:10:a7:93:7e:e2:9d:96:93:c0 -----BEGIN CERTIFICATE----- MIIHTzCCBTegAwIBAgIJAKPaQn6ksa7aMA0GCSqGSIb3DQEBBQUAMIGuMQswCQYD VQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBhZGRyZXNzIGF0 IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJQTgyNzQzMjg3 MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMTIENoYW1iZXJz IG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4MB4XDTA4MDgwMTEyMjk1MFoXDTM4MDcz MTEyMjk1MFowga4xCzAJBgNVBAYTAkVVMUMwQQYDVQQHEzpNYWRyaWQgKHNlZSBj dXJyZW50IGFkZHJlc3MgYXQgd3d3LmNhbWVyZmlybWEuY29tL2FkZHJlc3MpMRIw EAYDVQQFEwlBODI3NDMyODcxGzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjEp MCcGA1UEAxMgQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdCAtIDIwMDgwggIiMA0G CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCvAMtwNyuAWko6bHiUfaN/Gh/2NdW9 28sNRHI+JrKQUrpjOyhYb6WzbZSm891kDFX29ufyIiKAXuFixrYp4YFs8r/lfTJq VKAyGVn+H4vXPWCGhSRv4xGzdz4gljUha7MI2XAuZPeEklPWDrCQiorjh40G072Q DuKZoRuGDtqaCrsLYVAGUvGef3bsyw/QHg3PmTA9HMRFEFis1tPo1+XqxQEHd9ZR 5gN/ikilTWh1uem8nk4ZcfUyS5xtYBkL+8ydddy/Js2Pk3g5eXNeJQ7KXOt3EgfL ZEFHcpOrUMPrCXZkNNI5t3YRCQ12RcSprj1qr7V9ZS+UWBDsXHyvfuK2GNnQm05a Sd+pZgvMPMZ4fKecHePOjlO+Bd5gD2vlGts/4+EhySnB8esHnFIbAURRPHsl18Tl UlRdJQfKFiC4reRB7noI/plvg6aRArBsNlVq5331lubKgdaX8ZSD6e2wsWsSaR6s +12pxZjptFtYer49okQ6Y1nUCyXeG0+95QGezdIp1Z8XGQpvvwyQ0wlf2eOKNcx5 Wk0ZN5K3xMGtr/R5JJqyAQuxr1yW84Ay+1w9mPGgP0revq+ULtlVmhduYJ1jbLhj ya6BXBg14JC7vjxPNyK5fuvPnnchpj04gftI2jE9K+OJ9dC1vX7gUMQSibMjmhAx hduub+84Mxh2EQIDAQABo4IBbDCCAWgwEgYDVR0TAQH/BAgwBgEB/wIBDDAdBgNV HQ4EFgQU+SSsD7K1+HnA+mCIG8TZTQKeFxkwgeMGA1UdIwSB2zCB2IAU+SSsD7K1 +HnA+mCIG8TZTQKeFxmhgbSkgbEwga4xCzAJBgNVBAYTAkVVMUMwQQYDVQQHEzpN YWRyaWQgKHNlZSBjdXJyZW50IGFkZHJlc3MgYXQgd3d3LmNhbWVyZmlybWEuY29t L2FkZHJlc3MpMRIwEAYDVQQFEwlBODI3NDMyODcxGzAZBgNVBAoTEkFDIENhbWVy ZmlybWEgUy5BLjEpMCcGA1UEAxMgQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdCAt IDIwMDiCCQCj2kJ+pLGu2jAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRV HSAAMCowKAYIKwYBBQUHAgEWHGh0dHA6Ly9wb2xpY3kuY2FtZXJmaXJtYS5jb20w DQYJKoZIhvcNAQEFBQADggIBAJASryI1wqM58C7e6bXpeHxIvj99RZJe6dqxGfwW PJ+0W2aeaufDuV2I6A+tzyMP3iU6XsxPpcG1Lawk0lgH3qLPaYRgM+gQDROpI9CF 5Y57pp49chNyM/WqfcZjHwj0/gF/JM8rLFQJ3uIrbZLGOU8W6jx+ekbURWpGqOt1 glanq6B8aBMz9p0w8G8nOSQjKpD9kCk18pPfNKXG9/jvjA9iSnyu0/VU+I22mlaH FoI6M6taIgj3grrqLuBHmrS1RaMFO9ncLkVAO+rcf+g769HsJtg1pDDFOqxXnrN2 pSB7+R5KBWIBpih1YJeSDW4+TTdDDZIVnBgizVGZoCkaPF+KMjNbMMeJL0eYD6MD xvbxrN8y8NmBGuScvfaAFPDRLLmF9dijscilIeUcE5fuDr3fKanvNFNb0+RqE4QG tjICxFKuItLcsiFCGtpA8CnJ7AoMXOLQusxI0zcKzBIKinmwPQN/aUv0NCB9szTq jktk9T79syNnFQ0EuPAtwQlRPLJsFfClI9eDdOTlLsn+mCdCxqvGnrDQWzilm1De fhiYtUU79nm06PcaewaD+9CL2rvHvRirCG88gGtAPxkZumWK5r7VXNM21+9AUiRg OGcEMeyP84LG3rlV8zsxkVrctQgVrXYlCg17LofiDKYGvCYQbTed7N14jHyAxfDZ d0jQ -----END CERTIFICATE----- # Issuer: CN=Global Chambersign Root - 2008 O=AC Camerfirma S.A. # Subject: CN=Global Chambersign Root - 2008 O=AC Camerfirma S.A. # Label: "Global Chambersign Root - 2008" # Serial: 14541511773111788494 # MD5 Fingerprint: 9e:80:ff:78:01:0c:2e:c1:36:bd:fe:96:90:6e:08:f3 # SHA1 Fingerprint: 4a:bd:ee:ec:95:0d:35:9c:89:ae:c7:52:a1:2c:5b:29:f6:d6:aa:0c # SHA256 Fingerprint: 13:63:35:43:93:34:a7:69:80:16:a0:d3:24:de:72:28:4e:07:9d:7b:52:20:bb:8f:bd:74:78:16:ee:be:ba:ca -----BEGIN CERTIFICATE----- MIIHSTCCBTGgAwIBAgIJAMnN0+nVfSPOMA0GCSqGSIb3DQEBBQUAMIGsMQswCQYD VQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBhZGRyZXNzIGF0 IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJQTgyNzQzMjg3 MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAlBgNVBAMTHkdsb2JhbCBD aGFtYmVyc2lnbiBSb290IC0gMjAwODAeFw0wODA4MDExMjMxNDBaFw0zODA3MzEx MjMxNDBaMIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3Vy cmVudCBhZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAG A1UEBRMJQTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAl BgNVBAMTHkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwODCCAiIwDQYJKoZI hvcNAQEBBQADggIPADCCAgoCggIBAMDfVtPkOpt2RbQT2//BthmLN0EYlVJH6xed KYiONWwGMi5HYvNJBL99RDaxccy9Wglz1dmFRP+RVyXfXjaOcNFccUMd2drvXNL7 G706tcuto8xEpw2uIRU/uXpbknXYpBI4iRmKt4DS4jJvVpyR1ogQC7N0ZJJ0YPP2 zxhPYLIj0Mc7zmFLmY/CDNBAspjcDahOo7kKrmCgrUVSY7pmvWjg+b4aqIG7HkF4 ddPB/gBVsIdU6CeQNR1MM62X/JcumIS/LMmjv9GYERTtY/jKmIhYF5ntRQOXfjyG HoiMvvKRhI9lNNgATH23MRdaKXoKGCQwoze1eqkBfSbW+Q6OWfH9GzO1KTsXO0G2 Id3UwD2ln58fQ1DJu7xsepeY7s2MH/ucUa6LcL0nn3HAa6x9kGbo1106DbDVwo3V yJ2dwW3Q0L9R5OP4wzg2rtandeavhENdk5IMagfeOx2YItaswTXbo6Al/3K1dh3e beksZixShNBFks4c5eUzHdwHU1SjqoI7mjcv3N2gZOnm3b2u/GSFHTynyQbehP9r 6GsaPMWis0L7iwk+XwhSx2LE1AVxv8Rk5Pihg+g+EpuoHtQ2TS9x9o0o9oOpE9Jh wZG7SMA0j0GMS0zbaRL/UJScIINZc+18ofLx/d33SdNDWKBWY8o9PeU1VlnpDsog zCtLkykPAgMBAAGjggFqMIIBZjASBgNVHRMBAf8ECDAGAQH/AgEMMB0GA1UdDgQW BBS5CcqcHtvTbDprru1U8VuTBjUuXjCB4QYDVR0jBIHZMIHWgBS5CcqcHtvTbDpr ru1U8VuTBjUuXqGBsqSBrzCBrDELMAkGA1UEBhMCRVUxQzBBBgNVBAcTOk1hZHJp ZCAoc2VlIGN1cnJlbnQgYWRkcmVzcyBhdCB3d3cuY2FtZXJmaXJtYS5jb20vYWRk cmVzcykxEjAQBgNVBAUTCUE4Mjc0MzI4NzEbMBkGA1UEChMSQUMgQ2FtZXJmaXJt YSBTLkEuMScwJQYDVQQDEx5HbG9iYWwgQ2hhbWJlcnNpZ24gUm9vdCAtIDIwMDiC CQDJzdPp1X0jzjAOBgNVHQ8BAf8EBAMCAQYwPQYDVR0gBDYwNDAyBgRVHSAAMCow KAYIKwYBBQUHAgEWHGh0dHA6Ly9wb2xpY3kuY2FtZXJmaXJtYS5jb20wDQYJKoZI hvcNAQEFBQADggIBAICIf3DekijZBZRG/5BXqfEv3xoNa/p8DhxJJHkn2EaqbylZ UohwEurdPfWbU1Rv4WCiqAm57OtZfMY18dwY6fFn5a+6ReAJ3spED8IXDneRRXoz X1+WLGiLwUePmJs9wOzL9dWCkoQ10b42OFZyMVtHLaoXpGNR6woBrX/sdZ7LoR/x fxKxueRkf2fWIyr0uDldmOghp+G9PUIadJpwr2hsUF1Jz//7Dl3mLEfXgTpZALVz a2Mg9jFFCDkO9HB+QHBaP9BrQql0PSgvAm11cpUJjUhjxsYjV5KTXjXBjfkK9yyd Yhz2rXzdpjEetrHHfoUm+qRqtdpjMNHvkzeyZi99Bffnt0uYlDXA2TopwZ2yUDMd SqlapskD7+3056huirRXhOukP9DuqqqHW2Pok+JrqNS4cnhrG+055F3Lm6qH1U9O AP7Zap88MQ8oAgF9mOinsKJknnn4SPIVqczmyETrP3iZ8ntxPjzxmKfFGBI/5rso M0LpRQp8bfKGeS/Fghl9CYl8slR2iK7ewfPM4W7bMdaTrpmg7yVqc5iJWzouE4ge v8CSlDQb4ye3ix5vQv/n6TebUB0tovkC7stYWDpxvGjjqsGvHCgfotwjZT+B6q6Z 09gwzxMNTxXJhLynSC34MCN32EZLeW32jO06f2ARePTpm67VVMB0gNELQp/B -----END CERTIFICATE----- # Issuer: CN=Go Daddy Root Certificate Authority - G2 O=GoDaddy.com, Inc. # Subject: CN=Go Daddy Root Certificate Authority - G2 O=GoDaddy.com, Inc. # Label: "Go Daddy Root Certificate Authority - G2" # Serial: 0 # MD5 Fingerprint: 80:3a:bc:22:c1:e6:fb:8d:9b:3b:27:4a:32:1b:9a:01 # SHA1 Fingerprint: 47:be:ab:c9:22:ea:e8:0e:78:78:34:62:a7:9f:45:c2:54:fd:e6:8b # SHA256 Fingerprint: 45:14:0b:32:47:eb:9c:c8:c5:b4:f0:d7:b5:30:91:f7:32:92:08:9e:6e:5a:63:e2:74:9d:d3:ac:a9:19:8e:da -----BEGIN CERTIFICATE----- MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAwMFoXDTM3MTIzMTIz NTk1OVowgYMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjExMC8GA1UE AxMoR28gRGFkZHkgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIw DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9xYgjx+lk09xvJGKP3gElY6SKD E6bFIEMBO4Tx5oVJnyfq9oQbTqC023CYxzIBsQU+B07u9PpPL1kwIuerGVZr4oAH /PMWdYA5UXvl+TW2dE6pjYIT5LY/qQOD+qK+ihVqf94Lw7YZFAXK6sOoBJQ7Rnwy DfMAZiLIjWltNowRGLfTshxgtDj6AozO091GB94KPutdfMh8+7ArU6SSYmlRJQVh GkSBjCypQ5Yj36w6gZoOKcUcqeldHraenjAKOc7xiID7S13MMuyFYkMlNAJWJwGR tDtwKj9useiciAF9n9T521NtYJ2/LOdYq7hfRvzOxBsDPAnrSTFcaUaz4EcCAwEA AaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE FDqahQcQZyi27/a9BUFuIMGU2g/eMA0GCSqGSIb3DQEBCwUAA4IBAQCZ21151fmX WWcDYfF+OwYxdS2hII5PZYe096acvNjpL9DbWu7PdIxztDhC2gV7+AJ1uP2lsdeu 9tfeE8tTEH6KRtGX+rcuKxGrkLAngPnon1rpN5+r5N9ss4UXnT3ZJE95kTXWXwTr gIOrmgIttRD02JDHBHNA7XIloKmf7J6raBKZV8aPEjoJpL1E/QYVN8Gb5DKj7Tjo 2GTzLH4U/ALqn83/B2gX2yKQOC16jdFU8WnjXzPKej17CuPKf1855eJ1usV2GDPO LPAvTK33sefOT6jEm0pUBsV/fdUID+Ic/n4XuKxe9tQWskMJDE32p2u0mYRlynqI 4uJEvlz36hz1 -----END CERTIFICATE----- # Issuer: CN=Starfield Root Certificate Authority - G2 O=Starfield Technologies, Inc. # Subject: CN=Starfield Root Certificate Authority - G2 O=Starfield Technologies, Inc. # Label: "Starfield Root Certificate Authority - G2" # Serial: 0 # MD5 Fingerprint: d6:39:81:c6:52:7e:96:69:fc:fc:ca:66:ed:05:f2:96 # SHA1 Fingerprint: b5:1c:06:7c:ee:2b:0c:3d:f8:55:ab:2d:92:f4:fe:39:d4:e7:0f:0e # SHA256 Fingerprint: 2c:e1:cb:0b:f9:d2:f9:e1:02:99:3f:be:21:51:52:c3:b2:dd:0c:ab:de:1c:68:e5:31:9b:83:91:54:db:b7:f5 -----BEGIN CERTIFICATE----- MIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAMTKVN0YXJmaWVs ZCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAw MFoXDTM3MTIzMTIzNTk1OVowgY8xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6 b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFyZmllbGQgVGVj aG5vbG9naWVzLCBJbmMuMTIwMAYDVQQDEylTdGFyZmllbGQgUm9vdCBDZXJ0aWZp Y2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAL3twQP89o/8ArFvW59I2Z154qK3A2FWGMNHttfKPTUuiUP3oWmb3ooa/RMg nLRJdzIpVv257IzdIvpy3Cdhl+72WoTsbhm5iSzchFvVdPtrX8WJpRBSiUZV9Lh1 HOZ/5FSuS/hVclcCGfgXcVnrHigHdMWdSL5stPSksPNkN3mSwOxGXn/hbVNMYq/N Hwtjuzqd+/x5AJhhdM8mgkBj87JyahkNmcrUDnXMN/uLicFZ8WJ/X7NfZTD4p7dN dloedl40wOiWVpmKs/B/pM293DIxfJHP4F8R+GuqSVzRmZTRouNjWwl2tVZi4Ut0 HZbUJtQIBFnQmA4O5t78w+wfkPECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFHwMMh+n2TB/xH1oo2Kooc6rB1snMA0G CSqGSIb3DQEBCwUAA4IBAQARWfolTwNvlJk7mh+ChTnUdgWUXuEok21iXQnCoKjU sHU48TRqneSfioYmUeYs0cYtbpUgSpIB7LiKZ3sx4mcujJUDJi5DnUox9g61DLu3 4jd/IroAow57UvtruzvE03lRTs2Q9GcHGcg8RnoNAX3FWOdt5oUwF5okxBDgBPfg 8n/Uqgr/Qh037ZTlZFkSIHc40zI+OIF1lnP6aI+xy84fxez6nH7PfrHxBy22/L/K pL/QlwVKvOoYKAKQvVR4CSFx09F9HdkWsKlhPdAKACL8x3vLCWRFCztAgfd9fDL1 mMpYjn0q7pBZc2T5NnReJaH1ZgUufzkVqSr7UIuOhWn0 -----END CERTIFICATE----- # Issuer: CN=Starfield Services Root Certificate Authority - G2 O=Starfield Technologies, Inc. # Subject: CN=Starfield Services Root Certificate Authority - G2 O=Starfield Technologies, Inc. # Label: "Starfield Services Root Certificate Authority - G2" # Serial: 0 # MD5 Fingerprint: 17:35:74:af:7b:61:1c:eb:f4:f9:3c:e2:ee:40:f9:a2 # SHA1 Fingerprint: 92:5a:8f:8d:2c:6d:04:e0:66:5f:59:6a:ff:22:d8:63:e8:25:6f:3f # SHA256 Fingerprint: 56:8d:69:05:a2:c8:87:08:a4:b3:02:51:90:ed:cf:ed:b1:97:4a:60:6a:13:c6:e5:29:0f:cb:2a:e6:3e:da:b5 -----BEGIN CERTIFICATE----- MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVs ZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5 MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgZgxCzAJBgNVBAYTAlVTMRAwDgYD VQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFy ZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTswOQYDVQQDEzJTdGFyZmllbGQgU2Vy dmljZXMgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBANUMOsQq+U7i9b4Zl1+OiFOxHz/Lz58gE20p OsgPfTz3a3Y4Y9k2YKibXlwAgLIvWX/2h/klQ4bnaRtSmpDhcePYLQ1Ob/bISdm2 8xpWriu2dBTrz/sm4xq6HZYuajtYlIlHVv8loJNwU4PahHQUw2eeBGg6345AWh1K Ts9DkTvnVtYAcMtS7nt9rjrnvDH5RfbCYM8TWQIrgMw0R9+53pBlbQLPLJGmpufe hRhJfGZOozptqbXuNC66DQO4M99H67FrjSXZm86B0UVGMpZwh94CDklDhbZsc7tk 6mFBrMnUVN+HL8cisibMn1lUaJ/8viovxFUcdUBgF4UCVTmLfwUCAwEAAaNCMEAw DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJxfAN+q AdcwKziIorhtSpzyEZGDMA0GCSqGSIb3DQEBCwUAA4IBAQBLNqaEd2ndOxmfZyMI bw5hyf2E3F/YNoHN2BtBLZ9g3ccaaNnRbobhiCPPE95Dz+I0swSdHynVv/heyNXB ve6SbzJ08pGCL72CQnqtKrcgfU28elUSwhXqvfdqlS5sdJ/PHLTyxQGjhdByPq1z qwubdQxtRbeOlKyWN7Wg0I8VRw7j6IPdj/3vQQF3zCepYoUz8jcI73HPdwbeyBkd iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn 0q23KXB56jzaYyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCN sSi6 -----END CERTIFICATE----- # Issuer: CN=AffirmTrust Commercial O=AffirmTrust # Subject: CN=AffirmTrust Commercial O=AffirmTrust # Label: "AffirmTrust Commercial" # Serial: 8608355977964138876 # MD5 Fingerprint: 82:92:ba:5b:ef:cd:8a:6f:a6:3d:55:f9:84:f6:d6:b7 # SHA1 Fingerprint: f9:b5:b6:32:45:5f:9c:be:ec:57:5f:80:dc:e9:6e:2c:c7:b2:78:b7 # SHA256 Fingerprint: 03:76:ab:1d:54:c5:f9:80:3c:e4:b2:e2:01:a0:ee:7e:ef:7b:57:b6:36:e8:a9:3c:9b:8d:48:60:c9:6f:5f:a7 -----BEGIN CERTIFICATE----- MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UE BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz dCBDb21tZXJjaWFsMB4XDTEwMDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDEL MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp cm1UcnVzdCBDb21tZXJjaWFsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEA9htPZwcroRX1BiLLHwGy43NFBkRJLLtJJRTWzsO3qyxPxkEylFf6EqdbDuKP Hx6GGaeqtS25Xw2Kwq+FNXkyLbscYjfysVtKPcrNcV/pQr6U6Mje+SJIZMblq8Yr ba0F8PrVC8+a5fBQpIs7R6UjW3p6+DM/uO+Zl+MgwdYoic+U+7lF7eNAFxHUdPAL MeIrJmqbTFeurCA+ukV6BfO9m2kVrn1OIGPENXY6BwLJN/3HR+7o8XYdcxXyl6S1 yHp52UKqK39c/s4mT6NmgTWvRLpUHhwwMmWd5jyTXlBOeuM61G7MGvv50jeuJCqr VwMiKA1JdX+3KNp1v47j3A55MQIDAQABo0IwQDAdBgNVHQ4EFgQUnZPGU4teyq8/ nx4P5ZmVvCT2lI8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ KoZIhvcNAQELBQADggEBAFis9AQOzcAN/wr91LoWXym9e2iZWEnStB03TX8nfUYG XUPGhi4+c7ImfU+TqbbEKpqrIZcUsd6M06uJFdhrJNTxFq7YpFzUf1GO7RgBsZNj vbz4YYCanrHOQnDiqX0GJX0nof5v7LMeJNrjS1UaADs1tDvZ110w/YETifLCBivt Z8SOyUOyXGsViQK8YvxO8rUzqrJv0wqiUOP2O+guRMLbZjipM1ZI8W0bM40NjD9g N53Tym1+NH4Nn3J2ixufcv1SNUFFApYvHLKac0khsUlHRUe072o0EclNmsxZt9YC nlpOZbWUrhvfKbAW8b8Angc6F2S1BLUjIZkKlTuXfO8= -----END CERTIFICATE----- # Issuer: CN=AffirmTrust Networking O=AffirmTrust # Subject: CN=AffirmTrust Networking O=AffirmTrust # Label: "AffirmTrust Networking" # Serial: 8957382827206547757 # MD5 Fingerprint: 42:65:ca:be:01:9a:9a:4c:a9:8c:41:49:cd:c0:d5:7f # SHA1 Fingerprint: 29:36:21:02:8b:20:ed:02:f5:66:c5:32:d1:d6:ed:90:9f:45:00:2f # SHA256 Fingerprint: 0a:81:ec:5a:92:97:77:f1:45:90:4a:f3:8d:5d:50:9f:66:b5:e2:c5:8f:cd:b5:31:05:8b:0e:17:f3:f0:b4:1b -----BEGIN CERTIFICATE----- MIIDTDCCAjSgAwIBAgIIfE8EORzUmS0wDQYJKoZIhvcNAQEFBQAwRDELMAkGA1UE BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz dCBOZXR3b3JraW5nMB4XDTEwMDEyOTE0MDgyNFoXDTMwMTIzMTE0MDgyNFowRDEL MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp cm1UcnVzdCBOZXR3b3JraW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEAtITMMxcua5Rsa2FSoOujz3mUTOWUgJnLVWREZY9nZOIG41w3SfYvm4SEHi3y YJ0wTsyEheIszx6e/jarM3c1RNg1lho9Nuh6DtjVR6FqaYvZ/Ls6rnla1fTWcbua kCNrmreIdIcMHl+5ni36q1Mr3Lt2PpNMCAiMHqIjHNRqrSK6mQEubWXLviRmVSRL QESxG9fhwoXA3hA/Pe24/PHxI1Pcv2WXb9n5QHGNfb2V1M6+oF4nI979ptAmDgAp 6zxG8D1gvz9Q0twmQVGeFDdCBKNwV6gbh+0t+nvujArjqWaJGctB+d1ENmHP4ndG yH329JKBNv3bNPFyfvMMFr20FQIDAQABo0IwQDAdBgNVHQ4EFgQUBx/S55zawm6i QLSwelAQUHTEyL0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ KoZIhvcNAQEFBQADggEBAIlXshZ6qML91tmbmzTCnLQyFE2npN/svqe++EPbkTfO tDIuUFUaNU52Q3Eg75N3ThVwLofDwR1t3Mu1J9QsVtFSUzpE0nPIxBsFZVpikpzu QY0x2+c06lkh1QF612S4ZDnNye2v7UsDSKegmQGA3GWjNq5lWUhPgkvIZfFXHeVZ Lgo/bNjR9eUJtGxUAArgFU2HdW23WJZa3W3SAKD0m0i+wzekujbgfIeFlxoVot4u olu9rxj5kFDNcFn4J2dHy8egBzp90SxdbBk6ZrV9/ZFvgrG+CJPbFEfxojfHRZ48 x3evZKiT3/Zpg4Jg8klCNO1aAFSFHBY2kgxc+qatv9s= -----END CERTIFICATE----- # Issuer: CN=AffirmTrust Premium O=AffirmTrust # Subject: CN=AffirmTrust Premium O=AffirmTrust # Label: "AffirmTrust Premium" # Serial: 7893706540734352110 # MD5 Fingerprint: c4:5d:0e:48:b6:ac:28:30:4e:0a:bc:f9:38:16:87:57 # SHA1 Fingerprint: d8:a6:33:2c:e0:03:6f:b1:85:f6:63:4f:7d:6a:06:65:26:32:28:27 # SHA256 Fingerprint: 70:a7:3f:7f:37:6b:60:07:42:48:90:45:34:b1:14:82:d5:bf:0e:69:8e:cc:49:8d:f5:25:77:eb:f2:e9:3b:9a -----BEGIN CERTIFICATE----- MIIFRjCCAy6gAwIBAgIIbYwURrGmCu4wDQYJKoZIhvcNAQEMBQAwQTELMAkGA1UE BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVz dCBQcmVtaXVtMB4XDTEwMDEyOTE0MTAzNloXDTQwMTIzMTE0MTAzNlowQTELMAkG A1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1U cnVzdCBQcmVtaXVtMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxBLf qV/+Qd3d9Z+K4/as4Tx4mrzY8H96oDMq3I0gW64tb+eT2TZwamjPjlGjhVtnBKAQ JG9dKILBl1fYSCkTtuG+kU3fhQxTGJoeJKJPj/CihQvL9Cl/0qRY7iZNyaqoe5rZ +jjeRFcV5fiMyNlI4g0WJx0eyIOFJbe6qlVBzAMiSy2RjYvmia9mx+n/K+k8rNrS s8PhaJyJ+HoAVt70VZVs+7pk3WKL3wt3MutizCaam7uqYoNMtAZ6MMgpv+0GTZe5 HMQxK9VfvFMSF5yZVylmd2EhMQcuJUmdGPLu8ytxjLW6OQdJd/zvLpKQBY0tL3d7 70O/Nbua2Plzpyzy0FfuKE4mX4+QaAkvuPjcBukumj5Rp9EixAqnOEhss/n/fauG V+O61oV4d7pD6kh/9ti+I20ev9E2bFhc8e6kGVQa9QPSdubhjL08s9NIS+LI+H+S qHZGnEJlPqQewQcDWkYtuJfzt9WyVSHvutxMAJf7FJUnM7/oQ0dG0giZFmA7mn7S 5u046uwBHjxIVkkJx0w3AJ6IDsBz4W9m6XJHMD4Q5QsDyZpCAGzFlH5hxIrff4Ia C1nEWTJ3s7xgaVY5/bQGeyzWZDbZvUjthB9+pSKPKrhC9IK31FOQeE4tGv2Bb0TX OwF0lkLgAOIua+rF7nKsu7/+6qqo+Nz2snmKtmcCAwEAAaNCMEAwHQYDVR0OBBYE FJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/ BAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2 KI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg Nt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0QNiigfV4Py/VpfzZotReBA4Xrf5B 8OWycvpEgjNC6C1Y91aMYj+6QrCcDFx+LmUmXFNPALJ4fqENmS2NuB2OosSw/WDQ MKSOyARiqcTtNd56l+0OOF6SL5Nwpamcb6d9Ex1+xghIsV5n61EIJenmJWtSKZGc 0jlzCFfemQa0W50QBuHCAKi4HEoCChTQwUHK+4w1IX2COPKpVJEZNZOUbWo6xbLQ u4mGk+ibyQ86p3q4ofB4Rvr8Ny/lioTz3/4E2aFooC8k4gmVBtWVyuEklut89pMF u+1z6S3RdTnX5yTb2E5fQ4+e0BQ5v1VwSJlXMbSc7kqYA5YwH2AG7hsj/oFgIxpH YoWlzBk0gG+zrBrjn/B7SK3VAdlntqlyk+otZrWyuOQ9PLLvTIzq6we/qzWaVYa8 GKa1qF60g2xraUDTn9zxw2lrueFtCfTxqlB2Cnp9ehehVZZCmTEJ3WARjQUwfuaO RtGdFNrHF+QFlozEJLUbzxQHskD4o55BhrwE0GuWyCqANP2/7waj3VjFhT0+j/6e KeC2uAloGRwYQw== -----END CERTIFICATE----- # Issuer: CN=AffirmTrust Premium ECC O=AffirmTrust # Subject: CN=AffirmTrust Premium ECC O=AffirmTrust # Label: "AffirmTrust Premium ECC" # Serial: 8401224907861490260 # MD5 Fingerprint: 64:b0:09:55:cf:b1:d5:99:e2:be:13:ab:a6:5d:ea:4d # SHA1 Fingerprint: b8:23:6b:00:2f:1d:16:86:53:01:55:6c:11:a4:37:ca:eb:ff:c3:bb # SHA256 Fingerprint: bd:71:fd:f6:da:97:e4:cf:62:d1:64:7a:dd:25:81:b0:7d:79:ad:f8:39:7e:b4:ec:ba:9c:5e:84:88:82:14:23 -----BEGIN CERTIFICATE----- MIIB/jCCAYWgAwIBAgIIdJclisc/elQwCgYIKoZIzj0EAwMwRTELMAkGA1UEBhMC VVMxFDASBgNVBAoMC0FmZmlybVRydXN0MSAwHgYDVQQDDBdBZmZpcm1UcnVzdCBQ cmVtaXVtIEVDQzAeFw0xMDAxMjkxNDIwMjRaFw00MDEyMzExNDIwMjRaMEUxCzAJ BgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwXQWZmaXJt VHJ1c3QgUHJlbWl1bSBFQ0MwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNMF4bFZ0D 0KF5Nbc6PJJ6yhUczWLznCZcBz3lVPqj1swS6vQUX+iOGasvLkjmrBhDeKzQN8O9 ss0s5kfiGuZjuD0uL3jET9v0D6RoTFVya5UdThhClXjMNzyR4ptlKymjQjBAMB0G A1UdDgQWBBSaryl6wBE1NSZRMADDav5A1a7WPDAPBgNVHRMBAf8EBTADAQH/MA4G A1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNnADBkAjAXCfOHiFBar8jAQr9HX/Vs aobgxCd05DhT1wV/GzTjxi+zygk8N53X57hG8f2h4nECMEJZh0PUUd+60wkyWs6I flc9nF9Ca/UHLbXwgpP5WW+uZPpY5Yse42O+tYHNbwKMeQ== -----END CERTIFICATE----- # Issuer: CN=Certum Trusted Network CA O=Unizeto Technologies S.A. OU=Certum Certification Authority # Subject: CN=Certum Trusted Network CA O=Unizeto Technologies S.A. OU=Certum Certification Authority # Label: "Certum Trusted Network CA" # Serial: 279744 # MD5 Fingerprint: d5:e9:81:40:c5:18:69:fc:46:2c:89:75:62:0f:aa:78 # SHA1 Fingerprint: 07:e0:32:e0:20:b7:2c:3f:19:2f:06:28:a2:59:3a:19:a7:0f:06:9e # SHA256 Fingerprint: 5c:58:46:8d:55:f5:8e:49:7e:74:39:82:d2:b5:00:10:b6:d1:65:37:4a:cf:83:a7:d4:a3:2d:b7:68:c4:40:8e -----BEGIN CERTIFICATE----- MIIDuzCCAqOgAwIBAgIDBETAMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAlBM MSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5D ZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBU cnVzdGVkIE5ldHdvcmsgQ0EwHhcNMDgxMDIyMTIwNzM3WhcNMjkxMjMxMTIwNzM3 WjB+MQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIw IAYDVQQDExlDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEA4/t9o3K6wvDJFIf1awFO4W5AB7ptJ11/91sts1rH UV+rpDKmYYe2bg+G0jACl/jXaVehGDldamR5xgFZrDwxSjh80gTSSyjoIF87B6LM TXPb865Px1bVWqeWifrzq2jUI4ZZJ88JJ7ysbnKDHDBy3+Ci6dLhdHUZvSqeexVU BBvXQzmtVSjF4hq79MDkrjhJM8x2hZ85RdKknvISjFH4fOQtf/WsX+sWn7Et0brM kUJ3TCXJkDhv2/DM+44el1k+1WBO5gUo7Ul5E0u6SNsv+XLTOcr+H9g0cvW0QM8x AcPs3hEtF10fuFDRXhmnad4HMyjKUJX5p1TLVIZQRan5SQIDAQABo0IwQDAPBgNV HRMBAf8EBTADAQH/MB0GA1UdDgQWBBQIds3LB/8k9sXN7buQvOKEN0Z19zAOBgNV HQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEFBQADggEBAKaorSLOAT2mo/9i0Eidi15y sHhE49wcrwn9I0j6vSrEuVUEtRCjjSfeC4Jj0O7eDDd5QVsisrCaQVymcODU0HfL I9MA4GxWL+FpDQ3Zqr8hgVDZBqWo/5U30Kr+4rP1mS1FhIrlQgnXdAIv94nYmem8 J9RHjboNRhx3zxSkHLmkMcScKHQDNP8zGSal6Q10tz6XxnboJ5ajZt3hrvJBW8qY VoNzcOSGGtIxQbovvi0TWnZvTuhOgQ4/WwMioBK+ZlgRSssDxLQqKi2WF+A5VLxI 03YnnZotBqbJ7DnSq9ufmgsnAjUpsUCV5/nonFWIGUbWtzT1fs45mtk48VH3Tyw= -----END CERTIFICATE----- # Issuer: CN=TWCA Root Certification Authority O=TAIWAN-CA OU=Root CA # Subject: CN=TWCA Root Certification Authority O=TAIWAN-CA OU=Root CA # Label: "TWCA Root Certification Authority" # Serial: 1 # MD5 Fingerprint: aa:08:8f:f6:f9:7b:b7:f2:b1:a7:1e:9b:ea:ea:bd:79 # SHA1 Fingerprint: cf:9e:87:6d:d3:eb:fc:42:26:97:a3:b5:a3:7a:a0:76:a9:06:23:48 # SHA256 Fingerprint: bf:d8:8f:e1:10:1c:41:ae:3e:80:1b:f8:be:56:35:0e:e9:ba:d1:a6:b9:bd:51:5e:dc:5c:6d:5b:87:11:ac:44 -----BEGIN CERTIFICATE----- MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJUVzES MBAGA1UECgwJVEFJV0FOLUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFU V0NBIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwODI4MDcyNDMz WhcNMzAxMjMxMTU1OTU5WjBfMQswCQYDVQQGEwJUVzESMBAGA1UECgwJVEFJV0FO LUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE AcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH K3XLfJ+utdGdIzdjp9xCoi2SBBtQwXu4PhvJVgSLL1KbralW6cH/ralYhzC2gfeX RfwZVzsrb+RH9JlF/h3x+JejiB03HFyP4HYlmlD4oFT/RJB2I9IyxsOrBr/8+7/z rX2SYgJbKdM1o5OaQ2RgXbL6Mv87BK9NQGr5x+PvI/1ry+UPizgN7gr8/g+YnzAx 3WxSZfmLgb4i4RxYA7qRG4kHAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV HRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqOFsmjd6LWvJPelSDGRjjCDWmujANBgkq hkiG9w0BAQUFAAOCAQEAPNV3PdrfibqHDAhUaiBQkr6wQT25JmSDCi/oQMCXKCeC MErJk/9q56YAf4lCmtYR5VPOL8zy2gXE/uJQxDqGfczafhAJO5I1KlOy/usrBdls XebQ79NqZp4VKIV66IIArB6nCWlWQtNoURi+VJq/REG6Sb4gumlc7rh3zc5sH62D lhh9DrUUOYTxKOkto557HnpyWoOzeW/vtPzQCqVYT0bf+215WfKEIlKuD8z7fDvn aspHYcN6+NOSBB+4IIThNlQWx0DeO4pz3N/GCUzf7Nr/1FNCocnyYh0igzyXxfkZ YiesZSLX0zzG5Y6yU8xJzrww/nsOM5D77dIUkR8Hrw== -----END CERTIFICATE----- # Issuer: O=SECOM Trust Systems CO.,LTD. OU=Security Communication RootCA2 # Subject: O=SECOM Trust Systems CO.,LTD. OU=Security Communication RootCA2 # Label: "Security Communication RootCA2" # Serial: 0 # MD5 Fingerprint: 6c:39:7d:a4:0e:55:59:b2:3f:d6:41:b1:12:50:de:43 # SHA1 Fingerprint: 5f:3b:8c:f2:f8:10:b3:7d:78:b4:ce:ec:19:19:c3:73:34:b9:c7:74 # SHA256 Fingerprint: 51:3b:2c:ec:b8:10:d4:cd:e5:dd:85:39:1a:df:c6:c2:dd:60:d8:7b:b7:36:d2:b5:21:48:4a:a4:7a:0e:be:f6 -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIBADANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJKUDEl MCMGA1UEChMcU0VDT00gVHJ1c3QgU3lzdGVtcyBDTy4sTFRELjEnMCUGA1UECxMe U2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBSb290Q0EyMB4XDTA5MDUyOTA1MDAzOVoX DTI5MDUyOTA1MDAzOVowXTELMAkGA1UEBhMCSlAxJTAjBgNVBAoTHFNFQ09NIFRy dXN0IFN5c3RlbXMgQ08uLExURC4xJzAlBgNVBAsTHlNlY3VyaXR5IENvbW11bmlj YXRpb24gUm9vdENBMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANAV OVKxUrO6xVmCxF1SrjpDZYBLx/KWvNs2l9amZIyoXvDjChz335c9S672XewhtUGr zbl+dp+++T42NKA7wfYxEUV0kz1XgMX5iZnK5atq1LXaQZAQwdbWQonCv/Q4EpVM VAX3NuRFg3sUZdbcDE3R3n4MqzvEFb46VqZab3ZpUql6ucjrappdUtAtCms1FgkQ hNBqyjoGADdH5H5XTz+L62e4iKrFvlNVspHEfbmwhRkGeC7bYRr6hfVKkaHnFtWO ojnflLhwHyg/i/xAXmODPIMqGplrz95Zajv8bxbXH/1KEOtOghY6rCcMU/Gt1SSw awNQwS08Ft1ENCcadfsCAwEAAaNCMEAwHQYDVR0OBBYEFAqFqXdlBZh8QIH4D5cs OPEK7DzPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 DQEBCwUAA4IBAQBMOqNErLlFsceTfsgLCkLfZOoc7llsCLqJX2rKSpWeeo8HxdpF coJxDjrSzG+ntKEju/Ykn8sX/oymzsLS28yN/HH8AynBbF0zX2S2ZTuJbxh2ePXc okgfGT+Ok+vx+hfuzU7jBBJV1uXk3fs+BXziHV7Gp7yXT2g69ekuCkO2r1dcYmh8 t/2jioSgrGK+KwmHNPBqAbubKVY8/gA3zyNs8U6qtnRGEmyR7jTV7JqR50S+kDFy 1UkC9gLl9B/rfNmWVan/7Ir5mUf/NVoCqgTLiluHcSmRvaS0eg29mvVXIwAHIRc/ SjnRBUkLp7Y3gaVdjKozXoEofKd9J+sAro03 -----END CERTIFICATE----- # Issuer: CN=Hellenic Academic and Research Institutions RootCA 2011 O=Hellenic Academic and Research Institutions Cert. Authority # Subject: CN=Hellenic Academic and Research Institutions RootCA 2011 O=Hellenic Academic and Research Institutions Cert. Authority # Label: "Hellenic Academic and Research Institutions RootCA 2011" # Serial: 0 # MD5 Fingerprint: 73:9f:4c:4b:73:5b:79:e9:fa:ba:1c:ef:6e:cb:d5:c9 # SHA1 Fingerprint: fe:45:65:9b:79:03:5b:98:a1:61:b5:51:2e:ac:da:58:09:48:22:4d # SHA256 Fingerprint: bc:10:4f:15:a4:8b:e7:09:dc:a5:42:a7:e1:d4:b9:df:6f:05:45:27:e8:02:ea:a9:2d:59:54:44:25:8a:fe:71 -----BEGIN CERTIFICATE----- MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1 dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD 75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp 5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p 6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8 TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7 dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI l7WdmplNsDz4SgCbZN2fOUvRJ9e4 -----END CERTIFICATE----- # Issuer: CN=Actalis Authentication Root CA O=Actalis S.p.A./03358520967 # Subject: CN=Actalis Authentication Root CA O=Actalis S.p.A./03358520967 # Label: "Actalis Authentication Root CA" # Serial: 6271844772424770508 # MD5 Fingerprint: 69:c1:0d:4f:07:a3:1b:c3:fe:56:3d:04:bc:11:f6:a6 # SHA1 Fingerprint: f3:73:b3:87:06:5a:28:84:8a:f2:f3:4a:ce:19:2b:dd:c7:8e:9c:ac # SHA256 Fingerprint: 55:92:60:84:ec:96:3a:64:b9:6e:2a:be:01:ce:0b:a8:6a:64:fb:fe:bc:c7:aa:b5:af:c1:55:b3:7f:d7:60:66 -----BEGIN CERTIFICATE----- MIIFuzCCA6OgAwIBAgIIVwoRl0LE48wwDQYJKoZIhvcNAQELBQAwazELMAkGA1UE BhMCSVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8w MzM1ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290 IENBMB4XDTExMDkyMjExMjIwMloXDTMwMDkyMjExMjIwMlowazELMAkGA1UEBhMC SVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8wMzM1 ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290IENB MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAp8bEpSmkLO/lGMWwUKNv UTufClrJwkg4CsIcoBh/kbWHuUA/3R1oHwiD1S0eiKD4j1aPbZkCkpAW1V8IbInX 4ay8IMKx4INRimlNAJZaby/ARH6jDuSRzVju3PvHHkVH3Se5CAGfpiEd9UEtL0z9 KK3giq0itFZljoZUj5NDKd45RnijMCO6zfB9E1fAXdKDa0hMxKufgFpbOr3JpyI/ gCczWw63igxdBzcIy2zSekciRDXFzMwujt0q7bd9Zg1fYVEiVRvjRuPjPdA1Yprb rxTIW6HMiRvhMCb8oJsfgadHHwTrozmSBp+Z07/T6k9QnBn+locePGX2oxgkg4YQ 51Q+qDp2JE+BIcXjDwL4k5RHILv+1A7TaLndxHqEguNTVHnd25zS8gebLra8Pu2F be8lEfKXGkJh90qX6IuxEAf6ZYGyojnP9zz/GPvG8VqLWeICrHuS0E4UT1lF9gxe KF+w6D9Fz8+vm2/7hNN3WpVvrJSEnu68wEqPSpP4RCHiMUVhUE4Q2OM1fEwZtN4F v6MGn8i1zeQf1xcGDXqVdFUNaBr8EBtiZJ1t4JWgw5QHVw0U5r0F+7if5t+L4sbn fpb2U8WANFAoWPASUHEXMLrmeGO89LKtmyuy/uE5jF66CyCU3nuDuP/jVo23Eek7 jPKxwV2dpAtMK9myGPW1n0sCAwEAAaNjMGEwHQYDVR0OBBYEFFLYiDrIn3hm7Ynz ezhwlMkCAjbQMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUUtiIOsifeGbt ifN7OHCUyQICNtAwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAL e3KHwGCmSUyIWOYdiPcUZEim2FgKDk8TNd81HdTtBjHIgT5q1d07GjLukD0R0i70 jsNjLiNmsGe+b7bAEzlgqqI0JZN1Ut6nna0Oh4lScWoWPBkdg/iaKWW+9D+a2fDz WochcYBNy+A4mz+7+uAwTc+G02UQGRjRlwKxK3JCaKygvU5a2hi/a5iB0P2avl4V SM0RFbnAKVy06Ij3Pjaut2L9HmLecHgQHEhb2rykOLpn7VU+Xlff1ANATIGk0k9j pwlCCRT8AKnCgHNPLsBA2RF7SOp6AsDT6ygBJlh0wcBzIm2Tlf05fbsq4/aC4yyX X04fkZT6/iyj2HYauE2yOE+b+h1IYHkm4vP9qdCa6HCPSXrW5b0KDtst842/6+Ok fcvHlXHo2qN8xcL4dJIEG4aspCJTQLas/kx2z/uUMsA1n3Y/buWQbqCmJqK4LL7R K4X9p2jIugErsWx0Hbhzlefut8cl8ABMALJ+tguLHPPAUJ4lueAI3jZm/zel0btU ZCzJJ7VLkn5l/9Mt4blOvH+kQSGQQXemOR/qnuOf0GZvBeyqdn6/axag67XH/JJU LysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9vwGYT7JZVEc+NHt4bVaT LnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg== -----END CERTIFICATE----- # Issuer: O=Trustis Limited OU=Trustis FPS Root CA # Subject: O=Trustis Limited OU=Trustis FPS Root CA # Label: "Trustis FPS Root CA" # Serial: 36053640375399034304724988975563710553 # MD5 Fingerprint: 30:c9:e7:1e:6b:e6:14:eb:65:b2:16:69:20:31:67:4d # SHA1 Fingerprint: 3b:c0:38:0b:33:c3:f6:a6:0c:86:15:22:93:d9:df:f5:4b:81:c0:04 # SHA256 Fingerprint: c1:b4:82:99:ab:a5:20:8f:e9:63:0a:ce:55:ca:68:a0:3e:da:5a:51:9c:88:02:a0:d3:a6:73:be:8f:8e:55:7d -----BEGIN CERTIFICATE----- MIIDZzCCAk+gAwIBAgIQGx+ttiD5JNM2a/fH8YygWTANBgkqhkiG9w0BAQUFADBF MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPVHJ1c3RpcyBMaW1pdGVkMRwwGgYDVQQL ExNUcnVzdGlzIEZQUyBSb290IENBMB4XDTAzMTIyMzEyMTQwNloXDTI0MDEyMTEx MzY1NFowRTELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1RydXN0aXMgTGltaXRlZDEc MBoGA1UECxMTVHJ1c3RpcyBGUFMgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQAD ggEPADCCAQoCggEBAMVQe547NdDfxIzNjpvto8A2mfRC6qc+gIMPpqdZh8mQRUN+ AOqGeSoDvT03mYlmt+WKVoaTnGhLaASMk5MCPjDSNzoiYYkchU59j9WvezX2fihH iTHcDnlkH5nSW7r+f2C/revnPDgpai/lkQtV/+xvWNUtyd5MZnGPDNcE2gfmHhjj vSkCqPoc4Vu5g6hBSLwacY3nYuUtsuvffM/bq1rKMfFMIvMFE/eC+XN5DL7XSxzA 0RU8k0Fk0ea+IxciAIleH2ulrG6nS4zto3Lmr2NNL4XSFDWaLk6M6jKYKIahkQlB OrTh4/L68MkKokHdqeMDx4gVOxzUGpTXn2RZEm0CAwEAAaNTMFEwDwYDVR0TAQH/ BAUwAwEB/zAfBgNVHSMEGDAWgBS6+nEleYtXQSUhhgtx67JkDoshZzAdBgNVHQ4E FgQUuvpxJXmLV0ElIYYLceuyZA6LIWcwDQYJKoZIhvcNAQEFBQADggEBAH5Y//01 GX2cGE+esCu8jowU/yyg2kdbw++BLa8F6nRIW/M+TgfHbcWzk88iNVy2P3UnXwmW zaD+vkAMXBJV+JOCyinpXj9WV4s4NvdFGkwozZ5BuO1WTISkQMi4sKUraXAEasP4 1BIy+Q7DsdwyhEQsb8tGD+pmQQ9P8Vilpg0ND2HepZ5dfWWhPBfnqFVO76DH7cZE f1T1o+CP8HxVIo8ptoGj4W1OLBuAZ+ytIJ8MYmHVl/9D7S3B2l0pKoU/rGXuhg8F jZBf3+6f9L/uHfuY5H+QK4R4EA5sSVPvFVtlRkpdr7r7OnIdzfYliB6XzCGcKQEN ZetX2fNXlrtIzYE= -----END CERTIFICATE----- # Issuer: CN=Buypass Class 2 Root CA O=Buypass AS-983163327 # Subject: CN=Buypass Class 2 Root CA O=Buypass AS-983163327 # Label: "Buypass Class 2 Root CA" # Serial: 2 # MD5 Fingerprint: 46:a7:d2:fe:45:fb:64:5a:a8:59:90:9b:78:44:9b:29 # SHA1 Fingerprint: 49:0a:75:74:de:87:0a:47:fe:58:ee:f6:c7:6b:eb:c6:0b:12:40:99 # SHA256 Fingerprint: 9a:11:40:25:19:7c:5b:b9:5d:94:e6:3d:55:cd:43:79:08:47:b6:46:b2:3c:df:11:ad:a4:a0:0e:ff:15:fb:48 -----BEGIN CERTIFICATE----- MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEd MBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3Mg Q2xhc3MgMiBSb290IENBMB4XDTEwMTAyNjA4MzgwM1oXDTQwMTAyNjA4MzgwM1ow TjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MSAw HgYDVQQDDBdCdXlwYXNzIENsYXNzIDIgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEB BQADggIPADCCAgoCggIBANfHXvfBB9R3+0Mh9PT1aeTuMgHbo4Yf5FkNuud1g1Lr 6hxhFUi7HQfKjK6w3Jad6sNgkoaCKHOcVgb/S2TwDCo3SbXlzwx87vFKu3MwZfPV L4O2fuPn9Z6rYPnT8Z2SdIrkHJasW4DptfQxh6NR/Md+oW+OU3fUl8FVM5I+GC91 1K2GScuVr1QGbNgGE41b/+EmGVnAJLqBcXmQRFBoJJRfuLMR8SlBYaNByyM21cHx MlAQTn/0hpPshNOOvEu/XAFOBz3cFIqUCqTqc/sLUegTBxj6DvEr0VQVfTzh97QZ QmdiXnfgolXsttlpF9U6r0TtSsWe5HonfOV116rLJeffawrbD02TTqigzXsu8lkB arcNuAeBfos4GzjmCleZPe4h6KP1DBbdi+w0jpwqHAAVF41og9JwnxgIzRFo1clr Us3ERo/ctfPYV3Me6ZQ5BL/T3jjetFPsaRyifsSP5BtwrfKi+fv3FmRmaZ9JUaLi FRhnBkp/1Wy1TbMz4GHrXb7pmA8y1x1LPC5aAVKRCfLf6o3YBkBjqhHk/sM3nhRS P/TizPJhk9H9Z2vXUq6/aKtAQ6BXNVN48FP4YUIHZMbXb5tMOA1jrGKvNouicwoN 9SG9dKpN6nIDSdvHXx1iY8f93ZHsM+71bbRuMGjeyNYmsHVee7QHIJihdjK4TWxP AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMmAd+BikoL1Rpzz uvdMw964o605MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAU18h 9bqwOlI5LJKwbADJ784g7wbylp7ppHR/ehb8t/W2+xUbP6umwHJdELFx7rxP462s A20ucS6vxOOto70MEae0/0qyexAQH6dXQbLArvQsWdZHEIjzIVEpMMpghq9Gqx3t OluwlN5E40EIosHsHdb9T7bWR9AUC8rmyrV7d35BH16Dx7aMOZawP5aBQW9gkOLo +fsicdl9sz1Gv7SEr5AcD48Saq/v7h56rgJKihcrdv6sVIkkLE8/trKnToyokZf7 KcZ7XC25y2a2t6hbElGFtQl+Ynhw/qlqYLYdDnkM/crqJIByw5c/8nerQyIKx+u2 DISCLIBrQYoIwOula9+ZEsuK1V6ADJHgJgg2SMX6OBE1/yWDLfJ6v9r9jv6ly0Us H8SIU653DtmadsWOLB2jutXsMq7Aqqz30XpN69QH4kj3Io6wpJ9qzo6ysmD0oyLQ I+uUWnpp3Q+/QFesa1lQ2aOZ4W7+jQF5JyMV3pKdewlNWudLSDBaGOYKbeaP4NK7 5t98biGCwWg5TbSYWGZizEqQXsP6JwSxeRV0mcy+rSDeJmAc61ZRpqPq5KM/p/9h 3PFaTWwyI0PurKju7koSCTxdccK+efrCh2gdC/1cacwG0Jp9VJkqyTkaGa9LKkPz Y11aWOIv4x3kqdbQCtCev9eBCfHJxyYNrJgWVqA= -----END CERTIFICATE----- # Issuer: CN=Buypass Class 3 Root CA O=Buypass AS-983163327 # Subject: CN=Buypass Class 3 Root CA O=Buypass AS-983163327 # Label: "Buypass Class 3 Root CA" # Serial: 2 # MD5 Fingerprint: 3d:3b:18:9e:2c:64:5a:e8:d5:88:ce:0e:f9:37:c2:ec # SHA1 Fingerprint: da:fa:f7:fa:66:84:ec:06:8f:14:50:bd:c7:c2:81:a5:bc:a9:64:57 # SHA256 Fingerprint: ed:f7:eb:bc:a2:7a:2a:38:4d:38:7b:7d:40:10:c6:66:e2:ed:b4:84:3e:4c:29:b4:ae:1d:5b:93:32:e6:b2:4d -----BEGIN CERTIFICATE----- MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEd MBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3Mg Q2xhc3MgMyBSb290IENBMB4XDTEwMTAyNjA4Mjg1OFoXDTQwMTAyNjA4Mjg1OFow TjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MSAw HgYDVQQDDBdCdXlwYXNzIENsYXNzIDMgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEB BQADggIPADCCAgoCggIBAKXaCpUWUOOV8l6ddjEGMnqb8RB2uACatVI2zSRHsJ8Y ZLya9vrVediQYkwiL944PdbgqOkcLNt4EemOaFEVcsfzM4fkoF0LXOBXByow9c3E N3coTRiR5r/VUv1xLXA+58bEiuPwKAv0dpihi4dVsjoT/Lc+JzeOIuOoTyrvYLs9 tznDDgFHmV0ST9tD+leh7fmdvhFHJlsTmKtdFoqwNxxXnUX/iJY2v7vKB3tvh2PX 0DJq1l1sDPGzbjniazEuOQAnFN44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c /3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X KhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY zIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS O1UQRwUVZ2J+GGOmRj8JDlQyXr8NYnon74Do29lLBlo3WiXQCBJ31G8JUJc9yB3D 34xFMFbG02SrZvPAXpacw8Tvw3xrizp5f7NJzz3iiZ+gMEuFuZyUJHmPfWupRWgP K9Dx2hzLabjKSWJtyNBjYt1gD1iqj6G8BaVmos8bdrKEZLFMOVLAMLrwjEsCsLa3 AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEe4zf/lb+74suwv Tg75JbCOPGvDMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAACAj QTUEkMJAYmDv4jVM1z+s4jSQuKFvdvoWFqRINyzpkMLyPPgKn9iB5btb2iUspKdV cSQy9sgL8rxq+JOssgfCX5/bzMiKqr5qb+FJEMwx14C7u8jYog5kV+qi9cKpMRXS IGrs/CIBKM+GuIAeqcwRpTzyFrNHnfzSgCHEy9BHcEGhyoMZCCxt8l13nIoUE9Q2 HJLw5QY33KbmkJs4j1xrG0aGQ0JfPgEHU1RdZX33inOhmlRaHylDFCfChQ+1iHsa O5S3HWCntZznKWlXWpuTekMwGwPXYshApqr8ZORK15FTAaggiG6cX0S5y2CBNOxv 033aSF/rtJC8LakcC6wc1aJoIIAE1vyxjy+7SjENSoYc6+I2KSb12tjE8nVhz36u dmNKekBlk4f4HoCMhuWG1o8O/FMsYOgWYRqiPkN7zTlgVGr18okmAWiDSKIz6MkE kbIRNBE+6tBDGR8Dk5AM/1E9V/RBbuHLoL7ryWPNbczk+DaqaJ3tvV2XcEQNtg41 3OEMXbugUZTLfhbrES+jkkXITHHZvMmZUldGL1DPvTVp9D0VzgalLA8+9oG6lLvD u79leNKGef9JOxqDDPDeeOzI8k1MGt6CKfjBWtrt7uYnXuhF0J0cUahoq0Tj0Itq 4/g7u9xN12TyUb7mqqta6THuBrxzvxNiCp/HuZc= -----END CERTIFICATE----- # Issuer: CN=T-TeleSec GlobalRoot Class 3 O=T-Systems Enterprise Services GmbH OU=T-Systems Trust Center # Subject: CN=T-TeleSec GlobalRoot Class 3 O=T-Systems Enterprise Services GmbH OU=T-Systems Trust Center # Label: "T-TeleSec GlobalRoot Class 3" # Serial: 1 # MD5 Fingerprint: ca:fb:40:a8:4e:39:92:8a:1d:fe:8e:2f:c4:27:ea:ef # SHA1 Fingerprint: 55:a6:72:3e:cb:f2:ec:cd:c3:23:74:70:19:9d:2a:be:11:e3:81:d1 # SHA256 Fingerprint: fd:73:da:d3:1c:64:4f:f1:b4:3b:ef:0c:cd:da:96:71:0b:9c:d9:87:5e:ca:7e:31:70:7a:f3:e9:6d:52:2b:bd -----BEGIN CERTIFICATE----- MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl YyBHbG9iYWxSb290IENsYXNzIDMwHhcNMDgxMDAxMTAyOTU2WhcNMzMxMDAxMjM1 OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50 ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDMwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9dZPwYiJvJK7genasfb3ZJNW4t/zN 8ELg63iIVl6bmlQdTQyK9tPPcPRStdiTBONGhnFBSivwKixVA9ZIw+A5OO3yXDw/ RLyTPWGrTs0NvvAgJ1gORH8EGoel15YUNpDQSXuhdfsaa3Ox+M6pCSzyU9XDFES4 hqX2iys52qMzVNn6chr3IhUciJFrf2blw2qAsCTz34ZFiP0Zf3WHHx+xGwpzJFu5 ZeAsVMhg02YXP+HMVDNzkQI6pn97djmiH5a2OK61yJN0HZ65tOVgnS9W0eDrXltM EnAMbEQgqxHY9Bn20pxSN+f6tsIxO0rUFJmtxxr1XV/6B7h8DR/Wgx6zAgMBAAGj QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS1 A/d2O2GCahKqGFPrAyGUv/7OyjANBgkqhkiG9w0BAQsFAAOCAQEAVj3vlNW92nOy WL6ukK2YJ5f+AbGwUgC4TeQbIXQbfsDuXmkqJa9c1h3a0nnJ85cp4IaH3gRZD/FZ 1GSFS5mvJQQeyUapl96Cshtwn5z2r3Ex3XsFpSzTucpH9sry9uetuUg/vBa3wW30 6gmv7PO15wWeph6KU1HWk4HMdJP2udqmJQV0eVp+QD6CSyYRMG7hP0HHRwA11fXT 91Q+gT3aSWqas+8QPebrb9HIIkfLzM8BMZLZGOMivgkeGj5asuRrDFR6fUNOuIml e9eiPZaGzPImNC1qkp2aGtAw4l1OBLBfiyB+d8E9lYLRRpo7PHi4b6HQDWSieB4p TpPDpFQUWw== -----END CERTIFICATE----- # Issuer: CN=EE Certification Centre Root CA O=AS Sertifitseerimiskeskus # Subject: CN=EE Certification Centre Root CA O=AS Sertifitseerimiskeskus # Label: "EE Certification Centre Root CA" # Serial: 112324828676200291871926431888494945866 # MD5 Fingerprint: 43:5e:88:d4:7d:1a:4a:7e:fd:84:2e:52:eb:01:d4:6f # SHA1 Fingerprint: c9:a8:b9:e7:55:80:5e:58:e3:53:77:a7:25:eb:af:c3:7b:27:cc:d7 # SHA256 Fingerprint: 3e:84:ba:43:42:90:85:16:e7:75:73:c0:99:2f:09:79:ca:08:4e:46:85:68:1f:f1:95:cc:ba:8a:22:9b:8a:76 -----BEGIN CERTIFICATE----- MIIEAzCCAuugAwIBAgIQVID5oHPtPwBMyonY43HmSjANBgkqhkiG9w0BAQUFADB1 MQswCQYDVQQGEwJFRTEiMCAGA1UECgwZQVMgU2VydGlmaXRzZWVyaW1pc2tlc2t1 czEoMCYGA1UEAwwfRUUgQ2VydGlmaWNhdGlvbiBDZW50cmUgUm9vdCBDQTEYMBYG CSqGSIb3DQEJARYJcGtpQHNrLmVlMCIYDzIwMTAxMDMwMTAxMDMwWhgPMjAzMDEy MTcyMzU5NTlaMHUxCzAJBgNVBAYTAkVFMSIwIAYDVQQKDBlBUyBTZXJ0aWZpdHNl ZXJpbWlza2Vza3VzMSgwJgYDVQQDDB9FRSBDZXJ0aWZpY2F0aW9uIENlbnRyZSBS b290IENBMRgwFgYJKoZIhvcNAQkBFglwa2lAc2suZWUwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDIIMDs4MVLqwd4lfNE7vsLDP90jmG7sWLqI9iroWUy euuOF0+W2Ap7kaJjbMeMTC55v6kF/GlclY1i+blw7cNRfdCT5mzrMEvhvH2/UpvO bntl8jixwKIy72KyaOBhU8E2lf/slLo2rpwcpzIP5Xy0xm90/XsY6KxX7QYgSzIw WFv9zajmofxwvI6Sc9uXp3whrj3B9UiHbCe9nyV0gVWw93X2PaRka9ZP585ArQ/d MtO8ihJTmMmJ+xAdTX7Nfh9WDSFwhfYggx/2uh8Ej+p3iDXE/+pOoYtNP2MbRMNE 1CV2yreN1x5KZmTNXMWcg+HCCIia7E6j8T4cLNlsHaFLAgMBAAGjgYowgYcwDwYD VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFBLyWj7qVhy/ zQas8fElyalL1BSZMEUGA1UdJQQ+MDwGCCsGAQUFBwMCBggrBgEFBQcDAQYIKwYB BQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkwDQYJKoZIhvcNAQEF BQADggEBAHv25MANqhlHt01Xo/6tu7Fq1Q+e2+RjxY6hUFaTlrg4wCQiZrxTFGGV v9DHKpY5P30osxBAIWrEr7BSdxjhlthWXePdNl4dp1BUoMUq5KqMlIpPnTX/dqQG E5Gion0ARD9V04I8GtVbvFZMIi5GQ4okQC3zErg7cBqklrkar4dBGmoYDQZPxz5u uSlNDUmJEYcyW+ZLBMjkXOZ0c5RdFpgTlf7727FE5TpwrDdr5rMzcijJs1eg9gIW iAYLtqZLICjU3j2LrTcFU3T+bsy8QxdxXvnFzBqpYe73dgzzcvRyrc9yAjYHR8/v GVCJYMzpJJUPwssd8m92kMfMdcGWxZ0= -----END CERTIFICATE----- # Issuer: CN=D-TRUST Root Class 3 CA 2 2009 O=D-Trust GmbH # Subject: CN=D-TRUST Root Class 3 CA 2 2009 O=D-Trust GmbH # Label: "D-TRUST Root Class 3 CA 2 2009" # Serial: 623603 # MD5 Fingerprint: cd:e0:25:69:8d:47:ac:9c:89:35:90:f7:fd:51:3d:2f # SHA1 Fingerprint: 58:e8:ab:b0:36:15:33:fb:80:f7:9b:1b:6d:29:d3:ff:8d:5f:00:f0 # SHA256 Fingerprint: 49:e7:a4:42:ac:f0:ea:62:87:05:00:54:b5:25:64:b6:50:e4:f4:9e:42:e3:48:d6:aa:38:e0:39:e9:57:b1:c1 -----BEGIN CERTIFICATE----- MIIEMzCCAxugAwIBAgIDCYPzMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMDUwODM1NThaFw0yOTExMDUwODM1NTha ME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMM HkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBANOySs96R+91myP6Oi/WUEWJNTrGa9v+2wBoqOADER03 UAifTUpolDWzU9GUY6cgVq/eUXjsKj3zSEhQPgrfRlWLJ23DEE0NkVJD2IfgXU42 tSHKXzlABF9bfsyjxiupQB7ZNoTWSPOSHjRGICTBpFGOShrvUD9pXRl/RcPHAY9R ySPocq60vFYJfxLLHLGvKZAKyVXMD9O0Gu1HNVpK7ZxzBCHQqr0ME7UAyiZsxGsM lFqVlNpQmvH/pStmMaTJOKDfHR+4CS7zp+hnUquVH+BGPtikw8paxTGA6Eian5Rp /hnd2HN8gcqW3o7tszIFZYQ05ub9VxC1X3a/L7AQDcUCAwEAAaOCARowggEWMA8G A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3aFMSfMN4hvR5COfyrYyNJ4PGEMA4G A1UdDwEB/wQEAwIBBjCB0wYDVR0fBIHLMIHIMIGAoH6gfIZ6bGRhcDovL2RpcmVj dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwUm9vdCUyMENsYXNzJTIwMyUy MENBJTIwMiUyMDIwMDksTz1ELVRydXN0JTIwR21iSCxDPURFP2NlcnRpZmljYXRl cmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js L2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL BQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni acfzcNsgFYbQDfC+rAF1hM5+n02/t2A7nPPKHeJeaNijnZflQGDSNiH+0LS4F9p0 o3/U37CYAqxva2ssJSRyoWXuJVrl5jLn8t+rSfrzkGkj2wTZ51xY/GXUl77M/C4K zCUqNQT4YJEVdT1B/yMfGchs64JTBKbkTCJNjYy6zltz7GRUUG3RnFX7acM2w4y8 PIWmawomDeCTmGCufsYkl4phX5GOZpIJhzbNi5stPvZR1FDUWSi9g/LMKHtThm3Y Johw1+qRzT65ysCQblrGXnRl11z+o+I= -----END CERTIFICATE----- # Issuer: CN=D-TRUST Root Class 3 CA 2 EV 2009 O=D-Trust GmbH # Subject: CN=D-TRUST Root Class 3 CA 2 EV 2009 O=D-Trust GmbH # Label: "D-TRUST Root Class 3 CA 2 EV 2009" # Serial: 623604 # MD5 Fingerprint: aa:c6:43:2c:5e:2d:cd:c4:34:c0:50:4f:11:02:4f:b6 # SHA1 Fingerprint: 96:c9:1b:0b:95:b4:10:98:42:fa:d0:d8:22:79:fe:60:fa:b9:16:83 # SHA256 Fingerprint: ee:c5:49:6b:98:8c:e9:86:25:b9:34:09:2e:ec:29:08:be:d0:b0:f3:16:c2:d4:73:0c:84:ea:f1:f3:d3:48:81 -----BEGIN CERTIFICATE----- MIIEQzCCAyugAwIBAgIDCYP0MA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkRF MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMMIUQtVFJVU1QgUm9vdCBD bGFzcyAzIENBIDIgRVYgMjAwOTAeFw0wOTExMDUwODUwNDZaFw0yOTExMDUwODUw NDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV BAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn ljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JUut8Mxk2og+KbgPCdM0 3TP1YtHhzRnp7hhPTFiu4h7WDFsVWtg6uMQYZB7jM7K1iXdODL/ZlGsTl28So/6Z qQTMFexgaDbtCHu39b+T7WYxg4zGcTSHThfqr4uRjRxWQa4iN1438h3Z0S0NL2lR p75mpoo6Kr3HGrHhFPC+Oh25z1uxav60sUYgovseO3Dvk5h9jHOW8sXvhXCtKSb8 HgQ+HKDYD8tSg2J87otTlZCpV6LqYQXY+U3EJ/pure3511H3a6UCAwEAAaOCASQw ggEgMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNOUikxiEyoZLsyvcop9Ntea HNxnMA4GA1UdDwEB/wQEAwIBBjCB3QYDVR0fBIHVMIHSMIGHoIGEoIGBhn9sZGFw Oi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xh c3MlMjAzJTIwQ0ElMjAyJTIwRVYlMjAyMDA5LE89RC1UcnVzdCUyMEdtYkgsQz1E RT9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0MEagRKBChkBodHRwOi8vd3d3LmQt dHJ1c3QubmV0L2NybC9kLXRydXN0X3Jvb3RfY2xhc3NfM19jYV8yX2V2XzIwMDku Y3JsMA0GCSqGSIb3DQEBCwUAA4IBAQA07XtaPKSUiO8aEXUHL7P+PPoeUSbrh/Yp 3uDx1MYkCenBz1UbtDDZzhr+BlGmFaQt77JLvyAoJUnRpjZ3NOhk31KxEcdzes05 nsKtjHEh8lprr988TlWvsoRlFIm5d8sqMb7Po23Pb0iUMkZv53GMoKaEGTcH8gNF CSuGdXzfX2lXANtu2KZyIktQ1HWYVt+3GP9DQ1CuekR78HlR10M9p9OB0/DJT7na xpeG0ILD5EJt/rDiZE4OJudANCa1CInXCGNjOCd1HjPqbqjdn5lPdE2BiYBL3ZqX KVwvvoFBuYz/6n1gBp7N1z3TLqMVvKjmJuVvw9y4AyHqnxbxLFS1 -----END CERTIFICATE----- # Issuer: CN=CA Disig Root R2 O=Disig a.s. # Subject: CN=CA Disig Root R2 O=Disig a.s. # Label: "CA Disig Root R2" # Serial: 10572350602393338211 # MD5 Fingerprint: 26:01:fb:d8:27:a7:17:9a:45:54:38:1a:43:01:3b:03 # SHA1 Fingerprint: b5:61:eb:ea:a4:de:e4:25:4b:69:1a:98:a5:57:47:c2:34:c7:d9:71 # SHA256 Fingerprint: e2:3d:4a:03:6d:7b:70:e9:f5:95:b1:42:20:79:d2:b9:1e:df:bb:1f:b6:51:a0:63:3e:aa:8a:9d:c5:f8:07:03 -----BEGIN CERTIFICATE----- MIIFaTCCA1GgAwIBAgIJAJK4iNuwisFjMA0GCSqGSIb3DQEBCwUAMFIxCzAJBgNV BAYTAlNLMRMwEQYDVQQHEwpCcmF0aXNsYXZhMRMwEQYDVQQKEwpEaXNpZyBhLnMu MRkwFwYDVQQDExBDQSBEaXNpZyBSb290IFIyMB4XDTEyMDcxOTA5MTUzMFoXDTQy MDcxOTA5MTUzMFowUjELMAkGA1UEBhMCU0sxEzARBgNVBAcTCkJyYXRpc2xhdmEx EzARBgNVBAoTCkRpc2lnIGEucy4xGTAXBgNVBAMTEENBIERpc2lnIFJvb3QgUjIw ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCio8QACdaFXS1tFPbCw3Oe NcJxVX6B+6tGUODBfEl45qt5WDza/3wcn9iXAng+a0EE6UG9vgMsRfYvZNSrXaNH PWSb6WiaxswbP7q+sos0Ai6YVRn8jG+qX9pMzk0DIaPY0jSTVpbLTAwAFjxfGs3I x2ymrdMxp7zo5eFm1tL7A7RBZckQrg4FY8aAamkw/dLukO8NJ9+flXP04SXabBbe QTg06ov80egEFGEtQX6sx3dOy1FU+16SGBsEWmjGycT6txOgmLcRK7fWV8x8nhfR yyX+hk4kLlYMeE2eARKmK6cBZW58Yh2EhN/qwGu1pSqVg8NTEQxzHQuyRpDRQjrO QG6Vrf/GlK1ul4SOfW+eioANSW1z4nuSHsPzwfPrLgVv2RvPN3YEyLRa5Beny912 H9AZdugsBbPWnDTYltxhh5EF5EQIM8HauQhl1K6yNg3ruji6DOWbnuuNZt2Zz9aJ QfYEkoopKW1rOhzndX0CcQ7zwOe9yxndnWCywmZgtrEE7snmhrmaZkCo5xHtgUUD i/ZnWejBBhG93c+AAk9lQHhcR1DIm+YfgXvkRKhbhZri3lrVx/k6RGZL5DJUfORs nLMOPReisjQS1n6yqEm70XooQL6iFh/f5DcfEXP7kAplQ6INfPgGAVUzfbANuPT1 rqVCV3w2EYx7XsQDnYx5nQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud DwEB/wQEAwIBBjAdBgNVHQ4EFgQUtZn4r7CU9eMg1gqtzk5WpC5uQu0wDQYJKoZI hvcNAQELBQADggIBACYGXnDnZTPIgm7ZnBc6G3pmsgH2eDtpXi/q/075KMOYKmFM tCQSin1tERT3nLXK5ryeJ45MGcipvXrA1zYObYVybqjGom32+nNjf7xueQgcnYqf GopTpti72TVVsRHFqQOzVju5hJMiXn7B9hJSi+osZ7z+Nkz1uM/Rs0mSO9MpDpkb lvdhuDvEK7Z4bLQjb/D907JedR+Zlais9trhxTF7+9FGs9K8Z7RiVLoJ92Owk6Ka +elSLotgEqv89WBW7xBci8QaQtyDW2QOy7W81k/BfDxujRNt+3vrMNDcTa/F1bal TFtxyegxvug4BkihGuLq0t4SOVga/4AOgnXmt8kHbA7v/zjxmHHEt38OFdAlab0i nSvtBfZGR6ztwPDUO+Ls7pZbkBNOHlY667DvlruWIxG68kOGdGSVyCh13x01utI3 gzhTODY7z2zp+WsO0PsE6E9312UBeIYMej4hYvF/Y3EMyZ9E26gnonW+boE+18Dr G5gPcFw0sorMwIUY6256s/daoQe/qUKS82Ail+QUoQebTnbAjn39pCXHR+3/H3Os zMOl6W8KjptlwlCFtaOgUxLMVYdh84GuEEZhvUQhuMI9dM9+JDX6HAcOmz0iyu8x L4ysEr3vQCj8KWefshNPZiTEUxnpHikV7+ZtsH8tZ/3zbBt1RqPlShfppNcL -----END CERTIFICATE----- # Issuer: CN=ACCVRAIZ1 O=ACCV OU=PKIACCV # Subject: CN=ACCVRAIZ1 O=ACCV OU=PKIACCV # Label: "ACCVRAIZ1" # Serial: 6828503384748696800 # MD5 Fingerprint: d0:a0:5a:ee:05:b6:09:94:21:a1:7d:f1:b2:29:82:02 # SHA1 Fingerprint: 93:05:7a:88:15:c6:4f:ce:88:2f:fa:91:16:52:28:78:bc:53:64:17 # SHA256 Fingerprint: 9a:6e:c0:12:e1:a7:da:9d:be:34:19:4d:47:8a:d7:c0:db:18:22:fb:07:1d:f1:29:81:49:6e:d1:04:38:41:13 -----BEGIN CERTIFICATE----- MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/ 0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47 4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2 VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA 7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH 7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7 -----END CERTIFICATE----- # Issuer: CN=TWCA Global Root CA O=TAIWAN-CA OU=Root CA # Subject: CN=TWCA Global Root CA O=TAIWAN-CA OU=Root CA # Label: "TWCA Global Root CA" # Serial: 3262 # MD5 Fingerprint: f9:03:7e:cf:e6:9e:3c:73:7a:2a:90:07:69:ff:2b:96 # SHA1 Fingerprint: 9c:bb:48:53:f6:a4:f6:d3:52:a4:e8:32:52:55:60:13:f5:ad:af:65 # SHA256 Fingerprint: 59:76:90:07:f7:68:5d:0f:cd:50:87:2f:9f:95:d5:75:5a:5b:2b:45:7d:81:f3:69:2b:61:0a:98:67:2f:0e:1b -----BEGIN CERTIFICATE----- MIIFQTCCAymgAwIBAgICDL4wDQYJKoZIhvcNAQELBQAwUTELMAkGA1UEBhMCVFcx EjAQBgNVBAoTCVRBSVdBTi1DQTEQMA4GA1UECxMHUm9vdCBDQTEcMBoGA1UEAxMT VFdDQSBHbG9iYWwgUm9vdCBDQTAeFw0xMjA2MjcwNjI4MzNaFw0zMDEyMzExNTU5 NTlaMFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsT B1Jvb3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0EwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQCwBdvI64zEbooh745NnHEKH1Jw7W2CnJfF 10xORUnLQEK1EjRsGcJ0pDFfhQKX7EMzClPSnIyOt7h52yvVavKOZsTuKwEHktSz 0ALfUPZVr2YOy+BHYC8rMjk1Ujoog/h7FsYYuGLWRyWRzvAZEk2tY/XTP3VfKfCh MBwqoJimFb3u/Rk28OKRQ4/6ytYQJ0lM793B8YVwm8rqqFpD/G2Gb3PpN0Wp8DbH zIh1HrtsBv+baz4X7GGqcXzGHaL3SekVtTzWoWH1EfcFbx39Eb7QMAfCKbAJTibc 46KokWofwpFFiFzlmLhxpRUZyXx1EcxwdE8tmx2RRP1WKKD+u4ZqyPpcC1jcxkt2 yKsi2XMPpfRaAok/T54igu6idFMqPVMnaR1sjjIsZAAmY2E2TqNGtz99sy2sbZCi laLOz9qC5wc0GZbpuCGqKX6mOL6OKUohZnkfs8O1CWfe1tQHRvMq2uYiN2DLgbYP oA/pyJV/v1WRBXrPPRXAb94JlAGD1zQbzECl8LibZ9WYkTunhHiVJqRaCPgrdLQA BDzfuBSO6N+pjWxnkjMdwLfS7JLIvgm/LCkFbwJrnu+8vyq8W8BQj0FwcYeyTbcE qYSjMq+u7msXi7Kx/mzhkIyIqJdIzshNy/MGz19qCkKxHh53L46g5pIOBvwFItIm 4TFRfTLcDwIDAQABoyMwITAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB /zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL 1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn LhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF H6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34FOIWWxtuEXeZVFBs5fzNxGiWNo RI2T9GRwoD2dKAXDOXC4Ynsg/eTb6QihuJ49CcdP+yz4k3ZB3lLg4VfSnQO8d57+ nile98FRYB/e2guyLXW3Q0iT5/Z5xoRdgFlglPx4mI88k1HtQJAH32RjJMtOcQWh 15QaiDLxInQirqWm2BJpTGCjAu4r7NRjkgtevi92a6O2JryPA9gK8kxkRr05YuWW 6zRjESjMlfGt7+/cgFhI6Uu46mWs6fyAtbXIRfmswZ/ZuepiiI7E8UuDEq3mi4TW nsLrgxifarsbJGAzcMzs9zLzXNl5fe+epP7JI8Mk7hWSsT2RTyaGvWZzJBPqpK5j wa19hAM8EHiGG3njxPPyBJUgriOCxLM6AGK/5jYk4Ve6xx6QddVfP5VhK8E7zeWz aGHQRiapIVJpLesux+t3zqY6tQMzT3bR51xUAV3LePTJDL/PEo4XLSNolOer/qmy KwbQBM0= -----END CERTIFICATE----- # Issuer: CN=TeliaSonera Root CA v1 O=TeliaSonera # Subject: CN=TeliaSonera Root CA v1 O=TeliaSonera # Label: "TeliaSonera Root CA v1" # Serial: 199041966741090107964904287217786801558 # MD5 Fingerprint: 37:41:49:1b:18:56:9a:26:f5:ad:c2:66:fb:40:a5:4c # SHA1 Fingerprint: 43:13:bb:96:f1:d5:86:9b:c1:4e:6a:92:f6:cf:f6:34:69:87:82:37 # SHA256 Fingerprint: dd:69:36:fe:21:f8:f0:77:c1:23:a1:a5:21:c1:22:24:f7:22:55:b7:3e:03:a7:26:06:93:e8:a2:4b:0f:a3:89 -----BEGIN CERTIFICATE----- MIIFODCCAyCgAwIBAgIRAJW+FqD3LkbxezmCcvqLzZYwDQYJKoZIhvcNAQEFBQAw NzEUMBIGA1UECgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJv b3QgQ0EgdjEwHhcNMDcxMDE4MTIwMDUwWhcNMzIxMDE4MTIwMDUwWjA3MRQwEgYD VQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwWVGVsaWFTb25lcmEgUm9vdCBDQSB2 MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMK+6yfwIaPzaSZVfp3F VRaRXP3vIb9TgHot0pGMYzHw7CTww6XScnwQbfQ3t+XmfHnqjLWCi65ItqwA3GV1 7CpNX8GH9SBlK4GoRz6JI5UwFpB/6FcHSOcZrr9FZ7E3GwYq/t75rH2D+1665I+X Z75Ljo1kB1c4VWk0Nj0TSO9P4tNmHqTPGrdeNjPUtAa9GAH9d4RQAEX1jF3oI7x+ /jXh7VB7qTCNGdMJjmhnXb88lxhTuylixcpecsHHltTbLaC0H2kD7OriUPEMPPCs 81Mt8Bz17Ww5OXOAFshSsCPN4D7c3TxHoLs1iuKYaIu+5b9y7tL6pe0S7fyYGKkm dtwoSxAgHNN/Fnct7W+A90m7UwW7XWjH1Mh1Fj+JWov3F0fUTPHSiXk+TT2YqGHe Oh7S+F4D4MHJHIzTjU3TlTazN19jY5szFPAtJmtTfImMMsJu7D0hADnJoWjiUIMu sDor8zagrC/kb2HCUQk5PotTubtn2txTuXZZNp1D5SDgPTJghSJRt8czu90VL6R4 pgd7gUY2BIbdeTXHlSw7sKMXNeVzH7RcWe/a6hBle3rQf5+ztCo3O3CLm1u5K7fs slESl1MpWtTwEhDcTwK7EpIvYtQ/aUN8Ddb8WHUBiJ1YFkveupD/RwGJBmr2X7KQ arMCpgKIv7NHfirZ1fpoeDVNAgMBAAGjPzA9MA8GA1UdEwEB/wQFMAMBAf8wCwYD VR0PBAQDAgEGMB0GA1UdDgQWBBTwj1k4ALP1j5qWDNXr+nuqF+gTEjANBgkqhkiG 9w0BAQUFAAOCAgEAvuRcYk4k9AwI//DTDGjkk0kiP0Qnb7tt3oNmzqjMDfz1mgbl dxSR651Be5kqhOX//CHBXfDkH1e3damhXwIm/9fH907eT/j3HEbAek9ALCI18Bmx 0GtnLLCo4MBANzX2hFxc469CeP6nyQ1Q6g2EdvZR74NTxnr/DlZJLo961gzmJ1Tj TQpgcmLNkQfWpb/ImWvtxBnmq0wROMVvMeJuScg/doAmAyYp4Db29iBT4xdwNBed Y2gea+zDTYa4EzAvXUYNR0PVG6pZDrlcjQZIrXSHX8f8MVRBE+LHIQ6e4B4N4cB7 Q4WQxYpYxmUKeFfyxiMPAdkgS94P+5KFdSpcc41teyWRyu5FrgZLAMzTsVlQ2jqI OylDRl6XK1TOU2+NSueW+r9xDkKLfP0ooNBIytrEgUy7onOTJsjrDNYmiLbAJM+7 vVvrdX3pCI6GMyx5dwlppYn8s3CQh3aP0yK7Qs69cwsgJirQmz1wHiRszYd2qReW t88NkvuOGKmYSdGe/mBEciG5Ge3C9THxOUiIkCR1VBatzvT4aRRkOfujuLpwQMcn HL/EVlP6Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVx SK236thZiNSQvxaz2emsWWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY= -----END CERTIFICATE----- # Issuer: CN=T-TeleSec GlobalRoot Class 2 O=T-Systems Enterprise Services GmbH OU=T-Systems Trust Center # Subject: CN=T-TeleSec GlobalRoot Class 2 O=T-Systems Enterprise Services GmbH OU=T-Systems Trust Center # Label: "T-TeleSec GlobalRoot Class 2" # Serial: 1 # MD5 Fingerprint: 2b:9b:9e:e4:7b:6c:1f:00:72:1a:cc:c1:77:79:df:6a # SHA1 Fingerprint: 59:0d:2d:7d:88:4f:40:2e:61:7e:a5:62:32:17:65:cf:17:d8:94:e9 # SHA256 Fingerprint: 91:e2:f5:78:8d:58:10:eb:a7:ba:58:73:7d:e1:54:8a:8e:ca:cd:01:45:98:bc:0b:14:3e:04:1b:17:05:25:52 -----BEGIN CERTIFICATE----- MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl YyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgxMDAxMTA0MDE0WhcNMzMxMDAxMjM1 OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50 ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUd AqSzm1nzHoqvNK38DcLZSBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiC FoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/FvudocP05l03Sx5iRUKrERLMjfTlH6VJi 1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx9702cu+fjOlbpSD8DT6Iavq jnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGVWOHAD3bZ wI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGj QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/ WSA2AHmgoCJrjNXyYdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhy NsZt+U2e+iKo4YFWz827n+qrkRk4r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPAC uvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNfvNoBYimipidx5joifsFvHZVw IEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR3p1m0IvVVGb6 g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN 9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlP BSeOE6Fuwg== -----END CERTIFICATE----- # Issuer: CN=Atos TrustedRoot 2011 O=Atos # Subject: CN=Atos TrustedRoot 2011 O=Atos # Label: "Atos TrustedRoot 2011" # Serial: 6643877497813316402 # MD5 Fingerprint: ae:b9:c4:32:4b:ac:7f:5d:66:cc:77:94:bb:2a:77:56 # SHA1 Fingerprint: 2b:b1:f5:3e:55:0c:1d:c5:f1:d4:e6:b7:6a:46:4b:55:06:02:ac:21 # SHA256 Fingerprint: f3:56:be:a2:44:b7:a9:1e:b3:5d:53:ca:9a:d7:86:4a:ce:01:8e:2d:35:d5:f8:f9:6d:df:68:a6:f4:1a:a4:74 -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+ SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ 4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3 DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed -----END CERTIFICATE----- # Issuer: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited # Subject: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited # Label: "QuoVadis Root CA 1 G3" # Serial: 687049649626669250736271037606554624078720034195 # MD5 Fingerprint: a4:bc:5b:3f:fe:37:9a:fa:64:f0:e2:fa:05:3d:0b:ab # SHA1 Fingerprint: 1b:8e:ea:57:96:29:1a:c9:39:ea:b8:0a:81:1a:73:73:c0:93:79:67 # SHA256 Fingerprint: 8a:86:6f:d1:b2:76:b5:7e:57:8e:92:1c:65:82:8a:2b:ed:58:e9:f2:f2:88:05:41:34:b7:f1:f4:bf:c9:cc:74 -----BEGIN CERTIFICATE----- MIIFYDCCA0igAwIBAgIUeFhfLq0sGUvjNwc1NBMotZbUZZMwDQYJKoZIhvcNAQEL BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMSBHMzAeFw0xMjAxMTIxNzI3NDRaFw00 MjAxMTIxNzI3NDRaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDEgRzMwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQCgvlAQjunybEC0BJyFuTHK3C3kEakEPBtV wedYMB0ktMPvhd6MLOHBPd+C5k+tR4ds7FtJwUrVu4/sh6x/gpqG7D0DmVIB0jWe rNrwU8lmPNSsAgHaJNM7qAJGr6Qc4/hzWHa39g6QDbXwz8z6+cZM5cOGMAqNF341 68Xfuw6cwI2H44g4hWf6Pser4BOcBRiYz5P1sZK0/CPTz9XEJ0ngnjybCKOLXSoh 4Pw5qlPafX7PGglTvF0FBM+hSo+LdoINofjSxxR3W5A2B4GbPgb6Ul5jxaYA/qXp UhtStZI5cgMJYr2wYBZupt0lwgNm3fME0UDiTouG9G/lg6AnhF4EwfWQvTA9xO+o abw4m6SkltFi2mnAAZauy8RRNOoMqv8hjlmPSlzkYZqn0ukqeI1RPToV7qJZjqlc 3sX5kCLliEVx3ZGZbHqfPT2YfF72vhZooF6uCyP8Wg+qInYtyaEQHeTTRCOQiJ/G KubX9ZqzWB4vMIkIG1SitZgj7Ah3HJVdYdHLiZxfokqRmu8hqkkWCKi9YSgxyXSt hfbZxbGL0eUQMk1fiyA6PEkfM4VZDdvLCXVDaXP7a3F98N/ETH3Goy7IlXnLc6KO Tk0k+17kBL5yG6YnLUlamXrXXAkgt3+UuU/xDRxeiEIbEbfnkduebPRq34wGmAOt zCjvpUfzUwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB BjAdBgNVHQ4EFgQUo5fW816iEOGrRZ88F2Q87gFwnMwwDQYJKoZIhvcNAQELBQAD ggIBABj6W3X8PnrHX3fHyt/PX8MSxEBd1DKquGrX1RUVRpgjpeaQWxiZTOOtQqOC MTaIzen7xASWSIsBx40Bz1szBpZGZnQdT+3Btrm0DWHMY37XLneMlhwqI2hrhVd2 cDMT/uFPpiN3GPoajOi9ZcnPP/TJF9zrx7zABC4tRi9pZsMbj/7sPtPKlL92CiUN qXsCHKnQO18LwIE6PWThv6ctTr1NxNgpxiIY0MWscgKCP6o6ojoilzHdCGPDdRS5 YCgtW2jgFqlmgiNR9etT2DGbe+m3nUvriBbP+V04ikkwj+3x6xn0dxoxGE1nVGwv b2X52z3sIexe9PSLymBlVNFxZPT5pqOBMzYzcfCkeF9OrYMh3jRJjehZrJ3ydlo2 8hP0r+AJx2EqbPfgna67hkooby7utHnNkDPDs3b69fBsnQGQ+p6Q9pxyz0fawx/k NSBT8lTR32GDpgLiJTjehTItXnOQUl1CxM49S+H5GYQd1aJQzEH7QRTDvdbJWqNj ZgKAvQU6O0ec7AAmTPWIUb+oI38YB7AL7YsmoWTTYUrrXJ/es69nA7Mf3W1daWhp q1467HxpvMc7hU6eFbm0FU/DlXpY18ls6Wy58yljXrQs8C097Vpl4KlbQMJImYFt nh8GKjwStIsPm6Ik8KaN1nrgS7ZklmOVhMJKzRwuJIczYOXD -----END CERTIFICATE----- # Issuer: CN=QuoVadis Root CA 2 G3 O=QuoVadis Limited # Subject: CN=QuoVadis Root CA 2 G3 O=QuoVadis Limited # Label: "QuoVadis Root CA 2 G3" # Serial: 390156079458959257446133169266079962026824725800 # MD5 Fingerprint: af:0c:86:6e:bf:40:2d:7f:0b:3e:12:50:ba:12:3d:06 # SHA1 Fingerprint: 09:3c:61:f3:8b:8b:dc:7d:55:df:75:38:02:05:00:e1:25:f5:c8:36 # SHA256 Fingerprint: 8f:e4:fb:0a:f9:3a:4d:0d:67:db:0b:eb:b2:3e:37:c7:1b:f3:25:dc:bc:dd:24:0e:a0:4d:af:58:b4:7e:18:40 -----BEGIN CERTIFICATE----- MIIFYDCCA0igAwIBAgIURFc0JFuBiZs18s64KztbpybwdSgwDQYJKoZIhvcNAQEL BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMiBHMzAeFw0xMjAxMTIxODU5MzJaFw00 MjAxMTIxODU5MzJaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDIgRzMwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQChriWyARjcV4g/Ruv5r+LrI3HimtFhZiFf qq8nUeVuGxbULX1QsFN3vXg6YOJkApt8hpvWGo6t/x8Vf9WVHhLL5hSEBMHfNrMW n4rjyduYNM7YMxcoRvynyfDStNVNCXJJ+fKH46nafaF9a7I6JaltUkSs+L5u+9ym c5GQYaYDFCDy54ejiK2toIz/pgslUiXnFgHVy7g1gQyjO/Dh4fxaXc6AcW34Sas+ O7q414AB+6XrW7PFXmAqMaCvN+ggOp+oMiwMzAkd056OXbxMmO7FGmh77FOm6RQ1 o9/NgJ8MSPsc9PG/Srj61YxxSscfrf5BmrODXfKEVu+lV0POKa2Mq1W/xPtbAd0j IaFYAI7D0GoT7RPjEiuA3GfmlbLNHiJuKvhB1PLKFAeNilUSxmn1uIZoL1NesNKq IcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz 8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh vNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l 7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwNkALG cC4BrTwV1wIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB BjAdBgNVHQ4EFgQU7edvdlq/YOxJW8ald7tyFnGbxD0wDQYJKoZIhvcNAQELBQAD ggIBAJHfgD9DCX5xwvfrs4iP4VGyvD11+ShdyLyZm3tdquXK4Qr36LLTn91nMX66 AarHakE7kNQIXLJgapDwyM4DYvmL7ftuKtwGTTwpD4kWilhMSA/ohGHqPHKmd+RC roijQ1h5fq7KpVMNqT1wvSAZYaRsOPxDMuHBR//47PERIjKWnML2W2mWeyAMQ0Ga W/ZZGYjeVYg3UQt4XAoeo0L9x52ID8DyeAIkVJOviYeIyUqAHerQbj5hLja7NQ4n lv1mNDthcnPxFlxHBlRJAHpYErAK74X9sbgzdWqTHBLmYF5vHX/JHyPLhGGfHoJE +V+tYlUkmlKY7VHnoX6XOuYvHxHaU4AshZ6rNRDbIl9qxV6XU/IyAgkwo1jwDQHV csaxfGl7w/U2Rcxhbl5MlMVerugOXou/983g7aEOGzPuVBj+D77vfoRrQ+NwmNtd dbINWQeFFSM51vHfqSYP1kjHs6Yi9TM3WpVHn3u6GBVv/9YUZINJ0gpnIdsPNWNg KCLjsZWDzYWm3S8P52dSbrsvhXz1SnPnxT7AvSESBT/8twNJAlvIJebiVDj1eYeM HVOyToV7BjjHLPj4sHKNJeV3UvQDHEimUF+IIDBu8oJDqz2XhOdT+yHBTw8imoa4 WSr2Rz0ZiC3oheGe7IUIarFsNMkd7EgrO3jtZsSOeWmD3n+M -----END CERTIFICATE----- # Issuer: CN=QuoVadis Root CA 3 G3 O=QuoVadis Limited # Subject: CN=QuoVadis Root CA 3 G3 O=QuoVadis Limited # Label: "QuoVadis Root CA 3 G3" # Serial: 268090761170461462463995952157327242137089239581 # MD5 Fingerprint: df:7d:b9:ad:54:6f:68:a1:df:89:57:03:97:43:b0:d7 # SHA1 Fingerprint: 48:12:bd:92:3c:a8:c4:39:06:e7:30:6d:27:96:e6:a4:cf:22:2e:7d # SHA256 Fingerprint: 88:ef:81:de:20:2e:b0:18:45:2e:43:f8:64:72:5c:ea:5f:bd:1f:c2:d9:d2:05:73:07:09:c5:d8:b8:69:0f:46 -----BEGIN CERTIFICATE----- MIIFYDCCA0igAwIBAgIULvWbAiin23r/1aOp7r0DoM8Sah0wDQYJKoZIhvcNAQEL BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMyBHMzAeFw0xMjAxMTIyMDI2MzJaFw00 MjAxMTIyMDI2MzJaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDMgRzMwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQCzyw4QZ47qFJenMioKVjZ/aEzHs286IxSR /xl/pcqs7rN2nXrpixurazHb+gtTTK/FpRp5PIpM/6zfJd5O2YIyC0TeytuMrKNu FoM7pmRLMon7FhY4futD4tN0SsJiCnMK3UmzV9KwCoWdcTzeo8vAMvMBOSBDGzXR U7Ox7sWTaYI+FrUoRqHe6okJ7UO4BUaKhvVZR74bbwEhELn9qdIoyhA5CcoTNs+c ra1AdHkrAj80//ogaX3T7mH1urPnMNA3I4ZyYUUpSFlob3emLoG+B01vr87ERROR FHAGjx+f+IdpsQ7vw4kZ6+ocYfx6bIrc1gMLnia6Et3UVDmrJqMz6nWB2i3ND0/k A9HvFZcba5DFApCTZgIhsUfei5pKgLlVj7WiL8DWM2fafsSntARE60f75li59wzw eyuxwHApw0BiLTtIadwjPEjrewl5qW3aqDCYz4ByA4imW0aucnl8CAMhZa634Ryl sSqiMd5mBPfAdOhx3v89WcyWJhKLhZVXGqtrdQtEPREoPHtht+KPZ0/l7DxMYIBp VzgeAVuNVejH38DMdyM0SXV89pgR6y3e7UEuFAUCf+D+IOs15xGsIs5XPd7JMG0Q A4XN8f+MFrXBsj6IbGB/kE+V9/YtrQE5BwT6dYB9v0lQ7e/JxHwc64B+27bQ3RP+ ydOc17KXqQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB BjAdBgNVHQ4EFgQUxhfQvKjqAkPyGwaZXSuQILnXnOQwDQYJKoZIhvcNAQELBQAD ggIBADRh2Va1EodVTd2jNTFGu6QHcrxfYWLopfsLN7E8trP6KZ1/AvWkyaiTt3px KGmPc+FSkNrVvjrlt3ZqVoAh313m6Tqe5T72omnHKgqwGEfcIHB9UqM+WXzBusnI FUBhynLWcKzSt/Ac5IYp8M7vaGPQtSCKFWGafoaYtMnCdvvMujAWzKNhxnQT5Wvv oxXqA/4Ti2Tk08HS6IT7SdEQTXlm66r99I0xHnAUrdzeZxNMgRVhvLfZkXdxGYFg u/BYpbWcC/ePIlUnwEsBbTuZDdQdm2NnL9DuDcpmvJRPpq3t/O5jrFc/ZSXPsoaP 0Aj/uHYUbt7lJ+yreLVTubY/6CD50qi+YUbKh4yE8/nxoGibIh6BJpsQBJFxwAYf 3KDTuVan45gtf4Od34wrnDKOMpTwATwiKp9Dwi7DmDkHOHv8XgBCH/MyJnmDhPbl 8MFREsALHgQjDFSlTC9JxUrRtm5gDWv8a4uFJGS3iQ6rJUdbPM9+Sb3H6QrG2vd+ DhcI00iX0HGS8A85PjRqHH3Y8iKuu2n0M7SmSFXRDw4m6Oy2Cy2nhTXN/VnIn9HN PlopNLk9hM6xZdRZkZFWdSHBd575euFgndOtBBj0fOtek49TSiIp+EgrPk2GrFt/ ywaZWWDYWGWVjUTR939+J399roD1B0y2PpxxVJkES/1Y+Zj0 -----END CERTIFICATE----- # Issuer: CN=DigiCert Assured ID Root G2 O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Assured ID Root G2 O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Assured ID Root G2" # Serial: 15385348160840213938643033620894905419 # MD5 Fingerprint: 92:38:b9:f8:63:24:82:65:2c:57:33:e6:fe:81:8f:9d # SHA1 Fingerprint: a1:4b:48:d9:43:ee:0a:0e:40:90:4f:3c:e0:a4:c0:91:93:51:5d:3f # SHA256 Fingerprint: 7d:05:eb:b6:82:33:9f:8c:94:51:ee:09:4e:eb:fe:fa:79:53:a1:14:ed:b2:f4:49:49:45:2f:ab:7d:2f:c1:85 -----BEGIN CERTIFICATE----- MIIDljCCAn6gAwIBAgIQC5McOtY5Z+pnI7/Dr5r0SzANBgkqhkiG9w0BAQsFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv b3QgRzIwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBlMQswCQYDVQQG EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzIwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ5ygvUj82ckmIkzTz+GoeMVSA n61UQbVH35ao1K+ALbkKz3X9iaV9JPrjIgwrvJUXCzO/GU1BBpAAvQxNEP4Htecc biJVMWWXvdMX0h5i89vqbFCMP4QMls+3ywPgym2hFEwbid3tALBSfK+RbLE4E9Hp EgjAALAcKxHad3A2m67OeYfcgnDmCXRwVWmvo2ifv922ebPynXApVfSr/5Vh88lA bx3RvpO704gqu52/clpWcTs/1PPRCv4o76Pu2ZmvA9OPYLfykqGxvYmJHzDNw6Yu YjOuFgJ3RFrngQo8p0Quebg/BLxcoIfhG69Rjs3sLPr4/m3wOnyqi+RnlTGNAgMB AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQW BBTOw0q5mVXyuNtgv6l+vVa1lzan1jANBgkqhkiG9w0BAQsFAAOCAQEAyqVVjOPI QW5pJ6d1Ee88hjZv0p3GeDgdaZaikmkuOGybfQTUiaWxMTeKySHMq2zNixya1r9I 0jJmwYrA8y8678Dj1JGG0VDjA9tzd29KOVPt3ibHtX2vK0LRdWLjSisCx1BL4Gni lmwORGYQRI+tBev4eaymG+g3NJ1TyWGqolKvSnAWhsI6yLETcDbYz+70CjTVW0z9 B5yiutkBclzzTcHdDrEcDcRjvq30FPuJ7KJBDkzMyFdA0G4Dqs0MjomZmWzwPDCv ON9vvKO+KSAnq3T/EyJ43pdSVR6DtVQgA+6uwE9W3jfMw3+qBCe703e4YtsXfJwo IhNzbM8m9Yop5w== -----END CERTIFICATE----- # Issuer: CN=DigiCert Assured ID Root G3 O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Assured ID Root G3 O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Assured ID Root G3" # Serial: 15459312981008553731928384953135426796 # MD5 Fingerprint: 7c:7f:65:31:0c:81:df:8d:ba:3e:99:e2:5c:ad:6e:fb # SHA1 Fingerprint: f5:17:a2:4f:9a:48:c6:c9:f8:a2:00:26:9f:dc:0f:48:2c:ab:30:89 # SHA256 Fingerprint: 7e:37:cb:8b:4c:47:09:0c:ab:36:55:1b:a6:f4:5d:b8:40:68:0f:ba:16:6a:95:2d:b1:00:71:7f:43:05:3f:c2 -----BEGIN CERTIFICATE----- MIICRjCCAc2gAwIBAgIQC6Fa+h3foLVJRK/NJKBs7DAKBggqhkjOPQQDAzBlMQsw CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu ZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3Qg RzMwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBlMQswCQYDVQQGEwJV UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu Y29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzMwdjAQBgcq hkjOPQIBBgUrgQQAIgNiAAQZ57ysRGXtzbg/WPuNsVepRC0FFfLvC/8QdJ+1YlJf Zn4f5dwbRXkLzMZTCp2NXQLZqVneAlr2lSoOjThKiknGvMYDOAdfVdp+CW7if17Q RSAPWXYQ1qAk8C3eNvJsKTmjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/ BAQDAgGGMB0GA1UdDgQWBBTL0L2p4ZgFUaFNN6KDec6NHSrkhDAKBggqhkjOPQQD AwNnADBkAjAlpIFFAmsSS3V0T8gj43DydXLefInwz5FyYZ5eEJJZVrmDxxDnOOlY JjZ91eQ0hjkCMHw2U/Aw5WJjOpnitqM7mzT6HtoQknFekROn3aRukswy1vUhZscv 6pZjamVFkpUBtA== -----END CERTIFICATE----- # Issuer: CN=DigiCert Global Root G2 O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Global Root G2 O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Global Root G2" # Serial: 4293743540046975378534879503202253541 # MD5 Fingerprint: e4:a6:8a:c8:54:ac:52:42:46:0a:fd:72:48:1b:2a:44 # SHA1 Fingerprint: df:3c:24:f9:bf:d6:66:76:1b:26:80:73:fe:06:d1:cc:8d:4f:82:a4 # SHA256 Fingerprint: cb:3c:cb:b7:60:31:e5:e0:13:8f:8d:d3:9a:23:f9:de:47:ff:c3:5e:43:c1:14:4c:ea:27:d4:6a:5a:b1:cb:5f -----BEGIN CERTIFICATE----- MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI 2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx 1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV 5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY 1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4 NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91 8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl MrY= -----END CERTIFICATE----- # Issuer: CN=DigiCert Global Root G3 O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Global Root G3 O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Global Root G3" # Serial: 7089244469030293291760083333884364146 # MD5 Fingerprint: f5:5d:a4:50:a5:fb:28:7e:1e:0f:0d:cc:96:57:56:ca # SHA1 Fingerprint: 7e:04:de:89:6a:3e:66:6d:00:e6:87:d3:3f:fa:d9:3b:e8:3d:34:9e # SHA256 Fingerprint: 31:ad:66:48:f8:10:41:38:c7:38:f3:9e:a4:32:01:33:39:3e:3a:18:cc:02:29:6e:f9:7c:2a:c9:ef:67:31:d0 -----BEGIN CERTIFICATE----- MIICPzCCAcWgAwIBAgIQBVVWvPJepDU1w6QP1atFcjAKBggqhkjOPQQDAzBhMQsw CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu ZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMzAe Fw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVTMRUw EwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x IDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEczMHYwEAYHKoZIzj0CAQYF K4EEACIDYgAE3afZu4q4C/sLfyHS8L6+c/MzXRq8NOrexpu80JX28MzQC7phW1FG fp4tn+6OYwwX7Adw9c+ELkCDnOg/QW07rdOkFFk2eJ0DQ+4QE2xy3q6Ip6FrtUPO Z9wj/wMco+I+o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAd BgNVHQ4EFgQUs9tIpPmhxdiuNkHMEWNpYim8S8YwCgYIKoZIzj0EAwMDaAAwZQIx AK288mw/EkrRLTnDCgmXc/SINoyIJ7vmiI1Qhadj+Z4y3maTD/HMsQmP3Wyr+mt/ oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34VOKa5Vt8 sycX -----END CERTIFICATE----- # Issuer: CN=DigiCert Trusted Root G4 O=DigiCert Inc OU=www.digicert.com # Subject: CN=DigiCert Trusted Root G4 O=DigiCert Inc OU=www.digicert.com # Label: "DigiCert Trusted Root G4" # Serial: 7451500558977370777930084869016614236 # MD5 Fingerprint: 78:f2:fc:aa:60:1f:2f:b4:eb:c9:37:ba:53:2e:75:49 # SHA1 Fingerprint: dd:fb:16:cd:49:31:c9:73:a2:03:7d:3f:c8:3a:4d:7d:77:5d:05:e4 # SHA256 Fingerprint: 55:2f:7b:dc:f1:a7:af:9e:6c:e6:72:01:7f:4f:12:ab:f7:72:40:c7:8e:76:1a:c2:03:d1:d9:d2:0a:c8:99:88 -----BEGIN CERTIFICATE----- MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/ CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t 9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2 SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd +SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N 0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie 4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1 /YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+ -----END CERTIFICATE----- # Issuer: CN=COMODO RSA Certification Authority O=COMODO CA Limited # Subject: CN=COMODO RSA Certification Authority O=COMODO CA Limited # Label: "COMODO RSA Certification Authority" # Serial: 101909084537582093308941363524873193117 # MD5 Fingerprint: 1b:31:b0:71:40:36:cc:14:36:91:ad:c4:3e:fd:ec:18 # SHA1 Fingerprint: af:e5:d2:44:a8:d1:19:42:30:ff:47:9f:e2:f8:97:bb:cd:7a:8c:b4 # SHA256 Fingerprint: 52:f0:e1:c4:e5:8e:c6:29:29:1b:60:31:7f:07:46:71:b8:5d:7e:a8:0d:5b:07:27:34:63:53:4b:32:b4:02:34 -----BEGIN CERTIFICATE----- MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5 MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR 6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC 9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV /erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z +pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB /wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM 4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV 2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl 0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB NVOFBkpdn627G190 -----END CERTIFICATE----- # Issuer: CN=USERTrust RSA Certification Authority O=The USERTRUST Network # Subject: CN=USERTrust RSA Certification Authority O=The USERTRUST Network # Label: "USERTrust RSA Certification Authority" # Serial: 2645093764781058787591871645665788717 # MD5 Fingerprint: 1b:fe:69:d1:91:b7:19:33:a3:72:a8:0f:e1:55:e5:b5 # SHA1 Fingerprint: 2b:8f:1b:57:33:0d:bb:a2:d0:7a:6c:51:f7:0e:e9:0d:da:b9:ad:8e # SHA256 Fingerprint: e7:93:c9:b0:2f:d8:aa:13:e2:1c:31:22:8a:cc:b0:81:19:64:3b:74:9c:89:89:64:b1:74:6d:46:c3:d4:cb:d2 -----BEGIN CERTIFICATE----- MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B 3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/ Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2 VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT 79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6 c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3 ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs 8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/ qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG jjxDah2nGN59PRbxYvnKkKj9 -----END CERTIFICATE----- # Issuer: CN=USERTrust ECC Certification Authority O=The USERTRUST Network # Subject: CN=USERTrust ECC Certification Authority O=The USERTRUST Network # Label: "USERTrust ECC Certification Authority" # Serial: 123013823720199481456569720443997572134 # MD5 Fingerprint: fa:68:bc:d9:b5:7f:ad:fd:c9:1d:06:83:28:cc:24:c1 # SHA1 Fingerprint: d1:cb:ca:5d:b2:d5:2a:7f:69:3b:67:4d:e5:f0:5a:1d:0c:95:7d:f0 # SHA256 Fingerprint: 4f:f4:60:d5:4b:9c:86:da:bf:bc:fc:57:12:e0:40:0d:2b:ed:3f:bc:4d:4f:bd:aa:86:e0:6a:dc:d2:a9:ad:7a -----BEGIN CERTIFICATE----- MIICjzCCAhWgAwIBAgIQXIuZxVqUxdJxVt7NiYDMJjAKBggqhkjOPQQDAzCBiDEL MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAx MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT Ck5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUg VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQarFRaqflo I+d61SRvU8Za2EurxtW20eZzca7dnNYMYf3boIkDuAUU7FfO7l0/4iGzzvfUinng o4N+LZfQYcTxmdwlkWOrfzCjtHDix6EznPO/LlxTsV+zfTJ/ijTjeXmjQjBAMB0G A1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAOBgNVHQ8BAf8EBAMCAQYwDwYD VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjA2Z6EWCNzklwBBHU6+4WMB zzuqQhFkoJ2UOQIReVx7Hfpkue4WQrO/isIJxOzksU0CMQDpKmFHjFJKS04YcPbW RNZu9YO6bVi9JNlWSOrvxKJGgYhqOkbRqZtNyWHa0V1Xahg= -----END CERTIFICATE----- # Issuer: CN=GlobalSign O=GlobalSign OU=GlobalSign ECC Root CA - R4 # Subject: CN=GlobalSign O=GlobalSign OU=GlobalSign ECC Root CA - R4 # Label: "GlobalSign ECC Root CA - R4" # Serial: 14367148294922964480859022125800977897474 # MD5 Fingerprint: 20:f0:27:68:d1:7e:a0:9d:0e:e6:2a:ca:df:5c:89:8e # SHA1 Fingerprint: 69:69:56:2e:40:80:f4:24:a1:e7:19:9f:14:ba:f3:ee:58:ab:6a:bb # SHA256 Fingerprint: be:c9:49:11:c2:95:56:76:db:6c:0a:55:09:86:d7:6e:3b:a0:05:66:7c:44:2c:97:62:b4:fb:b7:73:de:22:8c -----BEGIN CERTIFICATE----- MIIB4TCCAYegAwIBAgIRKjikHJYKBN5CsiilC+g0mAIwCgYIKoZIzj0EAwIwUDEk MCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI0MRMwEQYDVQQKEwpH bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoX DTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBD QSAtIFI0MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMZ5049sJQ6fLjkZHAOkrprlOQcJ FspjsbmG+IpXwVfOQvpzofdlQv8ewQCybnMO/8ch5RikqtlxP6jUuc6MHaNCMEAw DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFSwe61F uOJAf/sKbvu+M8k8o4TVMAoGCCqGSM49BAMCA0gAMEUCIQDckqGgE6bPA7DmxCGX kPoUVy0D7O48027KqGx2vKLeuwIgJ6iFJzWbVsaj8kfSt24bAgAXqmemFZHe+pTs ewv4n4Q= -----END CERTIFICATE----- # Issuer: CN=GlobalSign O=GlobalSign OU=GlobalSign ECC Root CA - R5 # Subject: CN=GlobalSign O=GlobalSign OU=GlobalSign ECC Root CA - R5 # Label: "GlobalSign ECC Root CA - R5" # Serial: 32785792099990507226680698011560947931244 # MD5 Fingerprint: 9f:ad:3b:1c:02:1e:8a:ba:17:74:38:81:0c:a2:bc:08 # SHA1 Fingerprint: 1f:24:c6:30:cd:a4:18:ef:20:69:ff:ad:4f:dd:5f:46:3a:1b:69:aa # SHA256 Fingerprint: 17:9f:bc:14:8a:3d:d0:0f:d2:4e:a1:34:58:cc:43:bf:a7:f5:9c:81:82:d7:83:a5:13:f6:eb:ec:10:0c:89:24 -----BEGIN CERTIFICATE----- MIICHjCCAaSgAwIBAgIRYFlJ4CYuu1X5CneKcflK2GwwCgYIKoZIzj0EAwMwUDEk MCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI1MRMwEQYDVQQKEwpH bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoX DTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBD QSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc 8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke hOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYD VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUPeYpSJvqB8ohREom3m7e0oPQn1kwCgYI KoZIzj0EAwMDaAAwZQIxAOVpEslu28YxuglB4Zf4+/2a4n0Sye18ZNPLBSWLVtmg 515dTguDnFt2KaAJJiFqYgIwcdK1j1zqO+F4CYWodZI7yFz9SO8NdCKoCOJuxUnO xwy8p2Fp8fc74SrL+SvzZpA3 -----END CERTIFICATE----- # Issuer: CN=Staat der Nederlanden Root CA - G3 O=Staat der Nederlanden # Subject: CN=Staat der Nederlanden Root CA - G3 O=Staat der Nederlanden # Label: "Staat der Nederlanden Root CA - G3" # Serial: 10003001 # MD5 Fingerprint: 0b:46:67:07:db:10:2f:19:8c:35:50:60:d1:0b:f4:37 # SHA1 Fingerprint: d8:eb:6b:41:51:92:59:e0:f3:e7:85:00:c0:3d:b6:88:97:c9:ee:fc # SHA256 Fingerprint: 3c:4f:b0:b9:5a:b8:b3:00:32:f4:32:b8:6f:53:5f:e1:72:c1:85:d0:fd:39:86:58:37:cf:36:18:7f:a6:f4:28 -----BEGIN CERTIFICATE----- MIIFdDCCA1ygAwIBAgIEAJiiOTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJO TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSswKQYDVQQDDCJTdGFh dCBkZXIgTmVkZXJsYW5kZW4gUm9vdCBDQSAtIEczMB4XDTEzMTExNDExMjg0MloX DTI4MTExMzIzMDAwMFowWjELMAkGA1UEBhMCTkwxHjAcBgNVBAoMFVN0YWF0IGRl ciBOZWRlcmxhbmRlbjErMCkGA1UEAwwiU3RhYXQgZGVyIE5lZGVybGFuZGVuIFJv b3QgQ0EgLSBHMzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL4yolQP cPssXFnrbMSkUeiFKrPMSjTysF/zDsccPVMeiAho2G89rcKezIJnByeHaHE6n3WW IkYFsO2tx1ueKt6c/DrGlaf1F2cY5y9JCAxcz+bMNO14+1Cx3Gsy8KL+tjzk7FqX xz8ecAgwoNzFs21v0IJyEavSgWhZghe3eJJg+szeP4TrjTgzkApyI/o1zCZxMdFy KJLZWyNtZrVtB0LrpjPOktvA9mxjeM3KTj215VKb8b475lRgsGYeCasH/lSJEULR 9yS6YHgamPfJEf0WwTUaVHXvQ9Plrk7O53vDxk5hUUurmkVLoR9BvUhTFXFkC4az 5S6+zqQbwSmEorXLCCN2QyIkHxcE1G6cxvx/K2Ya7Irl1s9N9WMJtxU51nus6+N8 6U78dULI7ViVDAZCopz35HCz33JvWjdAidiFpNfxC95DGdRKWCyMijmev4SH8RY7 Ngzp07TKbBlBUgmhHbBqv4LvcFEhMtwFdozL92TkA1CvjJFnq8Xy7ljY3r735zHP bMk7ccHViLVlvMDoFxcHErVc0qsgk7TmgoNwNsXNo42ti+yjwUOH5kPiNL6VizXt BznaqB16nzaeErAMZRKQFWDZJkBE41ZgpRDUajz9QdwOWke275dhdU/Z/seyHdTt XUmzqWrLZoQT1Vyg3N9udwbRcXXIV2+vD3dbAgMBAAGjQjBAMA8GA1UdEwEB/wQF MAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRUrfrHkleuyjWcLhL75Lpd INyUVzANBgkqhkiG9w0BAQsFAAOCAgEAMJmdBTLIXg47mAE6iqTnB/d6+Oea31BD U5cqPco8R5gu4RV78ZLzYdqQJRZlwJ9UXQ4DO1t3ApyEtg2YXzTdO2PCwyiBwpwp LiniyMMB8jPqKqrMCQj3ZWfGzd/TtiunvczRDnBfuCPRy5FOCvTIeuXZYzbB1N/8 Ipf3YF3qKS9Ysr1YvY2WTxB1v0h7PVGHoTx0IsL8B3+A3MSs/mrBcDCw6Y5p4ixp gZQJut3+TcCDjJRYwEYgr5wfAvg1VUkvRtTA8KCWAg8zxXHzniN9lLf9OtMJgwYh /WA9rjLA0u6NpvDntIJ8CsxwyXmA+P5M9zWEGYox+wrZ13+b8KKaa8MFSu1BYBQw 0aoRQm7TIwIEC8Zl3d1Sd9qBa7Ko+gE4uZbqKmxnl4mUnrzhVNXkanjvSr0rmj1A fsbAddJu+2gw7OyLnflJNZoaLNmzlTnVHpL3prllL+U9bTpITAjc5CgSKL59NVzq 4BZ+Extq1z7XnvwtdbLBFNUjA9tbbws+eC8N3jONFrdI54OagQ97wUNNVQQXOEpR 1VmiiXTTn74eS9fGbbeIJG9gkaSChVtWQbzQRKtqE77RLFi3EjNYsjdj3BP1lB0/ QFH1T/U67cjF68IeHRaVesd+QnGTbksVtzDfqu1XhUisHWrdOWnk4Xl4vs4Fv6EM 94B7IWcnMFk= -----END CERTIFICATE----- # Issuer: CN=Staat der Nederlanden EV Root CA O=Staat der Nederlanden # Subject: CN=Staat der Nederlanden EV Root CA O=Staat der Nederlanden # Label: "Staat der Nederlanden EV Root CA" # Serial: 10000013 # MD5 Fingerprint: fc:06:af:7b:e8:1a:f1:9a:b4:e8:d2:70:1f:c0:f5:ba # SHA1 Fingerprint: 76:e2:7e:c1:4f:db:82:c1:c0:a6:75:b5:05:be:3d:29:b4:ed:db:bb # SHA256 Fingerprint: 4d:24:91:41:4c:fe:95:67:46:ec:4c:ef:a6:cf:6f:72:e2:8a:13:29:43:2f:9d:8a:90:7a:c4:cb:5d:ad:c1:5a -----BEGIN CERTIFICATE----- MIIFcDCCA1igAwIBAgIEAJiWjTANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJO TDEeMBwGA1UECgwVU3RhYXQgZGVyIE5lZGVybGFuZGVuMSkwJwYDVQQDDCBTdGFh dCBkZXIgTmVkZXJsYW5kZW4gRVYgUm9vdCBDQTAeFw0xMDEyMDgxMTE5MjlaFw0y MjEyMDgxMTEwMjhaMFgxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVTdGFhdCBkZXIg TmVkZXJsYW5kZW4xKTAnBgNVBAMMIFN0YWF0IGRlciBOZWRlcmxhbmRlbiBFViBS b290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA48d+ifkkSzrS M4M1LGns3Amk41GoJSt5uAg94JG6hIXGhaTK5skuU6TJJB79VWZxXSzFYGgEt9nC UiY4iKTWO0Cmws0/zZiTs1QUWJZV1VD+hq2kY39ch/aO5ieSZxeSAgMs3NZmdO3d Z//BYY1jTw+bbRcwJu+r0h8QoPnFfxZpgQNH7R5ojXKhTbImxrpsX23Wr9GxE46p rfNeaXUmGD5BKyF/7otdBwadQ8QpCiv8Kj6GyzyDOvnJDdrFmeK8eEEzduG/L13l pJhQDBXd4Pqcfzho0LKmeqfRMb1+ilgnQ7O6M5HTp5gVXJrm0w912fxBmJc+qiXb j5IusHsMX/FjqTf5m3VpTCgmJdrV8hJwRVXj33NeN/UhbJCONVrJ0yPr08C+eKxC KFhmpUZtcALXEPlLVPxdhkqHz3/KRawRWrUgUY0viEeXOcDPusBCAUCZSCELa6fS /ZbV0b5GnUngC6agIk440ME8MLxwjyx1zNDFjFE7PZQIZCZhfbnDZY8UnCHQqv0X cgOPvZuM5l5Tnrmd74K74bzickFbIZTTRTeU0d8JOV3nI6qaHcptqAqGhYqCvkIH 1vI4gnPah1vlPNOePqc7nvQDs/nxfRN0Av+7oeX6AHkcpmZBiFxgV6YuCcS6/ZrP px9Aw7vMWgpVSzs4dlG4Y4uElBbmVvMCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB /zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFP6rAJCYniT8qcwaivsnuL8wbqg7 MA0GCSqGSIb3DQEBCwUAA4ICAQDPdyxuVr5Os7aEAJSrR8kN0nbHhp8dB9O2tLsI eK9p0gtJ3jPFrK3CiAJ9Brc1AsFgyb/E6JTe1NOpEyVa/m6irn0F3H3zbPB+po3u 2dfOWBfoqSmuc0iH55vKbimhZF8ZE/euBhD/UcabTVUlT5OZEAFTdfETzsemQUHS v4ilf0X8rLiltTMMgsT7B/Zq5SWEXwbKwYY5EdtYzXc7LMJMD16a4/CrPmEbUCTC wPTxGfARKbalGAKb12NMcIxHowNDXLldRqANb/9Zjr7dn3LDWyvfjFvO5QxGbJKy CqNMVEIYFRIYvdr8unRu/8G2oGTYqV9Vrp9canaW2HNnh/tNf1zuacpzEPuKqf2e vTY4SUmH9A4U8OmHuD+nT3pajnnUk+S7aFKErGzp85hwVXIy+TSrK0m1zSBi5Dp6 Z2Orltxtrpfs/J92VoguZs9btsmksNcFuuEnL5O7Jiqik7Ab846+HUCjuTaPPoIa Gl6I6lD4WeKDRikL40Rc4ZW2aZCaFG+XroHPaO+Zmr615+F/+PoTRxZMzG0IQOeL eG9QgkRQP2YGiqtDhFZKDyAthg710tvSeopLzaXoTvFeJiUBWSOgftL2fiFX1ye8 FVdMpEbB4IMeDExNH08GGeL5qPQ6gqGyeUN51q1veieQA6TqJIc/2b3Z6fJfUEkc 7uzXLg== -----END CERTIFICATE----- # Issuer: CN=IdenTrust Commercial Root CA 1 O=IdenTrust # Subject: CN=IdenTrust Commercial Root CA 1 O=IdenTrust # Label: "IdenTrust Commercial Root CA 1" # Serial: 13298821034946342390520003877796839426 # MD5 Fingerprint: b3:3e:77:73:75:ee:a0:d3:e3:7e:49:63:49:59:bb:c7 # SHA1 Fingerprint: df:71:7e:aa:4a:d9:4e:c9:55:84:99:60:2d:48:de:5f:bc:f0:3a:25 # SHA256 Fingerprint: 5d:56:49:9b:e4:d2:e0:8b:cf:ca:d0:8a:3e:38:72:3d:50:50:3b:de:70:69:48:e4:2f:55:60:30:19:e5:28:ae -----BEGIN CERTIFICATE----- MIIFYDCCA0igAwIBAgIQCgFCgAAAAUUjyES1AAAAAjANBgkqhkiG9w0BAQsFADBK MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVu VHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwHhcNMTQwMTE2MTgxMjIzWhcNMzQw MTE2MTgxMjIzWjBKMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScw JQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwggIiMA0GCSqG SIb3DQEBAQUAA4ICDwAwggIKAoICAQCnUBneP5k91DNG8W9RYYKyqU+PZ4ldhNlT 3Qwo2dfw/66VQ3KZ+bVdfIrBQuExUHTRgQ18zZshq0PirK1ehm7zCYofWjK9ouuU +ehcCuz/mNKvcbO0U59Oh++SvL3sTzIwiEsXXlfEU8L2ApeN2WIrvyQfYo3fw7gp S0l4PJNgiCL8mdo2yMKi1CxUAGc1bnO/AljwpN3lsKImesrgNqUZFvX9t++uP0D1 bVoE/c40yiTcdCMbXTMTEl3EASX2MN0CXZ/g1Ue9tOsbobtJSdifWwLziuQkkORi T0/Br4sOdBeo0XKIanoBScy0RnnGF7HamB4HWfp1IYVl3ZBWzvurpWCdxJ35UrCL vYf5jysjCiN2O/cz4ckA82n5S6LgTrx+kzmEB/dEcH7+B1rlsazRGMzyNeVJSQjK Vsk9+w8YfYs7wRPCTY/JTw436R+hDmrfYi7LNQZReSzIJTj0+kuniVyc0uMNOYZK dHzVWYfCP04MXFL0PfdSgvHqo6z9STQaKPNBiDoT7uje/5kdX7rL6B7yuVBgwDHT c+XvvqDtMwt0viAgxGds8AgDelWAf0ZOlqf0Hj7h9tgJ4TNkK2PXMl6f+cB7D3hv l7yTmvmcEpB4eoCHFddydJxVdHixuuFucAS6T6C6aMN7/zHwcz09lCqxC0EOoP5N iGVreTO01wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB /zAdBgNVHQ4EFgQU7UQZwNPwBovupHu+QucmVMiONnYwDQYJKoZIhvcNAQELBQAD ggIBAA2ukDL2pkt8RHYZYR4nKM1eVO8lvOMIkPkp165oCOGUAFjvLi5+U1KMtlwH 6oi6mYtQlNeCgN9hCQCTrQ0U5s7B8jeUeLBfnLOic7iPBZM4zY0+sLj7wM+x8uwt LRvM7Kqas6pgghstO8OEPVeKlh6cdbjTMM1gCIOQ045U8U1mwF10A0Cj7oV+wh93 nAbowacYXVKV7cndJZ5t+qntozo00Fl72u1Q8zW/7esUTTHHYPTa8Yec4kjixsU3 +wYQ+nVZZjFHKdp2mhzpgq7vmrlR94gjmmmVYjzlVYA211QC//G5Xc7UI2/YRYRK W2XviQzdFKcgyxilJbQN+QHwotL0AMh0jqEqSI5l2xPE4iUXfeu+h1sXIFRRk0pT AwvsXcoz7WL9RccvW9xYoIA55vrX/hMUpu09lEpCdNTDd1lzzY9GvlU47/rokTLq l1gEIt44w8y8bckzOmoKaT+gyOpyj4xjhiO9bTyWnpXgSUyqorkqG5w2gXjtw+hG 4iZZRHUe2XWJUc0QhJ1hYMtd+ZciTY6Y5uN/9lu7rs3KSoFrXgvzUeF0K+l+J6fZ mUlO+KWA2yUPHGNiiskzZ2s8EIPGrd6ozRaOjfAHN3Gf8qv8QfXBi+wAN10J5U6A 7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7RcGzM7vRX+Bi6hG6H -----END CERTIFICATE----- # Issuer: CN=IdenTrust Public Sector Root CA 1 O=IdenTrust # Subject: CN=IdenTrust Public Sector Root CA 1 O=IdenTrust # Label: "IdenTrust Public Sector Root CA 1" # Serial: 13298821034946342390521976156843933698 # MD5 Fingerprint: 37:06:a5:b0:fc:89:9d:ba:f4:6b:8c:1a:64:cd:d5:ba # SHA1 Fingerprint: ba:29:41:60:77:98:3f:f4:f3:ef:f2:31:05:3b:2e:ea:6d:4d:45:fd # SHA256 Fingerprint: 30:d0:89:5a:9a:44:8a:26:20:91:63:55:22:d1:f5:20:10:b5:86:7a:ca:e1:2c:78:ef:95:8f:d4:f4:38:9f:2f -----BEGIN CERTIFICATE----- MIIFZjCCA06gAwIBAgIQCgFCgAAAAUUjz0Z8AAAAAjANBgkqhkiG9w0BAQsFADBN MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MSowKAYDVQQDEyFJZGVu VHJ1c3QgUHVibGljIFNlY3RvciBSb290IENBIDEwHhcNMTQwMTE2MTc1MzMyWhcN MzQwMTE2MTc1MzMyWjBNMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0 MSowKAYDVQQDEyFJZGVuVHJ1c3QgUHVibGljIFNlY3RvciBSb290IENBIDEwggIi MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2IpT8pEiv6EdrCvsnduTyP4o7 ekosMSqMjbCpwzFrqHd2hCa2rIFCDQjrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy RBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS bdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF /YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R 3j6HEDbhuaR672BQssvKplbgN6+rNBM5Jeg5ZuSYeqoSmJxZZoY+rfGwyj4GD3vw EUs3oERte8uojHH01bWRNszwFcYr3lEXsZdMUD2xlVl8BX0tIdUAvwFnol57plzy 9yLxkA2T26pEUWbMfXYD62qoKjgZl3YNa4ph+bz27nb9cCvdKTz4Ch5bQhyLVi9V GxyhLrXHFub4qjySjmm2AcG1hp2JDws4lFTo6tyePSW8Uybt1as5qsVATFSrsrTZ 2fjXctscvG29ZV/viDUqZi/u9rNl8DONfJhBaUYPQxxp+pu10GFqzcpL2UyQRqsV WaFHVCkugyhfHMKiq3IXAAaOReyL4jM9f9oZRORicsPfIsbyVtTdX5Vy7W1f90gD W/3FKqD2cyOEEBsB5wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/ BAUwAwEB/zAdBgNVHQ4EFgQU43HgntinQtnbcZFrlJPrw6PRFKMwDQYJKoZIhvcN AQELBQADggIBAEf63QqwEZE4rU1d9+UOl1QZgkiHVIyqZJnYWv6IAcVYpZmxI1Qj t2odIFflAWJBF9MJ23XLblSQdf4an4EKwt3X9wnQW3IV5B4Jaj0z8yGa5hV+rVHV DRDtfULAj+7AmgjVQdZcDiFpboBhDhXAuM/FSRJSzL46zNQuOAXeNf0fb7iAaJg9 TaDKQGXSc3z1i9kKlT/YPyNtGtEqJBnZhbMX73huqVjRI9PHE+1yJX9dsXNw0H8G lwmEKYBhHfpe/3OsoOOJuBxxFcbeMX8S3OFtm6/n6J91eEyrRjuazr8FGF1NFTwW mhlQBJqymm9li1JfPFgEKCXAZmExfrngdbkaqIHWchezxQMxNRF4eKLg6TCMf4Df WN88uieW4oA0beOY02QnrEh+KHdcxiVhJfiFDGX6xDIvpZgF5PgLZxYWxoK4Mhn5 +bl53B/N66+rDt0b20XkeucC4pVd/GnwU2lhlXV5C15V5jgclKlZM57IcXR5f1GJ tshquDDIajjDbp7hNxbqBWJMWxJH7ae0s1hWx0nzfxJoCTFx8G34Tkf71oXuxVhA GaQdp/lLQzfcaFpPz+vCZHTetBXZ9FRUGi8c15dxVJCO2SCdUyt/q4/i6jC8UDfv 8Ue1fXwsBOxonbRJRBD0ckscZOf85muQ3Wl9af0AVqW3rLatt8o+Ae+c -----END CERTIFICATE----- # Issuer: CN=Entrust Root Certification Authority - G2 O=Entrust, Inc. OU=See www.entrust.net/legal-terms/(c) 2009 Entrust, Inc. - for authorized use only # Subject: CN=Entrust Root Certification Authority - G2 O=Entrust, Inc. OU=See www.entrust.net/legal-terms/(c) 2009 Entrust, Inc. - for authorized use only # Label: "Entrust Root Certification Authority - G2" # Serial: 1246989352 # MD5 Fingerprint: 4b:e2:c9:91:96:65:0c:f4:0e:5a:93:92:a0:0a:fe:b2 # SHA1 Fingerprint: 8c:f4:27:fd:79:0c:3a:d1:66:06:8d:e8:1e:57:ef:bb:93:22:72:d4 # SHA256 Fingerprint: 43:df:57:74:b0:3e:7f:ef:5f:e4:0d:93:1a:7b:ed:f1:bb:2e:6b:42:73:8c:4e:6d:38:41:10:3d:3a:a7:f3:39 -----BEGIN CERTIFICATE----- MIIEPjCCAyagAwIBAgIESlOMKDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMC VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50 cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3Qs IEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVz dCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIwHhcNMDkwNzA3MTcy NTU0WhcNMzAxMjA3MTc1NTU0WjCBvjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVu dHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwt dGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0 aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmlj YXRpb24gQXV0aG9yaXR5IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQC6hLZy254Ma+KZ6TABp3bqMriVQRrJ2mFOWHLP/vaCeb9zYQYKpSfYs1/T RU4cctZOMvJyig/3gxnQaoCAAEUesMfnmr8SVycco2gvCoe9amsOXmXzHHfV1IWN cCG0szLni6LVhjkCsbjSR87kyUnEO6fe+1R9V77w6G7CebI6C1XiUJgWMhNcL3hW wcKUs/Ja5CeanyTXxuzQmyWC48zCxEXFjJd6BmsqEZ+pCm5IO2/b1BEZQvePB7/1 U1+cPvQXLOZprE4yTGJ36rfo5bs0vBmLrpxR57d+tVOxMyLlbc9wPBr64ptntoP0 jaWvYkxN4FisZDQSA/i2jZRjJKRxAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqciZ60B7vfec7aVHUbI2fkBJmqzAN BgkqhkiG9w0BAQsFAAOCAQEAeZ8dlsa2eT8ijYfThwMEYGprmi5ZiXMRrEPR9RP/ jTkrwPK9T3CMqS/qF8QLVJ7UG5aYMzyorWKiAHarWWluBh1+xLlEjZivEtRh2woZ Rkfz6/djwUAFQKXSt/S1mja/qYh2iARVBCuch38aNzx+LaUa2NSJXsq9rD1s2G2v 1fN2D807iDginWyTmsQ9v4IbZT+mD12q/OWyFcq1rca8PdCE6OoGcrBNOTJ4vz4R nAuknZoh8/CbCzB428Hch0P+vGOaysXCHMnHjf87ElgI5rY97HosTvuDls4MPGmH VHOkc8KT/1EQrBVUAdj8BbGJoX90g5pJ19xOe4pIb4tF9g== -----END CERTIFICATE----- # Issuer: CN=Entrust Root Certification Authority - EC1 O=Entrust, Inc. OU=See www.entrust.net/legal-terms/(c) 2012 Entrust, Inc. - for authorized use only # Subject: CN=Entrust Root Certification Authority - EC1 O=Entrust, Inc. OU=See www.entrust.net/legal-terms/(c) 2012 Entrust, Inc. - for authorized use only # Label: "Entrust Root Certification Authority - EC1" # Serial: 51543124481930649114116133369 # MD5 Fingerprint: b6:7e:1d:f0:58:c5:49:6c:24:3b:3d:ed:98:18:ed:bc # SHA1 Fingerprint: 20:d8:06:40:df:9b:25:f5:12:25:3a:11:ea:f7:59:8a:eb:14:b5:47 # SHA256 Fingerprint: 02:ed:0e:b2:8c:14:da:45:16:5c:56:67:91:70:0d:64:51:d7:fb:56:f0:b2:ab:1d:3b:8e:b0:70:e5:6e:df:f5 -----BEGIN CERTIFICATE----- MIIC+TCCAoCgAwIBAgINAKaLeSkAAAAAUNCR+TAKBggqhkjOPQQDAzCBvzELMAkG A1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3 d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDEyIEVu dHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEzMDEGA1UEAxMq RW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRUMxMB4XDTEy MTIxODE1MjUzNloXDTM3MTIxODE1NTUzNlowgb8xCzAJBgNVBAYTAlVTMRYwFAYD VQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3QubmV0 L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxMiBFbnRydXN0LCBJbmMuIC0g Zm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMzAxBgNVBAMTKkVudHJ1c3QgUm9vdCBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEVDMTB2MBAGByqGSM49AgEGBSuBBAAi A2IABIQTydC6bUF74mzQ61VfZgIaJPRbiWlH47jCffHyAsWfoPZb1YsGGYZPUxBt ByQnoaD41UcZYUx9ypMn6nQM72+WCf5j7HBdNq1nd67JnXxVRDqiY1Ef9eNi1KlH Bz7MIKNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O BBYEFLdj5xrdjekIplWDpOBqUEFlEUJJMAoGCCqGSM49BAMDA2cAMGQCMGF52OVC R98crlOZF7ZvHH3hvxGU0QOIdeSNiaSKd0bebWHvAvX7td/M/k7//qnmpwIwW5nX hTcGtXsI/esni0qU+eH6p44mCOh8kmhtc9hvJqwhAriZtyZBWyVgrtBIGu4G -----END CERTIFICATE----- # Issuer: CN=CFCA EV ROOT O=China Financial Certification Authority # Subject: CN=CFCA EV ROOT O=China Financial Certification Authority # Label: "CFCA EV ROOT" # Serial: 407555286 # MD5 Fingerprint: 74:e1:b6:ed:26:7a:7a:44:30:33:94:ab:7b:27:81:30 # SHA1 Fingerprint: e2:b8:29:4b:55:84:ab:6b:58:c2:90:46:6c:ac:3f:b8:39:8f:84:83 # SHA256 Fingerprint: 5c:c3:d7:8e:4e:1d:5e:45:54:7a:04:e6:87:3e:64:f9:0c:f9:53:6d:1c:cc:2e:f8:00:f3:55:c4:c5:fd:70:fd -----BEGIN CERTIFICATE----- MIIFjTCCA3WgAwIBAgIEGErM1jANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJD TjEwMC4GA1UECgwnQ2hpbmEgRmluYW5jaWFsIENlcnRpZmljYXRpb24gQXV0aG9y aXR5MRUwEwYDVQQDDAxDRkNBIEVWIFJPT1QwHhcNMTIwODA4MDMwNzAxWhcNMjkx MjMxMDMwNzAxWjBWMQswCQYDVQQGEwJDTjEwMC4GA1UECgwnQ2hpbmEgRmluYW5j aWFsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRUwEwYDVQQDDAxDRkNBIEVWIFJP T1QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXXWvNED8fBVnVBU03 sQ7smCuOFR36k0sXgiFxEFLXUWRwFsJVaU2OFW2fvwwbwuCjZ9YMrM8irq93VCpL TIpTUnrD7i7es3ElweldPe6hL6P3KjzJIx1qqx2hp/Hz7KDVRM8Vz3IvHWOX6Jn5 /ZOkVIBMUtRSqy5J35DNuF++P96hyk0g1CXohClTt7GIH//62pCfCqktQT+x8Rgp 7hZZLDRJGqgG16iI0gNyejLi6mhNbiyWZXvKWfry4t3uMCz7zEasxGPrb382KzRz EpR/38wmnvFyXVBlWY9ps4deMm/DGIq1lY+wejfeWkU7xzbh72fROdOXW3NiGUgt hxwG+3SYIElz8AXSG7Ggo7cbcNOIabla1jj0Ytwli3i/+Oh+uFzJlU9fpy25IGvP a931DfSCt/SyZi4QKPaXWnuWFo8BGS1sbn85WAZkgwGDg8NNkt0yxoekN+kWzqot aK8KgWU6cMGbrU1tVMoqLUuFG7OA5nBFDWteNfB/O7ic5ARwiRIlk9oKmSJgamNg TnYGmE69g60dWIolhdLHZR4tjsbftsbhf4oEIRUpdPA+nJCdDC7xij5aqgwJHsfV PKPtl8MeNPo4+QgO48BdK4PRVmrJtqhUUy54Mmc9gn900PvhtgVguXDbjgv5E1hv cWAQUhC5wUEJ73IfZzF4/5YFjQIDAQABo2MwYTAfBgNVHSMEGDAWgBTj/i39KNAL tbq2osS/BqoFjJP7LzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd BgNVHQ4EFgQU4/4t/SjQC7W6tqLEvwaqBYyT+y8wDQYJKoZIhvcNAQELBQADggIB ACXGumvrh8vegjmWPfBEp2uEcwPenStPuiB/vHiyz5ewG5zz13ku9Ui20vsXiObT ej/tUxPQ4i9qecsAIyjmHjdXNYmEwnZPNDatZ8POQQaIxffu2Bq41gt/UP+TqhdL jOztUmCypAbqTuv0axn96/Ua4CUqmtzHQTb3yHQFhDmVOdYLO6Qn+gjYXB74BGBS ESgoA//vU2YApUo0FmZ8/Qmkrp5nGm9BC2sGE5uPhnEFtC+NiWYzKXZUmhH4J/qy P5Hgzg0b8zAarb8iXRvTvyUFTeGSGn+ZnzxEk8rUQElsgIfXBDrDMlI1Dlb4pd19 xIsNER9Tyx6yF7Zod1rg1MvIB671Oi6ON7fQAUtDKXeMOZePglr4UeWJoBjnaH9d Ci77o0cOPaYjesYBx4/IXr9tgFa+iiS6M+qf4TIRnvHST4D2G0CvOJ4RUHlzEhLN 5mydLIhyPDCBBpEi6lmt2hkuIsKNuYyH4Ga8cyNfIWRjgEj1oDwYPZTISEEdQLpe /v5WOaHIz16eGWRGENoXkbcFgKyLmZJ956LYBws2J+dIeWCKw9cTXPhyQN9Ky8+Z AAoACxGV2lZFA4gKn2fQ1XmxqI1AbQ3CekD6819kR5LLU7m7Wc5P/dAVUwHY3+vZ 5nbv0CO7O6l5s9UCKc2Jo5YPSjXnTkLAdc0Hz+Ys63su -----END CERTIFICATE----- # Issuer: CN=T\xdcRKTRUST Elektronik Sertifika Hizmet Sa\u011flay\u0131c\u0131s\u0131 H5 O=T\xdcRKTRUST Bilgi \u0130leti\u015fim ve Bili\u015fim G\xfcvenli\u011fi Hizmetleri A.\u015e. # Subject: CN=T\xdcRKTRUST Elektronik Sertifika Hizmet Sa\u011flay\u0131c\u0131s\u0131 H5 O=T\xdcRKTRUST Bilgi \u0130leti\u015fim ve Bili\u015fim G\xfcvenli\u011fi Hizmetleri A.\u015e. # Label: "T\xdcRKTRUST Elektronik Sertifika Hizmet Sa\u011flay\u0131c\u0131s\u0131 H5" # Serial: 156233699172481 # MD5 Fingerprint: da:70:8e:f0:22:df:93:26:f6:5f:9f:d3:15:06:52:4e # SHA1 Fingerprint: c4:18:f6:4d:46:d1:df:00:3d:27:30:13:72:43:a9:12:11:c6:75:fb # SHA256 Fingerprint: 49:35:1b:90:34:44:c1:85:cc:dc:5c:69:3d:24:d8:55:5c:b2:08:d6:a8:14:13:07:69:9f:4a:f0:63:19:9d:78 -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIHAI4X/iQggTANBgkqhkiG9w0BAQsFADCBsTELMAkGA1UE BhMCVFIxDzANBgNVBAcMBkFua2FyYTFNMEsGA1UECgxEVMOcUktUUlVTVCBCaWxn aSDEsGxldGnFn2ltIHZlIEJpbGnFn2ltIEfDvHZlbmxpxJ9pIEhpem1ldGxlcmkg QS7Fni4xQjBABgNVBAMMOVTDnFJLVFJVU1QgRWxla3Ryb25payBTZXJ0aWZpa2Eg SGl6bWV0IFNhxJ9sYXnEsWPEsXPEsSBINTAeFw0xMzA0MzAwODA3MDFaFw0yMzA0 MjgwODA3MDFaMIGxMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMU0wSwYD VQQKDERUw5xSS1RSVVNUIEJpbGdpIMSwbGV0acWfaW0gdmUgQmlsacWfaW0gR8O8 dmVubGnEn2kgSGl6bWV0bGVyaSBBLsWeLjFCMEAGA1UEAww5VMOcUktUUlVTVCBF bGVrdHJvbmlrIFNlcnRpZmlrYSBIaXptZXQgU2HEn2xhecSxY8Sxc8SxIEg1MIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApCUZ4WWe60ghUEoI5RHwWrom /4NZzkQqL/7hzmAD/I0Dpe3/a6i6zDQGn1k19uwsu537jVJp45wnEFPzpALFp/kR Gml1bsMdi9GYjZOHp3GXDSHHmflS0yxjXVW86B8BSLlg/kJK9siArs1mep5Fimh3 4khon6La8eHBEJ/rPCmBp+EyCNSgBbGM+42WAA4+Jd9ThiI7/PS98wl+d+yG6w8z 5UNP9FR1bSmZLmZaQ9/LXMrI5Tjxfjs1nQ/0xVqhzPMggCTTV+wVunUlm+hkS7M0 hO8EuPbJbKoCPrZV4jI3X/xml1/N1p7HIL9Nxqw/dV8c7TKcfGkAaZHjIxhT6QID AQABo0IwQDAdBgNVHQ4EFgQUVpkHHtOsDGlktAxQR95DLL4gwPswDgYDVR0PAQH/ BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAJ5FdnsX SDLyOIspve6WSk6BGLFRRyDN0GSxDsnZAdkJzsiZ3GglE9Rc8qPoBP5yCccLqh0l VX6Wmle3usURehnmp349hQ71+S4pL+f5bFgWV1Al9j4uPqrtd3GqqpmWRgqujuwq URawXs3qZwQcWDD1YIq9pr1N5Za0/EKJAWv2cMhQOQwt1WbZyNKzMrcbGW3LM/nf peYVhDfwwvJllpKQd/Ct9JDpEXjXk4nAPQu6KfTomZ1yju2dL+6SfaHx/126M2CF Yv4HAqGEVka+lgqaE9chTLd8B59OTj+RdPsnnRHM3eaxynFNExc5JsUpISuTKWqW +qtB4Uu2NQvAmxU= -----END CERTIFICATE----- # Issuer: CN=Certinomis - Root CA O=Certinomis OU=0002 433998903 # Subject: CN=Certinomis - Root CA O=Certinomis OU=0002 433998903 # Label: "Certinomis - Root CA" # Serial: 1 # MD5 Fingerprint: 14:0a:fd:8d:a8:28:b5:38:69:db:56:7e:61:22:03:3f # SHA1 Fingerprint: 9d:70:bb:01:a5:a4:a0:18:11:2e:f7:1c:01:b9:32:c5:34:e7:88:a8 # SHA256 Fingerprint: 2a:99:f5:bc:11:74:b7:3c:bb:1d:62:08:84:e0:1c:34:e5:1c:cb:39:78:da:12:5f:0e:33:26:88:83:bf:41:58 -----BEGIN CERTIFICATE----- MIIFkjCCA3qgAwIBAgIBATANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJGUjET MBEGA1UEChMKQ2VydGlub21pczEXMBUGA1UECxMOMDAwMiA0MzM5OTg5MDMxHTAb BgNVBAMTFENlcnRpbm9taXMgLSBSb290IENBMB4XDTEzMTAyMTA5MTcxOFoXDTMz MTAyMTA5MTcxOFowWjELMAkGA1UEBhMCRlIxEzARBgNVBAoTCkNlcnRpbm9taXMx FzAVBgNVBAsTDjAwMDIgNDMzOTk4OTAzMR0wGwYDVQQDExRDZXJ0aW5vbWlzIC0g Um9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANTMCQosP5L2 fxSeC5yaah1AMGT9qt8OHgZbn1CF6s2Nq0Nn3rD6foCWnoR4kkjW4znuzuRZWJfl LieY6pOod5tK8O90gC3rMB+12ceAnGInkYjwSond3IjmFPnVAy//ldu9n+ws+hQV WZUKxkd8aRi5pwP5ynapz8dvtF4F/u7BUrJ1Mofs7SlmO/NKFoL21prbcpjp3vDF TKWrteoB4owuZH9kb/2jJZOLyKIOSY008B/sWEUuNKqEUL3nskoTuLAPrjhdsKkb 5nPJWqHZZkCqqU2mNAKthH6yI8H7KsZn9DS2sJVqM09xRLWtwHkziOC/7aOgFLSc CbAK42C++PhmiM1b8XcF4LVzbsF9Ri6OSyemzTUK/eVNfaoqoynHWmgE6OXWk6Ri wsXm9E/G+Z8ajYJJGYrKWUM66A0ywfRMEwNvbqY/kXPLynNvEiCL7sCCeN5LLsJJ wx3tFvYk9CcbXFcx3FXuqB5vbKziRcxXV4p1VxngtViZSTYxPDMBbRZKzbgqg4SG m/lg0h9tkQPTYKbVPZrdd5A9NaSfD171UkRpucC63M9933zZxKyGIjK8e2uR73r4 F2iw4lNVYC2vPsKD2NkJK/DAZNuHi5HMkesE/Xa0lZrmFAYb1TQdvtj/dBxThZng WVJKYe2InmtJiUZ+IFrZ50rlau7SZRFDAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIB BjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTvkUz1pcMw6C8I6tNxIqSSaHh0 2TAfBgNVHSMEGDAWgBTvkUz1pcMw6C8I6tNxIqSSaHh02TANBgkqhkiG9w0BAQsF AAOCAgEAfj1U2iJdGlg+O1QnurrMyOMaauo++RLrVl89UM7g6kgmJs95Vn6RHJk/ 0KGRHCwPT5iVWVO90CLYiF2cN/z7ZMF4jIuaYAnq1fohX9B0ZedQxb8uuQsLrbWw F6YSjNRieOpWauwK0kDDPAUwPk2Ut59KA9N9J0u2/kTO+hkzGm2kQtHdzMjI1xZS g081lLMSVX3l4kLr5JyTCcBMWwerx20RoFAXlCOotQqSD7J6wWAsOMwaplv/8gzj qh8c3LigkyfeY+N/IZ865Z764BNqdeuWXGKRlI5nU7aJ+BIJy29SWwNyhlCVCNSN h4YVH5Uk2KRvms6knZtt0rJ2BobGVgjF6wnaNsIbW0G+YSrjcOa4pvi2WsS9Iff/ ql+hbHY5ZtbqTFXhADObE5hjyW/QASAJN1LnDE8+zbz1X5YnpyACleAu6AdBBR8V btaw5BngDwKTACdyxYvRVB9dSsNAl35VpnzBMwQUAR1JIGkLGZOdblgi90AMRgwj Y/M50n92Uaf0yKHxDHYiI0ZSKS3io0EHVmmY0gUJvGnHWmHNj4FgFU2A3ZDifcRQ 8ow7bkrHxuaAKzyBvBGAFhAn1/DNP3nMcyrDflOR1m749fPH0FFNjkulW+YZFzvW gQncItzujrnEj1PhZ7szuIgVRs/taTX/dQ1G885x4cVrhkIGuUE= -----END CERTIFICATE----- # Issuer: CN=OISTE WISeKey Global Root GB CA O=WISeKey OU=OISTE Foundation Endorsed # Subject: CN=OISTE WISeKey Global Root GB CA O=WISeKey OU=OISTE Foundation Endorsed # Label: "OISTE WISeKey Global Root GB CA" # Serial: 157768595616588414422159278966750757568 # MD5 Fingerprint: a4:eb:b9:61:28:2e:b7:2f:98:b0:35:26:90:99:51:1d # SHA1 Fingerprint: 0f:f9:40:76:18:d3:d7:6a:4b:98:f0:a8:35:9e:0c:fd:27:ac:cc:ed # SHA256 Fingerprint: 6b:9c:08:e8:6e:b0:f7:67:cf:ad:65:cd:98:b6:21:49:e5:49:4a:67:f5:84:5e:7b:d1:ed:01:9f:27:b8:6b:d6 -----BEGIN CERTIFICATE----- MIIDtTCCAp2gAwIBAgIQdrEgUnTwhYdGs/gjGvbCwDANBgkqhkiG9w0BAQsFADBt MQswCQYDVQQGEwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUg Rm91bmRhdGlvbiBFbmRvcnNlZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9i YWwgUm9vdCBHQiBDQTAeFw0xNDEyMDExNTAwMzJaFw0zOTEyMDExNTEwMzFaMG0x CzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNURSBG b3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2Jh bCBSb290IEdCIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2Be3 HEokKtaXscriHvt9OO+Y9bI5mE4nuBFde9IllIiCFSZqGzG7qFshISvYD06fWvGx WuR51jIjK+FTzJlFXHtPrby/h0oLS5daqPZI7H17Dc0hBt+eFf1Biki3IPShehtX 1F1Q/7pn2COZH8g/497/b1t3sWtuuMlk9+HKQUYOKXHQuSP8yYFfTvdv37+ErXNk u7dCjmn21HYdfp2nuFeKUWdy19SouJVUQHMD9ur06/4oQnc/nSMbsrY9gBQHTC5P 99UKFg29ZkM3fiNDecNAhvVMKdqOmq0NpQSHiB6F4+lT1ZvIiwNjeOvgGUpuuy9r M2RYk61pv48b74JIxwIDAQABo1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUw AwEB/zAdBgNVHQ4EFgQUNQ/INmNe4qPs+TtmFc5RUuORmj0wEAYJKwYBBAGCNxUB BAMCAQAwDQYJKoZIhvcNAQELBQADggEBAEBM+4eymYGQfp3FsLAmzYh7KzKNbrgh cViXfa43FK8+5/ea4n32cZiZBKpDdHij40lhPnOMTZTg+XHEthYOU3gf1qKHLwI5 gSk8rxWYITD+KJAAjNHhy/peyP34EEY7onhCkRd0VQreUGdNZtGn//3ZwLWoo4rO ZvUPQ82nK1d7Y0Zqqi5S2PTt4W2tKZB4SLrhI6qjiey1q5bAtEuiHZeeevJuQHHf aPFlTc58Bd9TZaml8LGXBHAVRgOY1NK/VLSgWH1Sb9pWJmLU2NuJMW8c8CLC02Ic Nc1MaRVUGpCY3useX8p3x8uOPUNpnJpY0CQ73xtAln41rYHHTnG6iBM= -----END CERTIFICATE----- # Issuer: CN=SZAFIR ROOT CA2 O=Krajowa Izba Rozliczeniowa S.A. # Subject: CN=SZAFIR ROOT CA2 O=Krajowa Izba Rozliczeniowa S.A. # Label: "SZAFIR ROOT CA2" # Serial: 357043034767186914217277344587386743377558296292 # MD5 Fingerprint: 11:64:c1:89:b0:24:b1:8c:b1:07:7e:89:9e:51:9e:99 # SHA1 Fingerprint: e2:52:fa:95:3f:ed:db:24:60:bd:6e:28:f3:9c:cc:cf:5e:b3:3f:de # SHA256 Fingerprint: a1:33:9d:33:28:1a:0b:56:e5:57:d3:d3:2b:1c:e7:f9:36:7e:b0:94:bd:5f:a7:2a:7e:50:04:c8:de:d7:ca:fe -----BEGIN CERTIFICATE----- MIIDcjCCAlqgAwIBAgIUPopdB+xV0jLVt+O2XwHrLdzk1uQwDQYJKoZIhvcNAQEL BQAwUTELMAkGA1UEBhMCUEwxKDAmBgNVBAoMH0tyYWpvd2EgSXpiYSBSb3psaWN6 ZW5pb3dhIFMuQS4xGDAWBgNVBAMMD1NaQUZJUiBST09UIENBMjAeFw0xNTEwMTkw NzQzMzBaFw0zNTEwMTkwNzQzMzBaMFExCzAJBgNVBAYTAlBMMSgwJgYDVQQKDB9L cmFqb3dhIEl6YmEgUm96bGljemVuaW93YSBTLkEuMRgwFgYDVQQDDA9TWkFGSVIg Uk9PVCBDQTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3vD5QqEvN QLXOYeeWyrSh2gwisPq1e3YAd4wLz32ohswmUeQgPYUM1ljj5/QqGJ3a0a4m7utT 3PSQ1hNKDJA8w/Ta0o4NkjrcsbH/ON7Dui1fgLkCvUqdGw+0w8LBZwPd3BucPbOw 3gAeqDRHu5rr/gsUvTaE2g0gv/pby6kWIK05YO4vdbbnl5z5Pv1+TW9NL++IDWr6 3fE9biCloBK0TXC5ztdyO4mTp4CEHCdJckm1/zuVnsHMyAHs6A6KCpbns6aH5db5 BSsNl0BwPLqsdVqc1U2dAgrSS5tmS0YHF2Wtn2yIANwiieDhZNRnvDF5YTy7ykHN XGoAyDw4jlivAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD AgEGMB0GA1UdDgQWBBQuFqlKGLXLzPVvUPMjX/hd56zwyDANBgkqhkiG9w0BAQsF AAOCAQEAtXP4A9xZWx126aMqe5Aosk3AM0+qmrHUuOQn/6mWmc5G4G18TKI4pAZw 8PRBEew/R40/cof5O/2kbytTAOD/OblqBw7rHRz2onKQy4I9EYKL0rufKq8h5mOG nXkZ7/e7DDWQw4rtTw/1zBLZpD67oPwglV9PJi8RI4NOdQcPv5vRtB3pEAT+ymCP oky4rc/hkA/NrgrHXXu3UNLUYfrVFdvXn4dRVOul4+vJhaAlIDf7js4MNIThPIGy d05DpYhfhmehPea0XGG2Ptv+tyjFogeutcrKjSoS75ftwjCkySp6+/NNIxuZMzSg LvWpCz/UXeHPhJ/iGcJfitYgHuNztw== -----END CERTIFICATE----- # Issuer: CN=Certum Trusted Network CA 2 O=Unizeto Technologies S.A. OU=Certum Certification Authority # Subject: CN=Certum Trusted Network CA 2 O=Unizeto Technologies S.A. OU=Certum Certification Authority # Label: "Certum Trusted Network CA 2" # Serial: 44979900017204383099463764357512596969 # MD5 Fingerprint: 6d:46:9e:d9:25:6d:08:23:5b:5e:74:7d:1e:27:db:f2 # SHA1 Fingerprint: d3:dd:48:3e:2b:bf:4c:05:e8:af:10:f5:fa:76:26:cf:d3:dc:30:92 # SHA256 Fingerprint: b6:76:f2:ed:da:e8:77:5c:d3:6c:b0:f6:3c:d1:d4:60:39:61:f4:9e:62:65:ba:01:3a:2f:03:07:b6:d0:b8:04 -----BEGIN CERTIFICATE----- MIIF0jCCA7qgAwIBAgIQIdbQSk8lD8kyN/yqXhKN6TANBgkqhkiG9w0BAQ0FADCB gDELMAkGA1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMu QS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIG A1UEAxMbQ2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMCIYDzIwMTExMDA2MDgz OTU2WhgPMjA0NjEwMDYwODM5NTZaMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZ VW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3 b3JrIENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9+Xj45tWA DGSdhhuWZGc/IjoedQF97/tcZ4zJzFxrqZHmuULlIEub2pt7uZld2ZuAS9eEQCsn 0+i6MLs+CRqnSZXvK0AkwpfHp+6bJe+oCgCXhVqqndwpyeI1B+twTUrWwbNWuKFB OJvR+zF/j+Bf4bE/D44WSWDXBo0Y+aomEKsq09DRZ40bRr5HMNUuctHFY9rnY3lE fktjJImGLjQ/KUxSiyqnwOKRKIm5wFv5HdnnJ63/mgKXwcZQkpsCLL2puTRZCr+E Sv/f/rOf69me4Jgj7KZrdxYq28ytOxykh9xGc14ZYmhFV+SQgkK7QtbwYeDBoz1m o130GO6IyY0XRSmZMnUCMe4pJshrAua1YkV/NxVaI2iJ1D7eTiew8EAMvE0Xy02i sx7QBlrd9pPPV3WZ9fqGGmd4s7+W/jTcvedSVuWz5XV710GRBdxdaeOVDUO5/IOW OZV7bIBaTxNyxtd9KXpEulKkKtVBRgkg/iKgtlswjbyJDNXXcPiHUv3a76xRLgez Tv7QCdpw75j6VuZt27VXS9zlLCUVyJ4ueE742pyehizKV/Ma5ciSixqClnrDvFAS adgOWkaLOusm+iPJtrCBvkIApPjW/jAux9JG9uWOdf3yzLnQh1vMBhBgu4M1t15n 3kfsmUjxpKEV/q2MYo45VU85FrmxY53/twIDAQABo0IwQDAPBgNVHRMBAf8EBTAD AQH/MB0GA1UdDgQWBBS2oVQ5AsOgP46KvPrU+Bym0ToO/TAOBgNVHQ8BAf8EBAMC AQYwDQYJKoZIhvcNAQENBQADggIBAHGlDs7k6b8/ONWJWsQCYftMxRQXLYtPU2sQ F/xlhMcQSZDe28cmk4gmb3DWAl45oPePq5a1pRNcgRRtDoGCERuKTsZPpd1iHkTf CVn0W3cLN+mLIMb4Ck4uWBzrM9DPhmDJ2vuAL55MYIR4PSFk1vtBHxgP58l1cb29 XN40hz5BsA72udY/CROWFC/emh1auVbONTqwX3BNXuMp8SMoclm2q8KMZiYcdywm djWLKKdpoPk79SPdhRB0yZADVpHnr7pH1BKXESLjokmUbOe3lEu6LaTaM4tMpkT/ WjzGHWTYtTHkpjx6qFcL2+1hGsvxznN3Y6SHb0xRONbkX8eftoEq5IVIeVheO/jb AoJnwTnbw3RLPTYe+SmTiGhbqEQZIfCn6IENLOiTNrQ3ssqwGyZ6miUfmpqAnksq P/ujmv5zMnHCnsZy4YpoJ/HkD7TETKVhk/iXEAcqMCWpuchxuO9ozC1+9eB+D4Ko b7a6bINDd82Kkhehnlt4Fj1F4jNy3eFmypnTycUm/Q1oBEauttmbjL4ZvrHG8hnj XALKLNhvSgfZyTXaQHXyxKcZb55CEJh15pWLYLztxRLXis7VmFxWlgPF7ncGNf/P 5O4/E2Hu29othfDNrp2yGAlFw5Khchf8R7agCyzxxN5DaAhqXzvwdmP7zAYspsbi DrW5viSP -----END CERTIFICATE----- # Issuer: CN=Hellenic Academic and Research Institutions RootCA 2015 O=Hellenic Academic and Research Institutions Cert. Authority # Subject: CN=Hellenic Academic and Research Institutions RootCA 2015 O=Hellenic Academic and Research Institutions Cert. Authority # Label: "Hellenic Academic and Research Institutions RootCA 2015" # Serial: 0 # MD5 Fingerprint: ca:ff:e2:db:03:d9:cb:4b:e9:0f:ad:84:fd:7b:18:ce # SHA1 Fingerprint: 01:0c:06:95:a6:98:19:14:ff:bf:5f:c6:b0:b6:95:ea:29:e9:12:a6 # SHA256 Fingerprint: a0:40:92:9a:02:ce:53:b4:ac:f4:f2:ff:c6:98:1c:e4:49:6f:75:5e:6d:45:fe:0b:2a:69:2b:cd:52:52:3f:36 -----BEGIN CERTIFICATE----- MIIGCzCCA/OgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBpjELMAkGA1UEBhMCR1Ix DzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5k IFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxQDA+BgNVBAMT N0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgUm9v dENBIDIwMTUwHhcNMTUwNzA3MTAxMTIxWhcNNDAwNjMwMTAxMTIxWjCBpjELMAkG A1UEBhMCR1IxDzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNh ZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkx QDA+BgNVBAMTN0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1 dGlvbnMgUm9vdENBIDIwMTUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC AQDC+Kk/G4n8PDwEXT2QNrCROnk8ZlrvbTkBSRq0t89/TSNTt5AA4xMqKKYx8ZEA 4yjsriFBzh/a/X0SWwGDD7mwX5nh8hKDgE0GPt+sr+ehiGsxr/CL0BgzuNtFajT0 AoAkKAoCFZVedioNmToUW/bLy1O8E00BiDeUJRtCvCLYjqOWXjrZMts+6PAQZe10 4S+nfK8nNLspfZu2zwnI5dMK/IhlZXQK3HMcXM1AsRzUtoSMTFDPaI6oWa7CJ06C ojXdFPQf/7J31Ycvqm59JCfnxssm5uX+Zwdj2EUN3TpZZTlYepKZcj2chF6IIbjV 9Cz82XBST3i4vTwri5WY9bPRaM8gFH5MXF/ni+X1NYEZN9cRCLdmvtNKzoNXADrD gfgXy5I2XdGj2HUb4Ysn6npIQf1FGQatJ5lOwXBH3bWfgVMS5bGMSF0xQxfjjMZ6 Y5ZLKTBOhE5iGV48zpeQpX8B653g+IuJ3SWYPZK2fu/Z8VFRfS0myGlZYeCsargq NhEEelC9MoS+L9xy1dcdFkfkR2YgP/SWxa+OAXqlD3pk9Q0Yh9muiNX6hME6wGko LfINaFGq46V3xqSQDqE3izEjR8EJCOtu93ib14L8hCCZSRm2Ekax+0VVFqmjZayc Bw/qa9wfLgZy7IaIEuQt218FL+TwA9MmM+eAws1CoRc0CwIDAQABo0IwQDAPBgNV HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUcRVnyMjJvXVd ctA4GGqd83EkVAswDQYJKoZIhvcNAQELBQADggIBAHW7bVRLqhBYRjTyYtcWNl0I XtVsyIe9tC5G8jH4fOpCtZMWVdyhDBKg2mF+D1hYc2Ryx+hFjtyp8iY/xnmMsVMI M4GwVhO+5lFc2JsKT0ucVlMC6U/2DWDqTUJV6HwbISHTGzrMd/K4kPFox/la/vot 9L/J9UUbzjgQKjeKeaO04wlshYaT/4mWJ3iBj2fjRnRUjtkNaeJK9E10A/+yd+2V Z5fkscWrv2oj6NSU4kQoYsRL4vDY4ilrGnB+JGGTe08DMiUNRSQrlrRGar9KC/ea j8GsGsVn82800vpzY4zvFrCopEYq+OsS7HK07/grfoxSwIuEVPkvPuNVqNxmsdnh X9izjFk0WaSrT2y7HxjbdavYy5LNlDhhDgcGH0tGEPEVvo2FXDtKK4F5D7Rpn0lQ l033DlZdwJVqwjbDG2jJ9SrcR5q+ss7FJej6A7na+RZukYT1HCjI/CbM1xyQVqdf bzoEvM14iQuODy+jqk+iGxI9FghAD/FGTNeqewjBCvVtJ94Cj8rDtSvK6evIIVM4 pcw72Hc3MKJP2W/R8kCtQXoXxdZKNYm3QdV8hn9VTYNKpXMgwDqvkPGaJI7ZjnHK e7iG2rKPmT4dEw0SEe7Uq/DpFXYC5ODfqiAeW2GFZECpkJcNrVPSWh2HagCXZWK0 vm9qp/UsQu0yrbYhnr68 -----END CERTIFICATE----- # Issuer: CN=Hellenic Academic and Research Institutions ECC RootCA 2015 O=Hellenic Academic and Research Institutions Cert. Authority # Subject: CN=Hellenic Academic and Research Institutions ECC RootCA 2015 O=Hellenic Academic and Research Institutions Cert. Authority # Label: "Hellenic Academic and Research Institutions ECC RootCA 2015" # Serial: 0 # MD5 Fingerprint: 81:e5:b4:17:eb:c2:f5:e1:4b:0d:41:7b:49:92:fe:ef # SHA1 Fingerprint: 9f:f1:71:8d:92:d5:9a:f3:7d:74:97:b4:bc:6f:84:68:0b:ba:b6:66 # SHA256 Fingerprint: 44:b5:45:aa:8a:25:e6:5a:73:ca:15:dc:27:fc:36:d2:4c:1c:b9:95:3a:06:65:39:b1:15:82:dc:48:7b:48:33 -----BEGIN CERTIFICATE----- MIICwzCCAkqgAwIBAgIBADAKBggqhkjOPQQDAjCBqjELMAkGA1UEBhMCR1IxDzAN BgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl c2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxRDBCBgNVBAMTO0hl bGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgRUNDIFJv b3RDQSAyMDE1MB4XDTE1MDcwNzEwMzcxMloXDTQwMDYzMDEwMzcxMlowgaoxCzAJ BgNVBAYTAkdSMQ8wDQYDVQQHEwZBdGhlbnMxRDBCBgNVBAoTO0hlbGxlbmljIEFj YWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ2VydC4gQXV0aG9yaXR5 MUQwQgYDVQQDEztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0 dXRpb25zIEVDQyBSb290Q0EgMjAxNTB2MBAGByqGSM49AgEGBSuBBAAiA2IABJKg QehLgoRc4vgxEZmGZE4JJS+dQS8KrjVPdJWyUWRrjWvmP3CV8AVER6ZyOFB2lQJa jq4onvktTpnvLEhvTCUp6NFxW98dwXU3tNf6e3pCnGoKVlp8aQuqgAkkbH7BRqNC MEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFLQi C4KZJAEOnLvkDv2/+5cgk5kqMAoGCCqGSM49BAMCA2cAMGQCMGfOFmI4oqxiRaep lSTAGiecMjvAwNW6qef4BENThe5SId6d9SWDPp5YSy/XZxMOIQIwBeF1Ad5o7Sof TUwJCA3sS61kFyjndc5FZXIhF8siQQ6ME5g4mlRtm8rifOoCWCKR -----END CERTIFICATE----- # Issuer: CN=Certplus Root CA G1 O=Certplus # Subject: CN=Certplus Root CA G1 O=Certplus # Label: "Certplus Root CA G1" # Serial: 1491911565779898356709731176965615564637713 # MD5 Fingerprint: 7f:09:9c:f7:d9:b9:5c:69:69:56:d5:37:3e:14:0d:42 # SHA1 Fingerprint: 22:fd:d0:b7:fd:a2:4e:0d:ac:49:2c:a0:ac:a6:7b:6a:1f:e3:f7:66 # SHA256 Fingerprint: 15:2a:40:2b:fc:df:2c:d5:48:05:4d:22:75:b3:9c:7f:ca:3e:c0:97:80:78:b0:f0:ea:76:e5:61:a6:c7:43:3e -----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgISESBVg+QtPlRWhS2DN7cs3EYRMA0GCSqGSIb3DQEBDQUA MD4xCzAJBgNVBAYTAkZSMREwDwYDVQQKDAhDZXJ0cGx1czEcMBoGA1UEAwwTQ2Vy dHBsdXMgUm9vdCBDQSBHMTAeFw0xNDA1MjYwMDAwMDBaFw0zODAxMTUwMDAwMDBa MD4xCzAJBgNVBAYTAkZSMREwDwYDVQQKDAhDZXJ0cGx1czEcMBoGA1UEAwwTQ2Vy dHBsdXMgUm9vdCBDQSBHMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB ANpQh7bauKk+nWT6VjOaVj0W5QOVsjQcmm1iBdTYj+eJZJ+622SLZOZ5KmHNr49a iZFluVj8tANfkT8tEBXgfs+8/H9DZ6itXjYj2JizTfNDnjl8KvzsiNWI7nC9hRYt 6kuJPKNxQv4c/dMcLRC4hlTqQ7jbxofaqK6AJc96Jh2qkbBIb6613p7Y1/oA/caP 0FG7Yn2ksYyy/yARujVjBYZHYEMzkPZHogNPlk2dT8Hq6pyi/jQu3rfKG3akt62f 6ajUeD94/vI4CTYd0hYCyOwqaK/1jpTvLRN6HkJKHRUxrgwEV/xhc/MxVoYxgKDE EW4wduOU8F8ExKyHcomYxZ3MVwia9Az8fXoFOvpHgDm2z4QTd28n6v+WZxcIbekN 1iNQMLAVdBM+5S//Ds3EC0pd8NgAM0lm66EYfFkuPSi5YXHLtaW6uOrc4nBvCGrc h2c0798wct3zyT8j/zXhviEpIDCB5BmlIOklynMxdCm+4kLV87ImZsdo/Rmz5yCT mehd4F6H50boJZwKKSTUzViGUkAksnsPmBIgJPaQbEfIDbsYIC7Z/fyL8inqh3SV 4EJQeIQEQWGw9CEjjy3LKCHyamz0GqbFFLQ3ZU+V/YDI+HLlJWvEYLF7bY5KinPO WftwenMGE9nTdDckQQoRb5fc5+R+ob0V8rqHDz1oihYHAgMBAAGjYzBhMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSowcCbkahDFXxd Bie0KlHYlwuBsTAfBgNVHSMEGDAWgBSowcCbkahDFXxdBie0KlHYlwuBsTANBgkq hkiG9w0BAQ0FAAOCAgEAnFZvAX7RvUz1isbwJh/k4DgYzDLDKTudQSk0YcbX8ACh 66Ryj5QXvBMsdbRX7gp8CXrc1cqh0DQT+Hern+X+2B50ioUHj3/MeXrKls3N/U/7 /SMNkPX0XtPGYX2eEeAC7gkE2Qfdpoq3DIMku4NQkv5gdRE+2J2winq14J2by5BS S7CTKtQ+FjPlnsZlFT5kOwQ/2wyPX1wdaR+v8+khjPPvl/aatxm2hHSco1S1cE5j 2FddUyGbQJJD+tZ3VTNPZNX70Cxqjm0lpu+F6ALEUz65noe8zDUa3qHpimOHZR4R Kttjd5cUvpoUmRGywO6wT/gUITJDT5+rosuoD6o7BlXGEilXCNQ314cnrUlZp5Gr RHpejXDbl85IULFzk/bwg2D5zfHhMf1bfHEhYxQUqq/F3pN+aLHsIqKqkHWetUNy 6mSjhEv9DKgma3GX7lZjZuhCVPnHHd/Qj1vfyDBviP4NxDMcU6ij/UgQ8uQKTuEV V/xuZDDCVRHc6qnNSlSsKWNEz0pAoNZoWRsz+e86i9sgktxChL8Bq4fA1SCC28a5 g4VCXA9DO2pJNdWY9BW/+mGBDAkgGNLQFwzLSABQ6XaCjGTXOqAHVcweMcDvOrRl ++O/QmueD6i9a5jc2NvLi6Td11n0bt3+qsOR0C5CB8AMTVPNJLFMWx5R9N/pkvo= -----END CERTIFICATE----- # Issuer: CN=Certplus Root CA G2 O=Certplus # Subject: CN=Certplus Root CA G2 O=Certplus # Label: "Certplus Root CA G2" # Serial: 1492087096131536844209563509228951875861589 # MD5 Fingerprint: a7:ee:c4:78:2d:1b:ee:2d:b9:29:ce:d6:a7:96:32:31 # SHA1 Fingerprint: 4f:65:8e:1f:e9:06:d8:28:02:e9:54:47:41:c9:54:25:5d:69:cc:1a # SHA256 Fingerprint: 6c:c0:50:41:e6:44:5e:74:69:6c:4c:fb:c9:f8:0f:54:3b:7e:ab:bb:44:b4:ce:6f:78:7c:6a:99:71:c4:2f:17 -----BEGIN CERTIFICATE----- MIICHDCCAaKgAwIBAgISESDZkc6uo+jF5//pAq/Pc7xVMAoGCCqGSM49BAMDMD4x CzAJBgNVBAYTAkZSMREwDwYDVQQKDAhDZXJ0cGx1czEcMBoGA1UEAwwTQ2VydHBs dXMgUm9vdCBDQSBHMjAeFw0xNDA1MjYwMDAwMDBaFw0zODAxMTUwMDAwMDBaMD4x CzAJBgNVBAYTAkZSMREwDwYDVQQKDAhDZXJ0cGx1czEcMBoGA1UEAwwTQ2VydHBs dXMgUm9vdCBDQSBHMjB2MBAGByqGSM49AgEGBSuBBAAiA2IABM0PW1aC3/BFGtat 93nwHcmsltaeTpwftEIRyoa/bfuFo8XlGVzX7qY/aWfYeOKmycTbLXku54uNAm8x Ik0G42ByRZ0OQneezs/lf4WbGOT8zC5y0xaTTsqZY1yhBSpsBqNjMGEwDgYDVR0P AQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNqDYwJ5jtpMxjwj FNiPwyCrKGBZMB8GA1UdIwQYMBaAFNqDYwJ5jtpMxjwjFNiPwyCrKGBZMAoGCCqG SM49BAMDA2gAMGUCMHD+sAvZ94OX7PNVHdTcswYO/jOYnYs5kGuUIe22113WTNch p+e/IQ8rzfcq3IUHnQIxAIYUFuXcsGXCwI4Un78kFmjlvPl5adytRSv3tjFzzAal U5ORGpOucGpnutee5WEaXw== -----END CERTIFICATE----- # Issuer: CN=OpenTrust Root CA G1 O=OpenTrust # Subject: CN=OpenTrust Root CA G1 O=OpenTrust # Label: "OpenTrust Root CA G1" # Serial: 1492036577811947013770400127034825178844775 # MD5 Fingerprint: 76:00:cc:81:29:cd:55:5e:88:6a:7a:2e:f7:4d:39:da # SHA1 Fingerprint: 79:91:e8:34:f7:e2:ee:dd:08:95:01:52:e9:55:2d:14:e9:58:d5:7e # SHA256 Fingerprint: 56:c7:71:28:d9:8c:18:d9:1b:4c:fd:ff:bc:25:ee:91:03:d4:75:8e:a2:ab:ad:82:6a:90:f3:45:7d:46:0e:b4 -----BEGIN CERTIFICATE----- MIIFbzCCA1egAwIBAgISESCzkFU5fX82bWTCp59rY45nMA0GCSqGSIb3DQEBCwUA MEAxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlPcGVuVHJ1c3QxHTAbBgNVBAMMFE9w ZW5UcnVzdCBSb290IENBIEcxMB4XDTE0MDUyNjA4NDU1MFoXDTM4MDExNTAwMDAw MFowQDELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCU9wZW5UcnVzdDEdMBsGA1UEAwwU T3BlblRydXN0IFJvb3QgQ0EgRzEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQD4eUbalsUwXopxAy1wpLuwxQjczeY1wICkES3d5oeuXT2R0odsN7faYp6b wiTXj/HbpqbfRm9RpnHLPhsxZ2L3EVs0J9V5ToybWL0iEA1cJwzdMOWo010hOHQX /uMftk87ay3bfWAfjH1MBcLrARYVmBSO0ZB3Ij/swjm4eTrwSSTilZHcYTSSjFR0 77F9jAHiOH3BX2pfJLKOYheteSCtqx234LSWSE9mQxAGFiQD4eCcjsZGT44ameGP uY4zbGneWK2gDqdkVBFpRGZPTBKnjix9xNRbxQA0MMHZmf4yzgeEtE7NCv82TWLx p2NX5Ntqp66/K7nJ5rInieV+mhxNaMbBGN4zK1FGSxyO9z0M+Yo0FMT7MzUj8czx Kselu7Cizv5Ta01BG2Yospb6p64KTrk5M0ScdMGTHPjgniQlQ/GbI4Kq3ywgsNw2 TgOzfALU5nsaqocTvz6hdLubDuHAk5/XpGbKuxs74zD0M1mKB3IDVedzagMxbm+W G+Oin6+Sx+31QrclTDsTBM8clq8cIqPQqwWyTBIjUtz9GVsnnB47ev1CI9sjgBPw vFEVVJSmdz7QdFG9URQIOTfLHzSpMJ1ShC5VkLG631UAC9hWLbFJSXKAqWLXwPYY EQRVzXR7z2FwefR7LFxckvzluFqrTJOVoSfupb7PcSNCupt2LQIDAQABo2MwYTAO BgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUl0YhVyE1 2jZVx/PxN3DlCPaTKbYwHwYDVR0jBBgwFoAUl0YhVyE12jZVx/PxN3DlCPaTKbYw DQYJKoZIhvcNAQELBQADggIBAB3dAmB84DWn5ph76kTOZ0BP8pNuZtQ5iSas000E PLuHIT839HEl2ku6q5aCgZG27dmxpGWX4m9kWaSW7mDKHyP7Rbr/jyTwyqkxf3kf gLMtMrpkZ2CvuVnN35pJ06iCsfmYlIrM4LvgBBuZYLFGZdwIorJGnkSI6pN+VxbS FXJfLkur1J1juONI5f6ELlgKn0Md/rcYkoZDSw6cMoYsYPXpSOqV7XAp8dUv/TW0 V8/bhUiZucJvbI/NeJWsZCj9VrDDb8O+WVLhX4SPgPL0DTatdrOjteFkdjpY3H1P XlZs5VVZV6Xf8YpmMIzUUmI4d7S+KNfKNsSbBfD4Fdvb8e80nR14SohWZ25g/4/I i+GOvUKpMwpZQhISKvqxnUOOBZuZ2mKtVzazHbYNeS2WuOvyDEsMpZTGMKcmGS3t TAZQMPH9WD25SxdfGbRqhFS0OE85og2WaMMolP3tLR9Ka0OWLpABEPs4poEL0L91 09S5zvE/bw4cHjdx5RiHdRk/ULlepEU0rbDK5uUTdg8xFKmOLZTW1YVNcxVPS/Ky Pu1svf0OnWZzsD2097+o4BGkxK51CUpjAEggpsadCwmKtODmzj7HPiY46SvepghJ AwSQiumPv+i2tCqjI40cHLI5kqiPAlxAOXXUc0ECd97N4EOH1uS6SsNsEn/+KuYj 1oxx -----END CERTIFICATE----- # Issuer: CN=OpenTrust Root CA G2 O=OpenTrust # Subject: CN=OpenTrust Root CA G2 O=OpenTrust # Label: "OpenTrust Root CA G2" # Serial: 1492012448042702096986875987676935573415441 # MD5 Fingerprint: 57:24:b6:59:24:6b:ae:c8:fe:1c:0c:20:f2:c0:4e:eb # SHA1 Fingerprint: 79:5f:88:60:c5:ab:7c:3d:92:e6:cb:f4:8d:e1:45:cd:11:ef:60:0b # SHA256 Fingerprint: 27:99:58:29:fe:6a:75:15:c1:bf:e8:48:f9:c4:76:1d:b1:6c:22:59:29:25:7b:f4:0d:08:94:f2:9e:a8:ba:f2 -----BEGIN CERTIFICATE----- MIIFbzCCA1egAwIBAgISESChaRu/vbm9UpaPI+hIvyYRMA0GCSqGSIb3DQEBDQUA MEAxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlPcGVuVHJ1c3QxHTAbBgNVBAMMFE9w ZW5UcnVzdCBSb290IENBIEcyMB4XDTE0MDUyNjAwMDAwMFoXDTM4MDExNTAwMDAw MFowQDELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCU9wZW5UcnVzdDEdMBsGA1UEAwwU T3BlblRydXN0IFJvb3QgQ0EgRzIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQDMtlelM5QQgTJT32F+D3Y5z1zCU3UdSXqWON2ic2rxb95eolq5cSG+Ntmh /LzubKh8NBpxGuga2F8ORAbtp+Dz0mEL4DKiltE48MLaARf85KxP6O6JHnSrT78e CbY2albz4e6WiWYkBuTNQjpK3eCasMSCRbP+yatcfD7J6xcvDH1urqWPyKwlCm/6 1UWY0jUJ9gNDlP7ZvyCVeYCYitmJNbtRG6Q3ffyZO6v/v6wNj0OxmXsWEH4db0fE FY8ElggGQgT4hNYdvJGmQr5J1WqIP7wtUdGejeBSzFfdNTVY27SPJIjki9/ca1TS gSuyzpJLHB9G+h3Ykst2Z7UJmQnlrBcUVXDGPKBWCgOz3GIZ38i1MH/1PCZ1Eb3X G7OHngevZXHloM8apwkQHZOJZlvoPGIytbU6bumFAYueQ4xncyhZW+vj3CzMpSZy YhK05pyDRPZRpOLAeiRXyg6lPzq1O4vldu5w5pLeFlwoW5cZJ5L+epJUzpM5ChaH vGOz9bGTXOBut9Dq+WIyiET7vycotjCVXRIouZW+j1MY5aIYFuJWpLIsEPUdN6b4 t/bQWVyJ98LVtZR00dX+G7bw5tYee9I8y6jj9RjzIR9u701oBnstXW5DiabA+aC/ gh7PU3+06yzbXfZqfUAkBXKJOAGTy3HCOV0GEfZvePg3DTmEJwIDAQABo2MwYTAO BgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUajn6QiL3 5okATV59M4PLuG53hq8wHwYDVR0jBBgwFoAUajn6QiL35okATV59M4PLuG53hq8w DQYJKoZIhvcNAQENBQADggIBAJjLq0A85TMCl38th6aP1F5Kr7ge57tx+4BkJamz Gj5oXScmp7oq4fBXgwpkTx4idBvpkF/wrM//T2h6OKQQbA2xx6R3gBi2oihEdqc0 nXGEL8pZ0keImUEiyTCYYW49qKgFbdEfwFFEVn8nNQLdXpgKQuswv42hm1GqO+qT RmTFAHneIWv2V6CG1wZy7HBGS4tz3aAhdT7cHcCP009zHIXZ/n9iyJVvttN7jLpT wm+bREx50B1ws9efAvSyB7DH5fitIw6mVskpEndI2S9G/Tvw/HRwkqWOOAgfZDC2 t0v7NqwQjqBSM2OdAzVWxWm9xiNaJ5T2pBL4LTM8oValX9YZ6e18CL13zSdkzJTa TkZQh+D5wVOAHrut+0dSixv9ovneDiK3PTNZbNTe9ZUGMg1RGUFcPk8G97krgCf2 o6p6fAbhQ8MTOWIaNr3gKC6UAuQpLmBVrkA9sHSSXvAgZJY/X0VdiLWK2gKgW0VU 3jg9CcCoSmVGFvyqv1ROTVu+OEO3KMqLM6oaJbolXCkvW0pujOotnCr2BXbgd5eA iN1nE28daCSLT7d0geX0YJ96Vdc+N9oWaz53rK4YcJUIeSkDiv7BO7M/Gg+kO14f WKGVyasvc0rQLW6aWQ9VGHgtPFGml4vmu7JwqkwR3v98KzfUetF3NI/n+UL3PIEM S1IK -----END CERTIFICATE----- # Issuer: CN=OpenTrust Root CA G3 O=OpenTrust # Subject: CN=OpenTrust Root CA G3 O=OpenTrust # Label: "OpenTrust Root CA G3" # Serial: 1492104908271485653071219941864171170455615 # MD5 Fingerprint: 21:37:b4:17:16:92:7b:67:46:70:a9:96:d7:a8:13:24 # SHA1 Fingerprint: 6e:26:64:f3:56:bf:34:55:bf:d1:93:3f:7c:01:de:d8:13:da:8a:a6 # SHA256 Fingerprint: b7:c3:62:31:70:6e:81:07:8c:36:7c:b8:96:19:8f:1e:32:08:dd:92:69:49:dd:8f:57:09:a4:10:f7:5b:62:92 -----BEGIN CERTIFICATE----- MIICITCCAaagAwIBAgISESDm+Ez8JLC+BUCs2oMbNGA/MAoGCCqGSM49BAMDMEAx CzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlPcGVuVHJ1c3QxHTAbBgNVBAMMFE9wZW5U cnVzdCBSb290IENBIEczMB4XDTE0MDUyNjAwMDAwMFoXDTM4MDExNTAwMDAwMFow QDELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCU9wZW5UcnVzdDEdMBsGA1UEAwwUT3Bl blRydXN0IFJvb3QgQ0EgRzMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARK7liuTcpm 3gY6oxH84Bjwbhy6LTAMidnW7ptzg6kjFYwvWYpa3RTqnVkrQ7cG7DK2uu5Bta1d oYXM6h0UZqNnfkbilPPntlahFVmhTzeXuSIevRHr9LIfXsMUmuXZl5mjYzBhMA4G A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRHd8MUi2I5 DMlv4VBN0BBY3JWIbTAfBgNVHSMEGDAWgBRHd8MUi2I5DMlv4VBN0BBY3JWIbTAK BggqhkjOPQQDAwNpADBmAjEAj6jcnboMBBf6Fek9LykBl7+BFjNAk2z8+e2AcG+q j9uEwov1NcoG3GRvaBbhj5G5AjEA2Euly8LQCGzpGPta3U1fJAuwACEl74+nBCZx 4nxp5V2a+EEfOzmTk51V6s2N8fvB -----END CERTIFICATE----- # Issuer: CN=ISRG Root X1 O=Internet Security Research Group # Subject: CN=ISRG Root X1 O=Internet Security Research Group # Label: "ISRG Root X1" # Serial: 172886928669790476064670243504169061120 # MD5 Fingerprint: 0c:d2:f9:e0:da:17:73:e9:ed:86:4d:a5:e3:70:e7:4e # SHA1 Fingerprint: ca:bd:2a:79:a1:07:6a:31:f2:1d:25:36:35:cb:03:9d:43:29:a5:e8 # SHA256 Fingerprint: 96:bc:ec:06:26:49:76:f3:74:60:77:9a:cf:28:c5:a7:cf:e8:a3:c0:aa:e1:1a:8f:fc:ee:05:c0:bd:df:08:c6 -----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ 0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ 3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq 4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= -----END CERTIFICATE----- # Issuer: O=FNMT-RCM OU=AC RAIZ FNMT-RCM # Subject: O=FNMT-RCM OU=AC RAIZ FNMT-RCM # Label: "AC RAIZ FNMT-RCM" # Serial: 485876308206448804701554682760554759 # MD5 Fingerprint: e2:09:04:b4:d3:bd:d1:a0:14:fd:1a:d2:47:c4:57:1d # SHA1 Fingerprint: ec:50:35:07:b2:15:c4:95:62:19:e2:a8:9a:5b:42:99:2c:4c:2c:20 # SHA256 Fingerprint: eb:c5:57:0c:29:01:8c:4d:67:b1:aa:12:7b:af:12:f7:03:b4:61:1e:bc:17:b7:da:b5:57:38:94:17:9b:93:fa -----BEGIN CERTIFICATE----- MIIFgzCCA2ugAwIBAgIPXZONMGc2yAYdGsdUhGkHMA0GCSqGSIb3DQEBCwUAMDsx CzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJ WiBGTk1ULVJDTTAeFw0wODEwMjkxNTU5NTZaFw0zMDAxMDEwMDAwMDBaMDsxCzAJ BgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBG Tk1ULVJDTTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALpxgHpMhm5/ yBNtwMZ9HACXjywMI7sQmkCpGreHiPibVmr75nuOi5KOpyVdWRHbNi63URcfqQgf BBckWKo3Shjf5TnUV/3XwSyRAZHiItQDwFj8d0fsjz50Q7qsNI1NOHZnjrDIbzAz WHFctPVrbtQBULgTfmxKo0nRIBnuvMApGGWn3v7v3QqQIecaZ5JCEJhfTzC8PhxF tBDXaEAUwED653cXeuYLj2VbPNmaUtu1vZ5Gzz3rkQUCwJaydkxNEJY7kvqcfw+Z 374jNUUeAlz+taibmSXaXvMiwzn15Cou08YfxGyqxRxqAQVKL9LFwag0Jl1mpdIC IfkYtwb1TplvqKtMUejPUBjFd8g5CSxJkjKZqLsXF3mwWsXmo8RZZUc1g16p6DUL mbvkzSDGm0oGObVo/CK67lWMK07q87Hj/LaZmtVC+nFNCM+HHmpxffnTtOmlcYF7 wk5HlqX2doWjKI/pgG6BU6VtX7hI+cL5NqYuSf+4lsKMB7ObiFj86xsc3i1w4peS MKGJ47xVqCfWS+2QrYv6YyVZLag13cqXM7zlzced0ezvXg5KkAYmY6252TUtB7p2 ZSysV4999AeU14ECll2jB0nVetBX+RvnU0Z1qrB5QstocQjpYL05ac70r8NWQMet UqIJ5G+GR4of6ygnXYMgrwTJbFaai0b1AgMBAAGjgYMwgYAwDwYDVR0TAQH/BAUw AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFPd9xf3E6Jobd2Sn9R2gzL+H YJptMD4GA1UdIAQ3MDUwMwYEVR0gADArMCkGCCsGAQUFBwIBFh1odHRwOi8vd3d3 LmNlcnQuZm5tdC5lcy9kcGNzLzANBgkqhkiG9w0BAQsFAAOCAgEAB5BK3/MjTvDD nFFlm5wioooMhfNzKWtN/gHiqQxjAb8EZ6WdmF/9ARP67Jpi6Yb+tmLSbkyU+8B1 RXxlDPiyN8+sD8+Nb/kZ94/sHvJwnvDKuO+3/3Y3dlv2bojzr2IyIpMNOmqOFGYM LVN0V2Ue1bLdI4E7pWYjJ2cJj+F3qkPNZVEI7VFY/uY5+ctHhKQV8Xa7pO6kO8Rf 77IzlhEYt8llvhjho6Tc+hj507wTmzl6NLrTQfv6MooqtyuGC2mDOL7Nii4LcK2N JpLuHvUBKwrZ1pebbuCoGRw6IYsMHkCtA+fdZn71uSANA+iW+YJF1DngoABd15jm fZ5nc8OaKveri6E6FO80vFIOiZiaBECEHX5FaZNXzuvO+FB8TxxuBEOb+dY7Ixjp 6o7RTUaN8Tvkasq6+yO3m/qZASlaWFot4/nUbQ4mrcFuNLwy+AwF+mWj2zs3gyLp 1txyM/1d8iC9djwj2ij3+RvrWWTV3F9yfiD8zYm1kGdNYno/Tq0dwzn+evQoFt9B 9kiABdcPUXmsEKvU7ANm5mqwujGSQkBqvjrTcuFqN1W8rB2Vt2lh8kORdOag0wok RqEIr9baRRmW1FMdW4R58MD3R++Lj8UGrp1MYp3/RgT408m2ECVAdf4WqslKYIYv uu8wd+RU4riEmViAqhOLUTpPSPaLtrM= -----END CERTIFICATE----- # Issuer: CN=Amazon Root CA 1 O=Amazon # Subject: CN=Amazon Root CA 1 O=Amazon # Label: "Amazon Root CA 1" # Serial: 143266978916655856878034712317230054538369994 # MD5 Fingerprint: 43:c6:bf:ae:ec:fe:ad:2f:18:c6:88:68:30:fc:c8:e6 # SHA1 Fingerprint: 8d:a7:f9:65:ec:5e:fc:37:91:0f:1c:6e:59:fd:c1:cc:6a:6e:de:16 # SHA256 Fingerprint: 8e:cd:e6:88:4f:3d:87:b1:12:5b:a3:1a:c3:fc:b1:3d:70:16:de:7f:57:cc:90:4f:e1:cb:97:c6:ae:98:19:6e -----BEGIN CERTIFICATE----- MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6 b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM 9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6 VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L 93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU 5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy rqXRfboQnoZsG4q5WTP468SQvvG5 -----END CERTIFICATE----- # Issuer: CN=Amazon Root CA 2 O=Amazon # Subject: CN=Amazon Root CA 2 O=Amazon # Label: "Amazon Root CA 2" # Serial: 143266982885963551818349160658925006970653239 # MD5 Fingerprint: c8:e5:8d:ce:a8:42:e2:7a:c0:2a:5c:7c:9e:26:bf:66 # SHA1 Fingerprint: 5a:8c:ef:45:d7:a6:98:59:76:7a:8c:8b:44:96:b5:78:cf:47:4b:1a # SHA256 Fingerprint: 1b:a5:b2:aa:8c:65:40:1a:82:96:01:18:f8:0b:ec:4f:62:30:4d:83:ce:c4:71:3a:19:c3:9c:01:1e:a4:6d:b4 -----BEGIN CERTIFICATE----- MIIFQTCCAymgAwIBAgITBmyf0pY1hp8KD+WGePhbJruKNzANBgkqhkiG9w0BAQwF ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6 b24gUm9vdCBDQSAyMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTEL MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv b3QgQ0EgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2Wny2cSkxK gXlRmeyKy2tgURO8TW0G/LAIjd0ZEGrHJgw12MBvIITplLGbhQPDW9tK6Mj4kHbZ W0/jTOgGNk3Mmqw9DJArktQGGWCsN0R5hYGCrVo34A3MnaZMUnbqQ523BNFQ9lXg 1dKmSYXpN+nKfq5clU1Imj+uIFptiJXZNLhSGkOQsL9sBbm2eLfq0OQ6PBJTYv9K 8nu+NQWpEjTj82R0Yiw9AElaKP4yRLuH3WUnAnE72kr3H9rN9yFVkE8P7K6C4Z9r 2UXTu/Bfh+08LDmG2j/e7HJV63mjrdvdfLC6HM783k81ds8P+HgfajZRRidhW+me z/CiVX18JYpvL7TFz4QuK/0NURBs+18bvBt+xa47mAExkv8LV/SasrlX6avvDXbR 8O70zoan4G7ptGmh32n2M8ZpLpcTnqWHsFcQgTfJU7O7f/aS0ZzQGPSSbtqDT6Zj mUyl+17vIWR6IF9sZIUVyzfpYgwLKhbcAS4y2j5L9Z469hdAlO+ekQiG+r5jqFoz 7Mt0Q5X5bGlSNscpb/xVA1wf+5+9R+vnSUeVC06JIglJ4PVhHvG/LopyboBZ/1c6 +XUyo05f7O0oYtlNc/LMgRdg7c3r3NunysV+Ar3yVAhU/bQtCSwXVEqY0VThUWcI 0u1ufm8/0i2BWSlmy5A5lREedCf+3euvAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB Af8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSwDPBMMPQFWAJI/TPlUq9LhONm UjANBgkqhkiG9w0BAQwFAAOCAgEAqqiAjw54o+Ci1M3m9Zh6O+oAA7CXDpO8Wqj2 LIxyh6mx/H9z/WNxeKWHWc8w4Q0QshNabYL1auaAn6AFC2jkR2vHat+2/XcycuUY +gn0oJMsXdKMdYV2ZZAMA3m3MSNjrXiDCYZohMr/+c8mmpJ5581LxedhpxfL86kS k5Nrp+gvU5LEYFiwzAJRGFuFjWJZY7attN6a+yb3ACfAXVU3dJnJUH/jWS5E4ywl 7uxMMne0nxrpS10gxdr9HIcWxkPo1LsmmkVwXqkLN1PiRnsn/eBG8om3zEK2yygm btmlyTrIQRNg91CMFa6ybRoVGld45pIq2WWQgj9sAq+uEjonljYE1x2igGOpm/Hl urR8FLBOybEfdF849lHqm/osohHUqS0nGkWxr7JOcQ3AWEbWaQbLU8uz/mtBzUF+ fUwPfHJ5elnNXkoOrJupmHN5fLT0zLm4BwyydFy4x2+IoZCn9Kr5v2c69BoVYh63 n749sSmvZ6ES8lgQGVMDMBu4Gon2nL2XA46jCfMdiyHxtN/kHNGfZQIG6lzWE7OE 76KlXIx3KadowGuuQNKotOrN8I1LOJwZmhsoVLiJkO/KdYE+HvJkJMcYr07/R54H 9jVlpNMKVv/1F2Rs76giJUmTtt8AF9pYfl3uxRuw0dFfIRDH+fO6AgonB8Xx1sfT 4PsJYGw= -----END CERTIFICATE----- # Issuer: CN=Amazon Root CA 3 O=Amazon # Subject: CN=Amazon Root CA 3 O=Amazon # Label: "Amazon Root CA 3" # Serial: 143266986699090766294700635381230934788665930 # MD5 Fingerprint: a0:d4:ef:0b:f7:b5:d8:49:95:2a:ec:f5:c4:fc:81:87 # SHA1 Fingerprint: 0d:44:dd:8c:3c:8c:1a:1a:58:75:64:81:e9:0f:2e:2a:ff:b3:d2:6e # SHA256 Fingerprint: 18:ce:6c:fe:7b:f1:4e:60:b2:e3:47:b8:df:e8:68:cb:31:d0:2e:bb:3a:da:27:15:69:f5:03:43:b4:6d:b3:a4 -----BEGIN CERTIFICATE----- MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5 MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g Um9vdCBDQSAzMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg Q0EgMzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCmXp8ZBf8ANm+gBG1bG8lKl ui2yEujSLtf6ycXYqm0fc4E7O5hrOXwzpcVOho6AF2hiRVd9RFgdszflZwjrZt6j QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSr ttvXBp43rDCGB5Fwx5zEGbF4wDAKBggqhkjOPQQDAgNJADBGAiEA4IWSoxe3jfkr BqWTrBqYaGFy+uGh0PsceGCmQ5nFuMQCIQCcAu/xlJyzlvnrxir4tiz+OpAUFteM YyRIHN8wfdVoOw== -----END CERTIFICATE----- # Issuer: CN=Amazon Root CA 4 O=Amazon # Subject: CN=Amazon Root CA 4 O=Amazon # Label: "Amazon Root CA 4" # Serial: 143266989758080763974105200630763877849284878 # MD5 Fingerprint: 89:bc:27:d5:eb:17:8d:06:6a:69:d5:fd:89:47:b4:cd # SHA1 Fingerprint: f6:10:84:07:d6:f8:bb:67:98:0c:c2:e2:44:c2:eb:ae:1c:ef:63:be # SHA256 Fingerprint: e3:5d:28:41:9e:d0:20:25:cf:a6:90:38:cd:62:39:62:45:8d:a5:c6:95:fb:de:a3:c2:2b:0b:fb:25:89:70:92 -----BEGIN CERTIFICATE----- MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5 MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g Um9vdCBDQSA0MB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg Q0EgNDB2MBAGByqGSM49AgEGBSuBBAAiA2IABNKrijdPo1MN/sGKe0uoe0ZLY7Bi 9i0b2whxIdIA6GO9mif78DluXeo9pcmBqqNbIJhFXRbb/egQbeOc4OO9X4Ri83Bk M6DLJC9wuoihKqB1+IGuYgbEgds5bimwHvouXKNCMEAwDwYDVR0TAQH/BAUwAwEB /zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFNPsxzplbszh2naaVvuc84ZtV+WB MAoGCCqGSM49BAMDA2gAMGUCMDqLIfG9fhGt0O9Yli/W651+kI0rz2ZVwyzjKKlw CkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1AE47xDqUEpHJWEadIRNyp4iciuRMStuW 1KyLa2tJElMzrdfkviT8tQp21KW8EA== -----END CERTIFICATE----- # Issuer: CN=LuxTrust Global Root 2 O=LuxTrust S.A. # Subject: CN=LuxTrust Global Root 2 O=LuxTrust S.A. # Label: "LuxTrust Global Root 2" # Serial: 59914338225734147123941058376788110305822489521 # MD5 Fingerprint: b2:e1:09:00:61:af:f7:f1:91:6f:c4:ad:8d:5e:3b:7c # SHA1 Fingerprint: 1e:0e:56:19:0a:d1:8b:25:98:b2:04:44:ff:66:8a:04:17:99:5f:3f # SHA256 Fingerprint: 54:45:5f:71:29:c2:0b:14:47:c4:18:f9:97:16:8f:24:c5:8f:c5:02:3b:f5:da:5b:e2:eb:6e:1d:d8:90:2e:d5 -----BEGIN CERTIFICATE----- MIIFwzCCA6ugAwIBAgIUCn6m30tEntpqJIWe5rgV0xZ/u7EwDQYJKoZIhvcNAQEL BQAwRjELMAkGA1UEBhMCTFUxFjAUBgNVBAoMDUx1eFRydXN0IFMuQS4xHzAdBgNV BAMMFkx1eFRydXN0IEdsb2JhbCBSb290IDIwHhcNMTUwMzA1MTMyMTU3WhcNMzUw MzA1MTMyMTU3WjBGMQswCQYDVQQGEwJMVTEWMBQGA1UECgwNTHV4VHJ1c3QgUy5B LjEfMB0GA1UEAwwWTHV4VHJ1c3QgR2xvYmFsIFJvb3QgMjCCAiIwDQYJKoZIhvcN AQEBBQADggIPADCCAgoCggIBANeFl78RmOnwYoNMPIf5U2o3C/IPPIfOb9wmKb3F ibrJgz337spbxm1Jc7TJRqMbNBM/wYlFV/TZsfs2ZUv7COJIcRHIbjuend+JZTem hfY7RBi2xjcwYkSSl2l9QjAk5A0MiWtj3sXh306pFGxT4GHO9hcvHTy95iJMHZP1 EMShduxq3sVs35a0VkBCwGKSMKEtFZSg0iAGCW5qbeXrt77U8PEVfIvmTroTzEsn Xpk8F12PgX8zPU/TPxvsXD/wPEx1bvKm1Z3aLQdjAsZy6ZS8TEmVT4hSyNvoaYL4 zDRbIvCGp4m9SAptZoFtyMhk+wHh9OHe2Z7d21vUKpkmFRseTJIpgp7VkoGSQXAZ 96Tlk0u8d2cx3Rz9MXANF5kM+Qw5GSoXtTBxVdUPrljhPS80m8+f9niFwpN6cj5m j5wWEWCPnolvZ77gR1o7DJpni89Gxq44o/KnvObWhWszJHAiS8sIm7vI+AIpHb4g DEa/a4ebsypmQjVGbKq6rfmYe+lQVRQxv7HaLe2ArWgk+2mr2HETMOZns4dA/Yl+ 8kPREd8vZS9kzl8UubG/Mb2HeFpZZYiq/FkySIbWTLkpS5XTdvN3JW1CHDiDTf2j X5t/Lax5Gw5CMZdjpPuKadUiDTSQMC6otOBttpSsvItO13D8xTiOZCXhTTmQzsmH hFhxAgMBAAGjgagwgaUwDwYDVR0TAQH/BAUwAwEB/zBCBgNVHSAEOzA5MDcGByuB KwEBAQowLDAqBggrBgEFBQcCARYeaHR0cHM6Ly9yZXBvc2l0b3J5Lmx1eHRydXN0 Lmx1MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBT/GCh2+UgFLKGu8SsbK7JT +Et8szAdBgNVHQ4EFgQU/xgodvlIBSyhrvErGyuyU/hLfLMwDQYJKoZIhvcNAQEL BQADggIBAGoZFO1uecEsh9QNcH7X9njJCwROxLHOk3D+sFTAMs2ZMGQXvw/l4jP9 BzZAcg4atmpZ1gDlaCDdLnINH2pkMSCEfUmmWjfrRcmF9dTHF5kH5ptV5AzoqbTO jFu1EVzPig4N1qx3gf4ynCSecs5U89BvolbW7MM3LGVYvlcAGvI1+ut7MV3CwRI9 loGIlonBWVx65n9wNOeD4rHh4bhY79SV5GCc8JaXcozrhAIuZY+kt9J/Z93I055c qqmkoCUUBpvsT34tC38ddfEz2O3OuHVtPlu5mB0xDVbYQw8wkbIEa91WvpWAVWe+ 2M2D2RjuLg+GLZKecBPs3lHJQ3gCpU3I+V/EkVhGFndadKpAvAefMLmx9xIX3eP/ JEAdemrRTxgKqpAd60Ae36EeRJIQmvKN4dFLRp7oRUKX6kWZ8+xm1QL68qZKJKre zrnK+T+Tb/mjuuqlPpmt/f97mfVl7vBZKGfXkJWkE4SphMHozs51k2MavDzq1WQf LSoSOcbDWjLtR5EWDrw4wVDej8oqkDQc7kGUnF4ZLvhFSZl0kbAEb+MEWrGrKqv+ x9CWttrhSmQGbmBNvUJO/3jaJMobtNeWOWyu8Q6qp31IiyBMz2TWuJdGsE7RKlY6 oJO9r4Ak4Ap+58rVyuiFVdw2KuGUaJPHZnJED4AhMmwlxyOAgwrr -----END CERTIFICATE----- # Issuer: CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK OU=Kamu Sertifikasyon Merkezi - Kamu SM # Subject: CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK OU=Kamu Sertifikasyon Merkezi - Kamu SM # Label: "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1" # Serial: 1 # MD5 Fingerprint: dc:00:81:dc:69:2f:3e:2f:b0:3b:f6:3d:5a:91:8e:49 # SHA1 Fingerprint: 31:43:64:9b:ec:ce:27:ec:ed:3a:3f:0b:8f:0d:e4:e8:91:dd:ee:ca # SHA256 Fingerprint: 46:ed:c3:68:90:46:d5:3a:45:3f:b3:10:4a:b8:0d:ca:ec:65:8b:26:60:ea:16:29:dd:7e:86:79:90:64:87:16 -----BEGIN CERTIFICATE----- MIIEYzCCA0ugAwIBAgIBATANBgkqhkiG9w0BAQsFADCB0jELMAkGA1UEBhMCVFIx GDAWBgNVBAcTD0dlYnplIC0gS29jYWVsaTFCMEAGA1UEChM5VHVya2l5ZSBCaWxp bXNlbCB2ZSBUZWtub2xvamlrIEFyYXN0aXJtYSBLdXJ1bXUgLSBUVUJJVEFLMS0w KwYDVQQLEyRLYW11IFNlcnRpZmlrYXN5b24gTWVya2V6aSAtIEthbXUgU00xNjA0 BgNVBAMTLVRVQklUQUsgS2FtdSBTTSBTU0wgS29rIFNlcnRpZmlrYXNpIC0gU3Vy dW0gMTAeFw0xMzExMjUwODI1NTVaFw00MzEwMjUwODI1NTVaMIHSMQswCQYDVQQG EwJUUjEYMBYGA1UEBxMPR2ViemUgLSBLb2NhZWxpMUIwQAYDVQQKEzlUdXJraXll IEJpbGltc2VsIHZlIFRla25vbG9qaWsgQXJhc3Rpcm1hIEt1cnVtdSAtIFRVQklU QUsxLTArBgNVBAsTJEthbXUgU2VydGlmaWthc3lvbiBNZXJrZXppIC0gS2FtdSBT TTE2MDQGA1UEAxMtVFVCSVRBSyBLYW11IFNNIFNTTCBLb2sgU2VydGlmaWthc2kg LSBTdXJ1bSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3UwM6q7 a9OZLBI3hNmNe5eA027n/5tQlT6QlVZC1xl8JoSNkvoBHToP4mQ4t4y86Ij5iySr LqP1N+RAjhgleYN1Hzv/bKjFxlb4tO2KRKOrbEz8HdDc72i9z+SqzvBV96I01INr N3wcwv61A+xXzry0tcXtAA9TNypN9E8Mg/uGz8v+jE69h/mniyFXnHrfA2eJLJ2X YacQuFWQfw4tJzh03+f92k4S400VIgLI4OD8D62K18lUUMw7D8oWgITQUVbDjlZ/ iSIzL+aFCr2lqBs23tPcLG07xxO9WSMs5uWk99gL7eqQQESolbuT1dCANLZGeA4f AJNG4e7p+exPFwIDAQABo0IwQDAdBgNVHQ4EFgQUZT/HiobGPN08VFw1+DrtUgxH V8gwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL BQADggEBACo/4fEyjq7hmFxLXs9rHmoJ0iKpEsdeV31zVmSAhHqT5Am5EM2fKifh AHe+SMg1qIGf5LgsyX8OsNJLN13qudULXjS99HMpw+0mFZx+CFOKWI3QSyjfwbPf IPP54+M638yclNhOT8NrF7f3cuitZjO1JVOr4PhMqZ398g26rrnZqsZr+ZO7rqu4 lzwDGrpDxpa5RXI4s6ehlj2Re37AIVNMh+3yC1SVUZPVIqUNivGTDj5UDrDYyU7c 8jEyVupk+eq1nRZmQnLzf9OxMUP8pI4X8W0jq5Rm+K37DwhuJi1/FwcJsoz7UMCf lo3Ptv0AnVoUmr8CRPXBwp8iXqIPoeM= -----END CERTIFICATE----- # Issuer: CN=GDCA TrustAUTH R5 ROOT O=GUANG DONG CERTIFICATE AUTHORITY CO.,LTD. # Subject: CN=GDCA TrustAUTH R5 ROOT O=GUANG DONG CERTIFICATE AUTHORITY CO.,LTD. # Label: "GDCA TrustAUTH R5 ROOT" # Serial: 9009899650740120186 # MD5 Fingerprint: 63:cc:d9:3d:34:35:5c:6f:53:a3:e2:08:70:48:1f:b4 # SHA1 Fingerprint: 0f:36:38:5b:81:1a:25:c3:9b:31:4e:83:ca:e9:34:66:70:cc:74:b4 # SHA256 Fingerprint: bf:ff:8f:d0:44:33:48:7d:6a:8a:a6:0c:1a:29:76:7a:9f:c2:bb:b0:5e:42:0f:71:3a:13:b9:92:89:1d:38:93 -----BEGIN CERTIFICATE----- MIIFiDCCA3CgAwIBAgIIfQmX/vBH6nowDQYJKoZIhvcNAQELBQAwYjELMAkGA1UE BhMCQ04xMjAwBgNVBAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZ IENPLixMVEQuMR8wHQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMB4XDTE0 MTEyNjA1MTMxNVoXDTQwMTIzMTE1NTk1OVowYjELMAkGA1UEBhMCQ04xMjAwBgNV BAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZIENPLixMVEQuMR8w HQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMIICIjANBgkqhkiG9w0BAQEF AAOCAg8AMIICCgKCAgEA2aMW8Mh0dHeb7zMNOwZ+Vfy1YI92hhJCfVZmPoiC7XJj Dp6L3TQsAlFRwxn9WVSEyfFrs0yw6ehGXTjGoqcuEVe6ghWinI9tsJlKCvLriXBj TnnEt1u9ol2x8kECK62pOqPseQrsXzrj/e+APK00mxqriCZ7VqKChh/rNYmDf1+u KU49tm7srsHwJ5uu4/Ts765/94Y9cnrrpftZTqfrlYwiOXnhLQiPzLyRuEH3FMEj qcOtmkVEs7LXLM3GKeJQEK5cy4KOFxg2fZfmiJqwTTQJ9Cy5WmYqsBebnh52nUpm MUHfP/vFBu8btn4aRjb3ZGM74zkYI+dndRTVdVeSN72+ahsmUPI2JgaQxXABZG12 ZuGR224HwGGALrIuL4xwp9E7PLOR5G62xDtw8mySlwnNR30YwPO7ng/Wi64HtloP zgsMR6flPri9fcebNaBhlzpBdRfMK5Z3KpIhHtmVdiBnaM8Nvd/WHwlqmuLMc3Gk L30SgLdTMEZeS1SZD2fJpcjyIMGC7J0R38IC+xo70e0gmu9lZJIQDSri3nDxGGeC jGHeuLzRL5z7D9Ar7Rt2ueQ5Vfj4oR24qoAATILnsn8JuLwwoC8N9VKejveSswoA HQBUlwbgsQfZxw9cZX08bVlX5O2ljelAU58VS6Bx9hoh49pwBiFYFIeFd3mqgnkC AwEAAaNCMEAwHQYDVR0OBBYEFOLJQJ9NzuiaoXzPDj9lxSmIahlRMA8GA1UdEwEB /wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQDRSVfg p8xoWLoBDysZzY2wYUWsEe1jUGn4H3++Fo/9nesLqjJHdtJnJO29fDMylyrHBYZm DRd9FBUb1Ov9H5r2XpdptxolpAqzkT9fNqyL7FeoPueBihhXOYV0GkLH6VsTX4/5 COmSdI31R9KrO9b7eGZONn356ZLpBN79SWP8bfsUcZNnL0dKt7n/HipzcEYwv1ry L3ml4Y0M2fmyYzeMN2WFcGpcWwlyua1jPLHd+PwyvzeG5LuOmCd+uh8W4XAR8gPf JWIyJyYYMoSf/wA6E7qaTfRPuBRwIrHKK5DOKcFw9C+df/KQHtZa37dG/OaG+svg IHZ6uqbL9XzeYqWxi+7egmaKTjowHz+Ay60nugxe19CxVsp3cbK1daFQqUBDF8Io 2c9Si1vIY9RCPqAzekYu9wogRlR+ak8x8YF+QnQ4ZXMn7sZ8uI7XpTrXmKGcjBBV 09tL7ECQ8s1uV9JiDnxXk7Gnbc2dg7sq5+W2O3FYrf3RRbxake5TFW/TRQl1brqQ XR4EzzffHqhmsYzmIGrv/EhOdJhCrylvLmrH+33RZjEizIYAfmaDDEL0vTSSwxrq T8p+ck0LcIymSLumoRT2+1hEmRSuqguTaaApJUqlyyvdimYHFngVV3Eb7PVHhPOe MTd61X8kreS8/f3MboPoDKi3QWwH3b08hpcv0g== -----END CERTIFICATE----- # Issuer: CN=TrustCor RootCert CA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority # Subject: CN=TrustCor RootCert CA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority # Label: "TrustCor RootCert CA-1" # Serial: 15752444095811006489 # MD5 Fingerprint: 6e:85:f1:dc:1a:00:d3:22:d5:b2:b2:ac:6b:37:05:45 # SHA1 Fingerprint: ff:bd:cd:e7:82:c8:43:5e:3c:6f:26:86:5c:ca:a8:3a:45:5b:c3:0a # SHA256 Fingerprint: d4:0e:9c:86:cd:8f:e4:68:c1:77:69:59:f4:9e:a7:74:fa:54:86:84:b6:c4:06:f3:90:92:61:f4:dc:e2:57:5c -----BEGIN CERTIFICATE----- MIIEMDCCAxigAwIBAgIJANqb7HHzA7AZMA0GCSqGSIb3DQEBCwUAMIGkMQswCQYD VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRydXN0Q29y IFJvb3RDZXJ0IENBLTEwHhcNMTYwMjA0MTIzMjE2WhcNMjkxMjMxMTcyMzE2WjCB pDELMAkGA1UEBhMCUEExDzANBgNVBAgMBlBhbmFtYTEUMBIGA1UEBwwLUGFuYW1h IENpdHkxJDAiBgNVBAoMG1RydXN0Q29yIFN5c3RlbXMgUy4gZGUgUi5MLjEnMCUG A1UECwweVHJ1c3RDb3IgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR8wHQYDVQQDDBZU cnVzdENvciBSb290Q2VydCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAv463leLCJhJrMxnHQFgKq1mqjQCj/IDHUHuO1CAmujIS2CNUSSUQIpid RtLByZ5OGy4sDjjzGiVoHKZaBeYei0i/mJZ0PmnK6bV4pQa81QBeCQryJ3pS/C3V seq0iWEk8xoT26nPUu0MJLq5nux+AHT6k61sKZKuUbS701e/s/OojZz0JEsq1pme 9J7+wH5COucLlVPat2gOkEz7cD+PSiyU8ybdY2mplNgQTsVHCJCZGxdNuWxu72CV EY4hgLW9oHPY0LJ3xEXqWib7ZnZ2+AYfYW0PVcWDtxBWcgYHpfOxGgMFZA6dWorW hnAbJN7+KIor0Gqw/Hqi3LJ5DotlDwIDAQABo2MwYTAdBgNVHQ4EFgQU7mtJPHo/ DeOxCbeKyKsZn3MzUOcwHwYDVR0jBBgwFoAU7mtJPHo/DeOxCbeKyKsZn3MzUOcw DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD ggEBACUY1JGPE+6PHh0RU9otRCkZoB5rMZ5NDp6tPVxBb5UrJKF5mDo4Nvu7Zp5I /5CQ7z3UuJu0h3U/IJvOcs+hVcFNZKIZBqEHMwwLKeXx6quj7LUKdJDHfXLy11yf ke+Ri7fc7Waiz45mO7yfOgLgJ90WmMCV1Aqk5IGadZQ1nJBfiDcGrVmVCrDRZ9MZ yonnMlo2HD6CqFqTvsbQZJG2z9m2GM/bftJlo6bEjhcxwft+dtvTheNYsnd6djts L1Ac59v2Z3kf9YKVmgenFK+P3CghZwnS1k1aHBkcjndcw5QkPTJrS37UeJSDvjdN zl/HHk484IkzlQsPpTLWPFp5LBk= -----END CERTIFICATE----- # Issuer: CN=TrustCor RootCert CA-2 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority # Subject: CN=TrustCor RootCert CA-2 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority # Label: "TrustCor RootCert CA-2" # Serial: 2711694510199101698 # MD5 Fingerprint: a2:e1:f8:18:0b:ba:45:d5:c7:41:2a:bb:37:52:45:64 # SHA1 Fingerprint: b8:be:6d:cb:56:f1:55:b9:63:d4:12:ca:4e:06:34:c7:94:b2:1c:c0 # SHA256 Fingerprint: 07:53:e9:40:37:8c:1b:d5:e3:83:6e:39:5d:ae:a5:cb:83:9e:50:46:f1:bd:0e:ae:19:51:cf:10:fe:c7:c9:65 -----BEGIN CERTIFICATE----- MIIGLzCCBBegAwIBAgIIJaHfyjPLWQIwDQYJKoZIhvcNAQELBQAwgaQxCzAJBgNV BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEfMB0GA1UEAwwWVHJ1c3RDb3Ig Um9vdENlcnQgQ0EtMjAeFw0xNjAyMDQxMjMyMjNaFw0zNDEyMzExNzI2MzlaMIGk MQswCQYDVQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEg Q2l0eTEkMCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYD VQQLDB5UcnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRy dXN0Q29yIFJvb3RDZXJ0IENBLTIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK AoICAQCnIG7CKqJiJJWQdsg4foDSq8GbZQWU9MEKENUCrO2fk8eHyLAnK0IMPQo+ QVqedd2NyuCb7GgypGmSaIwLgQ5WoD4a3SwlFIIvl9NkRvRUqdw6VC0xK5mC8tkq 1+9xALgxpL56JAfDQiDyitSSBBtlVkxs1Pu2YVpHI7TYabS3OtB0PAx1oYxOdqHp 2yqlO/rOsP9+aij9JxzIsekp8VduZLTQwRVtDr4uDkbIXvRR/u8OYzo7cbrPb1nK DOObXUm4TOJXsZiKQlecdu/vvdFoqNL0Cbt3Nb4lggjEFixEIFapRBF37120Hape az6LMvYHL1cEksr1/p3C6eizjkxLAjHZ5DxIgif3GIJ2SDpxsROhOdUuxTTCHWKF 3wP+TfSvPd9cW436cOGlfifHhi5qjxLGhF5DUVCcGZt45vz27Ud+ez1m7xMTiF88 oWP7+ayHNZ/zgp6kPwqcMWmLmaSISo5uZk3vFsQPeSghYA2FFn3XVDjxklb9tTNM g9zXEJ9L/cb4Qr26fHMC4P99zVvh1Kxhe1fVSntb1IVYJ12/+CtgrKAmrhQhJ8Z3 mjOAPF5GP/fDsaOGM8boXg25NSyqRsGFAnWAoOsk+xWq5Gd/bnc/9ASKL3x74xdh 8N0JqSDIvgmk0H5Ew7IwSjiqqewYmgeCK9u4nBit2uBGF6zPXQIDAQABo2MwYTAd BgNVHQ4EFgQU2f4hQG6UnrybPZx9mCAZ5YwwYrIwHwYDVR0jBBgwFoAU2f4hQG6U nrybPZx9mCAZ5YwwYrIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYw DQYJKoZIhvcNAQELBQADggIBAJ5Fngw7tu/hOsh80QA9z+LqBrWyOrsGS2h60COX dKcs8AjYeVrXWoSK2BKaG9l9XE1wxaX5q+WjiYndAfrs3fnpkpfbsEZC89NiqpX+ MWcUaViQCqoL7jcjx1BRtPV+nuN79+TMQjItSQzL/0kMmx40/W5ulop5A7Zv2wnL /V9lFDfhOPXzYRZY5LVtDQsEGz9QLX+zx3oaFoBg+Iof6Rsqxvm6ARppv9JYx1RX CI/hOWB3S6xZhBqI8d3LT3jX5+EzLfzuQfogsL7L9ziUwOHQhQ+77Sxzq+3+knYa ZH9bDTMJBzN7Bj8RpFxwPIXAz+OQqIN3+tvmxYxoZxBnpVIt8MSZj3+/0WvitUfW 2dCFmU2Umw9Lje4AWkcdEQOsQRivh7dvDDqPys/cA8GiCcjl/YBeyGBCARsaU1q7 N6a3vLqE6R5sGtRk2tRD/pOLS/IseRYQ1JMLiI+h2IYURpFHmygk71dSTlxCnKr3 Sewn6EAes6aJInKc9Q0ztFijMDvd1GpUk74aTfOTlPf8hAs/hCBcNANExdqtvArB As8e5ZTZ845b2EzwnexhF7sUMlQMAimTHpKG9n/v55IFDlndmQguLvqcAFLTxWYp 5KeXRKQOKIETNcX2b2TmQcTVL8w0RSXPQQCWPUouwpaYT05KnJe32x+SMsj/D1Fu 1uwJ -----END CERTIFICATE----- # Issuer: CN=TrustCor ECA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority # Subject: CN=TrustCor ECA-1 O=TrustCor Systems S. de R.L. OU=TrustCor Certificate Authority # Label: "TrustCor ECA-1" # Serial: 9548242946988625984 # MD5 Fingerprint: 27:92:23:1d:0a:f5:40:7c:e9:e6:6b:9d:d8:f5:e7:6c # SHA1 Fingerprint: 58:d1:df:95:95:67:6b:63:c0:f0:5b:1c:17:4d:8b:84:0b:c8:78:bd # SHA256 Fingerprint: 5a:88:5d:b1:9c:01:d9:12:c5:75:93:88:93:8c:af:bb:df:03:1a:b2:d4:8e:91:ee:15:58:9b:42:97:1d:03:9c -----BEGIN CERTIFICATE----- MIIEIDCCAwigAwIBAgIJAISCLF8cYtBAMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxFzAVBgNVBAMMDlRydXN0Q29y IEVDQS0xMB4XDTE2MDIwNDEyMzIzM1oXDTI5MTIzMTE3MjgwN1owgZwxCzAJBgNV BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAwwOVHJ1c3RDb3Ig RUNBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPj+ARtZ+odnbb 3w9U73NjKYKtR8aja+3+XzP4Q1HpGjORMRegdMTUpwHmspI+ap3tDvl0mEDTPwOA BoJA6LHip1GnHYMma6ve+heRK9jGrB6xnhkB1Zem6g23xFUfJ3zSCNV2HykVh0A5 3ThFEXXQmqc04L/NyFIduUd+Dbi7xgz2c1cWWn5DkR9VOsZtRASqnKmcp0yJF4Ou owReUoCLHhIlERnXDH19MURB6tuvsBzvgdAsxZohmz3tQjtQJvLsznFhBmIhVE5/ wZ0+fyCMgMsq2JdiyIMzkX2woloPV+g7zPIlstR8L+xNxqE6FXrntl019fZISjZF ZtS6mFjBAgMBAAGjYzBhMB0GA1UdDgQWBBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAf BgNVHSMEGDAWgBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAPBgNVHRMBAf8EBTADAQH/ MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEABT41XBVwm8nHc2Fv civUwo/yQ10CzsSUuZQRg2dd4mdsdXa/uwyqNsatR5Nj3B5+1t4u/ukZMjgDfxT2 AHMsWbEhBuH7rBiVDKP/mZb3Kyeb1STMHd3BOuCYRLDE5D53sXOpZCz2HAF8P11F hcCF5yWPldwX8zyfGm6wyuMdKulMY/okYWLW2n62HGz1Ah3UKt1VkOsqEUc8Ll50 soIipX1TH0XsJ5F95yIW6MBoNtjG8U+ARDL54dHRHareqKucBK+tIA5kmE2la8BI WJZpTdwHjFGTot+fDz2LYLSCjaoITmJF4PkL0uDgPFveXHEnJcLmA4GLEFPjx1Wi tJ/X5g== -----END CERTIFICATE----- # Issuer: CN=SSL.com Root Certification Authority RSA O=SSL Corporation # Subject: CN=SSL.com Root Certification Authority RSA O=SSL Corporation # Label: "SSL.com Root Certification Authority RSA" # Serial: 8875640296558310041 # MD5 Fingerprint: 86:69:12:c0:70:f1:ec:ac:ac:c2:d5:bc:a5:5b:a1:29 # SHA1 Fingerprint: b7:ab:33:08:d1:ea:44:77:ba:14:80:12:5a:6f:bd:a9:36:49:0c:bb # SHA256 Fingerprint: 85:66:6a:56:2e:e0:be:5c:e9:25:c1:d8:89:0a:6f:76:a8:7e:c1:6d:4d:7d:5f:29:ea:74:19:cf:20:12:3b:69 -----BEGIN CERTIFICATE----- MIIF3TCCA8WgAwIBAgIIeyyb0xaAMpkwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UE BhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQK DA9TU0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eSBSU0EwHhcNMTYwMjEyMTczOTM5WhcNNDEwMjEyMTcz OTM5WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNv bSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTCCAiIwDQYJKoZIhvcN AQEBBQADggIPADCCAgoCggIBAPkP3aMrfcvQKv7sZ4Wm5y4bunfh4/WvpOz6Sl2R xFdHaxh3a3by/ZPkPQ/CFp4LZsNWlJ4Xg4XOVu/yFv0AYvUiCVToZRdOQbngT0aX qhvIuG5iXmmxX9sqAn78bMrzQdjt0Oj8P2FI7bADFB0QDksZ4LtO7IZl/zbzXmcC C52GVWH9ejjt/uIZALdvoVBidXQ8oPrIJZK0bnoix/geoeOy3ZExqysdBP+lSgQ3 6YWkMyv94tZVNHwZpEpox7Ko07fKoZOI68GXvIz5HdkihCR0xwQ9aqkpk8zruFvh /l8lqjRYyMEjVJ0bmBHDOJx+PYZspQ9AhnwC9FwCTyjLrnGfDzrIM/4RJTXq/LrF YD3ZfBjVsqnTdXgDciLKOsMf7yzlLqn6niy2UUb9rwPW6mBo6oUWNmuF6R7As93E JNyAKoFBbZQ+yODJgUEAnl6/f8UImKIYLEJAs/lvOCdLToD0PYFH4Ih86hzOtXVc US4cK38acijnALXRdMbX5J+tB5O2UzU1/Dfkw/ZdFr4hc96SCvigY2q8lpJqPvi8 ZVWb3vUNiSYE/CUapiVpy8JtynziWV+XrOvvLsi81xtZPCvM8hnIk2snYxnP/Okm +Mpxm3+T/jRnhE6Z6/yzeAkzcLpmpnbtG3PrGqUNxCITIJRWCk4sbE6x/c+cCbqi M+2HAgMBAAGjYzBhMB0GA1UdDgQWBBTdBAkHovV6fVJTEpKV7jiAJQ2mWTAPBgNV HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFN0ECQei9Xp9UlMSkpXuOIAlDaZZMA4G A1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAIBgRlCn7Jp0cHh5wYfGV cpNxJK1ok1iOMq8bs3AD/CUrdIWQPXhq9LmLpZc7tRiRux6n+UBbkflVma8eEdBc Hadm47GUBwwyOabqG7B52B2ccETjit3E+ZUfijhDPwGFpUenPUayvOUiaPd7nNgs PgohyC0zrL/FgZkxdMF1ccW+sfAjRfSda/wZY52jvATGGAslu1OJD7OAUN5F7kR/ q5R4ZJjT9ijdh9hwZXT7DrkT66cPYakylszeu+1jTBi7qUD3oFRuIIhxdRjqerQ0 cuAjJ3dctpDqhiVAq+8zD8ufgr6iIPv2tS0a5sKFsXQP+8hlAqRSAUfdSSLBv9jr a6x+3uxjMxW3IwiPxg+NQVrdjsW5j+VFP3jbutIbQLH+cU0/4IGiul607BXgk90I H37hVZkLId6Tngr75qNJvTYw/ud3sqB1l7UtgYgXZSD32pAAn8lSzDLKNXz1PQ/Y K9f1JmzJBjSWFupwWRoyeXkLtoh/D1JIPb9s2KJELtFOt3JY04kTlf5Eq/jXixtu nLwsoFvVagCvXzfh1foQC5ichucmj87w7G6KVwuA406ywKBjYZC6VWg3dGq2ktuf oYYitmUnDuy2n0Jg5GfCtdpBC8TTi2EbvPofkSvXRAdeuims2cXp71NIWuuA8ShY Ic2wBlX7Jz9TkHCpBB5XJ7k= -----END CERTIFICATE----- # Issuer: CN=SSL.com Root Certification Authority ECC O=SSL Corporation # Subject: CN=SSL.com Root Certification Authority ECC O=SSL Corporation # Label: "SSL.com Root Certification Authority ECC" # Serial: 8495723813297216424 # MD5 Fingerprint: 2e:da:e4:39:7f:9c:8f:37:d1:70:9f:26:17:51:3a:8e # SHA1 Fingerprint: c3:19:7c:39:24:e6:54:af:1b:c4:ab:20:95:7a:e2:c3:0e:13:02:6a # SHA256 Fingerprint: 34:17:bb:06:cc:60:07:da:1b:96:1c:92:0b:8a:b4:ce:3f:ad:82:0e:4a:a3:0b:9a:cb:c4:a7:4e:bd:ce:bc:65 -----BEGIN CERTIFICATE----- MIICjTCCAhSgAwIBAgIIdebfy8FoW6gwCgYIKoZIzj0EAwIwfDELMAkGA1UEBhMC VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T U0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZpY2F0 aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNDAzWhcNNDEwMjEyMTgxNDAz WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0 b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNvbSBS b290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49AgEGBSuB BAAiA2IABEVuqVDEpiM2nl8ojRfLliJkP9x6jh3MCLOicSS6jkm5BBtHllirLZXI 7Z4INcgn64mMU1jrYor+8FsPazFSY0E7ic3s7LaNGdM0B9y7xgZ/wkWV7Mt/qCPg CemB+vNH06NjMGEwHQYDVR0OBBYEFILRhXMw5zUE044CkvvlpNHEIejNMA8GA1Ud EwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUgtGFczDnNQTTjgKS++Wk0cQh6M0wDgYD VR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2cAMGQCMG/n61kRpGDPYbCWe+0F+S8T kdzt5fxQaxFGRrMcIQBiu77D5+jNB5n5DQtdcj7EqgIwH7y6C+IwJPt8bYBVCpk+ gA0z5Wajs6O7pdWLjwkspl1+4vAHCGht0nxpbl/f5Wpl -----END CERTIFICATE----- # Issuer: CN=SSL.com EV Root Certification Authority RSA R2 O=SSL Corporation # Subject: CN=SSL.com EV Root Certification Authority RSA R2 O=SSL Corporation # Label: "SSL.com EV Root Certification Authority RSA R2" # Serial: 6248227494352943350 # MD5 Fingerprint: e1:1e:31:58:1a:ae:54:53:02:f6:17:6a:11:7b:4d:95 # SHA1 Fingerprint: 74:3a:f0:52:9b:d0:32:a0:f4:4a:83:cd:d4:ba:a9:7b:7c:2e:c4:9a # SHA256 Fingerprint: 2e:7b:f1:6c:c2:24:85:a7:bb:e2:aa:86:96:75:07:61:b0:ae:39:be:3b:2f:e9:d0:cc:6d:4e:f7:34:91:42:5c -----BEGIN CERTIFICATE----- MIIF6zCCA9OgAwIBAgIIVrYpzTS8ePYwDQYJKoZIhvcNAQELBQAwgYIxCzAJBgNV BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE CgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQDDC5TU0wuY29tIEVWIFJvb3QgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyMB4XDTE3MDUzMTE4MTQzN1oXDTQy MDUzMDE4MTQzN1owgYIxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4G A1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQD DC5TU0wuY29tIEVWIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIy MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjzZlQOHWTcDXtOlG2mvq M0fNTPl9fb69LT3w23jhhqXZuglXaO1XPqDQCEGD5yhBJB/jchXQARr7XnAjssuf OePPxU7Gkm0mxnu7s9onnQqG6YE3Bf7wcXHswxzpY6IXFJ3vG2fThVUCAtZJycxa 4bH3bzKfydQ7iEGonL3Lq9ttewkfokxykNorCPzPPFTOZw+oz12WGQvE43LrrdF9 HSfvkusQv1vrO6/PgN3B0pYEW3p+pKk8OHakYo6gOV7qd89dAFmPZiw+B6KjBSYR aZfqhbcPlgtLyEDhULouisv3D5oi53+aNxPN8k0TayHRwMwi8qFG9kRpnMphNQcA b9ZhCBHqurj26bNg5U257J8UZslXWNvNh2n4ioYSA0e/ZhN2rHd9NCSFg83XqpyQ Gp8hLH94t2S42Oim9HizVcuE0jLEeK6jj2HdzghTreyI/BXkmg3mnxp3zkyPuBQV PWKchjgGAGYS5Fl2WlPAApiiECtoRHuOec4zSnaqW4EWG7WK2NAAe15itAnWhmMO pgWVSbooi4iTsjQc2KRVbrcc0N6ZVTsj9CLg+SlmJuwgUHfbSguPvuUCYHBBXtSu UDkiFCbLsjtzdFVHB3mBOagwE0TlBIqulhMlQg+5U8Sb/M3kHN48+qvWBkofZ6aY MBzdLNvcGJVXZsb/XItW9XcCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNV HSMEGDAWgBT5YLvU49U09rj1BoAlp3PbRmmonjAdBgNVHQ4EFgQU+WC71OPVNPa4 9QaAJadz20ZpqJ4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBW s47LCp1Jjr+kxJG7ZhcFUZh1++VQLHqe8RT6q9OKPv+RKY9ji9i0qVQBDb6Thi/5 Sm3HXvVX+cpVHBK+Rw82xd9qt9t1wkclf7nxY/hoLVUE0fKNsKTPvDxeH3jnpaAg cLAExbf3cqfeIg29MyVGjGSSJuM+LmOW2puMPfgYCdcDzH2GguDKBAdRUNf/ktUM 79qGn5nX67evaOI5JpS6aLe/g9Pqemc9YmeuJeVy6OLk7K4S9ksrPJ/psEDzOFSz /bdoyNrGj1E8svuR3Bznm53htw1yj+KkxKl4+esUrMZDBcJlOSgYAsOCsp0FvmXt ll9ldDz7CTUue5wT/RsPXcdtgTpWD8w74a8CLyKsRspGPKAcTNZEtF4uXBVmCeEm Kf7GUmG6sXP/wwyc5WxqlD8UykAWlYTzWamsX0xhk23RO8yilQwipmdnRC652dKK QbNmC1r7fSOl8hqw/96bg5Qu0T/fkreRrwU7ZcegbLHNYhLDkBvjJc40vG93drEQ w/cFGsDWr3RiSBd3kmmQYRzelYB0VI8YHMPzA9C/pEN1hlMYegouCRw2n5H9gooi S9EOUCXdywMMF8mDAAhONU2Ki+3wApRmLER/y5UnlhetCTCstnEXbosX9hwJ1C07 mKVx01QT2WDz9UtmT/rx7iASjbSsV7FFY6GsdqnC+w== -----END CERTIFICATE----- # Issuer: CN=SSL.com EV Root Certification Authority ECC O=SSL Corporation # Subject: CN=SSL.com EV Root Certification Authority ECC O=SSL Corporation # Label: "SSL.com EV Root Certification Authority ECC" # Serial: 3182246526754555285 # MD5 Fingerprint: 59:53:22:65:83:42:01:54:c0:ce:42:b9:5a:7c:f2:90 # SHA1 Fingerprint: 4c:dd:51:a3:d1:f5:20:32:14:b0:c6:c5:32:23:03:91:c7:46:42:6d # SHA256 Fingerprint: 22:a2:c1:f7:bd:ed:70:4c:c1:e7:01:b5:f4:08:c3:10:88:0f:e9:56:b5:de:2a:4a:44:f9:9c:87:3a:25:a7:c8 -----BEGIN CERTIFICATE----- MIIClDCCAhqgAwIBAgIILCmcWxbtBZUwCgYIKoZIzj0EAwIwfzELMAkGA1UEBhMC VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T U0wgQ29ycG9yYXRpb24xNDAyBgNVBAMMK1NTTC5jb20gRVYgUm9vdCBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNTIzWhcNNDEwMjEyMTgx NTIzWjB/MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrU1NMLmNv bSBFViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49 AgEGBSuBBAAiA2IABKoSR5CYG/vvw0AHgyBO8TCCogbR8pKGYfL2IWjKAMTH6kMA VIbc/R/fALhBYlzccBYy3h+Z1MzFB8gIH2EWB1E9fVwHU+M1OIzfzZ/ZLg1Kthku WnBaBu2+8KGwytAJKaNjMGEwHQYDVR0OBBYEFFvKXuXe0oGqzagtZFG22XKbl+ZP MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUW8pe5d7SgarNqC1kUbbZcpuX 5k8wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2gAMGUCMQCK5kCJN+vp1RPZ ytRrJPOwPYdGWBrssd9v+1a6cGvHOMzosYxPD/fxZ3YOg9AeUY8CMD32IygmTMZg h5Mmm7I1HrrW9zzRHM76JTymGoEVW/MSD2zuZYrJh6j5B+BimoxcSg== -----END CERTIFICATE-----	260.37 KB	2025-05-25 12:26
📄 client.py # Copyright 2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import logging from botocore import waiter, xform_name from botocore.args import ClientArgsCreator from botocore.auth import AUTH_TYPE_MAPS, resolve_auth_type from botocore.awsrequest import prepare_request_dict from botocore.compress import maybe_compress_request from botocore.config import Config from botocore.context import with_current_context from botocore.credentials import RefreshableCredentials from botocore.discovery import ( EndpointDiscoveryHandler, EndpointDiscoveryManager, block_endpoint_discovery_required_operations, ) from botocore.docs.docstring import ClientMethodDocstring, PaginatorDocstring from botocore.exceptions import ( DataNotFoundError, InvalidEndpointDiscoveryConfigurationError, OperationNotPageableError, UnknownServiceError, UnknownSignatureVersionError, ) from botocore.history import get_global_history_recorder from botocore.hooks import first_non_none_response from botocore.httpchecksum import ( apply_request_checksum, resolve_checksum_context, ) from botocore.model import ServiceModel from botocore.paginate import Paginator from botocore.retries import adaptive, standard from botocore.useragent import UserAgentString from botocore.utils import ( CachedProperty, EventbridgeSignerSetter, S3ControlArnParamHandlerv2, S3ExpressIdentityResolver, S3RegionRedirectorv2, ensure_boolean, get_service_module_name, ) # Keep these imported. There's pre-existing code that uses: # "from botocore.client import UNSIGNED" # "from botocore.client import ClientError" # etc. from botocore.exceptions import ClientError # noqa from botocore.utils import S3ArnParamHandler # noqa from botocore.utils import S3ControlArnParamHandler # noqa from botocore.utils import S3ControlEndpointSetter # noqa from botocore.utils import S3EndpointSetter # noqa from botocore.utils import S3RegionRedirector # noqa from botocore import UNSIGNED # noqa logger = logging.getLogger(__name__) history_recorder = get_global_history_recorder() class ClientCreator: """Creates client objects for a service.""" def __init__( self, loader, endpoint_resolver, user_agent, event_emitter, retry_handler_factory, retry_config_translator, response_parser_factory=None, exceptions_factory=None, config_store=None, user_agent_creator=None, ): self._loader = loader self._endpoint_resolver = endpoint_resolver self._user_agent = user_agent self._event_emitter = event_emitter self._retry_handler_factory = retry_handler_factory self._retry_config_translator = retry_config_translator self._response_parser_factory = response_parser_factory self._exceptions_factory = exceptions_factory # TODO: Migrate things away from scoped_config in favor of the # config_store. The config store can pull things from both the scoped # config and environment variables (and potentially more in the # future). self._config_store = config_store self._user_agent_creator = user_agent_creator def create_client( self, service_name, region_name, is_secure=True, endpoint_url=None, verify=None, credentials=None, scoped_config=None, api_version=None, client_config=None, auth_token=None, ): responses = self._event_emitter.emit( 'choose-service-name', service_name=service_name ) service_name = first_non_none_response(responses, default=service_name) service_model = self._load_service_model(service_name, api_version) try: endpoints_ruleset_data = self._load_service_endpoints_ruleset( service_name, api_version ) partition_data = self._loader.load_data('partitions') except UnknownServiceError: endpoints_ruleset_data = None partition_data = None logger.info( 'No endpoints ruleset found for service %s, falling back to ' 'legacy endpoint routing.', service_name, ) cls = self._create_client_class(service_name, service_model) region_name, client_config = self._normalize_fips_region( region_name, client_config ) if auth := service_model.metadata.get('auth'): service_signature_version = resolve_auth_type(auth) else: service_signature_version = service_model.metadata.get( 'signatureVersion' ) endpoint_bridge = ClientEndpointBridge( self._endpoint_resolver, scoped_config, client_config, service_signing_name=service_model.metadata.get('signingName'), config_store=self._config_store, service_signature_version=service_signature_version, ) client_args = self._get_client_args( service_model, region_name, is_secure, endpoint_url, verify, credentials, scoped_config, client_config, endpoint_bridge, auth_token, endpoints_ruleset_data, partition_data, ) service_client = cls(client_args) self._register_retries(service_client) self._register_s3_events( client=service_client, endpoint_bridge=None, endpoint_url=None, client_config=client_config, scoped_config=scoped_config, ) self._register_s3express_events(client=service_client) self._register_s3_control_events(client=service_client) self._register_importexport_events(client=service_client) self._register_endpoint_discovery( service_client, endpoint_url, client_config ) return service_client def create_client_class(self, service_name, api_version=None): service_model = self._load_service_model(service_name, api_version) return self._create_client_class(service_name, service_model) def _create_client_class(self, service_name, service_model): class_attributes = self._create_methods(service_model) py_name_to_operation_name = self._create_name_mapping(service_model) class_attributes['_PY_TO_OP_NAME'] = py_name_to_operation_name bases = [BaseClient] service_id = service_model.service_id.hyphenize() self._event_emitter.emit( f'creating-client-class.{service_id}', class_attributes=class_attributes, base_classes=bases, ) class_name = get_service_module_name(service_model) cls = type(str(class_name), tuple(bases), class_attributes) return cls def _normalize_fips_region(self, region_name, client_config): if region_name is not None: normalized_region_name = region_name.replace('fips-', '').replace( '-fips', '' ) # If region has been transformed then set flag if normalized_region_name != region_name: config_use_fips_endpoint = Config(use_fips_endpoint=True) if client_config: # Keeping endpoint setting client specific client_config = client_config.merge( config_use_fips_endpoint ) else: client_config = config_use_fips_endpoint logger.warning( f'transforming region from {region_name} to ' f'{normalized_region_name} and setting ' 'use_fips_endpoint to true. client should not ' 'be configured with a fips psuedo region.' ) region_name = normalized_region_name return region_name, client_config def _load_service_model(self, service_name, api_version=None): json_model = self._loader.load_service_model( service_name, 'service-2', api_version=api_version ) service_model = ServiceModel(json_model, service_name=service_name) return service_model def _load_service_endpoints_ruleset(self, service_name, api_version=None): return self._loader.load_service_model( service_name, 'endpoint-rule-set-1', api_version=api_version ) def _register_retries(self, client): retry_mode = client.meta.config.retries['mode'] if retry_mode == 'standard': self._register_v2_standard_retries(client) elif retry_mode == 'adaptive': self._register_v2_standard_retries(client) self._register_v2_adaptive_retries(client) elif retry_mode == 'legacy': self._register_legacy_retries(client) def _register_v2_standard_retries(self, client): max_attempts = client.meta.config.retries.get('total_max_attempts') kwargs = {'client': client} if max_attempts is not None: kwargs['max_attempts'] = max_attempts standard.register_retry_handler(kwargs) def _register_v2_adaptive_retries(self, client): adaptive.register_retry_handler(client) def _register_legacy_retries(self, client): endpoint_prefix = client.meta.service_model.endpoint_prefix service_id = client.meta.service_model.service_id service_event_name = service_id.hyphenize() # First, we load the entire retry config for all services, # then pull out just the information we need. original_config = self._loader.load_data('_retry') if not original_config: return retries = self._transform_legacy_retries(client.meta.config.retries) retry_config = self._retry_config_translator.build_retry_config( endpoint_prefix, original_config.get('retry', {}), original_config.get('definitions', {}), retries, ) logger.debug( "Registering retry handlers for service: %s", client.meta.service_model.service_name, ) handler = self._retry_handler_factory.create_retry_handler( retry_config, endpoint_prefix ) unique_id = f'retry-config-{service_event_name}' client.meta.events.register( f"needs-retry.{service_event_name}", handler, unique_id=unique_id ) def _transform_legacy_retries(self, retries): if retries is None: return copied_args = retries.copy() if 'total_max_attempts' in retries: copied_args = retries.copy() copied_args['max_attempts'] = ( copied_args.pop('total_max_attempts') - 1 ) return copied_args def _get_retry_mode(self, client, config_store): client_retries = client.meta.config.retries if ( client_retries is not None and client_retries.get('mode') is not None ): return client_retries['mode'] return config_store.get_config_variable('retry_mode') or 'legacy' def _register_endpoint_discovery(self, client, endpoint_url, config): if endpoint_url is not None: # Don't register any handlers in the case of a custom endpoint url return # Only attach handlers if the service supports discovery if client.meta.service_model.endpoint_discovery_operation is None: return events = client.meta.events service_id = client.meta.service_model.service_id.hyphenize() enabled = False if config and config.endpoint_discovery_enabled is not None: enabled = config.endpoint_discovery_enabled elif self._config_store: enabled = self._config_store.get_config_variable( 'endpoint_discovery_enabled' ) enabled = self._normalize_endpoint_discovery_config(enabled) if enabled and self._requires_endpoint_discovery(client, enabled): discover = enabled is True manager = EndpointDiscoveryManager( client, always_discover=discover ) handler = EndpointDiscoveryHandler(manager) handler.register(events, service_id) else: events.register( 'before-parameter-build', block_endpoint_discovery_required_operations, ) def _normalize_endpoint_discovery_config(self, enabled): """Config must either be a boolean-string or string-literal 'auto'""" if isinstance(enabled, str): enabled = enabled.lower().strip() if enabled == 'auto': return enabled elif enabled in ('true', 'false'): return ensure_boolean(enabled) elif isinstance(enabled, bool): return enabled raise InvalidEndpointDiscoveryConfigurationError(config_value=enabled) def _requires_endpoint_discovery(self, client, enabled): if enabled == "auto": return client.meta.service_model.endpoint_discovery_required return enabled def _register_eventbridge_events( self, client, endpoint_bridge, endpoint_url ): if client.meta.service_model.service_name != 'events': return EventbridgeSignerSetter( endpoint_resolver=self._endpoint_resolver, region=client.meta.region_name, endpoint_url=endpoint_url, ).register(client.meta.events) def _register_s3express_events( self, client, endpoint_bridge=None, endpoint_url=None, client_config=None, scoped_config=None, ): if client.meta.service_model.service_name != 's3': return S3ExpressIdentityResolver(client, RefreshableCredentials).register() def _register_s3_events( self, client, endpoint_bridge, endpoint_url, client_config, scoped_config, ): if client.meta.service_model.service_name != 's3': return S3RegionRedirectorv2(None, client).register() self._set_s3_presign_signature_version( client.meta, client_config, scoped_config ) client.meta.events.register( 'before-parameter-build.s3', self._inject_s3_input_parameters ) def _register_s3_control_events( self, client, endpoint_bridge=None, endpoint_url=None, client_config=None, scoped_config=None, ): if client.meta.service_model.service_name != 's3control': return S3ControlArnParamHandlerv2().register(client.meta.events) def _set_s3_presign_signature_version( self, client_meta, client_config, scoped_config ): # This will return the manually configured signature version, or None # if none was manually set. If a customer manually sets the signature # version, we always want to use what they set. provided_signature_version = _get_configured_signature_version( 's3', client_config, scoped_config ) if provided_signature_version is not None: return # Check to see if the region is a region that we know about. If we # don't know about a region, then we can safely assume it's a new # region that is sigv4 only, since all new S3 regions only allow sigv4. # The only exception is aws-global. This is a pseudo-region for the # global endpoint, we should respect the signature versions it # supports, which includes v2. regions = self._endpoint_resolver.get_available_endpoints( 's3', client_meta.partition ) if ( client_meta.region_name != 'aws-global' and client_meta.region_name not in regions ): return # If it is a region we know about, we want to default to sigv2, so here # we check to see if it is available. endpoint = self._endpoint_resolver.construct_endpoint( 's3', client_meta.region_name ) signature_versions = endpoint['signatureVersions'] if 's3' not in signature_versions: return # We now know that we're in a known region that supports sigv2 and # the customer hasn't set a signature version so we default the # signature version to sigv2. client_meta.events.register( 'choose-signer.s3', self._default_s3_presign_to_sigv2 ) def _inject_s3_input_parameters(self, params, context, kwargs): context['input_params'] = {} inject_parameters = ('Bucket', 'Delete', 'Key', 'Prefix') for inject_parameter in inject_parameters: if inject_parameter in params: context['input_params'][inject_parameter] = params[ inject_parameter ] def _default_s3_presign_to_sigv2(self, signature_version, kwargs): """ Returns the 's3' (sigv2) signer if presigning an s3 request. This is intended to be used to set the default signature version for the signer to sigv2. Situations where an asymmetric signature is required are the exception, for example MRAP needs v4a. :type signature_version: str :param signature_version: The current client signature version. :type signing_name: str :param signing_name: The signing name of the service. :return: 's3' if the request is an s3 presign request, None otherwise """ if signature_version.startswith('v4a'): return if signature_version.startswith('v4-s3express'): return signature_version for suffix in ['-query', '-presign-post']: if signature_version.endswith(suffix): return f's3{suffix}' def _register_importexport_events( self, client, endpoint_bridge=None, endpoint_url=None, client_config=None, scoped_config=None, ): if client.meta.service_model.service_name != 'importexport': return self._set_importexport_signature_version( client.meta, client_config, scoped_config ) def _set_importexport_signature_version( self, client_meta, client_config, scoped_config ): # This will return the manually configured signature version, or None # if none was manually set. If a customer manually sets the signature # version, we always want to use what they set. configured_signature_version = _get_configured_signature_version( 'importexport', client_config, scoped_config ) if configured_signature_version is not None: return # importexport has a modeled signatureVersion of v2, but we # previously switched to v4 via endpoint.json before endpoint rulesets. # Override the model's signatureVersion for backwards compatability. client_meta.events.register( 'choose-signer.importexport', self._default_signer_to_sigv4 ) def _default_signer_to_sigv4(self, signature_version, *kwargs): return 'v4' def _get_client_args( self, service_model, region_name, is_secure, endpoint_url, verify, credentials, scoped_config, client_config, endpoint_bridge, auth_token, endpoints_ruleset_data, partition_data, ): args_creator = ClientArgsCreator( self._event_emitter, self._user_agent, self._response_parser_factory, self._loader, self._exceptions_factory, config_store=self._config_store, user_agent_creator=self._user_agent_creator, ) return args_creator.get_client_args( service_model, region_name, is_secure, endpoint_url, verify, credentials, scoped_config, client_config, endpoint_bridge, auth_token, endpoints_ruleset_data, partition_data, ) def _create_methods(self, service_model): op_dict = {} for operation_name in service_model.operation_names: py_operation_name = xform_name(operation_name) op_dict[py_operation_name] = self._create_api_method( py_operation_name, operation_name, service_model ) return op_dict def _create_name_mapping(self, service_model): # py_name -> OperationName, for every operation available # for a service. mapping = {} for operation_name in service_model.operation_names: py_operation_name = xform_name(operation_name) mapping[py_operation_name] = operation_name return mapping def _create_api_method( self, py_operation_name, operation_name, service_model ): def _api_call(self, args, *kwargs): # We're accepting args so that we can give a more helpful # error message than TypeError: _api_call takes exactly # 1 argument. if args: raise TypeError( f"{py_operation_name}() only accepts keyword arguments." ) # The "self" in this scope is referring to the BaseClient. return self._make_api_call(operation_name, kwargs) _api_call.__name__ = str(py_operation_name) # Add the docstring to the client method operation_model = service_model.operation_model(operation_name) docstring = ClientMethodDocstring( operation_model=operation_model, method_name=operation_name, event_emitter=self._event_emitter, method_description=operation_model.documentation, example_prefix=f'response = client.{py_operation_name}', include_signature=False, ) _api_call.__doc__ = docstring return _api_call class ClientEndpointBridge: """Bridges endpoint data and client creation This class handles taking out the relevant arguments from the endpoint resolver and determining which values to use, taking into account any client configuration options and scope configuration options. This class also handles determining what, if any, region to use if no explicit region setting is provided. For example, Amazon S3 client will utilize "us-east-1" by default if no region can be resolved.""" DEFAULT_ENDPOINT = '{service}.{region}.amazonaws.com' _DUALSTACK_CUSTOMIZED_SERVICES = ['s3', 's3-control'] def __init__( self, endpoint_resolver, scoped_config=None, client_config=None, default_endpoint=None, service_signing_name=None, config_store=None, service_signature_version=None, ): self.service_signing_name = service_signing_name self.endpoint_resolver = endpoint_resolver self.scoped_config = scoped_config self.client_config = client_config self.default_endpoint = default_endpoint or self.DEFAULT_ENDPOINT self.config_store = config_store self.service_signature_version = service_signature_version def resolve( self, service_name, region_name=None, endpoint_url=None, is_secure=True ): region_name = self._check_default_region(service_name, region_name) use_dualstack_endpoint = self._resolve_use_dualstack_endpoint( service_name ) use_fips_endpoint = self._resolve_endpoint_variant_config_var( 'use_fips_endpoint' ) resolved = self.endpoint_resolver.construct_endpoint( service_name, region_name, use_dualstack_endpoint=use_dualstack_endpoint, use_fips_endpoint=use_fips_endpoint, ) # If we can't resolve the region, we'll attempt to get a global # endpoint for non-regionalized services (iam, route53, etc) if not resolved: # TODO: fallback partition_name should be configurable in the # future for users to define as needed. resolved = self.endpoint_resolver.construct_endpoint( service_name, region_name, partition_name='aws', use_dualstack_endpoint=use_dualstack_endpoint, use_fips_endpoint=use_fips_endpoint, ) if resolved: return self._create_endpoint( resolved, service_name, region_name, endpoint_url, is_secure ) else: return self._assume_endpoint( service_name, region_name, endpoint_url, is_secure ) def resolver_uses_builtin_data(self): return self.endpoint_resolver.uses_builtin_data def _check_default_region(self, service_name, region_name): if region_name is not None: return region_name # Use the client_config region if no explicit region was provided. if self.client_config and self.client_config.region_name is not None: return self.client_config.region_name def _create_endpoint( self, resolved, service_name, region_name, endpoint_url, is_secure ): region_name, signing_region = self._pick_region_values( resolved, region_name, endpoint_url ) if endpoint_url is None: endpoint_url = self._make_url( resolved.get('hostname'), is_secure, resolved.get('protocols', []), ) signature_version = self._resolve_signature_version( service_name, resolved ) signing_name = self._resolve_signing_name(service_name, resolved) return self._create_result( service_name=service_name, region_name=region_name, signing_region=signing_region, signing_name=signing_name, endpoint_url=endpoint_url, metadata=resolved, signature_version=signature_version, ) def _resolve_endpoint_variant_config_var(self, config_var): client_config = self.client_config config_val = False # Client configuration arg has precedence if client_config and getattr(client_config, config_var) is not None: return getattr(client_config, config_var) elif self.config_store is not None: # Check config store config_val = self.config_store.get_config_variable(config_var) return config_val def _resolve_use_dualstack_endpoint(self, service_name): s3_dualstack_mode = self._is_s3_dualstack_mode(service_name) if s3_dualstack_mode is not None: return s3_dualstack_mode return self._resolve_endpoint_variant_config_var( 'use_dualstack_endpoint' ) def _is_s3_dualstack_mode(self, service_name): if service_name not in self._DUALSTACK_CUSTOMIZED_SERVICES: return None # TODO: This normalization logic is duplicated from the # ClientArgsCreator class. Consolidate everything to # ClientArgsCreator. _resolve_signature_version also has similarly # duplicated logic. client_config = self.client_config if ( client_config is not None and client_config.s3 is not None and 'use_dualstack_endpoint' in client_config.s3 ): # Client config trumps scoped config. return client_config.s3['use_dualstack_endpoint'] if self.scoped_config is not None: enabled = self.scoped_config.get('s3', {}).get( 'use_dualstack_endpoint' ) if enabled in [True, 'True', 'true']: return True def _assume_endpoint( self, service_name, region_name, endpoint_url, is_secure ): if endpoint_url is None: # Expand the default hostname URI template. hostname = self.default_endpoint.format( service=service_name, region=region_name ) endpoint_url = self._make_url( hostname, is_secure, ['http', 'https'] ) logger.debug( f'Assuming an endpoint for {service_name}, {region_name}: {endpoint_url}' ) # We still want to allow the user to provide an explicit version. signature_version = self._resolve_signature_version( service_name, {'signatureVersions': ['v4']} ) signing_name = self._resolve_signing_name(service_name, resolved={}) return self._create_result( service_name=service_name, region_name=region_name, signing_region=region_name, signing_name=signing_name, signature_version=signature_version, endpoint_url=endpoint_url, metadata={}, ) def _create_result( self, service_name, region_name, signing_region, signing_name, endpoint_url, signature_version, metadata, ): return { 'service_name': service_name, 'region_name': region_name, 'signing_region': signing_region, 'signing_name': signing_name, 'endpoint_url': endpoint_url, 'signature_version': signature_version, 'metadata': metadata, } def _make_url(self, hostname, is_secure, supported_protocols): if is_secure and 'https' in supported_protocols: scheme = 'https' else: scheme = 'http' return f'{scheme}://{hostname}' def _resolve_signing_name(self, service_name, resolved): # CredentialScope overrides everything else. if ( 'credentialScope' in resolved and 'service' in resolved['credentialScope'] ): return resolved['credentialScope']['service'] # Use the signingName from the model if present. if self.service_signing_name: return self.service_signing_name # Just assume is the same as the service name. return service_name def _pick_region_values(self, resolved, region_name, endpoint_url): signing_region = region_name if endpoint_url is None: # Do not use the region name or signing name from the resolved # endpoint if the user explicitly provides an endpoint_url. This # would happen if we resolve to an endpoint where the service has # a "defaults" section that overrides all endpoint with a single # hostname and credentialScope. This has been the case historically # for how STS has worked. The only way to resolve an STS endpoint # was to provide a region_name and an endpoint_url. In that case, # we would still resolve an endpoint, but we would not use the # resolved endpointName or signingRegion because we want to allow # custom endpoints. region_name = resolved['endpointName'] signing_region = region_name if ( 'credentialScope' in resolved and 'region' in resolved['credentialScope'] ): signing_region = resolved['credentialScope']['region'] return region_name, signing_region def _resolve_signature_version(self, service_name, resolved): configured_version = _get_configured_signature_version( service_name, self.client_config, self.scoped_config ) if configured_version is not None: return configured_version # These have since added the "auth" key to the service model # with "aws.auth#sigv4", but preserve existing behavior from # when we preferred endpoints.json over the service models if service_name in ('s3', 's3-control'): return 's3v4' if self.service_signature_version is not None: # Prefer the service model potential_versions = [self.service_signature_version] else: # Fall back to endpoints.json to preserve existing behavior, which # may be useful for users who have custom service models potential_versions = resolved.get('signatureVersions', []) # This was added for the V2 -> V4 transition, # for services that added V4 after V2 in endpoints.json if 'v4' in potential_versions: return 'v4' # Now just iterate over the signature versions in order until we # find the first one that is known to Botocore. for known in potential_versions: if known in AUTH_TYPE_MAPS: return known raise UnknownSignatureVersionError( signature_version=potential_versions ) class BaseClient: # This is actually reassigned with the py->op_name mapping # when the client creator creates the subclass. This value is used # because calls such as client.get_paginator('list_objects') use the # snake_case name, but we need to know the ListObjects form. # xform_name() does the ListObjects->list_objects conversion, but # we need the reverse mapping here. _PY_TO_OP_NAME = {} def __init__( self, serializer, endpoint, response_parser, event_emitter, request_signer, service_model, loader, client_config, partition, exceptions_factory, endpoint_ruleset_resolver=None, user_agent_creator=None, ): self._serializer = serializer self._endpoint = endpoint self._ruleset_resolver = endpoint_ruleset_resolver self._response_parser = response_parser self._request_signer = request_signer self._cache = {} self._loader = loader self._client_config = client_config self.meta = ClientMeta( event_emitter, self._client_config, endpoint.host, service_model, self._PY_TO_OP_NAME, partition, ) self._exceptions_factory = exceptions_factory self._exceptions = None self._user_agent_creator = user_agent_creator if self._user_agent_creator is None: self._user_agent_creator = ( UserAgentString.from_environment().with_client_config( self._client_config ) ) self._register_handlers() def __getattr__(self, item): service_id = self._service_model.service_id.hyphenize() event_name = f'getattr.{service_id}.{item}' handler, event_response = self.meta.events.emit_until_response( event_name, client=self ) if event_response is not None: return event_response raise AttributeError( f"'{self.__class__.__name__}' object has no attribute '{item}'" ) def close(self): """Closes underlying endpoint connections.""" self._endpoint.close() def _register_handlers(self): # Register the handler required to sign requests. service_id = self.meta.service_model.service_id.hyphenize() self.meta.events.register( f"request-created.{service_id}", self._request_signer.handler ) # Rebuild user agent string right before request is sent # to ensure all registered features are included. self.meta.events.register_last( f"request-created.{service_id}", self._user_agent_creator.rebuild_and_replace_user_agent_handler, ) @property def _service_model(self): return self.meta.service_model @with_current_context() def _make_api_call(self, operation_name, api_params): operation_model = self._service_model.operation_model(operation_name) service_name = self._service_model.service_name history_recorder.record( 'API_CALL', { 'service': service_name, 'operation': operation_name, 'params': api_params, }, ) if operation_model.deprecated: logger.debug( 'Warning: %s.%s() is deprecated', service_name, operation_name ) request_context = { 'client_region': self.meta.region_name, 'client_config': self.meta.config, 'has_streaming_input': operation_model.has_streaming_input, 'auth_type': operation_model.resolved_auth_type, 'unsigned_payload': operation_model.unsigned_payload, } api_params = self._emit_api_params( api_params=api_params, operation_model=operation_model, context=request_context, ) ( endpoint_url, additional_headers, properties, ) = self._resolve_endpoint_ruleset( operation_model, api_params, request_context ) if properties: # Pass arbitrary endpoint info with the Request # for use during construction. request_context['endpoint_properties'] = properties request_dict = self._convert_to_request_dict( api_params=api_params, operation_model=operation_model, endpoint_url=endpoint_url, context=request_context, headers=additional_headers, ) resolve_checksum_context(request_dict, operation_model, api_params) service_id = self._service_model.service_id.hyphenize() handler, event_response = self.meta.events.emit_until_response( f'before-call.{service_id}.{operation_name}', model=operation_model, params=request_dict, request_signer=self._request_signer, context=request_context, ) if event_response is not None: http, parsed_response = event_response else: maybe_compress_request( self.meta.config, request_dict, operation_model ) apply_request_checksum(request_dict) http, parsed_response = self._make_request( operation_model, request_dict, request_context ) self.meta.events.emit( f'after-call.{service_id}.{operation_name}', http_response=http, parsed=parsed_response, model=operation_model, context=request_context, ) if http.status_code >= 300: error_info = parsed_response.get("Error", {}) error_code = error_info.get("QueryErrorCode") or error_info.get( "Code" ) error_class = self.exceptions.from_code(error_code) raise error_class(parsed_response, operation_name) else: return parsed_response def _make_request(self, operation_model, request_dict, request_context): try: return self._endpoint.make_request(operation_model, request_dict) except Exception as e: self.meta.events.emit( f'after-call-error.{self._service_model.service_id.hyphenize()}.{operation_model.name}', exception=e, context=request_context, ) raise def _convert_to_request_dict( self, api_params, operation_model, endpoint_url, context=None, headers=None, set_user_agent_header=True, ): request_dict = self._serializer.serialize_to_request( api_params, operation_model ) if not self._client_config.inject_host_prefix: request_dict.pop('host_prefix', None) if headers is not None: request_dict['headers'].update(headers) if set_user_agent_header: user_agent = self._user_agent_creator.to_string() else: user_agent = None prepare_request_dict( request_dict, endpoint_url=endpoint_url, user_agent=user_agent, context=context, ) return request_dict def _emit_api_params(self, api_params, operation_model, context): # Given the API params provided by the user and the operation_model # we can serialize the request to a request_dict. operation_name = operation_model.name # Emit an event that allows users to modify the parameters at the # beginning of the method. It allows handlers to modify existing # parameters or return a new set of parameters to use. service_id = self._service_model.service_id.hyphenize() responses = self.meta.events.emit( f'provide-client-params.{service_id}.{operation_name}', params=api_params, model=operation_model, context=context, ) api_params = first_non_none_response(responses, default=api_params) self.meta.events.emit( f'before-parameter-build.{service_id}.{operation_name}', params=api_params, model=operation_model, context=context, ) return api_params def _resolve_endpoint_ruleset( self, operation_model, params, request_context, ignore_signing_region=False, ): """Returns endpoint URL and list of additional headers returned from EndpointRulesetResolver for the given operation and params. If the ruleset resolver is not available, for example because the service has no endpoints ruleset file, the legacy endpoint resolver's value is returned. Use ignore_signing_region for generating presigned URLs or any other situation where the signing region information from the ruleset resolver should be ignored. Returns tuple of URL and headers dictionary. Additionally, the request_context dict is modified in place with any signing information returned from the ruleset resolver. """ if self._ruleset_resolver is None: endpoint_url = self.meta.endpoint_url additional_headers = {} endpoint_properties = {} else: endpoint_info = self._ruleset_resolver.construct_endpoint( operation_model=operation_model, call_args=params, request_context=request_context, ) endpoint_url = endpoint_info.url additional_headers = endpoint_info.headers endpoint_properties = endpoint_info.properties # If authSchemes is present, overwrite default auth type and # signing context derived from service model. auth_schemes = endpoint_info.properties.get('authSchemes') if auth_schemes is not None: auth_info = self._ruleset_resolver.auth_schemes_to_signing_ctx( auth_schemes ) auth_type, signing_context = auth_info request_context['auth_type'] = auth_type if 'region' in signing_context and ignore_signing_region: del signing_context['region'] if 'signing' in request_context: request_context['signing'].update(signing_context) else: request_context['signing'] = signing_context return endpoint_url, additional_headers, endpoint_properties def get_paginator(self, operation_name): """Create a paginator for an operation. :type operation_name: string :param operation_name: The operation name. This is the same name as the method name on the client. For example, if the method name is ``create_foo``, and you'd normally invoke the operation as ``client.create_foo(kwargs)``, if the ``create_foo`` operation can be paginated, you can use the call ``client.get_paginator("create_foo")``. :raise OperationNotPageableError: Raised if the operation is not pageable. You can use the ``client.can_paginate`` method to check if an operation is pageable. :rtype: ``botocore.paginate.Paginator`` :return: A paginator object. """ if not self.can_paginate(operation_name): raise OperationNotPageableError(operation_name=operation_name) else: actual_operation_name = self._PY_TO_OP_NAME[operation_name] # Create a new paginate method that will serve as a proxy to # the underlying Paginator.paginate method. This is needed to # attach a docstring to the method. def paginate(self, kwargs): return Paginator.paginate(self, kwargs) paginator_config = self._cache['page_config'][ actual_operation_name ] # Add the docstring for the paginate method. paginate.__doc__ = PaginatorDocstring( paginator_name=actual_operation_name, event_emitter=self.meta.events, service_model=self.meta.service_model, paginator_config=paginator_config, include_signature=False, ) # Rename the paginator class based on the type of paginator. service_module_name = get_service_module_name( self.meta.service_model ) paginator_class_name = ( f"{service_module_name}.Paginator.{actual_operation_name}" ) # Create the new paginator class documented_paginator_cls = type( paginator_class_name, (Paginator,), {'paginate': paginate} ) operation_model = self._service_model.operation_model( actual_operation_name ) paginator = documented_paginator_cls( getattr(self, operation_name), paginator_config, operation_model, ) return paginator def can_paginate(self, operation_name): """Check if an operation can be paginated. :type operation_name: string :param operation_name: The operation name. This is the same name as the method name on the client. For example, if the method name is ``create_foo``, and you'd normally invoke the operation as ``client.create_foo(kwargs)``, if the ``create_foo`` operation can be paginated, you can use the call ``client.get_paginator("create_foo")``. :return: ``True`` if the operation can be paginated, ``False`` otherwise. """ if 'page_config' not in self._cache: try: page_config = self._loader.load_service_model( self._service_model.service_name, 'paginators-1', self._service_model.api_version, )['pagination'] self._cache['page_config'] = page_config except DataNotFoundError: self._cache['page_config'] = {} actual_operation_name = self._PY_TO_OP_NAME[operation_name] return actual_operation_name in self._cache['page_config'] def _get_waiter_config(self): if 'waiter_config' not in self._cache: try: waiter_config = self._loader.load_service_model( self._service_model.service_name, 'waiters-2', self._service_model.api_version, ) self._cache['waiter_config'] = waiter_config except DataNotFoundError: self._cache['waiter_config'] = {} return self._cache['waiter_config'] def get_waiter(self, waiter_name): """Returns an object that can wait for some condition. :type waiter_name: str :param waiter_name: The name of the waiter to get. See the waiters section of the service docs for a list of available waiters. :returns: The specified waiter object. :rtype: ``botocore.waiter.Waiter`` """ config = self._get_waiter_config() if not config: raise ValueError(f"Waiter does not exist: {waiter_name}") model = waiter.WaiterModel(config) mapping = {} for name in model.waiter_names: mapping[xform_name(name)] = name if waiter_name not in mapping: raise ValueError(f"Waiter does not exist: {waiter_name}") return waiter.create_waiter_with_client( mapping[waiter_name], model, self ) @CachedProperty def waiter_names(self): """Returns a list of all available waiters.""" config = self._get_waiter_config() if not config: return [] model = waiter.WaiterModel(config) # Waiter configs is a dict, we just want the waiter names # which are the keys in the dict. return [xform_name(name) for name in model.waiter_names] @property def exceptions(self): if self._exceptions is None: self._exceptions = self._load_exceptions() return self._exceptions def _load_exceptions(self): return self._exceptions_factory.create_client_exceptions( self._service_model ) def _get_credentials(self): """ This private interface is subject to abrupt breaking changes, including removal, in any botocore release. """ return self._request_signer._credentials class ClientMeta: """Holds additional client methods. This class holds additional information for clients. It exists for two reasons: * To give advanced functionality to clients * To namespace additional client attributes from the operation names which are mapped to methods at runtime. This avoids ever running into collisions with operation names. """ def __init__( self, events, client_config, endpoint_url, service_model, method_to_api_mapping, partition, ): self.events = events self._client_config = client_config self._endpoint_url = endpoint_url self._service_model = service_model self._method_to_api_mapping = method_to_api_mapping self._partition = partition @property def service_model(self): return self._service_model @property def region_name(self): return self._client_config.region_name @property def endpoint_url(self): return self._endpoint_url @property def config(self): return self._client_config @property def method_to_api_mapping(self): return self._method_to_api_mapping @property def partition(self): return self._partition def _get_configured_signature_version( service_name, client_config, scoped_config ): """ Gets the manually configured signature version. :returns: the customer configured signature version, or None if no signature version was configured. """ # Client config overrides everything. if client_config and client_config.signature_version is not None: return client_config.signature_version # Scoped config overrides picking from the endpoint metadata. if scoped_config is not None: # A given service may have service specific configuration in the # config file, so we need to check there as well. service_config = scoped_config.get(service_name) if service_config is not None and isinstance(service_config, dict): version = service_config.get('signature_version') if version: logger.debug( "Switching signature version for service %s " "to version %s based on config file override.", service_name, version, ) return version return None	52.3 KB	2025-05-25 12:26
📄 compat.py # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import copy import datetime import sys import inspect import warnings import hashlib from http.client import HTTPMessage import logging import shlex import re import os from collections import OrderedDict from collections.abc import MutableMapping from math import floor from botocore.vendored import six from botocore.exceptions import MD5UnavailableError from dateutil.tz import tzlocal from urllib3 import exceptions logger = logging.getLogger(__name__) class HTTPHeaders(HTTPMessage): pass from urllib.parse import ( quote, urlencode, unquote, unquote_plus, urlparse, urlsplit, urlunsplit, urljoin, parse_qsl, parse_qs, ) from http.client import HTTPResponse from io import IOBase as _IOBase from base64 import encodebytes from email.utils import formatdate from itertools import zip_longest file_type = _IOBase zip = zip # In python3, unquote takes a str() object, url decodes it, # then takes the bytestring and decodes it to utf-8. unquote_str = unquote_plus def set_socket_timeout(http_response, timeout): """Set the timeout of the socket from an HTTPResponse. :param http_response: An instance of ``httplib.HTTPResponse`` """ http_response._fp.fp.raw._sock.settimeout(timeout) def accepts_kwargs(func): # In python3.4.1, there's backwards incompatible # changes when using getargspec with functools.partials. return inspect.getfullargspec(func)[2] def ensure_unicode(s, encoding=None, errors=None): # NOOP in Python 3, because every string is already unicode return s def ensure_bytes(s, encoding='utf-8', errors='strict'): if isinstance(s, str): return s.encode(encoding, errors) if isinstance(s, bytes): return s raise ValueError(f"Expected str or bytes, received {type(s)}.") try: import xml.etree.cElementTree as ETree except ImportError: # cElementTree does not exist from Python3.9+ import xml.etree.ElementTree as ETree XMLParseError = ETree.ParseError import json def filter_ssl_warnings(): # Ignore warnings related to SNI as it is not being used in validations. warnings.filterwarnings( 'ignore', message="A true SSLContext object is not available.", category=exceptions.InsecurePlatformWarning, module=r".urllib3\.util\.ssl_", ) @classmethod def from_dict(cls, d): new_instance = cls() for key, value in d.items(): new_instance[key] = value return new_instance @classmethod def from_pairs(cls, pairs): new_instance = cls() for key, value in pairs: new_instance[key] = value return new_instance HTTPHeaders.from_dict = from_dict HTTPHeaders.from_pairs = from_pairs def copy_kwargs(kwargs): """ This used to be a compat shim for 2.6 but is now just an alias. """ copy_kwargs = copy.copy(kwargs) return copy_kwargs def total_seconds(delta): """ Returns the total seconds in a ``datetime.timedelta``. This used to be a compat shim for 2.6 but is now just an alias. :param delta: The timedelta object :type delta: ``datetime.timedelta`` """ return delta.total_seconds() # Checks to see if md5 is available on this system. A given system might not # have access to it for various reasons, such as FIPS mode being enabled. try: hashlib.md5() MD5_AVAILABLE = True except (AttributeError, ValueError): MD5_AVAILABLE = False def get_md5(args, kwargs): """ Attempts to get an md5 hashing object. :param args: Args to pass to the MD5 constructor :param kwargs: Key word arguments to pass to the MD5 constructor :return: An MD5 hashing object if available. If it is unavailable, None is returned if raise_error_if_unavailable is set to False. """ if MD5_AVAILABLE: return hashlib.md5(args, *kwargs) else: raise MD5UnavailableError() def compat_shell_split(s, platform=None): if platform is None: platform = sys.platform if platform == "win32": return _windows_shell_split(s) else: return shlex.split(s) def _windows_shell_split(s): """Splits up a windows command as the built-in command parser would. Windows has potentially bizarre rules depending on where you look. When spawning a process via the Windows C runtime (which is what python does when you call popen) the rules are as follows: https://docs.microsoft.com/en-us/cpp/cpp/parsing-cpp-command-line-arguments To summarize: Only space and tab are valid delimiters * Double quotes are the only valid quotes * Backslash is interpreted literally unless it is part of a chain that leads up to a double quote. Then the backslashes escape the backslashes, and if there is an odd number the final backslash escapes the quote. :param s: The command string to split up into parts. :return: A list of command components. """ if not s: return [] components = [] buff = [] is_quoted = False num_backslashes = 0 for character in s: if character == '\\': # We can't simply append backslashes because we don't know if # they are being used as escape characters or not. Instead we # keep track of how many we've encountered and handle them when # we encounter a different character. num_backslashes += 1 elif character == '"': if num_backslashes > 0: # The backslashes are in a chain leading up to a double # quote, so they are escaping each other. buff.append('\\' * int(floor(num_backslashes / 2))) remainder = num_backslashes % 2 num_backslashes = 0 if remainder == 1: # The number of backslashes is uneven, so they are also # escaping the double quote, so it needs to be added to # the current component buffer. buff.append('"') continue # We've encountered a double quote that is not escaped, # so we toggle is_quoted. is_quoted = not is_quoted # If there are quotes, then we may want an empty string. To be # safe, we add an empty string to the buffer so that we make # sure it sticks around if there's nothing else between quotes. # If there is other stuff between quotes, the empty string will # disappear during the joining process. buff.append('') elif character in [' ', '\t'] and not is_quoted: # Since the backslashes aren't leading up to a quote, we put in # the exact number of backslashes. if num_backslashes > 0: buff.append('\\' * num_backslashes) num_backslashes = 0 # Excess whitespace is ignored, so only add the components list # if there is anything in the buffer. if buff: components.append(''.join(buff)) buff = [] else: # Since the backslashes aren't leading up to a quote, we put in # the exact number of backslashes. if num_backslashes > 0: buff.append('\\' * num_backslashes) num_backslashes = 0 buff.append(character) # Quotes must be terminated. if is_quoted: raise ValueError(f"No closing quotation in string: {s}") # There may be some leftover backslashes, so we need to add them in. # There's no quote so we add the exact number. if num_backslashes > 0: buff.append('\\' * num_backslashes) # Add the final component in if there is anything in the buffer. if buff: components.append(''.join(buff)) return components def get_tzinfo_options(): # Due to dateutil/dateutil#197, Windows may fail to parse times in the past # with the system clock. We can alternatively fallback to tzwininfo when # this happens, which will get time info from the Windows registry. if sys.platform == 'win32': from dateutil.tz import tzwinlocal return (tzlocal, tzwinlocal) else: return (tzlocal,) # Detect if CRT is available for use try: import awscrt.auth # Allow user opt-out if needed disabled = os.environ.get('BOTO_DISABLE_CRT', "false") HAS_CRT = not disabled.lower() == 'true' except ImportError: HAS_CRT = False def has_minimum_crt_version(minimum_version): """Not intended for use outside botocore.""" if not HAS_CRT: return False crt_version_str = awscrt.__version__ try: crt_version_ints = map(int, crt_version_str.split(".")) crt_version_tuple = tuple(crt_version_ints) except (TypeError, ValueError): return False return crt_version_tuple >= minimum_version ######################################################## # urllib3 compat backports # ######################################################## # Vendoring IPv6 validation regex patterns from urllib3 # https://github.com/urllib3/urllib3/blob/7e856c0/src/urllib3/util/url.py IPV4_PAT = r"(?:[0-9]{1,3}\.){3}[0-9]{1,3}" IPV4_RE = re.compile("^" + IPV4_PAT + "$") HEX_PAT = "[0-9A-Fa-f]{1,4}" LS32_PAT = "(?:{hex}:{hex}\|{ipv4})".format(hex=HEX_PAT, ipv4=IPV4_PAT) _subs = {"hex": HEX_PAT, "ls32": LS32_PAT} _variations = [ # 6( h16 ":" ) ls32 "(?:%(hex)s:){6}%(ls32)s", # "::" 5( h16 ":" ) ls32 "::(?:%(hex)s:){5}%(ls32)s", # [ h16 ] "::" 4( h16 ":" ) ls32 "(?:%(hex)s)?::(?:%(hex)s:){4}%(ls32)s", # [ 1( h16 ":" ) h16 ] "::" 3( h16 ":" ) ls32 "(?:(?:%(hex)s:)?%(hex)s)?::(?:%(hex)s:){3}%(ls32)s", # [ 2( h16 ":" ) h16 ] "::" 2( h16 ":" ) ls32 "(?:(?:%(hex)s:){0,2}%(hex)s)?::(?:%(hex)s:){2}%(ls32)s", # [ 3( h16 ":" ) h16 ] "::" h16 ":" ls32 "(?:(?:%(hex)s:){0,3}%(hex)s)?::%(hex)s:%(ls32)s", # [ 4( h16 ":" ) h16 ] "::" ls32 "(?:(?:%(hex)s:){0,4}%(hex)s)?::%(ls32)s", # [ 5( h16 ":" ) h16 ] "::" h16 "(?:(?:%(hex)s:){0,5}%(hex)s)?::%(hex)s", # [ 6( h16 ":" ) h16 ] "::" "(?:(?:%(hex)s:){0,6}%(hex)s)?::", ] UNRESERVED_PAT = ( r"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._!\-~" ) IPV6_PAT = "(?:" + "\|".join([x % _subs for x in _variations]) + ")" ZONE_ID_PAT = "(?:%25\|%)(?:[" + UNRESERVED_PAT + "]\|%[a-fA-F0-9]{2})+" IPV6_ADDRZ_PAT = r"\[" + IPV6_PAT + r"(?:" + ZONE_ID_PAT + r")?\]" IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT + "$") # These are the characters that are stripped by post-bpo-43882 urlparse(). UNSAFE_URL_CHARS = frozenset('\t\r\n') # Detect if gzip is available for use try: import gzip HAS_GZIP = True except ImportError: HAS_GZIP = False	11.25 KB	2025-05-25 12:26
📄 compress.py # Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """ NOTE: All functions in this module are considered private and are subject to abrupt breaking changes. Please do not use them directly. """ import io import logging from gzip import GzipFile from gzip import compress as gzip_compress from botocore.compat import urlencode from botocore.utils import determine_content_length logger = logging.getLogger(__name__) def maybe_compress_request(config, request_dict, operation_model): """Attempt to compress the request body using the modeled encodings.""" if _should_compress_request(config, request_dict, operation_model): for encoding in operation_model.request_compression['encodings']: encoder = COMPRESSION_MAPPING.get(encoding) if encoder is not None: logger.debug('Compressing request with %s encoding.', encoding) request_dict['body'] = encoder(request_dict['body']) _set_compression_header(request_dict['headers'], encoding) return else: logger.debug('Unsupported compression encoding: %s', encoding) def _should_compress_request(config, request_dict, operation_model): if ( config.disable_request_compression is not True and config.signature_version != 'v2' and operation_model.request_compression is not None ): if not _is_compressible_type(request_dict): body_type = type(request_dict['body']) log_msg = 'Body type %s does not support compression.' logger.debug(log_msg, body_type) return False if operation_model.has_streaming_input: streaming_input = operation_model.get_streaming_input() streaming_metadata = streaming_input.metadata return 'requiresLength' not in streaming_metadata body_size = _get_body_size(request_dict['body']) min_size = config.request_min_compression_size_bytes return min_size <= body_size return False def _is_compressible_type(request_dict): body = request_dict['body'] # Coerce dict to a format compatible with compression. if isinstance(body, dict): body = urlencode(body, doseq=True, encoding='utf-8').encode('utf-8') request_dict['body'] = body is_supported_type = isinstance(body, (str, bytes, bytearray)) return is_supported_type or hasattr(body, 'read') def _get_body_size(body): size = determine_content_length(body) if size is None: logger.debug( 'Unable to get length of the request body: %s. ' 'Skipping compression.', body, ) size = 0 return size def _gzip_compress_body(body): if isinstance(body, str): return gzip_compress(body.encode('utf-8')) elif isinstance(body, (bytes, bytearray)): return gzip_compress(body) elif hasattr(body, 'read'): if hasattr(body, 'seek') and hasattr(body, 'tell'): current_position = body.tell() compressed_obj = _gzip_compress_fileobj(body) body.seek(current_position) return compressed_obj return _gzip_compress_fileobj(body) def _gzip_compress_fileobj(body): compressed_obj = io.BytesIO() with GzipFile(fileobj=compressed_obj, mode='wb') as gz: while True: chunk = body.read(8192) if not chunk: break if isinstance(chunk, str): chunk = chunk.encode('utf-8') gz.write(chunk) compressed_obj.seek(0) return compressed_obj def _set_compression_header(headers, encoding): ce_header = headers.get('Content-Encoding') if ce_header is None: headers['Content-Encoding'] = encoding else: headers['Content-Encoding'] = f'{ce_header},{encoding}' COMPRESSION_MAPPING = {'gzip': _gzip_compress_body}	4.33 KB	2025-05-25 12:26
📄 config.py # Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import copy from botocore.compat import OrderedDict from botocore.endpoint import DEFAULT_TIMEOUT, MAX_POOL_CONNECTIONS from botocore.exceptions import ( InvalidMaxRetryAttemptsError, InvalidRetryConfigurationError, InvalidRetryModeError, InvalidS3AddressingStyleError, ) class Config: """Advanced configuration for Botocore clients. :type region_name: str :param region_name: The region to use in instantiating the client :type signature_version: str :param signature_version: The signature version when signing requests. :type user_agent: str :param user_agent: The value to use in the User-Agent header. :type user_agent_extra: str :param user_agent_extra: The value to append to the current User-Agent header value. :type user_agent_appid: str :param user_agent_appid: A value that gets included in the User-Agent string in the format "app/<user_agent_appid>". Allowed characters are ASCII alphanumerics and ``!$%&'+-.^_`\|~``. All other characters will be replaced by a ``-``. :type connect_timeout: float or int :param connect_timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds. :type read_timeout: float or int :param read_timeout: The time in seconds till a timeout exception is thrown when attempting to read from a connection. The default is 60 seconds. :type parameter_validation: bool :param parameter_validation: Whether parameter validation should occur when serializing requests. The default is True. You can disable parameter validation for performance reasons. Otherwise, it's recommended to leave parameter validation enabled. :type max_pool_connections: int :param max_pool_connections: The maximum number of connections to keep in a connection pool. If this value is not set, the default value of 10 is used. :type proxies: dict :param proxies: A dictionary of proxy servers to use by protocol or endpoint, e.g.: ``{'http': 'foo.bar:3128', 'http://hostname': 'foo.bar:4012'}``. The proxies are used on each request. :type proxies_config: dict :param proxies_config: A dictionary of additional proxy configurations. Valid keys are: ``proxy_ca_bundle`` -- The path to a custom certificate bundle to use when establishing SSL/TLS connections with proxy. * ``proxy_client_cert`` -- The path to a certificate for proxy TLS client authentication. When a string is provided it is treated as a path to a proxy client certificate. When a two element tuple is provided, it will be interpreted as the path to the client certificate, and the path to the certificate key. * ``proxy_use_forwarding_for_https`` -- For HTTPS proxies, forward your requests to HTTPS destinations with an absolute URI. We strongly recommend you only use this option with trusted or corporate proxies. Value must be boolean. :type s3: dict :param s3: A dictionary of S3 specific configurations. Valid keys are: * ``use_accelerate_endpoint`` -- Refers to whether to use the S3 Accelerate endpoint. The value must be a boolean. If True, the client will use the S3 Accelerate endpoint. If the S3 Accelerate endpoint is being used then the addressing style will always be virtual. * ``payload_signing_enabled`` -- Refers to whether or not to SHA256 sign sigv4 payloads. By default, this is disabled for streaming uploads (UploadPart and PutObject). * ``addressing_style`` -- Refers to the style in which to address s3 endpoints. Values must be a string that equals one of: * ``auto`` -- Addressing style is chosen for user. Depending on the configuration of client, the endpoint may be addressed in the virtual or the path style. Note that this is the default behavior if no style is specified. * ``virtual`` -- Addressing style is always virtual. The name of the bucket must be DNS compatible or an exception will be thrown. Endpoints will be addressed as such: ``amzn-s3-demo-bucket.s3.amazonaws.com`` * ``path`` -- Addressing style is always by path. Endpoints will be addressed as such: ``s3.amazonaws.com/amzn-s3-demo-bucket`` * ``us_east_1_regional_endpoint`` -- Refers to what S3 endpoint to use when the region is configured to be us-east-1. Values must be a string that equals: * ``regional`` -- Use the us-east-1.amazonaws.com endpoint if the client is configured to use the us-east-1 region. * ``legacy`` -- Use the s3.amazonaws.com endpoint if the client is configured to use the us-east-1 region. This is the default if the configuration option is not specified. :type retries: dict :param retries: A dictionary for configuration related to retry behavior. Valid keys are: * ``total_max_attempts`` -- An integer representing the maximum number of total attempts that will be made on a single request. This includes the initial request, so a value of 1 indicates that no requests will be retried. If ``total_max_attempts`` and ``max_attempts`` are both provided, ``total_max_attempts`` takes precedence. ``total_max_attempts`` is preferred over ``max_attempts`` because it maps to the ``AWS_MAX_ATTEMPTS`` environment variable and the ``max_attempts`` config file value. * ``max_attempts`` -- An integer representing the maximum number of retry attempts that will be made on a single request. For example, setting this value to 2 will result in the request being retried at most two times after the initial request. Setting this value to 0 will result in no retries ever being attempted after the initial request. If not provided, the number of retries will default to the value specified in the service model, which is typically four retries. * ``mode`` -- A string representing the type of retry mode botocore should use. Valid values are: * ``legacy`` - The pre-existing retry behavior. * ``standard`` - The standardized set of retry rules. This will also default to 3 max attempts unless overridden. * ``adaptive`` - Retries with additional client side throttling. :type client_cert: str, (str, str) :param client_cert: The path to a certificate for TLS client authentication. When a string is provided it is treated as a path to a client certificate to be used when creating a TLS connection. If a client key is to be provided alongside the client certificate the client_cert should be set to a tuple of length two where the first element is the path to the client certificate and the second element is the path to the certificate key. :type inject_host_prefix: bool :param inject_host_prefix: Whether host prefix injection should occur. Defaults to None. The default of None is equivalent to setting to True, which enables the injection of operation parameters into the prefix of the hostname. Setting this to False disables the injection of operation parameters into the prefix of the hostname. Setting this to False is useful for clients providing custom endpoints that should not have their host prefix modified. :type use_dualstack_endpoint: bool :param use_dualstack_endpoint: Setting to True enables dualstack endpoint resolution. Defaults to None. :type use_fips_endpoint: bool :param use_fips_endpoint: Setting to True enables fips endpoint resolution. Defaults to None. :type ignore_configured_endpoint_urls: bool :param ignore_configured_endpoint_urls: Setting to True disables use of endpoint URLs provided via environment variables and the shared configuration file. Defaults to None. :type tcp_keepalive: bool :param tcp_keepalive: Enables the TCP Keep-Alive socket option used when creating new connections if set to True. Defaults to False. :type request_min_compression_size_bytes: int :param request_min_compression_size_bytes: The minimum size in bytes that a request body should be to trigger compression. All requests with streaming input that don't contain the ``requiresLength`` trait will be compressed regardless of this setting. Defaults to None. :type disable_request_compression: bool :param disable_request_compression: Disables request body compression if set to True. Defaults to None. :type sigv4a_signing_region_set: string :param sigv4a_signing_region_set: A set of AWS regions to apply the signature for when using SigV4a for signing. Set to ```` to represent all regions. Defaults to None. :type client_context_params: dict :param client_context_params: A dictionary of parameters specific to individual services. If available, valid parameters can be found in the ``Client Context Parameters`` section of the service client's documentation. Invalid parameters or ones that are not used by the specified service will be ignored. Defaults to None. :type request_checksum_calculation: str :param request_checksum_calculation: Determines when a checksum will be calculated for request payloads. Valid values are: ``when_supported`` -- When set, a checksum will be calculated for all request payloads of operations modeled with the ``httpChecksum`` trait where ``requestChecksumRequired`` is ``true`` or a ``requestAlgorithmMember`` is modeled. * ``when_required`` -- When set, a checksum will only be calculated for request payloads of operations modeled with the ``httpChecksum`` trait where ``requestChecksumRequired`` is ``true`` or where a ``requestAlgorithmMember`` is modeled and supplied. Defaults to None. :type response_checksum_validation: str :param response_checksum_validation: Determines when checksum validation will be performed on response payloads. Valid values are: * ``when_supported`` -- When set, checksum validation is performed on all response payloads of operations modeled with the ``httpChecksum`` trait where ``responseAlgorithms`` is modeled, except when no modeled checksum algorithms are supported. * ``when_required`` -- When set, checksum validation is not performed on response payloads of operations unless the checksum algorithm is supported and the ``requestValidationModeMember`` member is set to ``ENABLED``. Defaults to None. :type account_id_endpoint_mode: str :param account_id_endpoint_mode: The value used to determine the client's behavior for account ID based endpoint routing. Valid values are: * ``preferred`` - The endpoint should include account ID if available. * ``disabled`` - A resolved endpoint does not include account ID. * ``required`` - The endpoint must include account ID. If the account ID isn't available, an exception will be raised. If a value is not provided, the client will default to ``preferred``. Defaults to None. """ OPTION_DEFAULTS = OrderedDict( [ ('region_name', None), ('signature_version', None), ('user_agent', None), ('user_agent_extra', None), ('user_agent_appid', None), ('connect_timeout', DEFAULT_TIMEOUT), ('read_timeout', DEFAULT_TIMEOUT), ('parameter_validation', True), ('max_pool_connections', MAX_POOL_CONNECTIONS), ('proxies', None), ('proxies_config', None), ('s3', None), ('retries', None), ('client_cert', None), ('inject_host_prefix', None), ('endpoint_discovery_enabled', None), ('use_dualstack_endpoint', None), ('use_fips_endpoint', None), ('ignore_configured_endpoint_urls', None), ('defaults_mode', None), ('tcp_keepalive', None), ('request_min_compression_size_bytes', None), ('disable_request_compression', None), ('client_context_params', None), ('sigv4a_signing_region_set', None), ('request_checksum_calculation', None), ('response_checksum_validation', None), ('account_id_endpoint_mode', None), ] ) NON_LEGACY_OPTION_DEFAULTS = { 'connect_timeout': None, } # The original default value of the inject_host_prefix parameter was True. # This prevented the ability to override the value from other locations in # the parameter provider chain, like env vars or the shared configuration # file. TO accomplish this, we need to disambiguate when the value was set # by the user or not. This overrides the parameter with a property so the # default value of inject_host_prefix is still True if it is not set by the # user. @property def inject_host_prefix(self): if self._inject_host_prefix == "UNSET": return True return self._inject_host_prefix # Override the setter for the case where the user does supply a value; # _inject_host_prefix will no longer be "UNSET". @inject_host_prefix.setter def inject_host_prefix(self, value): self._inject_host_prefix = value def __init__(self, args, kwargs): self._user_provided_options = self._record_user_provided_options( args, kwargs ) # By default, we use a value that indicates the user did not # set it. This value MUST persist on the Config object to be used # elsewhere. self._inject_host_prefix = 'UNSET' # Merge the user_provided options onto the default options config_vars = copy.copy(self.OPTION_DEFAULTS) defaults_mode = self._user_provided_options.get( 'defaults_mode', 'legacy' ) if defaults_mode != 'legacy': config_vars.update(self.NON_LEGACY_OPTION_DEFAULTS) config_vars.update(self._user_provided_options) # Set the attributes based on the config_vars for key, value in config_vars.items(): # Default values for the Config object are set here. We don't want # to use `setattr` in the case where the user already supplied a # value. if ( key == 'inject_host_prefix' and 'inject_host_prefix' not in self._user_provided_options.keys() ): continue setattr(self, key, value) # Validate the s3 options self._validate_s3_configuration(self.s3) self._validate_retry_configuration(self.retries) def _record_user_provided_options(self, args, kwargs): option_order = list(self.OPTION_DEFAULTS) user_provided_options = {} # Iterate through the kwargs passed through to the constructor and # map valid keys to the dictionary for key, value in kwargs.items(): if key in self.OPTION_DEFAULTS: user_provided_options[key] = value # The key must exist in the available options else: raise TypeError(f"Got unexpected keyword argument '{key}'") # The number of args should not be longer than the allowed # options if len(args) > len(option_order): raise TypeError( f"Takes at most {len(option_order)} arguments ({len(args)} given)" ) # Iterate through the args passed through to the constructor and map # them to appropriate keys. for i, arg in enumerate(args): # If a kwarg was specified for the arg, then error out if option_order[i] in user_provided_options: raise TypeError( f"Got multiple values for keyword argument '{option_order[i]}'" ) user_provided_options[option_order[i]] = arg return user_provided_options def _validate_s3_configuration(self, s3): if s3 is not None: addressing_style = s3.get('addressing_style') if addressing_style not in ['virtual', 'auto', 'path', None]: raise InvalidS3AddressingStyleError( s3_addressing_style=addressing_style ) def _validate_retry_configuration(self, retries): valid_options = ('max_attempts', 'mode', 'total_max_attempts') valid_modes = ('legacy', 'standard', 'adaptive') if retries is not None: for key, value in retries.items(): if key not in valid_options: raise InvalidRetryConfigurationError( retry_config_option=key, valid_options=valid_options, ) if key == 'max_attempts' and value < 0: raise InvalidMaxRetryAttemptsError( provided_max_attempts=value, min_value=0, ) if key == 'total_max_attempts' and value < 1: raise InvalidMaxRetryAttemptsError( provided_max_attempts=value, min_value=1, ) if key == 'mode' and value not in valid_modes: raise InvalidRetryModeError( provided_retry_mode=value, valid_modes=valid_modes, ) def merge(self, other_config): """Merges the config object with another config object This will merge in all non-default values from the provided config and return a new config object :type other_config: botocore.config.Config :param other config: Another config object to merge with. The values in the provided config object will take precedence in the merging :returns: A config object built from the merged values of both config objects. """ # Make a copy of the current attributes in the config object. config_options = copy.copy(self._user_provided_options) # Merge in the user provided options from the other config config_options.update(other_config._user_provided_options) # Return a new config object with the merged properties. return Config(*config_options)	19.36 KB	2025-05-25 12:26
📄 configloader.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import configparser import copy import os import shlex import sys import botocore.exceptions def multi_file_load_config(filenames): """Load and combine multiple INI configs with profiles. This function will take a list of filesnames and return a single dictionary that represents the merging of the loaded config files. If any of the provided filenames does not exist, then that file is ignored. It is therefore ok to provide a list of filenames, some of which may not exist. Configuration files are not* deep merged, only the top level keys are merged. The filenames should be passed in order of precedence. The first config file has precedence over the second config file, which has precedence over the third config file, etc. The only exception to this is that the "profiles" key is merged to combine profiles from multiple config files into a single profiles mapping. However, if a profile is defined in multiple config files, then the config file with the highest precedence is used. Profile values themselves are not merged. For example:: FileA FileB FileC [foo] [foo] [bar] a=1 a=2 a=3 b=2 [bar] [baz] [profile a] a=2 a=3 region=e [profile a] [profile b] [profile c] region=c region=d region=f The final result of ``multi_file_load_config(FileA, FileB, FileC)`` would be:: {"foo": {"a": 1}, "bar": {"a": 2}, "baz": {"a": 3}, "profiles": {"a": {"region": "c"}}, {"b": {"region": d"}}, {"c": {"region": "f"}}} Note that the "foo" key comes from A, even though it's defined in both FileA and FileB. Because "foo" was defined in FileA first, then the values for "foo" from FileA are used and the values for "foo" from FileB are ignored. Also note where the profiles originate from. Profile "a" comes FileA, profile "b" comes from FileB, and profile "c" comes from FileC. """ configs = [] profiles = [] for filename in filenames: try: loaded = load_config(filename) except botocore.exceptions.ConfigNotFound: continue profiles.append(loaded.pop('profiles')) configs.append(loaded) merged_config = _merge_list_of_dicts(configs) merged_profiles = _merge_list_of_dicts(profiles) merged_config['profiles'] = merged_profiles return merged_config def _merge_list_of_dicts(list_of_dicts): merged_dicts = {} for single_dict in list_of_dicts: for key, value in single_dict.items(): if key not in merged_dicts: merged_dicts[key] = value return merged_dicts def load_config(config_filename): """Parse a INI config with profiles. This will parse an INI config file and map top level profiles into a top level "profile" key. If you want to parse an INI file and map all section names to top level keys, use ``raw_config_parse`` instead. """ parsed = raw_config_parse(config_filename) return build_profile_map(parsed) def raw_config_parse(config_filename, parse_subsections=True): """Returns the parsed INI config contents. Each section name is a top level key. :param config_filename: The name of the INI file to parse :param parse_subsections: If True, parse indented blocks as subsections that represent their own configuration dictionary. For example, if the config file had the contents:: s3 = signature_version = s3v4 addressing_style = path The resulting ``raw_config_parse`` would be:: {'s3': {'signature_version': 's3v4', 'addressing_style': 'path'}} If False, do not try to parse subsections and return the indented block as its literal value:: {'s3': '\nsignature_version = s3v4\naddressing_style = path'} :returns: A dict with keys for each profile found in the config file and the value of each key being a dict containing name value pairs found in that profile. :raises: ConfigNotFound, ConfigParseError """ config = {} path = config_filename if path is not None: path = os.path.expandvars(path) path = os.path.expanduser(path) if not os.path.isfile(path): raise botocore.exceptions.ConfigNotFound(path=_unicode_path(path)) cp = configparser.RawConfigParser() try: cp.read([path]) except (configparser.Error, UnicodeDecodeError) as e: raise botocore.exceptions.ConfigParseError( path=_unicode_path(path), error=e ) from None else: for section in cp.sections(): config[section] = {} for option in cp.options(section): config_value = cp.get(section, option) if parse_subsections and config_value.startswith('\n'): # Then we need to parse the inner contents as # hierarchical. We support a single level # of nesting for now. try: config_value = _parse_nested(config_value) except ValueError as e: raise botocore.exceptions.ConfigParseError( path=_unicode_path(path), error=e ) from None config[section][option] = config_value return config def _unicode_path(path): if isinstance(path, str): return path # According to the documentation getfilesystemencoding can return None # on unix in which case the default encoding is used instead. filesystem_encoding = sys.getfilesystemencoding() if filesystem_encoding is None: filesystem_encoding = sys.getdefaultencoding() return path.decode(filesystem_encoding, 'replace') def _parse_nested(config_value): # Given a value like this: # \n # foo = bar # bar = baz # We need to parse this into # {'foo': 'bar', 'bar': 'baz} parsed = {} for line in config_value.splitlines(): line = line.strip() if not line: continue # The caller will catch ValueError # and raise an appropriate error # if this fails. key, value = line.split('=', 1) parsed[key.strip()] = value.strip() return parsed def _parse_section(key, values): result = {} try: parts = shlex.split(key) except ValueError: return result if len(parts) == 2: result[parts[1]] = values return result def build_profile_map(parsed_ini_config): """Convert the parsed INI config into a profile map. The config file format requires that every profile except the default to be prepended with "profile", e.g.:: [profile test] aws_... = foo aws_... = bar [profile bar] aws_... = foo aws_... = bar # This is not a profile [preview] otherstuff = 1 # Neither is this [foobar] morestuff = 2 The build_profile_map will take a parsed INI config file where each top level key represents a section name, and convert into a format where all the profiles are under a single top level "profiles" key, and each key in the sub dictionary is a profile name. For example, the above config file would be converted from:: {"profile test": {"aws_...": "foo", "aws...": "bar"}, "profile bar": {"aws...": "foo", "aws...": "bar"}, "preview": {"otherstuff": ...}, "foobar": {"morestuff": ...}, } into:: {"profiles": {"test": {"aws_...": "foo", "aws...": "bar"}, "bar": {"aws...": "foo", "aws...": "bar"}, "preview": {"otherstuff": ...}, "foobar": {"morestuff": ...}, } If there are no profiles in the provided parsed INI contents, then an empty dict will be the value associated with the ``profiles`` key. .. note:: This will not mutate the passed in parsed_ini_config. Instead it will make a deepcopy and return that value. """ parsed_config = copy.deepcopy(parsed_ini_config) profiles = {} sso_sessions = {} services = {} final_config = {} for key, values in parsed_config.items(): if key.startswith("profile"): profiles.update(_parse_section(key, values)) elif key.startswith("sso-session"): sso_sessions.update(_parse_section(key, values)) elif key.startswith("services"): services.update(_parse_section(key, values)) elif key == 'default': # default section is special and is considered a profile # name but we don't require you use 'profile "default"' # as a section. profiles[key] = values else: final_config[key] = values final_config['profiles'] = profiles final_config['sso_sessions'] = sso_sessions final_config['services'] = services return final_config	9.8 KB	2025-05-25 12:26
📄 configprovider.py # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """This module contains the interface for controlling how configuration is loaded. """ import copy import logging import os from botocore import utils from botocore.exceptions import InvalidConfigError logger = logging.getLogger(__name__) #: A default dictionary that maps the logical names for session variables #: to the specific environment variables and configuration file names #: that contain the values for these variables. #: When creating a new Session object, you can pass in your own dictionary #: to remap the logical names or to add new logical names. You can then #: get the current value for these variables by using the #: ``get_config_variable`` method of the :class:`botocore.session.Session` #: class. #: These form the keys of the dictionary. The values in the dictionary #: are tuples of (<config_name>, <environment variable>, <default value>, #: <conversion func>). #: The conversion func is a function that takes the configuration value #: as an argument and returns the converted value. If this value is #: None, then the configuration value is returned unmodified. This #: conversion function can be used to type convert config values to #: values other than the default values of strings. #: The ``profile`` and ``config_file`` variables should always have a #: None value for the first entry in the tuple because it doesn't make #: sense to look inside the config file for the location of the config #: file or for the default profile to use. #: The ``config_name`` is the name to look for in the configuration file, #: the ``env var`` is the OS environment variable (``os.environ``) to #: use, and ``default_value`` is the value to use if no value is otherwise #: found. #: NOTE: Fixing the spelling of this variable would be a breaking change. #: Please leave as is. BOTOCORE_DEFAUT_SESSION_VARIABLES = { # logical: config_file, env_var, default_value, conversion_func 'profile': (None, ['AWS_DEFAULT_PROFILE', 'AWS_PROFILE'], None, None), 'region': ('region', 'AWS_DEFAULT_REGION', None, None), 'data_path': ('data_path', 'AWS_DATA_PATH', None, None), 'config_file': (None, 'AWS_CONFIG_FILE', '~/.aws/config', None), 'ca_bundle': ('ca_bundle', 'AWS_CA_BUNDLE', None, None), 'api_versions': ('api_versions', None, {}, None), # This is the shared credentials file amongst sdks. 'credentials_file': ( None, 'AWS_SHARED_CREDENTIALS_FILE', '~/.aws/credentials', None, ), # These variables only exist in the config file. # This is the number of seconds until we time out a request to # the instance metadata service. 'metadata_service_timeout': ( 'metadata_service_timeout', 'AWS_METADATA_SERVICE_TIMEOUT', 1, int, ), # This is the number of request attempts we make until we give # up trying to retrieve data from the instance metadata service. 'metadata_service_num_attempts': ( 'metadata_service_num_attempts', 'AWS_METADATA_SERVICE_NUM_ATTEMPTS', 1, int, ), 'ec2_metadata_service_endpoint': ( 'ec2_metadata_service_endpoint', 'AWS_EC2_METADATA_SERVICE_ENDPOINT', None, None, ), 'ec2_metadata_service_endpoint_mode': ( 'ec2_metadata_service_endpoint_mode', 'AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE', None, None, ), 'ec2_metadata_v1_disabled': ( 'ec2_metadata_v1_disabled', 'AWS_EC2_METADATA_V1_DISABLED', False, utils.ensure_boolean, ), 'imds_use_ipv6': ( 'imds_use_ipv6', 'AWS_IMDS_USE_IPV6', False, utils.ensure_boolean, ), 'use_dualstack_endpoint': ( 'use_dualstack_endpoint', 'AWS_USE_DUALSTACK_ENDPOINT', None, utils.ensure_boolean, ), 'use_fips_endpoint': ( 'use_fips_endpoint', 'AWS_USE_FIPS_ENDPOINT', None, utils.ensure_boolean, ), 'ignore_configured_endpoint_urls': ( 'ignore_configured_endpoint_urls', 'AWS_IGNORE_CONFIGURED_ENDPOINT_URLS', None, utils.ensure_boolean, ), 'parameter_validation': ('parameter_validation', None, True, None), # Client side monitoring configurations. # Note: These configurations are considered internal to botocore. # Do not use them until publicly documented. 'csm_enabled': ( 'csm_enabled', 'AWS_CSM_ENABLED', False, utils.ensure_boolean, ), 'csm_host': ('csm_host', 'AWS_CSM_HOST', '127.0.0.1', None), 'csm_port': ('csm_port', 'AWS_CSM_PORT', 31000, int), 'csm_client_id': ('csm_client_id', 'AWS_CSM_CLIENT_ID', '', None), # Endpoint discovery configuration 'endpoint_discovery_enabled': ( 'endpoint_discovery_enabled', 'AWS_ENDPOINT_DISCOVERY_ENABLED', 'auto', None, ), 'retry_mode': ('retry_mode', 'AWS_RETRY_MODE', 'legacy', None), 'defaults_mode': ('defaults_mode', 'AWS_DEFAULTS_MODE', 'legacy', None), # We can't have a default here for v1 because we need to defer to # whatever the defaults are in _retry.json. 'max_attempts': ('max_attempts', 'AWS_MAX_ATTEMPTS', None, int), 'user_agent_appid': ('sdk_ua_app_id', 'AWS_SDK_UA_APP_ID', None, None), 'request_min_compression_size_bytes': ( 'request_min_compression_size_bytes', 'AWS_REQUEST_MIN_COMPRESSION_SIZE_BYTES', 10240, None, ), 'disable_request_compression': ( 'disable_request_compression', 'AWS_DISABLE_REQUEST_COMPRESSION', False, utils.ensure_boolean, ), 'sigv4a_signing_region_set': ( 'sigv4a_signing_region_set', 'AWS_SIGV4A_SIGNING_REGION_SET', None, None, ), 'request_checksum_calculation': ( 'request_checksum_calculation', 'AWS_REQUEST_CHECKSUM_CALCULATION', "when_supported", None, ), 'response_checksum_validation': ( 'response_checksum_validation', 'AWS_RESPONSE_CHECKSUM_VALIDATION', "when_supported", None, ), 'account_id_endpoint_mode': ( 'account_id_endpoint_mode', 'AWS_ACCOUNT_ID_ENDPOINT_MODE', 'preferred', None, ), 'disable_host_prefix_injection': ( 'disable_host_prefix_injection', 'AWS_DISABLE_HOST_PREFIX_INJECTION', None, utils.ensure_boolean, ), } # Evaluate AWS_STS_REGIONAL_ENDPOINTS settings try: # This is not a public interface and is subject to abrupt breaking changes. # Any usage is not advised or supported in external code bases. from botocore.customizations.sts import ( sts_default_setting as _sts_default_setting, ) except ImportError: _sts_default_setting = 'legacy' _STS_DEFAULT_SETTINGS = { 'sts_regional_endpoints': ( 'sts_regional_endpoints', 'AWS_STS_REGIONAL_ENDPOINTS', _sts_default_setting, None, ), } BOTOCORE_DEFAUT_SESSION_VARIABLES.update(_STS_DEFAULT_SETTINGS) # A mapping for the s3 specific configuration vars. These are the configuration # vars that typically go in the s3 section of the config file. This mapping # follows the same schema as the previous session variable mapping. DEFAULT_S3_CONFIG_VARS = { 'addressing_style': (('s3', 'addressing_style'), None, None, None), 'use_accelerate_endpoint': ( ('s3', 'use_accelerate_endpoint'), None, None, utils.ensure_boolean, ), 'use_dualstack_endpoint': ( ('s3', 'use_dualstack_endpoint'), None, None, utils.ensure_boolean, ), 'payload_signing_enabled': ( ('s3', 'payload_signing_enabled'), None, None, utils.ensure_boolean, ), 'use_arn_region': ( ['s3_use_arn_region', ('s3', 'use_arn_region')], 'AWS_S3_USE_ARN_REGION', None, utils.ensure_boolean, ), 'us_east_1_regional_endpoint': ( [ 's3_us_east_1_regional_endpoint', ('s3', 'us_east_1_regional_endpoint'), ], 'AWS_S3_US_EAST_1_REGIONAL_ENDPOINT', None, None, ), 's3_disable_multiregion_access_points': ( ('s3', 's3_disable_multiregion_access_points'), 'AWS_S3_DISABLE_MULTIREGION_ACCESS_POINTS', None, utils.ensure_boolean, ), } # A mapping for the proxy specific configuration vars. These are # used to configure how botocore interacts with proxy setups while # sending requests. DEFAULT_PROXIES_CONFIG_VARS = { 'proxy_ca_bundle': ('proxy_ca_bundle', None, None, None), 'proxy_client_cert': ('proxy_client_cert', None, None, None), 'proxy_use_forwarding_for_https': ( 'proxy_use_forwarding_for_https', None, None, utils.normalize_boolean, ), } def create_botocore_default_config_mapping(session): chain_builder = ConfigChainFactory(session=session) config_mapping = _create_config_chain_mapping( chain_builder, BOTOCORE_DEFAUT_SESSION_VARIABLES ) config_mapping['s3'] = SectionConfigProvider( 's3', session, _create_config_chain_mapping(chain_builder, DEFAULT_S3_CONFIG_VARS), ) config_mapping['proxies_config'] = SectionConfigProvider( 'proxies_config', session, _create_config_chain_mapping( chain_builder, DEFAULT_PROXIES_CONFIG_VARS ), ) return config_mapping def _create_config_chain_mapping(chain_builder, config_variables): mapping = {} for logical_name, config in config_variables.items(): mapping[logical_name] = chain_builder.create_config_chain( instance_name=logical_name, env_var_names=config[1], config_property_names=config[0], default=config[2], conversion_func=config[3], ) return mapping class DefaultConfigResolver: def __init__(self, default_config_data): self._base_default_config = default_config_data['base'] self._modes = default_config_data['modes'] self._resolved_default_configurations = {} def _resolve_default_values_by_mode(self, mode): default_config = self._base_default_config.copy() modifications = self._modes.get(mode) for config_var in modifications: default_value = default_config[config_var] modification_dict = modifications[config_var] modification = list(modification_dict.keys())[0] modification_value = modification_dict[modification] if modification == 'multiply': default_value *= modification_value elif modification == 'add': default_value += modification_value elif modification == 'override': default_value = modification_value default_config[config_var] = default_value return default_config def get_default_modes(self): default_modes = ['legacy', 'auto'] default_modes.extend(self._modes.keys()) return default_modes def get_default_config_values(self, mode): if mode not in self._resolved_default_configurations: defaults = self._resolve_default_values_by_mode(mode) self._resolved_default_configurations[mode] = defaults return self._resolved_default_configurations[mode] class ConfigChainFactory: """Factory class to create our most common configuration chain case. This is a convenience class to construct configuration chains that follow our most common pattern. This is to prevent ordering them incorrectly, and to make the config chain construction more readable. """ def __init__(self, session, environ=None): """Initialize a ConfigChainFactory. :type session: :class:`botocore.session.Session` :param session: This is the session that should be used to look up values from the config file. :type environ: dict :param environ: A mapping to use for environment variables. If this is not provided it will default to use os.environ. """ self._session = session if environ is None: environ = os.environ self._environ = environ def create_config_chain( self, instance_name=None, env_var_names=None, config_property_names=None, default=None, conversion_func=None, ): """Build a config chain following the standard botocore pattern. In botocore most of our config chains follow the the precendence: session_instance_variables, environment, config_file, default_value. This is a convenience function for creating a chain that follow that precendence. :type instance_name: str :param instance_name: This indicates what session instance variable corresponds to this config value. If it is None it will not be added to the chain. :type env_var_names: str or list of str or None :param env_var_names: One or more environment variable names to search for this value. They are searched in order. If it is None it will not be added to the chain. :type config_property_names: str/tuple or list of str/tuple or None :param config_property_names: One of more strings or tuples representing the name of the key in the config file for this config option. They are searched in order. If it is None it will not be added to the chain. :type default: Any :param default: Any constant value to be returned. :type conversion_func: None or callable :param conversion_func: If this value is None then it has no effect on the return type. Otherwise, it is treated as a function that will conversion_func our provided type. :rvalue: ConfigChain :returns: A ConfigChain that resolves in the order env_var_names -> config_property_name -> default. Any values that were none are omitted form the chain. """ providers = [] if instance_name is not None: providers.append( InstanceVarProvider( instance_var=instance_name, session=self._session ) ) if env_var_names is not None: providers.extend(self._get_env_providers(env_var_names)) if config_property_names is not None: providers.extend( self._get_scoped_config_providers(config_property_names) ) if default is not None: providers.append(ConstantProvider(value=default)) return ChainProvider( providers=providers, conversion_func=conversion_func, ) def _get_env_providers(self, env_var_names): env_var_providers = [] if not isinstance(env_var_names, list): env_var_names = [env_var_names] for env_var_name in env_var_names: env_var_providers.append( EnvironmentProvider(name=env_var_name, env=self._environ) ) return env_var_providers def _get_scoped_config_providers(self, config_property_names): scoped_config_providers = [] if not isinstance(config_property_names, list): config_property_names = [config_property_names] for config_property_name in config_property_names: scoped_config_providers.append( ScopedConfigProvider( config_var_name=config_property_name, session=self._session, ) ) return scoped_config_providers class ConfigValueStore: """The ConfigValueStore object stores configuration values.""" def __init__(self, mapping=None): """Initialize a ConfigValueStore. :type mapping: dict :param mapping: The mapping parameter is a map of string to a subclass of BaseProvider. When a config variable is asked for via the get_config_variable method, the corresponding provider will be invoked to load the value. """ self._overrides = {} self._mapping = {} if mapping is not None: for logical_name, provider in mapping.items(): self.set_config_provider(logical_name, provider) def __deepcopy__(self, memo): config_store = ConfigValueStore(copy.deepcopy(self._mapping, memo)) for logical_name, override_value in self._overrides.items(): config_store.set_config_variable(logical_name, override_value) return config_store def __copy__(self): config_store = ConfigValueStore(copy.copy(self._mapping)) for logical_name, override_value in self._overrides.items(): config_store.set_config_variable(logical_name, override_value) return config_store def get_config_variable(self, logical_name): """ Retrieve the value associated with the specified logical_name from the corresponding provider. If no value is found None will be returned. :type logical_name: str :param logical_name: The logical name of the session variable you want to retrieve. This name will be mapped to the appropriate environment variable name for this session as well as the appropriate config file entry. :returns: value of variable or None if not defined. """ if logical_name in self._overrides: return self._overrides[logical_name] if logical_name not in self._mapping: return None provider = self._mapping[logical_name] return provider.provide() def get_config_provider(self, logical_name): """ Retrieve the provider associated with the specified logical_name. If no provider is found None will be returned. :type logical_name: str :param logical_name: The logical name of the session variable you want to retrieve. This name will be mapped to the appropriate environment variable name for this session as well as the appropriate config file entry. :returns: configuration provider or None if not defined. """ if ( logical_name in self._overrides or logical_name not in self._mapping ): return None provider = self._mapping[logical_name] return provider def set_config_variable(self, logical_name, value): """Set a configuration variable to a specific value. By using this method, you can override the normal lookup process used in ``get_config_variable`` by explicitly setting a value. Subsequent calls to ``get_config_variable`` will use the ``value``. This gives you per-session specific configuration values. :: >>> # Assume logical name 'foo' maps to env var 'FOO' >>> os.environ['FOO'] = 'myvalue' >>> s.get_config_variable('foo') 'myvalue' >>> s.set_config_variable('foo', 'othervalue') >>> s.get_config_variable('foo') 'othervalue' :type logical_name: str :param logical_name: The logical name of the session variable you want to set. These are the keys in ``SESSION_VARIABLES``. :param value: The value to associate with the config variable. """ self._overrides[logical_name] = value def clear_config_variable(self, logical_name): """Remove an override config variable from the session. :type logical_name: str :param logical_name: The name of the parameter to clear the override value from. """ self._overrides.pop(logical_name, None) def set_config_provider(self, logical_name, provider): """Set the provider for a config value. This provides control over how a particular configuration value is loaded. This replaces the provider for ``logical_name`` with the new ``provider``. :type logical_name: str :param logical_name: The name of the config value to change the config provider for. :type provider: :class:`botocore.configprovider.BaseProvider` :param provider: The new provider that should be responsible for providing a value for the config named ``logical_name``. """ self._mapping[logical_name] = provider class SmartDefaultsConfigStoreFactory: def __init__(self, default_config_resolver, imds_region_provider): self._default_config_resolver = default_config_resolver self._imds_region_provider = imds_region_provider # Initializing _instance_metadata_region as None so we # can fetch region in a lazy fashion only when needed. self._instance_metadata_region = None def merge_smart_defaults(self, config_store, mode, region_name): if mode == 'auto': mode = self.resolve_auto_mode(region_name) default_configs = ( self._default_config_resolver.get_default_config_values(mode) ) for config_var in default_configs: config_value = default_configs[config_var] method = getattr(self, f'_set_{config_var}', None) if method: method(config_store, config_value) def resolve_auto_mode(self, region_name): current_region = None if os.environ.get('AWS_EXECUTION_ENV'): default_region = os.environ.get('AWS_DEFAULT_REGION') current_region = os.environ.get('AWS_REGION', default_region) if not current_region: if self._instance_metadata_region: current_region = self._instance_metadata_region else: try: current_region = self._imds_region_provider.provide() self._instance_metadata_region = current_region except Exception: pass if current_region: if region_name == current_region: return 'in-region' else: return 'cross-region' return 'standard' def _update_provider(self, config_store, variable, value): original_provider = config_store.get_config_provider(variable) default_provider = ConstantProvider(value) if isinstance(original_provider, ChainProvider): chain_provider_copy = copy.deepcopy(original_provider) chain_provider_copy.set_default_provider(default_provider) default_provider = chain_provider_copy elif isinstance(original_provider, BaseProvider): default_provider = ChainProvider( providers=[original_provider, default_provider] ) config_store.set_config_provider(variable, default_provider) def _update_section_provider( self, config_store, section_name, variable, value ): section_provider_copy = copy.deepcopy( config_store.get_config_provider(section_name) ) section_provider_copy.set_default_provider( variable, ConstantProvider(value) ) config_store.set_config_provider(section_name, section_provider_copy) def _set_retryMode(self, config_store, value): self._update_provider(config_store, 'retry_mode', value) def _set_stsRegionalEndpoints(self, config_store, value): self._update_provider(config_store, 'sts_regional_endpoints', value) def _set_s3UsEast1RegionalEndpoints(self, config_store, value): self._update_section_provider( config_store, 's3', 'us_east_1_regional_endpoint', value ) def _set_connectTimeoutInMillis(self, config_store, value): self._update_provider(config_store, 'connect_timeout', value / 1000) class BaseProvider: """Base class for configuration value providers. A configuration provider has some method of providing a configuration value. """ def provide(self): """Provide a config value.""" raise NotImplementedError('provide') class ChainProvider(BaseProvider): """This provider wraps one or more other providers. Each provider in the chain is called, the first one returning a non-None value is then returned. """ def __init__(self, providers=None, conversion_func=None): """Initalize a ChainProvider. :type providers: list :param providers: The initial list of providers to check for values when invoked. :type conversion_func: None or callable :param conversion_func: If this value is None then it has no affect on the return type. Otherwise, it is treated as a function that will transform provided value. """ if providers is None: providers = [] self._providers = providers self._conversion_func = conversion_func def __deepcopy__(self, memo): return ChainProvider( copy.deepcopy(self._providers, memo), self._conversion_func ) def provide(self): """Provide the value from the first provider to return non-None. Each provider in the chain has its provide method called. The first one in the chain to return a non-None value is the returned from the ChainProvider. When no non-None value is found, None is returned. """ for provider in self._providers: value = provider.provide() if value is not None: return self._convert_type(value) return None def set_default_provider(self, default_provider): if self._providers and isinstance( self._providers[-1], ConstantProvider ): self._providers[-1] = default_provider else: self._providers.append(default_provider) num_of_constants = sum( isinstance(provider, ConstantProvider) for provider in self._providers ) if num_of_constants > 1: logger.info( 'ChainProvider object contains multiple ' 'instances of ConstantProvider objects' ) def _convert_type(self, value): if self._conversion_func is not None: return self._conversion_func(value) return value def __repr__(self): return '[{}]'.format(', '.join([str(p) for p in self._providers])) class InstanceVarProvider(BaseProvider): """This class loads config values from the session instance vars.""" def __init__(self, instance_var, session): """Initialize InstanceVarProvider. :type instance_var: str :param instance_var: The instance variable to load from the session. :type session: :class:`botocore.session.Session` :param session: The botocore session to get the loaded configuration file variables from. """ self._instance_var = instance_var self._session = session def __deepcopy__(self, memo): return InstanceVarProvider( copy.deepcopy(self._instance_var, memo), self._session ) def provide(self): """Provide a config value from the session instance vars.""" instance_vars = self._session.instance_variables() value = instance_vars.get(self._instance_var) return value def __repr__(self): return f'InstanceVarProvider(instance_var={self._instance_var}, session={self._session})' class ScopedConfigProvider(BaseProvider): def __init__(self, config_var_name, session): """Initialize ScopedConfigProvider. :type config_var_name: str or tuple :param config_var_name: The name of the config variable to load from the configuration file. If the value is a tuple, it must only consist of two items, where the first item represents the section and the second item represents the config var name in the section. :type session: :class:`botocore.session.Session` :param session: The botocore session to get the loaded configuration file variables from. """ self._config_var_name = config_var_name self._session = session def __deepcopy__(self, memo): return ScopedConfigProvider( copy.deepcopy(self._config_var_name, memo), self._session ) def provide(self): """Provide a value from a config file property.""" scoped_config = self._session.get_scoped_config() if isinstance(self._config_var_name, tuple): section_config = scoped_config.get(self._config_var_name[0]) if not isinstance(section_config, dict): return None return section_config.get(self._config_var_name[1]) return scoped_config.get(self._config_var_name) def __repr__(self): return f'ScopedConfigProvider(config_var_name={self._config_var_name}, session={self._session})' class EnvironmentProvider(BaseProvider): """This class loads config values from environment variables.""" def __init__(self, name, env): """Initialize with the keys in the dictionary to check. :type name: str :param name: The key with that name will be loaded and returned. :type env: dict :param env: Environment variables dictionary to get variables from. """ self._name = name self._env = env def __deepcopy__(self, memo): return EnvironmentProvider( copy.deepcopy(self._name, memo), copy.deepcopy(self._env, memo) ) def provide(self): """Provide a config value from a source dictionary.""" if self._name in self._env: return self._env[self._name] return None def __repr__(self): return f'EnvironmentProvider(name={self._name}, env={self._env})' class SectionConfigProvider(BaseProvider): """Provides a dictionary from a section in the scoped config This is useful for retrieving scoped config variables (i.e. s3) that have their own set of config variables and resolving logic. """ def __init__(self, section_name, session, override_providers=None): self._section_name = section_name self._session = session self._scoped_config_provider = ScopedConfigProvider( self._section_name, self._session ) self._override_providers = override_providers if self._override_providers is None: self._override_providers = {} def __deepcopy__(self, memo): return SectionConfigProvider( copy.deepcopy(self._section_name, memo), self._session, copy.deepcopy(self._override_providers, memo), ) def provide(self): section_config = self._scoped_config_provider.provide() if section_config and not isinstance(section_config, dict): logger.debug( "The %s config key is not a dictionary type, " "ignoring its value of: %s", self._section_name, section_config, ) return None for section_config_var, provider in self._override_providers.items(): provider_val = provider.provide() if provider_val is not None: if section_config is None: section_config = {} section_config[section_config_var] = provider_val return section_config def set_default_provider(self, key, default_provider): provider = self._override_providers.get(key) if isinstance(provider, ChainProvider): provider.set_default_provider(default_provider) return elif isinstance(provider, BaseProvider): default_provider = ChainProvider( providers=[provider, default_provider] ) self._override_providers[key] = default_provider def __repr__(self): return ( f'SectionConfigProvider(section_name={self._section_name}, ' f'session={self._session}, ' f'override_providers={self._override_providers})' ) class ConstantProvider(BaseProvider): """This provider provides a constant value.""" def __init__(self, value): self._value = value def __deepcopy__(self, memo): return ConstantProvider(copy.deepcopy(self._value, memo)) def provide(self): """Provide the constant value given during initialization.""" return self._value def __repr__(self): return f'ConstantProvider(value={self._value})' class ConfiguredEndpointProvider(BaseProvider): """Lookup an endpoint URL from environment variable or shared config file. NOTE: This class is considered private and is subject to abrupt breaking changes or removal without prior announcement. Please do not use it directly. """ _ENDPOINT_URL_LOOKUP_ORDER = [ 'environment_service', 'environment_global', 'config_service', 'config_global', ] def __init__( self, full_config, scoped_config, client_name, environ=None, ): """Initialize a ConfiguredEndpointProviderChain. :type full_config: dict :param full_config: This is the dict representing the full configuration file. :type scoped_config: dict :param scoped_config: This is the dict representing the configuration for the current profile for the session. :type client_name: str :param client_name: The name used to instantiate a client using botocore.session.Session.create_client. :type environ: dict :param environ: A mapping to use for environment variables. If this is not provided it will default to use os.environ. """ self._full_config = full_config self._scoped_config = scoped_config self._client_name = client_name self._transformed_service_id = self._get_snake_case_service_id( self._client_name ) if environ is None: environ = os.environ self._environ = environ def provide(self): """Lookup the configured endpoint URL. The order is: 1. The value provided by a service-specific environment variable. 2. The value provided by the global endpoint environment variable (AWS_ENDPOINT_URL). 3. The value provided by a service-specific parameter from a services definition section in the shared configuration file. 4. The value provided by the global parameter from a services definition section in the shared configuration file. """ for location in self._ENDPOINT_URL_LOOKUP_ORDER: logger.debug( 'Looking for endpoint for %s via: %s', self._client_name, location, ) endpoint_url = getattr(self, f'_get_endpoint_url_{location}')() if endpoint_url: logger.info( 'Found endpoint for %s via: %s.', self._client_name, location, ) return endpoint_url logger.debug('No configured endpoint found.') return None def _get_snake_case_service_id(self, client_name): # Get the service ID without loading the service data file, accounting # for any aliases and standardizing the names with hyphens. client_name = utils.SERVICE_NAME_ALIASES.get(client_name, client_name) hyphenized_service_id = ( utils.CLIENT_NAME_TO_HYPHENIZED_SERVICE_ID_OVERRIDES.get( client_name, client_name ) ) return hyphenized_service_id.replace('-', '_') def _get_service_env_var_name(self): transformed_service_id_env = self._transformed_service_id.upper() return f'AWS_ENDPOINT_URL_{transformed_service_id_env}' def _get_services_config(self): if 'services' not in self._scoped_config: return {} section_name = self._scoped_config['services'] services_section = self._full_config.get('services', {}).get( section_name ) if not services_section: error_msg = ( f'The profile is configured to use the services ' f'section but the "{section_name}" services ' f'configuration does not exist.' ) raise InvalidConfigError(error_msg=error_msg) return services_section def _get_endpoint_url_config_service(self): snakecase_service_id = self._transformed_service_id.lower() return ( self._get_services_config() .get(snakecase_service_id, {}) .get('endpoint_url') ) def _get_endpoint_url_config_global(self): return self._scoped_config.get('endpoint_url') def _get_endpoint_url_environment_service(self): return EnvironmentProvider( name=self._get_service_env_var_name(), env=self._environ ).provide() def _get_endpoint_url_environment_global(self): return EnvironmentProvider( name='AWS_ENDPOINT_URL', env=self._environ ).provide()	37.52 KB	2025-05-25 12:26
📄 context.py # Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """ NOTE: All classes and functions in this module are considered private and are subject to abrupt breaking changes. Please do not use them directly. """ from contextlib import contextmanager from contextvars import ContextVar from copy import deepcopy from dataclasses import dataclass, field from functools import wraps @dataclass class ClientContext: """ Encapsulation of objects tracked within the ``_context`` context variable. ``features`` is a set responsible for storing features used during preparation of an AWS request. ``botocore.useragent.register_feature_id`` is used to add to this set. """ features: set[str] = field(default_factory=set) _context = ContextVar("_context") def get_context(): """Get the current ``_context`` context variable if set, else None.""" return _context.get(None) def set_context(ctx): """Set the current ``_context`` context variable. :type ctx: ClientContext :param ctx: Client context object to set as the current context variable. :rtype: contextvars.Token :returns: Token object used to revert the context variable to what it was before the corresponding set. """ token = _context.set(ctx) return token def reset_context(token): """Reset the current ``_context`` context variable. :type token: contextvars.Token :param token: Token object to reset the context variable. """ _context.reset(token) @contextmanager def start_as_current_context(ctx=None): """ Context manager that copies the passed or current context object and sets it as the current context variable. If no context is found, a new ``ClientContext`` object is created. It mainly ensures the context variable is reset to the previous value once the executed code returns. Example usage: def my_feature(): with start_as_current_context(): register_feature_id('MY_FEATURE') pass :type ctx: ClientContext :param ctx: The client context object to set as the new context variable. If not provided, the current or a new context variable is used. """ current = ctx or get_context() if current is None: new = ClientContext() else: new = deepcopy(current) token = set_context(new) try: yield finally: reset_context(token) def with_current_context(hook=None): """ Decorator that wraps ``start_as_current_context`` and optionally invokes a hook within the newly-set context. This is just syntactic sugar to avoid indenting existing code under the context manager. Example usage: @with_current_context(partial(register_feature_id, 'MY_FEATURE')) def my_feature(): pass :type hook: callable :param hook: A callable that will be invoked within the scope of the ``start_as_current_context`` context manager. """ def decorator(func): @wraps(func) def wrapper(args, kwargs): with start_as_current_context(): if hook: hook() return func(args, **kwargs) return wrapper return decorator	3.69 KB	2025-05-25 12:26
📄 credentials.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import datetime import getpass import json import logging import os import subprocess import threading import time from collections import namedtuple from copy import deepcopy from hashlib import sha1 from dateutil.parser import parse from dateutil.tz import tzlocal, tzutc import botocore.compat import botocore.configloader from botocore import UNSIGNED from botocore.compat import compat_shell_split, total_seconds from botocore.config import Config from botocore.exceptions import ( ConfigNotFound, CredentialRetrievalError, InfiniteLoopConfigError, InvalidConfigError, MetadataRetrievalError, PartialCredentialsError, RefreshWithMFAUnsupportedError, UnauthorizedSSOTokenError, UnknownCredentialError, ) from botocore.tokens import SSOTokenProvider from botocore.utils import ( ArnParser, ContainerMetadataFetcher, FileWebIdentityTokenLoader, InstanceMetadataFetcher, JSONFileCache, SSOTokenLoader, parse_key_val_file, resolve_imds_endpoint_mode, ) logger = logging.getLogger(__name__) ReadOnlyCredentials = namedtuple( 'ReadOnlyCredentials', ['access_key', 'secret_key', 'token', 'account_id'], defaults=(None,), ) _DEFAULT_MANDATORY_REFRESH_TIMEOUT = 10 * 60 # 10 min _DEFAULT_ADVISORY_REFRESH_TIMEOUT = 15 * 60 # 15 min def create_credential_resolver(session, cache=None, region_name=None): """Create a default credential resolver. This creates a pre-configured credential resolver that includes the default lookup chain for credentials. """ profile_name = session.get_config_variable('profile') or 'default' metadata_timeout = session.get_config_variable('metadata_service_timeout') num_attempts = session.get_config_variable('metadata_service_num_attempts') disable_env_vars = session.instance_variables().get('profile') is not None imds_config = { 'ec2_metadata_service_endpoint': session.get_config_variable( 'ec2_metadata_service_endpoint' ), 'ec2_metadata_service_endpoint_mode': resolve_imds_endpoint_mode( session ), 'ec2_credential_refresh_window': _DEFAULT_ADVISORY_REFRESH_TIMEOUT, 'ec2_metadata_v1_disabled': session.get_config_variable( 'ec2_metadata_v1_disabled' ), } if cache is None: cache = {} env_provider = EnvProvider() container_provider = ContainerProvider() instance_metadata_provider = InstanceMetadataProvider( iam_role_fetcher=InstanceMetadataFetcher( timeout=metadata_timeout, num_attempts=num_attempts, user_agent=session.user_agent(), config=imds_config, ) ) profile_provider_builder = ProfileProviderBuilder( session, cache=cache, region_name=region_name ) assume_role_provider = AssumeRoleProvider( load_config=lambda: session.full_config, client_creator=_get_client_creator(session, region_name), cache=cache, profile_name=profile_name, credential_sourcer=CanonicalNameCredentialSourcer( [env_provider, container_provider, instance_metadata_provider] ), profile_provider_builder=profile_provider_builder, ) pre_profile = [ env_provider, assume_role_provider, ] profile_providers = profile_provider_builder.providers( profile_name=profile_name, disable_env_vars=disable_env_vars, ) post_profile = [ OriginalEC2Provider(), BotoProvider(), container_provider, instance_metadata_provider, ] providers = pre_profile + profile_providers + post_profile if disable_env_vars: # An explicitly provided profile will negate an EnvProvider. # We will defer to providers that understand the "profile" # concept to retrieve credentials. # The one edge case if is all three values are provided via # env vars: # export AWS_ACCESS_KEY_ID=foo # export AWS_SECRET_ACCESS_KEY=bar # export AWS_PROFILE=baz # Then, just like our client() calls, the explicit credentials # will take precedence. # # This precedence is enforced by leaving the EnvProvider in the chain. # This means that the only way a "profile" would win is if the # EnvProvider does not return credentials, which is what we want # in this scenario. providers.remove(env_provider) logger.debug( 'Skipping environment variable credential check' ' because profile name was explicitly set.' ) resolver = CredentialResolver(providers=providers) return resolver class ProfileProviderBuilder: """This class handles the creation of profile based providers. NOTE: This class is only intended for internal use. This class handles the creation and ordering of the various credential providers that primarly source their configuration from the shared config. This is needed to enable sharing between the default credential chain and the source profile chain created by the assume role provider. """ def __init__( self, session, cache=None, region_name=None, sso_token_cache=None ): self._session = session self._cache = cache self._region_name = region_name self._sso_token_cache = sso_token_cache def providers(self, profile_name, disable_env_vars=False): return [ self._create_web_identity_provider( profile_name, disable_env_vars, ), self._create_sso_provider(profile_name), self._create_shared_credential_provider(profile_name), self._create_process_provider(profile_name), self._create_config_provider(profile_name), ] def _create_process_provider(self, profile_name): return ProcessProvider( profile_name=profile_name, load_config=lambda: self._session.full_config, ) def _create_shared_credential_provider(self, profile_name): credential_file = self._session.get_config_variable('credentials_file') return SharedCredentialProvider( profile_name=profile_name, creds_filename=credential_file, ) def _create_config_provider(self, profile_name): config_file = self._session.get_config_variable('config_file') return ConfigProvider( profile_name=profile_name, config_filename=config_file, ) def _create_web_identity_provider(self, profile_name, disable_env_vars): return AssumeRoleWithWebIdentityProvider( load_config=lambda: self._session.full_config, client_creator=_get_client_creator( self._session, self._region_name ), cache=self._cache, profile_name=profile_name, disable_env_vars=disable_env_vars, ) def _create_sso_provider(self, profile_name): return SSOProvider( load_config=lambda: self._session.full_config, client_creator=self._session.create_client, profile_name=profile_name, cache=self._cache, token_cache=self._sso_token_cache, token_provider=SSOTokenProvider( self._session, cache=self._sso_token_cache, profile_name=profile_name, ), ) def get_credentials(session): resolver = create_credential_resolver(session) return resolver.load_credentials() def _local_now(): return datetime.datetime.now(tzlocal()) def _parse_if_needed(value): if isinstance(value, datetime.datetime): return value return parse(value) def _serialize_if_needed(value, iso=False): if isinstance(value, datetime.datetime): if iso: return value.isoformat() return value.strftime('%Y-%m-%dT%H:%M:%S%Z') return value def _get_client_creator(session, region_name): def client_creator(service_name, kwargs): create_client_kwargs = {'region_name': region_name} create_client_kwargs.update(kwargs) return session.create_client(service_name, create_client_kwargs) return client_creator def create_assume_role_refresher(client, params): def refresh(): response = client.assume_role(params) credentials = response['Credentials'] # We need to normalize the credential names to # the values expected by the refresh creds. return { 'access_key': credentials['AccessKeyId'], 'secret_key': credentials['SecretAccessKey'], 'token': credentials['SessionToken'], 'expiry_time': _serialize_if_needed(credentials['Expiration']), } return refresh def create_mfa_serial_refresher(actual_refresh): class _Refresher: def __init__(self, refresh): self._refresh = refresh self._has_been_called = False def __call__(self): if self._has_been_called: # We can explore an option in the future to support # reprompting for MFA, but for now we just error out # when the temp creds expire. raise RefreshWithMFAUnsupportedError() self._has_been_called = True return self._refresh() return _Refresher(actual_refresh) class Credentials: """ Holds the credentials needed to authenticate requests. :param str access_key: The access key part of the credentials. :param str secret_key: The secret key part of the credentials. :param str token: The security token, valid only for session credentials. :param str method: A string which identifies where the credentials were found. :param str account_id: (optional) An account ID associated with the credentials. """ def __init__( self, access_key, secret_key, token=None, method=None, account_id=None ): self.access_key = access_key self.secret_key = secret_key self.token = token if method is None: method = 'explicit' self.method = method self.account_id = account_id self._normalize() def _normalize(self): # Keys would sometimes (accidentally) contain non-ascii characters. # It would cause a confusing UnicodeDecodeError in Python 2. # We explicitly convert them into unicode to avoid such error. # # Eventually the service will decide whether to accept the credential. # This also complies with the behavior in Python 3. self.access_key = botocore.compat.ensure_unicode(self.access_key) self.secret_key = botocore.compat.ensure_unicode(self.secret_key) def get_frozen_credentials(self): return ReadOnlyCredentials( self.access_key, self.secret_key, self.token, self.account_id ) def get_deferred_property(self, property_name): def get_property(): return getattr(self, property_name, None) return get_property class RefreshableCredentials(Credentials): """ Holds the credentials needed to authenticate requests. In addition, it knows how to refresh itself. :param str access_key: The access key part of the credentials. :param str secret_key: The secret key part of the credentials. :param str token: The security token, valid only for session credentials. :param datetime expiry_time: The expiration time of the credentials. :param function refresh_using: Callback function to refresh the credentials. :param str method: A string which identifies where the credentials were found. :param function time_fetcher: Callback function to retrieve current time. """ # The time at which we'll attempt to refresh, but not # block if someone else is refreshing. _advisory_refresh_timeout = _DEFAULT_ADVISORY_REFRESH_TIMEOUT # The time at which all threads will block waiting for # refreshed credentials. _mandatory_refresh_timeout = _DEFAULT_MANDATORY_REFRESH_TIMEOUT def __init__( self, access_key, secret_key, token, expiry_time, refresh_using, method, time_fetcher=_local_now, advisory_timeout=None, mandatory_timeout=None, account_id=None, ): self._refresh_using = refresh_using self._access_key = access_key self._secret_key = secret_key self._token = token self._account_id = account_id self._expiry_time = expiry_time self._time_fetcher = time_fetcher self._refresh_lock = threading.Lock() self.method = method self._frozen_credentials = ReadOnlyCredentials( access_key, secret_key, token, account_id ) self._normalize() if advisory_timeout is not None: self._advisory_refresh_timeout = advisory_timeout if mandatory_timeout is not None: self._mandatory_refresh_timeout = mandatory_timeout def _normalize(self): self._access_key = botocore.compat.ensure_unicode(self._access_key) self._secret_key = botocore.compat.ensure_unicode(self._secret_key) @classmethod def create_from_metadata( cls, metadata, refresh_using, method, advisory_timeout=None, mandatory_timeout=None, ): kwargs = {} if advisory_timeout is not None: kwargs['advisory_timeout'] = advisory_timeout if mandatory_timeout is not None: kwargs['mandatory_timeout'] = mandatory_timeout instance = cls( access_key=metadata['access_key'], secret_key=metadata['secret_key'], token=metadata['token'], expiry_time=cls._expiry_datetime(metadata['expiry_time']), method=method, refresh_using=refresh_using, account_id=metadata.get('account_id'), *kwargs, ) return instance @property def access_key(self): """Warning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. """ self._refresh() return self._access_key @access_key.setter def access_key(self, value): self._access_key = value @property def secret_key(self): """Warning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. """ self._refresh() return self._secret_key @secret_key.setter def secret_key(self, value): self._secret_key = value @property def token(self): """Warning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. """ self._refresh() return self._token @token.setter def token(self, value): self._token = value @property def account_id(self): """Warning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. """ self._refresh() return self._account_id @account_id.setter def account_id(self, value): self._account_id = value def _seconds_remaining(self): delta = self._expiry_time - self._time_fetcher() return total_seconds(delta) def refresh_needed(self, refresh_in=None): """Check if a refresh is needed. A refresh is needed if the expiry time associated with the temporary credentials is less than the provided ``refresh_in``. If ``time_delta`` is not provided, ``self.advisory_refresh_needed`` will be used. For example, if your temporary credentials expire in 10 minutes and the provided ``refresh_in`` is ``15 60``, then this function will return ``True``. :type refresh_in: int :param refresh_in: The number of seconds before the credentials expire in which refresh attempts should be made. :return: True if refresh needed, False otherwise. """ if self._expiry_time is None: # No expiration, so assume we don't need to refresh. return False if refresh_in is None: refresh_in = self._advisory_refresh_timeout # The credentials should be refreshed if they're going to expire # in less than 5 minutes. if self._seconds_remaining() >= refresh_in: # There's enough time left. Don't refresh. return False logger.debug("Credentials need to be refreshed.") return True def _is_expired(self): # Checks if the current credentials are expired. return self.refresh_needed(refresh_in=0) def _refresh(self): # In the common case where we don't need a refresh, we # can immediately exit and not require acquiring the # refresh lock. if not self.refresh_needed(self._advisory_refresh_timeout): return # acquire() doesn't accept kwargs, but False is indicating # that we should not block if we can't acquire the lock. # If we aren't able to acquire the lock, we'll trigger # the else clause. if self._refresh_lock.acquire(False): try: if not self.refresh_needed(self._advisory_refresh_timeout): return is_mandatory_refresh = self.refresh_needed( self._mandatory_refresh_timeout ) self._protected_refresh(is_mandatory=is_mandatory_refresh) return finally: self._refresh_lock.release() elif self.refresh_needed(self._mandatory_refresh_timeout): # If we're within the mandatory refresh window, # we must block until we get refreshed credentials. with self._refresh_lock: if not self.refresh_needed(self._mandatory_refresh_timeout): return self._protected_refresh(is_mandatory=True) def _protected_refresh(self, is_mandatory): # precondition: this method should only be called if you've acquired # the self._refresh_lock. try: metadata = self._refresh_using() except Exception: period_name = 'mandatory' if is_mandatory else 'advisory' logger.warning( "Refreshing temporary credentials failed " "during %s refresh period.", period_name, exc_info=True, ) if is_mandatory: # If this is a mandatory refresh, then # all errors that occur when we attempt to refresh # credentials are propagated back to the user. raise # Otherwise we'll just return. # The end result will be that we'll use the current # set of temporary credentials we have. return self._set_from_data(metadata) self._frozen_credentials = ReadOnlyCredentials( self._access_key, self._secret_key, self._token, self._account_id ) if self._is_expired(): # We successfully refreshed credentials but for whatever # reason, our refreshing function returned credentials # that are still expired. In this scenario, the only # thing we can do is let the user know and raise # an exception. msg = ( "Credentials were refreshed, but the " "refreshed credentials are still expired." ) logger.warning(msg) raise RuntimeError(msg) @staticmethod def _expiry_datetime(time_str): return parse(time_str) def _set_from_data(self, data): expected_keys = ['access_key', 'secret_key', 'token', 'expiry_time'] if not data: missing_keys = expected_keys else: missing_keys = [k for k in expected_keys if k not in data] if missing_keys: message = "Credential refresh failed, response did not contain: %s" raise CredentialRetrievalError( provider=self.method, error_msg=message % ', '.join(missing_keys), ) self.access_key = data['access_key'] self.secret_key = data['secret_key'] self.token = data['token'] self._expiry_time = parse(data['expiry_time']) self.account_id = data.get('account_id') logger.debug( "Retrieved credentials will expire at: %s", self._expiry_time ) self._normalize() def get_frozen_credentials(self): """Return immutable credentials. The ``access_key``, ``secret_key``, and ``token`` properties on this class will always check and refresh credentials if needed before returning the particular credentials. This has an edge case where you can get inconsistent credentials. Imagine this: # Current creds are "t1" tmp.access_key ---> expired? no, so return t1.access_key # ---- time is now expired, creds need refreshing to "t2" ---- tmp.secret_key ---> expired? yes, refresh and return t2.secret_key This means we're using the access key from t1 with the secret key from t2. To fix this issue, you can request a frozen credential object which is guaranteed not to change. The frozen credentials returned from this method should be used immediately and then discarded. The typical usage pattern would be:: creds = RefreshableCredentials(...) some_code = SomeSignerObject() # I'm about to sign the request. # The frozen credentials are only used for the # duration of generate_presigned_url and will be # immediately thrown away. request = some_code.sign_some_request( with_credentials=creds.get_frozen_credentials()) print("Signed request:", request) """ self._refresh() return self._frozen_credentials class DeferredRefreshableCredentials(RefreshableCredentials): """Refreshable credentials that don't require initial credentials. refresh_using will be called upon first access. """ def __init__(self, refresh_using, method, time_fetcher=_local_now): self._refresh_using = refresh_using self._access_key = None self._secret_key = None self._token = None self._account_id = None self._expiry_time = None self._time_fetcher = time_fetcher self._refresh_lock = threading.Lock() self.method = method self._frozen_credentials = None def refresh_needed(self, refresh_in=None): if self._frozen_credentials is None: return True return super().refresh_needed(refresh_in) class CachedCredentialFetcher: DEFAULT_EXPIRY_WINDOW_SECONDS = 60 * 15 def __init__(self, cache=None, expiry_window_seconds=None): if cache is None: cache = {} self._cache = cache self._cache_key = self._create_cache_key() if expiry_window_seconds is None: expiry_window_seconds = self.DEFAULT_EXPIRY_WINDOW_SECONDS self._expiry_window_seconds = expiry_window_seconds def _create_cache_key(self): raise NotImplementedError('_create_cache_key()') def _make_file_safe(self, filename): # Replace :, path sep, and / to make it the string filename safe. filename = filename.replace(':', '_').replace(os.sep, '_') return filename.replace('/', '_') def _get_credentials(self): raise NotImplementedError('_get_credentials()') def fetch_credentials(self): return self._get_cached_credentials() def _get_cached_credentials(self): """Get up-to-date credentials. This will check the cache for up-to-date credentials, calling assume role if none are available. """ response = self._load_from_cache() if response is None: response = self._get_credentials() self._write_to_cache(response) else: logger.debug("Credentials for role retrieved from cache.") creds = response['Credentials'] expiration = _serialize_if_needed(creds['Expiration'], iso=True) credentials = { 'access_key': creds['AccessKeyId'], 'secret_key': creds['SecretAccessKey'], 'token': creds['SessionToken'], 'expiry_time': expiration, 'account_id': creds.get('AccountId'), } return credentials def _load_from_cache(self): if self._cache_key in self._cache: creds = deepcopy(self._cache[self._cache_key]) if not self._is_expired(creds): return creds else: logger.debug( "Credentials were found in cache, but they are expired." ) return None def _write_to_cache(self, response): self._cache[self._cache_key] = deepcopy(response) def _is_expired(self, credentials): """Check if credentials are expired.""" end_time = _parse_if_needed(credentials['Credentials']['Expiration']) seconds = total_seconds(end_time - _local_now()) return seconds < self._expiry_window_seconds class BaseAssumeRoleCredentialFetcher(CachedCredentialFetcher): def __init__( self, client_creator, role_arn, extra_args=None, cache=None, expiry_window_seconds=None, ): self._client_creator = client_creator self._role_arn = role_arn if extra_args is None: self._assume_kwargs = {} else: self._assume_kwargs = deepcopy(extra_args) self._assume_kwargs['RoleArn'] = self._role_arn self._role_session_name = self._assume_kwargs.get('RoleSessionName') self._using_default_session_name = False if not self._role_session_name: self._generate_assume_role_name() super().__init__(cache, expiry_window_seconds) def _generate_assume_role_name(self): self._role_session_name = f'botocore-session-{int(time.time())}' self._assume_kwargs['RoleSessionName'] = self._role_session_name self._using_default_session_name = True def _create_cache_key(self): """Create a predictable cache key for the current configuration. The cache key is intended to be compatible with file names. """ args = deepcopy(self._assume_kwargs) # The role session name gets randomly generated, so we don't want it # in the hash. if self._using_default_session_name: del args['RoleSessionName'] if 'Policy' in args: # To have a predictable hash, the keys of the policy must be # sorted, so we have to load it here to make sure it gets sorted # later on. args['Policy'] = json.loads(args['Policy']) args = json.dumps(args, sort_keys=True) argument_hash = sha1(args.encode('utf-8')).hexdigest() return self._make_file_safe(argument_hash) def _add_account_id_to_response(self, response): role_arn = response.get('AssumedRoleUser', {}).get('Arn') if ArnParser.is_arn(role_arn): arn_parser = ArnParser() account_id = arn_parser.parse_arn(role_arn)['account'] response['Credentials']['AccountId'] = account_id else: logger.debug(f"Unable to extract account ID from Arn: {role_arn}") class AssumeRoleCredentialFetcher(BaseAssumeRoleCredentialFetcher): def __init__( self, client_creator, source_credentials, role_arn, extra_args=None, mfa_prompter=None, cache=None, expiry_window_seconds=None, ): """ :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type source_credentials: Credentials :param source_credentials: The credentials to use to create the client for the call to AssumeRole. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type mfa_prompter: callable :param mfa_prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, """ self._source_credentials = source_credentials self._mfa_prompter = mfa_prompter if self._mfa_prompter is None: self._mfa_prompter = getpass.getpass super().__init__( client_creator, role_arn, extra_args=extra_args, cache=cache, expiry_window_seconds=expiry_window_seconds, ) def _get_credentials(self): """Get credentials by calling assume role.""" kwargs = self._assume_role_kwargs() client = self._create_client() response = client.assume_role(kwargs) self._add_account_id_to_response(response) return response def _assume_role_kwargs(self): """Get the arguments for assume role based on current configuration.""" assume_role_kwargs = deepcopy(self._assume_kwargs) mfa_serial = assume_role_kwargs.get('SerialNumber') if mfa_serial is not None: prompt = f'Enter MFA code for {mfa_serial}: ' token_code = self._mfa_prompter(prompt) assume_role_kwargs['TokenCode'] = token_code duration_seconds = assume_role_kwargs.get('DurationSeconds') if duration_seconds is not None: assume_role_kwargs['DurationSeconds'] = duration_seconds return assume_role_kwargs def _create_client(self): """Create an STS client using the source credentials.""" frozen_credentials = self._source_credentials.get_frozen_credentials() return self._client_creator( 'sts', aws_access_key_id=frozen_credentials.access_key, aws_secret_access_key=frozen_credentials.secret_key, aws_session_token=frozen_credentials.token, ) class AssumeRoleWithWebIdentityCredentialFetcher( BaseAssumeRoleCredentialFetcher ): def __init__( self, client_creator, web_identity_token_loader, role_arn, extra_args=None, cache=None, expiry_window_seconds=None, ): """ :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type web_identity_token_loader: callable :param web_identity_token_loader: A callable that takes no arguments and returns a web identity token str. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, """ self._web_identity_token_loader = web_identity_token_loader super().__init__( client_creator, role_arn, extra_args=extra_args, cache=cache, expiry_window_seconds=expiry_window_seconds, ) def _get_credentials(self): """Get credentials by calling assume role.""" kwargs = self._assume_role_kwargs() # Assume role with web identity does not require credentials other than # the token, explicitly configure the client to not sign requests. config = Config(signature_version=UNSIGNED) client = self._client_creator('sts', config=config) response = client.assume_role_with_web_identity(kwargs) self._add_account_id_to_response(response) return response def _assume_role_kwargs(self): """Get the arguments for assume role based on current configuration.""" assume_role_kwargs = deepcopy(self._assume_kwargs) identity_token = self._web_identity_token_loader() assume_role_kwargs['WebIdentityToken'] = identity_token return assume_role_kwargs class CredentialProvider: # A short name to identify the provider within botocore. METHOD = None # A name to identify the provider for use in cross-sdk features like # assume role's `credential_source` configuration option. These names # are to be treated in a case-insensitive way. NOTE: any providers not # implemented in botocore MUST prefix their canonical names with # 'custom' or we DO NOT guarantee that it will work with any features # that this provides. CANONICAL_NAME = None def __init__(self, session=None): self.session = session def load(self): """ Loads the credentials from their source & sets them on the object. Subclasses should implement this method (by reading from disk, the environment, the network or wherever), returning ``True`` if they were found & loaded. If not found, this method should return ``False``, indictating that the ``CredentialResolver`` should fall back to the next available method. The default implementation does nothing, assuming the user has set the ``access_key/secret_key/token`` themselves. :returns: Whether credentials were found & set :rtype: Credentials """ return True def _extract_creds_from_mapping(self, mapping, key_names): found = [] for key_name in key_names: try: found.append(mapping[key_name]) except KeyError: raise PartialCredentialsError( provider=self.METHOD, cred_var=key_name ) return found class ProcessProvider(CredentialProvider): METHOD = 'custom-process' def __init__(self, profile_name, load_config, popen=subprocess.Popen): self._profile_name = profile_name self._load_config = load_config self._loaded_config = None self._popen = popen def load(self): credential_process = self._credential_process if credential_process is None: return creds_dict = self._retrieve_credentials_using(credential_process) if creds_dict.get('expiry_time') is not None: return RefreshableCredentials.create_from_metadata( creds_dict, lambda: self._retrieve_credentials_using(credential_process), self.METHOD, ) return Credentials( access_key=creds_dict['access_key'], secret_key=creds_dict['secret_key'], token=creds_dict.get('token'), method=self.METHOD, account_id=creds_dict.get('account_id'), ) def _retrieve_credentials_using(self, credential_process): # We're not using shell=True, so we need to pass the # command and all arguments as a list. process_list = compat_shell_split(credential_process) p = self._popen( process_list, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) stdout, stderr = p.communicate() if p.returncode != 0: raise CredentialRetrievalError( provider=self.METHOD, error_msg=stderr.decode('utf-8') ) parsed = botocore.compat.json.loads(stdout.decode('utf-8')) version = parsed.get('Version', '<Version key not provided>') if version != 1: raise CredentialRetrievalError( provider=self.METHOD, error_msg=( f"Unsupported version '{version}' for credential process " f"provider, supported versions: 1" ), ) try: return { 'access_key': parsed['AccessKeyId'], 'secret_key': parsed['SecretAccessKey'], 'token': parsed.get('SessionToken'), 'expiry_time': parsed.get('Expiration'), 'account_id': self._get_account_id(parsed), } except KeyError as e: raise CredentialRetrievalError( provider=self.METHOD, error_msg=f"Missing required key in response: {e}", ) @property def _credential_process(self): return self.profile_config.get('credential_process') @property def profile_config(self): if self._loaded_config is None: self._loaded_config = self._load_config() profile_config = self._loaded_config.get('profiles', {}).get( self._profile_name, {} ) return profile_config def _get_account_id(self, parsed): account_id = parsed.get('AccountId') return account_id or self.profile_config.get('aws_account_id') class InstanceMetadataProvider(CredentialProvider): METHOD = 'iam-role' CANONICAL_NAME = 'Ec2InstanceMetadata' def __init__(self, iam_role_fetcher): self._role_fetcher = iam_role_fetcher def load(self): fetcher = self._role_fetcher # We do the first request, to see if we get useful data back. # If not, we'll pass & move on to whatever's next in the credential # chain. metadata = fetcher.retrieve_iam_role_credentials() if not metadata: return None logger.info( 'Found credentials from IAM Role: %s', metadata['role_name'] ) # We manually set the data here, since we already made the request & # have it. When the expiry is hit, the credentials will auto-refresh # themselves. creds = RefreshableCredentials.create_from_metadata( metadata, method=self.METHOD, refresh_using=fetcher.retrieve_iam_role_credentials, ) return creds class EnvProvider(CredentialProvider): METHOD = 'env' CANONICAL_NAME = 'Environment' ACCESS_KEY = 'AWS_ACCESS_KEY_ID' SECRET_KEY = 'AWS_SECRET_ACCESS_KEY' # The token can come from either of these env var. # AWS_SESSION_TOKEN is what other AWS SDKs have standardized on. TOKENS = ['AWS_SECURITY_TOKEN', 'AWS_SESSION_TOKEN'] EXPIRY_TIME = 'AWS_CREDENTIAL_EXPIRATION' ACCOUNT_ID = 'AWS_ACCOUNT_ID' def __init__(self, environ=None, mapping=None): """ :param environ: The environment variables (defaults to ``os.environ`` if no value is provided). :param mapping: An optional mapping of variable names to environment variable names. Use this if you want to change the mapping of access_key->AWS_ACCESS_KEY_ID, etc. The dict can have up to 5 keys: ``access_key`` * ``secret_key`` * ``token`` * ``expiry_time`` * ``account_id`` """ if environ is None: environ = os.environ self.environ = environ self._mapping = self._build_mapping(mapping) def _build_mapping(self, mapping): # Mapping of variable name to env var name. var_mapping = {} if mapping is None: # Use the class var default. var_mapping['access_key'] = self.ACCESS_KEY var_mapping['secret_key'] = self.SECRET_KEY var_mapping['token'] = self.TOKENS var_mapping['expiry_time'] = self.EXPIRY_TIME var_mapping['account_id'] = self.ACCOUNT_ID else: var_mapping['access_key'] = mapping.get( 'access_key', self.ACCESS_KEY ) var_mapping['secret_key'] = mapping.get( 'secret_key', self.SECRET_KEY ) var_mapping['token'] = mapping.get('token', self.TOKENS) if not isinstance(var_mapping['token'], list): var_mapping['token'] = [var_mapping['token']] var_mapping['expiry_time'] = mapping.get( 'expiry_time', self.EXPIRY_TIME ) var_mapping['account_id'] = mapping.get( 'account_id', self.ACCOUNT_ID ) return var_mapping def load(self): """ Search for credentials in explicit environment variables. """ access_key = self.environ.get(self._mapping['access_key'], '') if access_key: logger.info('Found credentials in environment variables.') fetcher = self._create_credentials_fetcher() credentials = fetcher(require_expiry=False) expiry_time = credentials['expiry_time'] if expiry_time is not None: expiry_time = parse(expiry_time) return RefreshableCredentials( credentials['access_key'], credentials['secret_key'], credentials['token'], expiry_time, refresh_using=fetcher, method=self.METHOD, account_id=credentials['account_id'], ) return Credentials( credentials['access_key'], credentials['secret_key'], credentials['token'], method=self.METHOD, account_id=credentials['account_id'], ) else: return None def _create_credentials_fetcher(self): mapping = self._mapping method = self.METHOD environ = self.environ def fetch_credentials(require_expiry=True): credentials = {} access_key = environ.get(mapping['access_key'], '') if not access_key: raise PartialCredentialsError( provider=method, cred_var=mapping['access_key'] ) credentials['access_key'] = access_key secret_key = environ.get(mapping['secret_key'], '') if not secret_key: raise PartialCredentialsError( provider=method, cred_var=mapping['secret_key'] ) credentials['secret_key'] = secret_key credentials['token'] = None for token_env_var in mapping['token']: token = environ.get(token_env_var, '') if token: credentials['token'] = token break credentials['expiry_time'] = None expiry_time = environ.get(mapping['expiry_time'], '') if expiry_time: credentials['expiry_time'] = expiry_time if require_expiry and not expiry_time: raise PartialCredentialsError( provider=method, cred_var=mapping['expiry_time'] ) credentials['account_id'] = None account_id = environ.get(mapping['account_id'], '') if account_id: credentials['account_id'] = account_id return credentials return fetch_credentials class OriginalEC2Provider(CredentialProvider): METHOD = 'ec2-credentials-file' CANONICAL_NAME = 'Ec2Config' CRED_FILE_ENV = 'AWS_CREDENTIAL_FILE' ACCESS_KEY = 'AWSAccessKeyId' SECRET_KEY = 'AWSSecretKey' def __init__(self, environ=None, parser=None): if environ is None: environ = os.environ if parser is None: parser = parse_key_val_file self._environ = environ self._parser = parser def load(self): """ Search for a credential file used by original EC2 CLI tools. """ if 'AWS_CREDENTIAL_FILE' in self._environ: full_path = os.path.expanduser( self._environ['AWS_CREDENTIAL_FILE'] ) creds = self._parser(full_path) if self.ACCESS_KEY in creds: logger.info('Found credentials in AWS_CREDENTIAL_FILE.') access_key = creds[self.ACCESS_KEY] secret_key = creds[self.SECRET_KEY] # EC2 creds file doesn't support session tokens. return Credentials(access_key, secret_key, method=self.METHOD) else: return None class SharedCredentialProvider(CredentialProvider): METHOD = 'shared-credentials-file' CANONICAL_NAME = 'SharedCredentials' ACCESS_KEY = 'aws_access_key_id' SECRET_KEY = 'aws_secret_access_key' # Same deal as the EnvProvider above. Botocore originally supported # aws_security_token, but the SDKs are standardizing on aws_session_token # so we support both. TOKENS = ['aws_security_token', 'aws_session_token'] ACCOUNT_ID = 'aws_account_id' def __init__(self, creds_filename, profile_name=None, ini_parser=None): self._creds_filename = creds_filename if profile_name is None: profile_name = 'default' self._profile_name = profile_name if ini_parser is None: ini_parser = botocore.configloader.raw_config_parse self._ini_parser = ini_parser def load(self): try: available_creds = self._ini_parser(self._creds_filename) except ConfigNotFound: return None if self._profile_name in available_creds: config = available_creds[self._profile_name] if self.ACCESS_KEY in config: logger.info( "Found credentials in shared credentials file: %s", self._creds_filename, ) access_key, secret_key = self._extract_creds_from_mapping( config, self.ACCESS_KEY, self.SECRET_KEY ) token = self._get_session_token(config) account_id = self._get_account_id(config) return Credentials( access_key, secret_key, token, method=self.METHOD, account_id=account_id, ) def _get_session_token(self, config): for token_envvar in self.TOKENS: if token_envvar in config: return config[token_envvar] def _get_account_id(self, config): return config.get(self.ACCOUNT_ID) class ConfigProvider(CredentialProvider): """INI based config provider with profile sections.""" METHOD = 'config-file' CANONICAL_NAME = 'SharedConfig' ACCESS_KEY = 'aws_access_key_id' SECRET_KEY = 'aws_secret_access_key' # Same deal as the EnvProvider above. Botocore originally supported # aws_security_token, but the SDKs are standardizing on aws_session_token # so we support both. TOKENS = ['aws_security_token', 'aws_session_token'] ACCOUNT_ID = 'aws_account_id' def __init__(self, config_filename, profile_name, config_parser=None): """ :param config_filename: The session configuration scoped to the current profile. This is available via ``session.config``. :param profile_name: The name of the current profile. :param config_parser: A config parser callable. """ self._config_filename = config_filename self._profile_name = profile_name if config_parser is None: config_parser = botocore.configloader.load_config self._config_parser = config_parser def load(self): """ If there is are credentials in the configuration associated with the session, use those. """ try: full_config = self._config_parser(self._config_filename) except ConfigNotFound: return None if self._profile_name in full_config['profiles']: profile_config = full_config['profiles'][self._profile_name] if self.ACCESS_KEY in profile_config: logger.info( "Credentials found in config file: %s", self._config_filename, ) access_key, secret_key = self._extract_creds_from_mapping( profile_config, self.ACCESS_KEY, self.SECRET_KEY ) token = self._get_session_token(profile_config) account_id = self._get_account_id(profile_config) return Credentials( access_key, secret_key, token, method=self.METHOD, account_id=account_id, ) else: return None def _get_session_token(self, profile_config): for token_name in self.TOKENS: if token_name in profile_config: return profile_config[token_name] def _get_account_id(self, config): return config.get(self.ACCOUNT_ID) class BotoProvider(CredentialProvider): METHOD = 'boto-config' CANONICAL_NAME = 'Boto2Config' BOTO_CONFIG_ENV = 'BOTO_CONFIG' DEFAULT_CONFIG_FILENAMES = ['/etc/boto.cfg', '~/.boto'] ACCESS_KEY = 'aws_access_key_id' SECRET_KEY = 'aws_secret_access_key' def __init__(self, environ=None, ini_parser=None): if environ is None: environ = os.environ if ini_parser is None: ini_parser = botocore.configloader.raw_config_parse self._environ = environ self._ini_parser = ini_parser def load(self): """ Look for credentials in boto config file. """ if self.BOTO_CONFIG_ENV in self._environ: potential_locations = [self._environ[self.BOTO_CONFIG_ENV]] else: potential_locations = self.DEFAULT_CONFIG_FILENAMES for filename in potential_locations: try: config = self._ini_parser(filename) except ConfigNotFound: # Move on to the next potential config file name. continue if 'Credentials' in config: credentials = config['Credentials'] if self.ACCESS_KEY in credentials: logger.info( "Found credentials in boto config file: %s", filename ) access_key, secret_key = self._extract_creds_from_mapping( credentials, self.ACCESS_KEY, self.SECRET_KEY ) return Credentials( access_key, secret_key, method=self.METHOD ) class AssumeRoleProvider(CredentialProvider): METHOD = 'assume-role' # The AssumeRole provider is logically part of the SharedConfig and # SharedCredentials providers. Since the purpose of the canonical name # is to provide cross-sdk compatibility, calling code will need to be # aware that either of those providers should be tied to the AssumeRole # provider as much as possible. CANONICAL_NAME = None ROLE_CONFIG_VAR = 'role_arn' WEB_IDENTITY_TOKE_FILE_VAR = 'web_identity_token_file' # Credentials are considered expired (and will be refreshed) once the total # remaining time left until the credentials expires is less than the # EXPIRY_WINDOW. EXPIRY_WINDOW_SECONDS = 60 * 15 def __init__( self, load_config, client_creator, cache, profile_name, prompter=getpass.getpass, credential_sourcer=None, profile_provider_builder=None, ): """ :type load_config: callable :param load_config: A function that accepts no arguments, and when called, will return the full configuration dictionary for the session (``session.full_config``). :type client_creator: callable :param client_creator: A factory function that will create a client when called. Has the same interface as ``botocore.session.Session.create_client``. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in the CLI. :type profile_name: str :param profile_name: The name of the profile. :type prompter: callable :param prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type credential_sourcer: CanonicalNameCredentialSourcer :param credential_sourcer: A credential provider that takes a configuration, which is used to provide the source credentials for the STS call. """ #: The cache used to first check for assumed credentials. #: This is checked before making the AssumeRole API #: calls and can be useful if you have short lived #: scripts and you'd like to avoid calling AssumeRole #: until the credentials are expired. self.cache = cache self._load_config = load_config # client_creator is a callable that creates function. # It's basically session.create_client self._client_creator = client_creator self._profile_name = profile_name self._prompter = prompter # The _loaded_config attribute will be populated from the # load_config() function once the configuration is actually # loaded. The reason we go through all this instead of just # requiring that the loaded_config be passed to us is to that # we can defer configuration loaded until we actually try # to load credentials (as opposed to when the object is # instantiated). self._loaded_config = {} self._credential_sourcer = credential_sourcer self._profile_provider_builder = profile_provider_builder self._visited_profiles = [self._profile_name] def load(self): self._loaded_config = self._load_config() profiles = self._loaded_config.get('profiles', {}) profile = profiles.get(self._profile_name, {}) if self._has_assume_role_config_vars(profile): return self._load_creds_via_assume_role(self._profile_name) def _has_assume_role_config_vars(self, profile): return ( self.ROLE_CONFIG_VAR in profile and # We need to ensure this provider doesn't look at a profile when # the profile has configuration for web identity. Simply relying on # the order in the credential chain is insufficient as it doesn't # prevent the case when we're doing an assume role chain. self.WEB_IDENTITY_TOKE_FILE_VAR not in profile ) def _load_creds_via_assume_role(self, profile_name): role_config = self._get_role_config(profile_name) source_credentials = self._resolve_source_credentials( role_config, profile_name ) extra_args = {} role_session_name = role_config.get('role_session_name') if role_session_name is not None: extra_args['RoleSessionName'] = role_session_name external_id = role_config.get('external_id') if external_id is not None: extra_args['ExternalId'] = external_id mfa_serial = role_config.get('mfa_serial') if mfa_serial is not None: extra_args['SerialNumber'] = mfa_serial duration_seconds = role_config.get('duration_seconds') if duration_seconds is not None: extra_args['DurationSeconds'] = duration_seconds fetcher = AssumeRoleCredentialFetcher( client_creator=self._client_creator, source_credentials=source_credentials, role_arn=role_config['role_arn'], extra_args=extra_args, mfa_prompter=self._prompter, cache=self.cache, ) refresher = fetcher.fetch_credentials if mfa_serial is not None: refresher = create_mfa_serial_refresher(refresher) # The initial credentials are empty and the expiration time is set # to now so that we can delay the call to assume role until it is # strictly needed. return DeferredRefreshableCredentials( method=self.METHOD, refresh_using=refresher, time_fetcher=_local_now, ) def _get_role_config(self, profile_name): """Retrieves and validates the role configuration for the profile.""" profiles = self._loaded_config.get('profiles', {}) profile = profiles[profile_name] source_profile = profile.get('source_profile') role_arn = profile['role_arn'] credential_source = profile.get('credential_source') mfa_serial = profile.get('mfa_serial') external_id = profile.get('external_id') role_session_name = profile.get('role_session_name') duration_seconds = profile.get('duration_seconds') role_config = { 'role_arn': role_arn, 'external_id': external_id, 'mfa_serial': mfa_serial, 'role_session_name': role_session_name, 'source_profile': source_profile, 'credential_source': credential_source, } if duration_seconds is not None: try: role_config['duration_seconds'] = int(duration_seconds) except ValueError: pass # Either the credential source or the source profile must be # specified, but not both. if credential_source is not None and source_profile is not None: raise InvalidConfigError( error_msg=( f'The profile "{profile_name}" contains both ' 'source_profile and credential_source.' ) ) elif credential_source is None and source_profile is None: raise PartialCredentialsError( provider=self.METHOD, cred_var='source_profile or credential_source', ) elif credential_source is not None: self._validate_credential_source(profile_name, credential_source) else: self._validate_source_profile(profile_name, source_profile) return role_config def _validate_credential_source(self, parent_profile, credential_source): if self._credential_sourcer is None: raise InvalidConfigError( error_msg=( f"The credential_source \"{credential_source}\" is specified " f"in profile \"{parent_profile}\", " f"but no source provider was configured." ) ) if not self._credential_sourcer.is_supported(credential_source): raise InvalidConfigError( error_msg=( f"The credential source \"{credential_source}\" referenced " f"in profile \"{parent_profile}\" is not valid." ) ) def _source_profile_has_credentials(self, profile): return any( [ self._has_static_credentials(profile), self._has_assume_role_config_vars(profile), ] ) def _validate_source_profile( self, parent_profile_name, source_profile_name ): profiles = self._loaded_config.get('profiles', {}) if source_profile_name not in profiles: raise InvalidConfigError( error_msg=( f"The source_profile \"{source_profile_name}\" referenced in " f"the profile \"{parent_profile_name}\" does not exist." ) ) source_profile = profiles[source_profile_name] # Make sure we aren't going into an infinite loop. If we haven't # visited the profile yet, we're good. if source_profile_name not in self._visited_profiles: return # If we have visited the profile and the profile isn't simply # referencing itself, that's an infinite loop. if source_profile_name != parent_profile_name: raise InfiniteLoopConfigError( source_profile=source_profile_name, visited_profiles=self._visited_profiles, ) # A profile is allowed to reference itself so that it can source # static credentials and have configuration all in the same # profile. This will only ever work for the top level assume # role because the static credentials will otherwise take # precedence. if not self._has_static_credentials(source_profile): raise InfiniteLoopConfigError( source_profile=source_profile_name, visited_profiles=self._visited_profiles, ) def _has_static_credentials(self, profile): static_keys = ['aws_secret_access_key', 'aws_access_key_id'] return any(static_key in profile for static_key in static_keys) def _resolve_source_credentials(self, role_config, profile_name): credential_source = role_config.get('credential_source') if credential_source is not None: return self._resolve_credentials_from_source( credential_source, profile_name ) source_profile = role_config['source_profile'] self._visited_profiles.append(source_profile) return self._resolve_credentials_from_profile(source_profile) def _resolve_credentials_from_profile(self, profile_name): profiles = self._loaded_config.get('profiles', {}) profile = profiles[profile_name] if ( self._has_static_credentials(profile) and not self._profile_provider_builder ): # This is only here for backwards compatibility. If this provider # isn't given a profile provider builder we still want to be able # to handle the basic static credential case as we would before the # profile provider builder parameter was added. return self._resolve_static_credentials_from_profile(profile) elif self._has_static_credentials( profile ) or not self._has_assume_role_config_vars(profile): profile_providers = self._profile_provider_builder.providers( profile_name=profile_name, disable_env_vars=True, ) profile_chain = CredentialResolver(profile_providers) credentials = profile_chain.load_credentials() if credentials is None: error_message = ( 'The source profile "%s" must have credentials.' ) raise InvalidConfigError( error_msg=error_message % profile_name, ) return credentials return self._load_creds_via_assume_role(profile_name) def _resolve_static_credentials_from_profile(self, profile): try: return Credentials( access_key=profile['aws_access_key_id'], secret_key=profile['aws_secret_access_key'], token=profile.get('aws_session_token'), ) except KeyError as e: raise PartialCredentialsError( provider=self.METHOD, cred_var=str(e) ) def _resolve_credentials_from_source( self, credential_source, profile_name ): credentials = self._credential_sourcer.source_credentials( credential_source ) if credentials is None: raise CredentialRetrievalError( provider=credential_source, error_msg=( 'No credentials found in credential_source referenced ' f'in profile {profile_name}' ), ) return credentials class AssumeRoleWithWebIdentityProvider(CredentialProvider): METHOD = 'assume-role-with-web-identity' CANONICAL_NAME = None _CONFIG_TO_ENV_VAR = { 'web_identity_token_file': 'AWS_WEB_IDENTITY_TOKEN_FILE', 'role_session_name': 'AWS_ROLE_SESSION_NAME', 'role_arn': 'AWS_ROLE_ARN', } def __init__( self, load_config, client_creator, profile_name, cache=None, disable_env_vars=False, token_loader_cls=None, ): self.cache = cache self._load_config = load_config self._client_creator = client_creator self._profile_name = profile_name self._profile_config = None self._disable_env_vars = disable_env_vars if token_loader_cls is None: token_loader_cls = FileWebIdentityTokenLoader self._token_loader_cls = token_loader_cls def load(self): return self._assume_role_with_web_identity() def _get_profile_config(self, key): if self._profile_config is None: loaded_config = self._load_config() profiles = loaded_config.get('profiles', {}) self._profile_config = profiles.get(self._profile_name, {}) return self._profile_config.get(key) def _get_env_config(self, key): if self._disable_env_vars: return None env_key = self._CONFIG_TO_ENV_VAR.get(key) if env_key and env_key in os.environ: return os.environ[env_key] return None def _get_config(self, key): env_value = self._get_env_config(key) if env_value is not None: return env_value return self._get_profile_config(key) def _assume_role_with_web_identity(self): token_path = self._get_config('web_identity_token_file') if not token_path: return None token_loader = self._token_loader_cls(token_path) role_arn = self._get_config('role_arn') if not role_arn: error_msg = ( 'The provided profile or the current environment is ' 'configured to assume role with web identity but has no ' 'role ARN configured. Ensure that the profile has the role_arn' 'configuration set or the AWS_ROLE_ARN env var is set.' ) raise InvalidConfigError(error_msg=error_msg) extra_args = {} role_session_name = self._get_config('role_session_name') if role_session_name is not None: extra_args['RoleSessionName'] = role_session_name fetcher = AssumeRoleWithWebIdentityCredentialFetcher( client_creator=self._client_creator, web_identity_token_loader=token_loader, role_arn=role_arn, extra_args=extra_args, cache=self.cache, ) # The initial credentials are empty and the expiration time is set # to now so that we can delay the call to assume role until it is # strictly needed. return DeferredRefreshableCredentials( method=self.METHOD, refresh_using=fetcher.fetch_credentials, ) class CanonicalNameCredentialSourcer: def __init__(self, providers): self._providers = providers def is_supported(self, source_name): """Validates a given source name. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: bool :returns: True if the credential provider is supported, False otherwise. """ return source_name in [p.CANONICAL_NAME for p in self._providers] def source_credentials(self, source_name): """Loads source credentials based on the provided configuration. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: Credentials """ source = self._get_provider(source_name) if isinstance(source, CredentialResolver): return source.load_credentials() return source.load() def _get_provider(self, canonical_name): """Return a credential provider by its canonical name. :type canonical_name: str :param canonical_name: The canonical name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. """ provider = self._get_provider_by_canonical_name(canonical_name) # The AssumeRole provider should really be part of the SharedConfig # provider rather than being its own thing, but it is not. It is # effectively part of both the SharedConfig provider and the # SharedCredentials provider now due to the way it behaves. # Therefore if we want either of those providers we should return # the AssumeRole provider with it. if canonical_name.lower() in ['sharedconfig', 'sharedcredentials']: assume_role_provider = self._get_provider_by_method('assume-role') if assume_role_provider is not None: # The SharedConfig or SharedCredentials provider may not be # present if it was removed for some reason, but the # AssumeRole provider could still be present. In that case, # return the assume role provider by itself. if provider is None: return assume_role_provider # If both are present, return them both as a # CredentialResolver so that calling code can treat them as # a single entity. return CredentialResolver([assume_role_provider, provider]) if provider is None: raise UnknownCredentialError(name=canonical_name) return provider def _get_provider_by_canonical_name(self, canonical_name): """Return a credential provider by its canonical name. This function is strict, it does not attempt to address compatibility issues. """ for provider in self._providers: name = provider.CANONICAL_NAME # Canonical names are case-insensitive if name and name.lower() == canonical_name.lower(): return provider def _get_provider_by_method(self, method): """Return a credential provider by its METHOD name.""" for provider in self._providers: if provider.METHOD == method: return provider class ContainerProvider(CredentialProvider): METHOD = 'container-role' CANONICAL_NAME = 'EcsContainer' ENV_VAR = 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' ENV_VAR_FULL = 'AWS_CONTAINER_CREDENTIALS_FULL_URI' ENV_VAR_AUTH_TOKEN = 'AWS_CONTAINER_AUTHORIZATION_TOKEN' ENV_VAR_AUTH_TOKEN_FILE = 'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE' def __init__(self, environ=None, fetcher=None): if environ is None: environ = os.environ if fetcher is None: fetcher = ContainerMetadataFetcher() self._environ = environ self._fetcher = fetcher def load(self): # This cred provider is only triggered if the self.ENV_VAR is set, # which only happens if you opt into this feature. if self.ENV_VAR in self._environ or self.ENV_VAR_FULL in self._environ: return self._retrieve_or_fail() def _retrieve_or_fail(self): if self._provided_relative_uri(): full_uri = self._fetcher.full_url(self._environ[self.ENV_VAR]) else: full_uri = self._environ[self.ENV_VAR_FULL] fetcher = self._create_fetcher(full_uri) creds = fetcher() return RefreshableCredentials( access_key=creds['access_key'], secret_key=creds['secret_key'], token=creds['token'], method=self.METHOD, expiry_time=_parse_if_needed(creds['expiry_time']), refresh_using=fetcher, account_id=creds.get('account_id'), ) def _build_headers(self): auth_token = None if self.ENV_VAR_AUTH_TOKEN_FILE in self._environ: auth_token_file_path = self._environ[self.ENV_VAR_AUTH_TOKEN_FILE] with open(auth_token_file_path) as token_file: auth_token = token_file.read() elif self.ENV_VAR_AUTH_TOKEN in self._environ: auth_token = self._environ[self.ENV_VAR_AUTH_TOKEN] if auth_token is not None: self._validate_auth_token(auth_token) return {'Authorization': auth_token} def _validate_auth_token(self, auth_token): if "\r" in auth_token or "\n" in auth_token: raise ValueError("Auth token value is not a legal header value") def _create_fetcher(self, full_uri, args, kwargs): def fetch_creds(): try: headers = self._build_headers() response = self._fetcher.retrieve_full_uri( full_uri, headers=headers ) except MetadataRetrievalError as e: logger.debug( "Error retrieving container metadata: %s", e, exc_info=True ) raise CredentialRetrievalError( provider=self.METHOD, error_msg=str(e) ) return { 'access_key': response['AccessKeyId'], 'secret_key': response['SecretAccessKey'], 'token': response['Token'], 'expiry_time': response['Expiration'], 'account_id': response.get('AccountId'), } return fetch_creds def _provided_relative_uri(self): return self.ENV_VAR in self._environ class CredentialResolver: def __init__(self, providers): """ :param providers: A list of ``CredentialProvider`` instances. """ self.providers = providers def insert_before(self, name, credential_provider): """ Inserts a new instance of ``CredentialProvider`` into the chain that will be tried before an existing one. :param name: The short name of the credentials you'd like to insert the new credentials before. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` """ try: offset = [p.METHOD for p in self.providers].index(name) except ValueError: raise UnknownCredentialError(name=name) self.providers.insert(offset, credential_provider) def insert_after(self, name, credential_provider): """ Inserts a new type of ``Credentials`` instance into the chain that will be tried after an existing one. :param name: The short name of the credentials you'd like to insert the new credentials after. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` """ offset = self._get_provider_offset(name) self.providers.insert(offset + 1, credential_provider) def remove(self, name): """ Removes a given ``Credentials`` instance from the chain. :param name: The short name of the credentials instance to remove. :type name: string """ available_methods = [p.METHOD for p in self.providers] if name not in available_methods: # It's not present. Fail silently. return offset = available_methods.index(name) self.providers.pop(offset) def get_provider(self, name): """Return a credential provider by name. :type name: str :param name: The name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. """ return self.providers[self._get_provider_offset(name)] def _get_provider_offset(self, name): try: return [p.METHOD for p in self.providers].index(name) except ValueError: raise UnknownCredentialError(name=name) def load_credentials(self): """ Goes through the credentials chain, returning the first ``Credentials`` that could be loaded. """ # First provider to return a non-None response wins. for provider in self.providers: logger.debug("Looking for credentials via: %s", provider.METHOD) creds = provider.load() if creds is not None: return creds # If we got here, no credentials could be found. # This feels like it should be an exception, but historically, ``None`` # is returned. # # +1 # -js return None class SSOCredentialFetcher(CachedCredentialFetcher): _UTC_DATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ' def __init__( self, start_url, sso_region, role_name, account_id, client_creator, token_loader=None, cache=None, expiry_window_seconds=None, token_provider=None, sso_session_name=None, ): self._client_creator = client_creator self._sso_region = sso_region self._role_name = role_name self._account_id = account_id self._start_url = start_url self._token_loader = token_loader self._token_provider = token_provider self._sso_session_name = sso_session_name super().__init__(cache, expiry_window_seconds) def _create_cache_key(self): """Create a predictable cache key for the current configuration. The cache key is intended to be compatible with file names. """ args = { 'roleName': self._role_name, 'accountId': self._account_id, } if self._sso_session_name: args['sessionName'] = self._sso_session_name else: args['startUrl'] = self._start_url # NOTE: It would be good to hoist this cache key construction logic # into the CachedCredentialFetcher class as we should be consistent. # Unfortunately, the current assume role fetchers that sub class don't # pass separators resulting in non-minified JSON. In the long term, # all fetchers should use the below caching scheme. args = json.dumps(args, sort_keys=True, separators=(',', ':')) argument_hash = sha1(args.encode('utf-8')).hexdigest() return self._make_file_safe(argument_hash) def _parse_timestamp(self, timestamp_ms): # fromtimestamp expects seconds so: milliseconds / 1000 = seconds timestamp_seconds = timestamp_ms / 1000.0 timestamp = datetime.datetime.fromtimestamp(timestamp_seconds, tzutc()) return timestamp.strftime(self._UTC_DATE_FORMAT) def _get_credentials(self): """Get credentials by calling SSO get role credentials.""" config = Config( signature_version=UNSIGNED, region_name=self._sso_region, ) client = self._client_creator('sso', config=config) if self._token_provider: initial_token_data = self._token_provider.load_token() token = initial_token_data.get_frozen_token().token else: token = self._token_loader(self._start_url)['accessToken'] kwargs = { 'roleName': self._role_name, 'accountId': self._account_id, 'accessToken': token, } try: response = client.get_role_credentials(kwargs) except client.exceptions.UnauthorizedException: raise UnauthorizedSSOTokenError() credentials = response['roleCredentials'] credentials = { 'ProviderType': 'sso', 'Credentials': { 'AccessKeyId': credentials['accessKeyId'], 'SecretAccessKey': credentials['secretAccessKey'], 'SessionToken': credentials['sessionToken'], 'Expiration': self._parse_timestamp(credentials['expiration']), 'AccountId': self._account_id, }, } return credentials class SSOProvider(CredentialProvider): METHOD = 'sso' _SSO_TOKEN_CACHE_DIR = os.path.expanduser( os.path.join('~', '.aws', 'sso', 'cache') ) _PROFILE_REQUIRED_CONFIG_VARS = ( 'sso_role_name', 'sso_account_id', ) _SSO_REQUIRED_CONFIG_VARS = ( 'sso_start_url', 'sso_region', ) _ALL_REQUIRED_CONFIG_VARS = ( _PROFILE_REQUIRED_CONFIG_VARS + _SSO_REQUIRED_CONFIG_VARS ) def __init__( self, load_config, client_creator, profile_name, cache=None, token_cache=None, token_provider=None, ): if token_cache is None: token_cache = JSONFileCache(self._SSO_TOKEN_CACHE_DIR) self._token_cache = token_cache self._token_provider = token_provider if cache is None: cache = {} self.cache = cache self._load_config = load_config self._client_creator = client_creator self._profile_name = profile_name def _load_sso_config(self): loaded_config = self._load_config() profiles = loaded_config.get('profiles', {}) profile_name = self._profile_name profile_config = profiles.get(self._profile_name, {}) sso_sessions = loaded_config.get('sso_sessions', {}) # Role name & Account ID indicate the cred provider should be used if all( c not in profile_config for c in self._PROFILE_REQUIRED_CONFIG_VARS ): return None resolved_config, extra_reqs = self._resolve_sso_session_reference( profile_config, sso_sessions ) config = {} missing_config_vars = [] all_required_configs = self._ALL_REQUIRED_CONFIG_VARS + extra_reqs for config_var in all_required_configs: if config_var in resolved_config: config[config_var] = resolved_config[config_var] else: missing_config_vars.append(config_var) if missing_config_vars: missing = ', '.join(missing_config_vars) raise InvalidConfigError( error_msg=( f'The profile "{profile_name}" is configured to use SSO ' f'but is missing required configuration: {missing}' ) ) return config def _resolve_sso_session_reference(self, profile_config, sso_sessions): sso_session_name = profile_config.get('sso_session') if sso_session_name is None: # No reference to resolve, proceed with legacy flow return profile_config, () if sso_session_name not in sso_sessions: error_msg = f'The specified sso-session does not exist: "{sso_session_name}"' raise InvalidConfigError(error_msg=error_msg) config = profile_config.copy() session = sso_sessions[sso_session_name] for config_var, val in session.items(): # Validate any keys referenced in both profile and sso_session match if config.get(config_var, val) != val: error_msg = ( f"The value for {config_var} is inconsistent between " f"profile ({config[config_var]}) and sso-session ({val})." ) raise InvalidConfigError(error_msg=error_msg) config[config_var] = val return config, ('sso_session',) def load(self): sso_config = self._load_sso_config() if not sso_config: return None fetcher_kwargs = { 'start_url': sso_config['sso_start_url'], 'sso_region': sso_config['sso_region'], 'role_name': sso_config['sso_role_name'], 'account_id': sso_config['sso_account_id'], 'client_creator': self._client_creator, 'token_loader': SSOTokenLoader(cache=self._token_cache), 'cache': self.cache, } if 'sso_session' in sso_config: fetcher_kwargs['sso_session_name'] = sso_config['sso_session'] fetcher_kwargs['token_provider'] = self._token_provider sso_fetcher = SSOCredentialFetcher(*fetcher_kwargs) return DeferredRefreshableCredentials( method=self.METHOD, refresh_using=sso_fetcher.fetch_credentials, )	86.04 KB	2025-05-25 12:26
📁 crt	-	2025-05-25 12:26
📁 data	-	2025-05-25 12:26
📄 discovery.py # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import logging import time import weakref from botocore import xform_name from botocore.exceptions import BotoCoreError, ConnectionError, HTTPClientError from botocore.model import OperationNotFoundError from botocore.utils import CachedProperty logger = logging.getLogger(__name__) class EndpointDiscoveryException(BotoCoreError): pass class EndpointDiscoveryRequired(EndpointDiscoveryException): """Endpoint Discovery is disabled but is required for this operation.""" fmt = 'Endpoint Discovery is not enabled but this operation requires it.' class EndpointDiscoveryRefreshFailed(EndpointDiscoveryException): """Endpoint Discovery failed to the refresh the known endpoints.""" fmt = 'Endpoint Discovery failed to refresh the required endpoints.' def block_endpoint_discovery_required_operations(model, kwargs): endpoint_discovery = model.endpoint_discovery if endpoint_discovery and endpoint_discovery.get('required'): raise EndpointDiscoveryRequired() class EndpointDiscoveryModel: def __init__(self, service_model): self._service_model = service_model @CachedProperty def discovery_operation_name(self): discovery_operation = self._service_model.endpoint_discovery_operation return xform_name(discovery_operation.name) @CachedProperty def discovery_operation_keys(self): discovery_operation = self._service_model.endpoint_discovery_operation keys = [] if discovery_operation.input_shape: keys = list(discovery_operation.input_shape.members.keys()) return keys def discovery_required_for(self, operation_name): try: operation_model = self._service_model.operation_model( operation_name ) return operation_model.endpoint_discovery.get('required', False) except OperationNotFoundError: return False def discovery_operation_kwargs(self, kwargs): input_keys = self.discovery_operation_keys # Operation and Identifiers are only sent if there are Identifiers if not kwargs.get('Identifiers'): kwargs.pop('Operation', None) kwargs.pop('Identifiers', None) return {k: v for k, v in kwargs.items() if k in input_keys} def gather_identifiers(self, operation, params): return self._gather_ids(operation.input_shape, params) def _gather_ids(self, shape, params, ids=None): # Traverse the input shape and corresponding parameters, gathering # any input fields labeled as an endpoint discovery id if ids is None: ids = {} for member_name, member_shape in shape.members.items(): if member_shape.metadata.get('endpointdiscoveryid'): ids[member_name] = params[member_name] elif ( member_shape.type_name == 'structure' and member_name in params ): self._gather_ids(member_shape, params[member_name], ids) return ids class EndpointDiscoveryManager: def __init__( self, client, cache=None, current_time=None, always_discover=True ): if cache is None: cache = {} self._cache = cache self._failed_attempts = {} if current_time is None: current_time = time.time self._time = current_time self._always_discover = always_discover # This needs to be a weak ref in order to prevent memory leaks on # python 2.6 self._client = weakref.proxy(client) self._model = EndpointDiscoveryModel(client.meta.service_model) def _parse_endpoints(self, response): endpoints = response['Endpoints'] current_time = self._time() for endpoint in endpoints: cache_time = endpoint.get('CachePeriodInMinutes') endpoint['Expiration'] = current_time + cache_time * 60 return endpoints def _cache_item(self, value): if isinstance(value, dict): return tuple(sorted(value.items())) else: return value def _create_cache_key(self, kwargs): kwargs = self._model.discovery_operation_kwargs(kwargs) return tuple(self._cache_item(v) for k, v in sorted(kwargs.items())) def gather_identifiers(self, operation, params): return self._model.gather_identifiers(operation, params) def delete_endpoints(self, kwargs): cache_key = self._create_cache_key(kwargs) if cache_key in self._cache: del self._cache[cache_key] def _describe_endpoints(self, kwargs): # This is effectively a proxy to whatever name/kwargs the service # supports for endpoint discovery. kwargs = self._model.discovery_operation_kwargs(kwargs) operation_name = self._model.discovery_operation_name discovery_operation = getattr(self._client, operation_name) logger.debug('Discovering endpoints with kwargs: %s', kwargs) return discovery_operation(kwargs) def _get_current_endpoints(self, key): if key not in self._cache: return None now = self._time() return [e for e in self._cache[key] if now < e['Expiration']] def _refresh_current_endpoints(self, kwargs): cache_key = self._create_cache_key(kwargs) try: response = self._describe_endpoints(kwargs) endpoints = self._parse_endpoints(response) self._cache[cache_key] = endpoints self._failed_attempts.pop(cache_key, None) return endpoints except (ConnectionError, HTTPClientError): self._failed_attempts[cache_key] = self._time() + 60 return None def _recently_failed(self, cache_key): if cache_key in self._failed_attempts: now = self._time() if now < self._failed_attempts[cache_key]: return True del self._failed_attempts[cache_key] return False def _select_endpoint(self, endpoints): return endpoints[0]['Address'] def describe_endpoint(self, kwargs): operation = kwargs['Operation'] discovery_required = self._model.discovery_required_for(operation) if not self._always_discover and not discovery_required: # Discovery set to only run on required operations logger.debug( f'Optional discovery disabled. Skipping discovery for Operation: {operation}' ) return None # Get the endpoint for the provided operation and identifiers cache_key = self._create_cache_key(kwargs) endpoints = self._get_current_endpoints(cache_key) if endpoints: return self._select_endpoint(endpoints) # All known endpoints are stale recently_failed = self._recently_failed(cache_key) if not recently_failed: # We haven't failed to discover recently, go ahead and refresh endpoints = self._refresh_current_endpoints(kwargs) if endpoints: return self._select_endpoint(endpoints) # Discovery has failed recently, do our best to get an endpoint logger.debug('Endpoint Discovery has failed for: %s', kwargs) stale_entries = self._cache.get(cache_key, None) if stale_entries: # We have stale entries, use those while discovery is failing return self._select_endpoint(stale_entries) if discovery_required: # It looks strange to be checking recently_failed again but, # this informs us as to whether or not we tried to refresh earlier if recently_failed: # Discovery is required and we haven't already refreshed endpoints = self._refresh_current_endpoints(kwargs) if endpoints: return self._select_endpoint(endpoints) # No endpoints even refresh, raise hard error raise EndpointDiscoveryRefreshFailed() # Discovery is optional, just use the default endpoint for now return None class EndpointDiscoveryHandler: def __init__(self, manager): self._manager = manager def register(self, events, service_id): events.register( f'before-parameter-build.{service_id}', self.gather_identifiers ) events.register_first( f'request-created.{service_id}', self.discover_endpoint ) events.register(f'needs-retry.{service_id}', self.handle_retries) def gather_identifiers(self, params, model, context, kwargs): endpoint_discovery = model.endpoint_discovery # Only continue if the operation supports endpoint discovery if endpoint_discovery is None: return ids = self._manager.gather_identifiers(model, params) context['discovery'] = {'identifiers': ids} def discover_endpoint(self, request, operation_name, kwargs): ids = request.context.get('discovery', {}).get('identifiers') if ids is None: return endpoint = self._manager.describe_endpoint( Operation=operation_name, Identifiers=ids ) if endpoint is None: logger.debug('Failed to discover and inject endpoint') return if not endpoint.startswith('http'): endpoint = 'https://' + endpoint logger.debug('Injecting discovered endpoint: %s', endpoint) request.url = endpoint def handle_retries(self, request_dict, response, operation, **kwargs): if response is None: return None _, response = response status = response.get('ResponseMetadata', {}).get('HTTPStatusCode') error_code = response.get('Error', {}).get('Code') if status != 421 and error_code != 'InvalidEndpointException': return None context = request_dict.get('context', {}) ids = context.get('discovery', {}).get('identifiers') if ids is None: return None # Delete the cached endpoints, forcing a refresh on retry # TODO: Improve eviction behavior to only evict the bad endpoint if # there are multiple. This will almost certainly require a lock. self._manager.delete_endpoints( Operation=operation.name, Identifiers=ids ) return 0	10.79 KB	2025-05-25 12:26
📁 docs	-	2025-05-25 12:26
📄 endpoint.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import datetime import logging import os import threading import time import uuid from botocore import parsers from botocore.awsrequest import create_request_object from botocore.exceptions import HTTPClientError from botocore.history import get_global_history_recorder from botocore.hooks import first_non_none_response from botocore.httpchecksum import handle_checksum_body from botocore.httpsession import URLLib3Session from botocore.response import StreamingBody from botocore.utils import ( get_environ_proxies, is_valid_endpoint_url, is_valid_ipv6_endpoint_url, ) logger = logging.getLogger(__name__) history_recorder = get_global_history_recorder() DEFAULT_TIMEOUT = 60 MAX_POOL_CONNECTIONS = 10 def convert_to_response_dict(http_response, operation_model): """Convert an HTTP response object to a request dict. This converts the requests library's HTTP response object to a dictionary. :type http_response: botocore.vendored.requests.model.Response :param http_response: The HTTP response from an AWS service request. :rtype: dict :return: A response dictionary which will contain the following keys: * headers (dict) * status_code (int) * body (string or file-like object) """ response_dict = { 'headers': http_response.headers, 'status_code': http_response.status_code, 'context': { 'operation_name': operation_model.name, }, } if response_dict['status_code'] >= 300: response_dict['body'] = http_response.content elif operation_model.has_event_stream_output: response_dict['body'] = http_response.raw elif operation_model.has_streaming_output: length = response_dict['headers'].get('content-length') response_dict['body'] = StreamingBody(http_response.raw, length) else: response_dict['body'] = http_response.content return response_dict class Endpoint: """ Represents an endpoint for a particular service in a specific region. Only an endpoint can make requests. :ivar service: The Service object that describes this endpoints service. :ivar host: The fully qualified endpoint hostname. :ivar session: The session object. """ def __init__( self, host, endpoint_prefix, event_emitter, response_parser_factory=None, http_session=None, ): self._endpoint_prefix = endpoint_prefix self._event_emitter = event_emitter self.host = host self._lock = threading.Lock() if response_parser_factory is None: response_parser_factory = parsers.ResponseParserFactory() self._response_parser_factory = response_parser_factory self.http_session = http_session if self.http_session is None: self.http_session = URLLib3Session() def __repr__(self): return f'{self._endpoint_prefix}({self.host})' def close(self): self.http_session.close() def make_request(self, operation_model, request_dict): logger.debug( "Making request for %s with params: %s", operation_model, request_dict, ) return self._send_request(request_dict, operation_model) def create_request(self, params, operation_model=None): request = create_request_object(params) if operation_model: request.stream_output = any( [ operation_model.has_streaming_output, operation_model.has_event_stream_output, ] ) service_id = operation_model.service_model.service_id.hyphenize() event_name = f'request-created.{service_id}.{operation_model.name}' self._event_emitter.emit( event_name, request=request, operation_name=operation_model.name, ) prepared_request = self.prepare_request(request) return prepared_request def _encode_headers(self, headers): # In place encoding of headers to utf-8 if they are unicode. for key, value in headers.items(): if isinstance(value, str): headers[key] = value.encode('utf-8') def prepare_request(self, request): self._encode_headers(request.headers) return request.prepare() def _calculate_ttl( self, response_received_timestamp, date_header, read_timeout ): local_timestamp = datetime.datetime.utcnow() date_conversion = datetime.datetime.strptime( date_header, "%a, %d %b %Y %H:%M:%S %Z" ) estimated_skew = date_conversion - response_received_timestamp ttl = ( local_timestamp + datetime.timedelta(seconds=read_timeout) + estimated_skew ) return ttl.strftime('%Y%m%dT%H%M%SZ') def _set_ttl(self, retries_context, read_timeout, success_response): response_date_header = success_response[0].headers.get('Date') has_streaming_input = retries_context.get('has_streaming_input') if response_date_header and not has_streaming_input: try: response_received_timestamp = datetime.datetime.utcnow() retries_context['ttl'] = self._calculate_ttl( response_received_timestamp, response_date_header, read_timeout, ) except Exception: logger.debug( "Exception received when updating retries context with TTL", exc_info=True, ) def _update_retries_context(self, context, attempt, success_response=None): retries_context = context.setdefault('retries', {}) retries_context['attempt'] = attempt if 'invocation-id' not in retries_context: retries_context['invocation-id'] = str(uuid.uuid4()) if success_response: read_timeout = context['client_config'].read_timeout self._set_ttl(retries_context, read_timeout, success_response) def _send_request(self, request_dict, operation_model): attempts = 1 context = request_dict['context'] self._update_retries_context(context, attempts) request = self.create_request(request_dict, operation_model) success_response, exception = self._get_response( request, operation_model, context ) while self._needs_retry( attempts, operation_model, request_dict, success_response, exception, ): attempts += 1 self._update_retries_context(context, attempts, success_response) # If there is a stream associated with the request, we need # to reset it before attempting to send the request again. # This will ensure that we resend the entire contents of the # body. request.reset_stream() # Create a new request when retried (including a new signature). request = self.create_request(request_dict, operation_model) success_response, exception = self._get_response( request, operation_model, context ) if ( success_response is not None and 'ResponseMetadata' in success_response[1] ): # We want to share num retries, not num attempts. total_retries = attempts - 1 success_response[1]['ResponseMetadata']['RetryAttempts'] = ( total_retries ) if exception is not None: raise exception else: return success_response def _get_response(self, request, operation_model, context): # This will return a tuple of (success_response, exception) # and success_response is itself a tuple of # (http_response, parsed_dict). # If an exception occurs then the success_response is None. # If no exception occurs then exception is None. success_response, exception = self._do_get_response( request, operation_model, context ) kwargs_to_emit = { 'response_dict': None, 'parsed_response': None, 'context': context, 'exception': exception, } if success_response is not None: http_response, parsed_response = success_response kwargs_to_emit['parsed_response'] = parsed_response kwargs_to_emit['response_dict'] = convert_to_response_dict( http_response, operation_model ) service_id = operation_model.service_model.service_id.hyphenize() self._event_emitter.emit( f"response-received.{service_id}.{operation_model.name}", **kwargs_to_emit, ) return success_response, exception def _do_get_response(self, request, operation_model, context): try: logger.debug("Sending http request: %s", request) history_recorder.record( 'HTTP_REQUEST', { 'method': request.method, 'headers': request.headers, 'streaming': operation_model.has_streaming_input, 'url': request.url, 'body': request.body, }, ) service_id = operation_model.service_model.service_id.hyphenize() event_name = f"before-send.{service_id}.{operation_model.name}" responses = self._event_emitter.emit(event_name, request=request) http_response = first_non_none_response(responses) if http_response is None: http_response = self._send(request) except HTTPClientError as e: return (None, e) except Exception as e: logger.debug( "Exception received when sending HTTP request.", exc_info=True ) return (None, e) # This returns the http_response and the parsed_data. response_dict = convert_to_response_dict( http_response, operation_model ) handle_checksum_body( http_response, response_dict, context, operation_model, ) http_response_record_dict = response_dict.copy() http_response_record_dict['streaming'] = ( operation_model.has_streaming_output ) history_recorder.record('HTTP_RESPONSE', http_response_record_dict) protocol = operation_model.metadata['protocol'] customized_response_dict = {} self._event_emitter.emit( f"before-parse.{service_id}.{operation_model.name}", operation_model=operation_model, response_dict=response_dict, customized_response_dict=customized_response_dict, ) parser = self._response_parser_factory.create_parser(protocol) parsed_response = parser.parse( response_dict, operation_model.output_shape ) parsed_response.update(customized_response_dict) # Do a second parsing pass to pick up on any modeled error fields # NOTE: Ideally, we would push this down into the parser classes but # they currently have no reference to the operation or service model # The parsers should probably take the operation model instead of # output shape but we can't change that now if http_response.status_code >= 300: self._add_modeled_error_fields( response_dict, parsed_response, operation_model, parser, ) history_recorder.record('PARSED_RESPONSE', parsed_response) return (http_response, parsed_response), None def _add_modeled_error_fields( self, response_dict, parsed_response, operation_model, parser, ): error_code = parsed_response.get("Error", {}).get("Code") if error_code is None: return service_model = operation_model.service_model error_shape = service_model.shape_for_error_code(error_code) if error_shape is None: return modeled_parse = parser.parse(response_dict, error_shape) # TODO: avoid naming conflicts with ResponseMetadata and Error parsed_response.update(modeled_parse) def _needs_retry( self, attempts, operation_model, request_dict, response=None, caught_exception=None, ): service_id = operation_model.service_model.service_id.hyphenize() event_name = f"needs-retry.{service_id}.{operation_model.name}" responses = self._event_emitter.emit( event_name, response=response, endpoint=self, operation=operation_model, attempts=attempts, caught_exception=caught_exception, request_dict=request_dict, ) handler_response = first_non_none_response(responses) if handler_response is None: return False else: # Request needs to be retried, and we need to sleep # for the specified number of times. logger.debug( "Response received to retry, sleeping for %s seconds", handler_response, ) time.sleep(handler_response) return True def _send(self, request): return self.http_session.send(request) class EndpointCreator: def __init__(self, event_emitter): self._event_emitter = event_emitter def create_endpoint( self, service_model, region_name, endpoint_url, verify=None, response_parser_factory=None, timeout=DEFAULT_TIMEOUT, max_pool_connections=MAX_POOL_CONNECTIONS, http_session_cls=URLLib3Session, proxies=None, socket_options=None, client_cert=None, proxies_config=None, ): if not is_valid_endpoint_url( endpoint_url ) and not is_valid_ipv6_endpoint_url(endpoint_url): raise ValueError(f"Invalid endpoint: {endpoint_url}") if proxies is None: proxies = self._get_proxies(endpoint_url) endpoint_prefix = service_model.endpoint_prefix logger.debug('Setting %s timeout as %s', endpoint_prefix, timeout) http_session = http_session_cls( timeout=timeout, proxies=proxies, verify=self._get_verify_value(verify), max_pool_connections=max_pool_connections, socket_options=socket_options, client_cert=client_cert, proxies_config=proxies_config, ) return Endpoint( endpoint_url, endpoint_prefix=endpoint_prefix, event_emitter=self._event_emitter, response_parser_factory=response_parser_factory, http_session=http_session, ) def _get_proxies(self, url): # We could also support getting proxies from a config file, # but for now proxy support is taken from the environment. return get_environ_proxies(url) def _get_verify_value(self, verify): # This is to account for: # https://github.com/kennethreitz/requests/issues/1436 # where we need to honor REQUESTS_CA_BUNDLE because we're creating our # own request objects. # First, if verify is not None, then the user explicitly specified # a value so this automatically wins. if verify is not None: return verify # Otherwise use the value from REQUESTS_CA_BUNDLE, or default to # True if the env var does not exist. return os.environ.get('REQUESTS_CA_BUNDLE', True)	16.33 KB	2025-05-25 12:26
📄 endpoint_provider.py # Copyright 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """ NOTE: All classes and functions in this module are considered private and are subject to abrupt breaking changes. Please do not use them directly. To view the raw JSON that the objects in this module represent, please go to any `endpoint-rule-set.json` file in /botocore/data/<service>/<api version>/ or you can look at the test files in /tests/unit/data/endpoints/valid-rules/ """ import logging import re from enum import Enum from string import Formatter from typing import NamedTuple from botocore import xform_name from botocore.compat import IPV4_RE, quote, urlparse from botocore.exceptions import EndpointResolutionError from botocore.utils import ( ArnParser, InvalidArnException, is_valid_ipv4_endpoint_url, is_valid_ipv6_endpoint_url, lru_cache_weakref, normalize_url_path, percent_encode, ) logger = logging.getLogger(__name__) TEMPLATE_STRING_RE = re.compile(r"\{[a-zA-Z#]+\}") GET_ATTR_RE = re.compile(r"(\w)\[(\d+)\]") VALID_HOST_LABEL_RE = re.compile( r"^(?!-)[a-zA-Z\d-]{1,63}(?<!-)$", ) CACHE_SIZE = 100 ARN_PARSER = ArnParser() STRING_FORMATTER = Formatter() class RuleSetStandardLibrary: """Rule actions to be performed by the EndpointProvider.""" def __init__(self, partitions_data): self.partitions_data = partitions_data def is_func(self, argument): """Determine if an object is a function object. :type argument: Any :rtype: bool """ return isinstance(argument, dict) and "fn" in argument def is_ref(self, argument): """Determine if an object is a reference object. :type argument: Any :rtype: bool """ return isinstance(argument, dict) and "ref" in argument def is_template(self, argument): """Determine if an object contains a template string. :type argument: Any :rtpe: bool """ return ( isinstance(argument, str) and TEMPLATE_STRING_RE.search(argument) is not None ) def resolve_template_string(self, value, scope_vars): """Resolve and inject values into a template string. :type value: str :type scope_vars: dict :rtype: str """ result = "" for literal, reference, _, _ in STRING_FORMATTER.parse(value): if reference is not None: template_value = scope_vars template_params = reference.split("#") for param in template_params: template_value = template_value[param] result += f"{literal}{template_value}" else: result += literal return result def resolve_value(self, value, scope_vars): """Return evaluated value based on type. :type value: Any :type scope_vars: dict :rtype: Any """ if self.is_func(value): return self.call_function(value, scope_vars) elif self.is_ref(value): return scope_vars.get(value["ref"]) elif self.is_template(value): return self.resolve_template_string(value, scope_vars) return value def convert_func_name(self, value): """Normalize function names. :type value: str :rtype: str """ normalized_name = f"{xform_name(value)}" if normalized_name == "not": normalized_name = f"_{normalized_name}" return normalized_name.replace(".", "_") def call_function(self, func_signature, scope_vars): """Call the function with the resolved arguments and assign to `scope_vars` when applicable. :type func_signature: dict :type scope_vars: dict :rtype: Any """ func_args = [ self.resolve_value(arg, scope_vars) for arg in func_signature["argv"] ] func_name = self.convert_func_name(func_signature["fn"]) func = getattr(self, func_name) result = func(func_args) if "assign" in func_signature: assign = func_signature["assign"] if assign in scope_vars: raise EndpointResolutionError( msg=f"Assignment {assign} already exists in " "scoped variables and cannot be overwritten" ) scope_vars[assign] = result return result def is_set(self, value): """Evaluates whether a value is set. :type value: Any :rytpe: bool """ return value is not None def get_attr(self, value, path): """Find an attribute within a value given a path string. The path can contain the name of the attribute and an index in brackets. A period separating attribute names indicates the one to the right is nested. The index will always occur at the end of the path. :type value: dict or tuple :type path: str :rtype: Any """ for part in path.split("."): match = GET_ATTR_RE.search(part) if match is not None: name, index = match.groups() index = int(index) if name: value = value.get(name) if value is None or index >= len(value): return None return value[index] else: value = value[part] return value def format_partition_output(self, partition): output = partition["outputs"] output["name"] = partition["id"] return output def is_partition_match(self, region, partition): matches_regex = re.match(partition["regionRegex"], region) is not None return region in partition["regions"] or matches_regex def aws_partition(self, value): """Match a region string to an AWS partition. :type value: str :rtype: dict """ partitions = self.partitions_data['partitions'] if value is not None: for partition in partitions: if self.is_partition_match(value, partition): return self.format_partition_output(partition) # return the default partition if no matches were found aws_partition = partitions[0] return self.format_partition_output(aws_partition) def aws_parse_arn(self, value): """Parse and validate string for ARN components. :type value: str :rtype: dict """ if value is None or not value.startswith("arn:"): return None try: arn_dict = ARN_PARSER.parse_arn(value) except InvalidArnException: return None # partition, resource, and service are required if not all( (arn_dict["partition"], arn_dict["service"], arn_dict["resource"]) ): return None arn_dict["accountId"] = arn_dict.pop("account") resource = arn_dict.pop("resource") arn_dict["resourceId"] = resource.replace(":", "/").split("/") return arn_dict def is_valid_host_label(self, value, allow_subdomains): """Evaluates whether a value is a valid host label per RFC 1123. If allow_subdomains is True, split on `.` and validate each component separately. :type value: str :type allow_subdomains: bool :rtype: bool """ if value is None or allow_subdomains is False and value.count(".") > 0: return False if allow_subdomains is True: return all( self.is_valid_host_label(label, False) for label in value.split(".") ) return VALID_HOST_LABEL_RE.match(value) is not None def string_equals(self, value1, value2): """Evaluates two string values for equality. :type value1: str :type value2: str :rtype: bool """ if not all(isinstance(val, str) for val in (value1, value2)): msg = f"Both values must be strings, not {type(value1)} and {type(value2)}." raise EndpointResolutionError(msg=msg) return value1 == value2 def uri_encode(self, value): """Perform percent-encoding on an input string. :type value: str :rytpe: str """ if value is None: return None return percent_encode(value) def parse_url(self, value): """Parse a URL string into components. :type value: str :rtype: dict """ if value is None: return None url_components = urlparse(value) try: # url_parse may assign non-integer values to # `port` and will fail when accessed. url_components.port except ValueError: return None scheme = url_components.scheme query = url_components.query # URLs with queries are not supported if scheme not in ("https", "http") or len(query) > 0: return None path = url_components.path normalized_path = quote(normalize_url_path(path)) if not normalized_path.endswith("/"): normalized_path = f"{normalized_path}/" return { "scheme": scheme, "authority": url_components.netloc, "path": path, "normalizedPath": normalized_path, "isIp": is_valid_ipv4_endpoint_url(value) or is_valid_ipv6_endpoint_url(value), } def boolean_equals(self, value1, value2): """Evaluates two boolean values for equality. :type value1: bool :type value2: bool :rtype: bool """ if not all(isinstance(val, bool) for val in (value1, value2)): msg = f"Both arguments must be bools, not {type(value1)} and {type(value2)}." raise EndpointResolutionError(msg=msg) return value1 is value2 def is_ascii(self, value): """Evaluates if a string only contains ASCII characters. :type value: str :rtype: bool """ try: value.encode("ascii") return True except UnicodeEncodeError: return False def substring(self, value, start, stop, reverse): """Computes a substring given the start index and end index. If `reverse` is True, slice the string from the end instead. :type value: str :type start: int :type end: int :type reverse: bool :rtype: str """ if not isinstance(value, str): msg = f"Input must be a string, not {type(value)}." raise EndpointResolutionError(msg=msg) if start >= stop or len(value) < stop or not self.is_ascii(value): return None if reverse is True: r_start = len(value) - stop r_stop = len(value) - start return value[r_start:r_stop] return value[start:stop] def _not(self, value): """A function implementation of the logical operator `not`. :type value: Any :rtype: bool """ return not value def aws_is_virtual_hostable_s3_bucket(self, value, allow_subdomains): """Evaluates whether a value is a valid bucket name for virtual host style bucket URLs. To pass, the value must meet the following criteria: 1. is_valid_host_label(value) is True 2. length between 3 and 63 characters (inclusive) 3. does not contain uppercase characters 4. is not formatted as an IP address If allow_subdomains is True, split on `.` and validate each component separately. :type value: str :type allow_subdomains: bool :rtype: bool """ if ( value is None or len(value) < 3 or value.lower() != value or IPV4_RE.match(value) is not None ): return False return self.is_valid_host_label( value, allow_subdomains=allow_subdomains ) # maintains backwards compatibility as `Library` was misspelled # in earlier versions RuleSetStandardLibary = RuleSetStandardLibrary class BaseRule: """Base interface for individual endpoint rules.""" def __init__(self, conditions, documentation=None): self.conditions = conditions self.documentation = documentation def evaluate(self, scope_vars, rule_lib): raise NotImplementedError() def evaluate_conditions(self, scope_vars, rule_lib): """Determine if all conditions in a rule are met. :type scope_vars: dict :type rule_lib: RuleSetStandardLibrary :rtype: bool """ for func_signature in self.conditions: result = rule_lib.call_function(func_signature, scope_vars) if result is False or result is None: return False return True class RuleSetEndpoint(NamedTuple): """A resolved endpoint object returned by a rule.""" url: str properties: dict headers: dict class EndpointRule(BaseRule): def __init__(self, endpoint, kwargs): super().__init__(kwargs) self.endpoint = endpoint def evaluate(self, scope_vars, rule_lib): """Determine if conditions are met to provide a valid endpoint. :type scope_vars: dict :rtype: RuleSetEndpoint """ if self.evaluate_conditions(scope_vars, rule_lib): url = rule_lib.resolve_value(self.endpoint["url"], scope_vars) properties = self.resolve_properties( self.endpoint.get("properties", {}), scope_vars, rule_lib, ) headers = self.resolve_headers(scope_vars, rule_lib) return RuleSetEndpoint( url=url, properties=properties, headers=headers ) return None def resolve_properties(self, properties, scope_vars, rule_lib): """Traverse `properties` attribute, resolving any template strings. :type properties: dict/list/str :type scope_vars: dict :type rule_lib: RuleSetStandardLibrary :rtype: dict """ if isinstance(properties, list): return [ self.resolve_properties(prop, scope_vars, rule_lib) for prop in properties ] elif isinstance(properties, dict): return { key: self.resolve_properties(value, scope_vars, rule_lib) for key, value in properties.items() } elif rule_lib.is_template(properties): return rule_lib.resolve_template_string(properties, scope_vars) return properties def resolve_headers(self, scope_vars, rule_lib): """Iterate through headers attribute resolving all values. :type scope_vars: dict :type rule_lib: RuleSetStandardLibrary :rtype: dict """ resolved_headers = {} headers = self.endpoint.get("headers", {}) for header, values in headers.items(): resolved_headers[header] = [ rule_lib.resolve_value(item, scope_vars) for item in values ] return resolved_headers class ErrorRule(BaseRule): def __init__(self, error, kwargs): super().__init__(kwargs) self.error = error def evaluate(self, scope_vars, rule_lib): """If an error rule's conditions are met, raise an error rule. :type scope_vars: dict :type rule_lib: RuleSetStandardLibrary :rtype: EndpointResolutionError """ if self.evaluate_conditions(scope_vars, rule_lib): error = rule_lib.resolve_value(self.error, scope_vars) raise EndpointResolutionError(msg=error) return None class TreeRule(BaseRule): """A tree rule is non-terminal meaning it will never be returned to a provider. Additionally this means it has no attributes that need to be resolved. """ def __init__(self, rules, kwargs): super().__init__(kwargs) self.rules = [RuleCreator.create(rule) for rule in rules] def evaluate(self, scope_vars, rule_lib): """If a tree rule's conditions are met, iterate its sub-rules and return first result found. :type scope_vars: dict :type rule_lib: RuleSetStandardLibrary :rtype: RuleSetEndpoint/EndpointResolutionError """ if self.evaluate_conditions(scope_vars, rule_lib): for rule in self.rules: # don't share scope_vars between rules rule_result = rule.evaluate(scope_vars.copy(), rule_lib) if rule_result: return rule_result return None class RuleCreator: endpoint = EndpointRule error = ErrorRule tree = TreeRule @classmethod def create(cls, kwargs): """Create a rule instance from metadata. :rtype: TreeRule/EndpointRule/ErrorRule """ rule_type = kwargs.pop("type") try: rule_class = getattr(cls, rule_type) except AttributeError: raise EndpointResolutionError( msg=f"Unknown rule type: {rule_type}. A rule must " "be of type tree, endpoint or error." ) else: return rule_class(kwargs) class ParameterType(Enum): """Translation from `type` attribute to native Python type.""" string = str boolean = bool stringarray = tuple class ParameterDefinition: """The spec of an individual parameter defined in a RuleSet.""" def __init__( self, name, parameter_type, documentation=None, builtIn=None, default=None, required=None, deprecated=None, ): self.name = name try: self.parameter_type = getattr( ParameterType, parameter_type.lower() ).value except AttributeError: raise EndpointResolutionError( msg=f"Unknown parameter type: {parameter_type}. " "A parameter must be of type string, boolean, or stringarray." ) self.documentation = documentation self.builtin = builtIn self.default = default self.required = required self.deprecated = deprecated def validate_input(self, value): """Perform base validation on parameter input. :type value: Any :raises: EndpointParametersError """ if not isinstance(value, self.parameter_type): raise EndpointResolutionError( msg=f"Value ({self.name}) is the wrong " f"type. Must be {self.parameter_type}." ) if self.deprecated is not None: depr_str = f"{self.name} has been deprecated." msg = self.deprecated.get("message") since = self.deprecated.get("since") if msg: depr_str += f"\n{msg}" if since: depr_str += f"\nDeprecated since {since}." logger.info(depr_str) return None def process_input(self, value): """Process input against spec, applying default if value is None.""" if value is None: if self.default is not None: return self.default if self.required: raise EndpointResolutionError( msg=f"Cannot find value for required parameter {self.name}" ) # in all other cases, the parameter will keep the value None else: self.validate_input(value) return value class RuleSet: """Collection of rules to derive a routable service endpoint.""" def __init__( self, version, parameters, rules, partitions, documentation=None ): self.version = version self.parameters = self._ingest_parameter_spec(parameters) self.rules = [RuleCreator.create(rule) for rule in rules] self.rule_lib = RuleSetStandardLibrary(partitions) self.documentation = documentation def _ingest_parameter_spec(self, parameters): return { name: ParameterDefinition( name, spec["type"], spec.get("documentation"), spec.get("builtIn"), spec.get("default"), spec.get("required"), spec.get("deprecated"), ) for name, spec in parameters.items() } def process_input_parameters(self, input_params): """Process each input parameter against its spec. :type input_params: dict """ for name, spec in self.parameters.items(): value = spec.process_input(input_params.get(name)) if value is not None: input_params[name] = value return None def evaluate(self, input_parameters): """Evaluate input parameters against rules returning first match. :type input_parameters: dict """ self.process_input_parameters(input_parameters) for rule in self.rules: evaluation = rule.evaluate(input_parameters.copy(), self.rule_lib) if evaluation is not None: return evaluation return None class EndpointProvider: """Derives endpoints from a RuleSet for given input parameters.""" def __init__(self, ruleset_data, partition_data): self.ruleset = RuleSet(ruleset_data, partitions=partition_data) @lru_cache_weakref(maxsize=CACHE_SIZE) def resolve_endpoint(self, input_parameters): """Match input parameters to a rule. :type input_parameters: dict :rtype: RuleSetEndpoint """ params_for_error = input_parameters.copy() endpoint = self.ruleset.evaluate(input_parameters) if endpoint is None: param_string = "\n".join( [f"{key}: {value}" for key, value in params_for_error.items()] ) raise EndpointResolutionError( msg=f"No endpoint found for parameters:\n{param_string}" ) return endpoint	22.47 KB	2025-05-25 12:26
📄 errorfactory.py # Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. from botocore.exceptions import ClientError from botocore.utils import get_service_module_name class BaseClientExceptions: ClientError = ClientError def __init__(self, code_to_exception): """Base class for exceptions object on a client :type code_to_exception: dict :param code_to_exception: Mapping of error codes (strings) to exception class that should be raised when encountering a particular error code. """ self._code_to_exception = code_to_exception def from_code(self, error_code): """Retrieves the error class based on the error code This is helpful for identifying the exception class needing to be caught based on the ClientError.parsed_reponse['Error']['Code'] value :type error_code: string :param error_code: The error code associated to a ClientError exception :rtype: ClientError or a subclass of ClientError :returns: The appropriate modeled exception class for that error code. If the error code does not match any of the known modeled exceptions then return a generic ClientError. """ return self._code_to_exception.get(error_code, self.ClientError) def __getattr__(self, name): exception_cls_names = [ exception_cls.__name__ for exception_cls in self._code_to_exception.values() ] raise AttributeError( rf"{self} object has no attribute {name}. " rf"Valid exceptions are: {', '.join(exception_cls_names)}" ) class ClientExceptionsFactory: def __init__(self): self._client_exceptions_cache = {} def create_client_exceptions(self, service_model): """Creates a ClientExceptions object for the particular service client :type service_model: botocore.model.ServiceModel :param service_model: The service model for the client :rtype: object that subclasses from BaseClientExceptions :returns: The exceptions object of a client that can be used to grab the various different modeled exceptions. """ service_name = service_model.service_name if service_name not in self._client_exceptions_cache: client_exceptions = self._create_client_exceptions(service_model) self._client_exceptions_cache[service_name] = client_exceptions return self._client_exceptions_cache[service_name] def _create_client_exceptions(self, service_model): cls_props = {} code_to_exception = {} for error_shape in service_model.error_shapes: exception_name = str(error_shape.name) exception_cls = type(exception_name, (ClientError,), {}) cls_props[exception_name] = exception_cls code = str(error_shape.error_code) code_to_exception[code] = exception_cls cls_name = str(get_service_module_name(service_model) + 'Exceptions') client_exceptions_cls = type( cls_name, (BaseClientExceptions,), cls_props ) return client_exceptions_cls(code_to_exception)	3.63 KB	2025-05-25 12:26
📄 eventstream.py # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Binary Event Stream Decoding""" from binascii import crc32 from struct import unpack from botocore.exceptions import EventStreamError # byte length of the prelude (total_length + header_length + prelude_crc) _PRELUDE_LENGTH = 12 _MAX_HEADERS_LENGTH = 128 * 1024 # 128 Kb _MAX_PAYLOAD_LENGTH = 24 * 1024 * 1024 # 24 Mb class ParserError(Exception): """Base binary flow encoding parsing exception.""" pass class DuplicateHeader(ParserError): """Duplicate header found in the event.""" def __init__(self, header): message = f'Duplicate header present: "{header}"' super().__init__(message) class InvalidHeadersLength(ParserError): """Headers length is longer than the maximum.""" def __init__(self, length): message = f'Header length of {length} exceeded the maximum of {_MAX_HEADERS_LENGTH}' super().__init__(message) class InvalidPayloadLength(ParserError): """Payload length is longer than the maximum.""" def __init__(self, length): message = f'Payload length of {length} exceeded the maximum of {_MAX_PAYLOAD_LENGTH}' super().__init__(message) class ChecksumMismatch(ParserError): """Calculated checksum did not match the expected checksum.""" def __init__(self, expected, calculated): message = f'Checksum mismatch: expected 0x{expected:08x}, calculated 0x{calculated:08x}' super().__init__(message) class NoInitialResponseError(ParserError): """An event of type initial-response was not received. This exception is raised when the event stream produced no events or the first event in the stream was not of the initial-response type. """ def __init__(self): message = 'First event was not of the initial-response type' super().__init__(message) class DecodeUtils: """Unpacking utility functions used in the decoder. All methods on this class take raw bytes and return a tuple containing the value parsed from the bytes and the number of bytes consumed to parse that value. """ UINT8_BYTE_FORMAT = '!B' UINT16_BYTE_FORMAT = '!H' UINT32_BYTE_FORMAT = '!I' INT8_BYTE_FORMAT = '!b' INT16_BYTE_FORMAT = '!h' INT32_BYTE_FORMAT = '!i' INT64_BYTE_FORMAT = '!q' PRELUDE_BYTE_FORMAT = '!III' # uint byte size to unpack format UINT_BYTE_FORMAT = { 1: UINT8_BYTE_FORMAT, 2: UINT16_BYTE_FORMAT, 4: UINT32_BYTE_FORMAT, } @staticmethod def unpack_true(data): """This method consumes none of the provided bytes and returns True. :type data: bytes :param data: The bytes to parse from. This is ignored in this method. :rtype: tuple :rtype: (bool, int) :returns: The tuple (True, 0) """ return True, 0 @staticmethod def unpack_false(data): """This method consumes none of the provided bytes and returns False. :type data: bytes :param data: The bytes to parse from. This is ignored in this method. :rtype: tuple :rtype: (bool, int) :returns: The tuple (False, 0) """ return False, 0 @staticmethod def unpack_uint8(data): """Parse an unsigned 8-bit integer from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: (int, int) :returns: A tuple containing the (parsed integer value, bytes consumed) """ value = unpack(DecodeUtils.UINT8_BYTE_FORMAT, data[:1])[0] return value, 1 @staticmethod def unpack_uint32(data): """Parse an unsigned 32-bit integer from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: (int, int) :returns: A tuple containing the (parsed integer value, bytes consumed) """ value = unpack(DecodeUtils.UINT32_BYTE_FORMAT, data[:4])[0] return value, 4 @staticmethod def unpack_int8(data): """Parse a signed 8-bit integer from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: (int, int) :returns: A tuple containing the (parsed integer value, bytes consumed) """ value = unpack(DecodeUtils.INT8_BYTE_FORMAT, data[:1])[0] return value, 1 @staticmethod def unpack_int16(data): """Parse a signed 16-bit integer from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: tuple :rtype: (int, int) :returns: A tuple containing the (parsed integer value, bytes consumed) """ value = unpack(DecodeUtils.INT16_BYTE_FORMAT, data[:2])[0] return value, 2 @staticmethod def unpack_int32(data): """Parse a signed 32-bit integer from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: tuple :rtype: (int, int) :returns: A tuple containing the (parsed integer value, bytes consumed) """ value = unpack(DecodeUtils.INT32_BYTE_FORMAT, data[:4])[0] return value, 4 @staticmethod def unpack_int64(data): """Parse a signed 64-bit integer from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: tuple :rtype: (int, int) :returns: A tuple containing the (parsed integer value, bytes consumed) """ value = unpack(DecodeUtils.INT64_BYTE_FORMAT, data[:8])[0] return value, 8 @staticmethod def unpack_byte_array(data, length_byte_size=2): """Parse a variable length byte array from the bytes. The bytes are expected to be in the following format: [ length ][0 ... length bytes] where length is an unsigned integer represented in the smallest number of bytes to hold the maximum length of the array. :type data: bytes :param data: The bytes to parse from. :type length_byte_size: int :param length_byte_size: The byte size of the preceding integer that represents the length of the array. Supported values are 1, 2, and 4. :rtype: (bytes, int) :returns: A tuple containing the (parsed byte array, bytes consumed). """ uint_byte_format = DecodeUtils.UINT_BYTE_FORMAT[length_byte_size] length = unpack(uint_byte_format, data[:length_byte_size])[0] bytes_end = length + length_byte_size array_bytes = data[length_byte_size:bytes_end] return array_bytes, bytes_end @staticmethod def unpack_utf8_string(data, length_byte_size=2): """Parse a variable length utf-8 string from the bytes. The bytes are expected to be in the following format: [ length ][0 ... length bytes] where length is an unsigned integer represented in the smallest number of bytes to hold the maximum length of the array and the following bytes are a valid utf-8 string. :type data: bytes :param bytes: The bytes to parse from. :type length_byte_size: int :param length_byte_size: The byte size of the preceding integer that represents the length of the array. Supported values are 1, 2, and 4. :rtype: (str, int) :returns: A tuple containing the (utf-8 string, bytes consumed). """ array_bytes, consumed = DecodeUtils.unpack_byte_array( data, length_byte_size ) return array_bytes.decode('utf-8'), consumed @staticmethod def unpack_uuid(data): """Parse a 16-byte uuid from the bytes. :type data: bytes :param data: The bytes to parse from. :rtype: (bytes, int) :returns: A tuple containing the (uuid bytes, bytes consumed). """ return data[:16], 16 @staticmethod def unpack_prelude(data): """Parse the prelude for an event stream message from the bytes. The prelude for an event stream message has the following format: [total_length][header_length][prelude_crc] where each field is an unsigned 32-bit integer. :rtype: ((int, int, int), int) :returns: A tuple of ((total_length, headers_length, prelude_crc), consumed) """ return (unpack(DecodeUtils.PRELUDE_BYTE_FORMAT, data), _PRELUDE_LENGTH) def _validate_checksum(data, checksum, crc=0): # To generate the same numeric value across all Python versions and # platforms use crc32(data) & 0xffffffff. computed_checksum = crc32(data, crc) & 0xFFFFFFFF if checksum != computed_checksum: raise ChecksumMismatch(checksum, computed_checksum) class MessagePrelude: """Represents the prelude of an event stream message.""" def __init__(self, total_length, headers_length, crc): self.total_length = total_length self.headers_length = headers_length self.crc = crc @property def payload_length(self): """Calculates the total payload length. The extra minus 4 bytes is for the message CRC. :rtype: int :returns: The total payload length. """ return self.total_length - self.headers_length - _PRELUDE_LENGTH - 4 @property def payload_end(self): """Calculates the byte offset for the end of the message payload. The extra minus 4 bytes is for the message CRC. :rtype: int :returns: The byte offset from the beginning of the event stream message to the end of the payload. """ return self.total_length - 4 @property def headers_end(self): """Calculates the byte offset for the end of the message headers. :rtype: int :returns: The byte offset from the beginning of the event stream message to the end of the headers. """ return _PRELUDE_LENGTH + self.headers_length class EventStreamMessage: """Represents an event stream message.""" def __init__(self, prelude, headers, payload, crc): self.prelude = prelude self.headers = headers self.payload = payload self.crc = crc def to_response_dict(self, status_code=200): message_type = self.headers.get(':message-type') if message_type == 'error' or message_type == 'exception': status_code = 400 return { 'status_code': status_code, 'headers': self.headers, 'body': self.payload, } class EventStreamHeaderParser: """Parses the event headers from an event stream message. Expects all of the header data upfront and creates a dictionary of headers to return. This object can be reused multiple times to parse the headers from multiple event stream messages. """ # Maps header type to appropriate unpacking function # These unpacking functions return the value and the amount unpacked _HEADER_TYPE_MAP = { # boolean_true 0: DecodeUtils.unpack_true, # boolean_false 1: DecodeUtils.unpack_false, # byte 2: DecodeUtils.unpack_int8, # short 3: DecodeUtils.unpack_int16, # integer 4: DecodeUtils.unpack_int32, # long 5: DecodeUtils.unpack_int64, # byte_array 6: DecodeUtils.unpack_byte_array, # string 7: DecodeUtils.unpack_utf8_string, # timestamp 8: DecodeUtils.unpack_int64, # uuid 9: DecodeUtils.unpack_uuid, } def __init__(self): self._data = None def parse(self, data): """Parses the event stream headers from an event stream message. :type data: bytes :param data: The bytes that correspond to the headers section of an event stream message. :rtype: dict :returns: A dictionary of header key, value pairs. """ self._data = data return self._parse_headers() def _parse_headers(self): headers = {} while self._data: name, value = self._parse_header() if name in headers: raise DuplicateHeader(name) headers[name] = value return headers def _parse_header(self): name = self._parse_name() value = self._parse_value() return name, value def _parse_name(self): name, consumed = DecodeUtils.unpack_utf8_string(self._data, 1) self._advance_data(consumed) return name def _parse_type(self): type, consumed = DecodeUtils.unpack_uint8(self._data) self._advance_data(consumed) return type def _parse_value(self): header_type = self._parse_type() value_unpacker = self._HEADER_TYPE_MAP[header_type] value, consumed = value_unpacker(self._data) self._advance_data(consumed) return value def _advance_data(self, consumed): self._data = self._data[consumed:] class EventStreamBuffer: """Streaming based event stream buffer A buffer class that wraps bytes from an event stream providing parsed messages as they become available via an iterable interface. """ def __init__(self): self._data = b'' self._prelude = None self._header_parser = EventStreamHeaderParser() def add_data(self, data): """Add data to the buffer. :type data: bytes :param data: The bytes to add to the buffer to be used when parsing """ self._data += data def _validate_prelude(self, prelude): if prelude.headers_length > _MAX_HEADERS_LENGTH: raise InvalidHeadersLength(prelude.headers_length) if prelude.payload_length > _MAX_PAYLOAD_LENGTH: raise InvalidPayloadLength(prelude.payload_length) def _parse_prelude(self): prelude_bytes = self._data[:_PRELUDE_LENGTH] raw_prelude, _ = DecodeUtils.unpack_prelude(prelude_bytes) prelude = MessagePrelude(raw_prelude) # The minus 4 removes the prelude crc from the bytes to be checked _validate_checksum(prelude_bytes[: _PRELUDE_LENGTH - 4], prelude.crc) self._validate_prelude(prelude) return prelude def _parse_headers(self): header_bytes = self._data[_PRELUDE_LENGTH : self._prelude.headers_end] return self._header_parser.parse(header_bytes) def _parse_payload(self): prelude = self._prelude payload_bytes = self._data[prelude.headers_end : prelude.payload_end] return payload_bytes def _parse_message_crc(self): prelude = self._prelude crc_bytes = self._data[prelude.payload_end : prelude.total_length] message_crc, _ = DecodeUtils.unpack_uint32(crc_bytes) return message_crc def _parse_message_bytes(self): # The minus 4 includes the prelude crc to the bytes to be checked message_bytes = self._data[ _PRELUDE_LENGTH - 4 : self._prelude.payload_end ] return message_bytes def _validate_message_crc(self): message_crc = self._parse_message_crc() message_bytes = self._parse_message_bytes() _validate_checksum(message_bytes, message_crc, crc=self._prelude.crc) return message_crc def _parse_message(self): crc = self._validate_message_crc() headers = self._parse_headers() payload = self._parse_payload() message = EventStreamMessage(self._prelude, headers, payload, crc) self._prepare_for_next_message() return message def _prepare_for_next_message(self): # Advance the data and reset the current prelude self._data = self._data[self._prelude.total_length :] self._prelude = None def next(self): """Provides the next available message parsed from the stream :rtype: EventStreamMessage :returns: The next event stream message """ if len(self._data) < _PRELUDE_LENGTH: raise StopIteration() if self._prelude is None: self._prelude = self._parse_prelude() if len(self._data) < self._prelude.total_length: raise StopIteration() return self._parse_message() def __next__(self): return self.next() def __iter__(self): return self class EventStream: """Wrapper class for an event stream body. This wraps the underlying streaming body, parsing it for individual events and yielding them as they come available through the iterator interface. The following example uses the S3 select API to get structured data out of an object stored in S3 using an event stream. Example:* :: from botocore.session import Session s3 = Session().create_client('s3') response = s3.select_object_content( Bucket='bucketname', Key='keyname', ExpressionType='SQL', RequestProgress={'Enabled': True}, Expression="SELECT * FROM S3Object s", InputSerialization={'CSV': {}}, OutputSerialization={'CSV': {}}, ) # This is the event stream in the response event_stream = response['Payload'] end_event_received = False with open('output', 'wb') as f: # Iterate over events in the event stream as they come for event in event_stream: # If we received a records event, write the data to a file if 'Records' in event: data = event['Records']['Payload'] f.write(data) # If we received a progress event, print the details elif 'Progress' in event: print(event['Progress']['Details']) # End event indicates that the request finished successfully elif 'End' in event: print('Result is complete') end_event_received = True if not end_event_received: raise Exception("End event not received, request incomplete.") """ def __init__(self, raw_stream, output_shape, parser, operation_name): self._raw_stream = raw_stream self._output_shape = output_shape self._operation_name = operation_name self._parser = parser self._event_generator = self._create_raw_event_generator() def __iter__(self): for event in self._event_generator: parsed_event = self._parse_event(event) if parsed_event: yield parsed_event def _create_raw_event_generator(self): event_stream_buffer = EventStreamBuffer() for chunk in self._raw_stream.stream(): event_stream_buffer.add_data(chunk) yield from event_stream_buffer def _parse_event(self, event): response_dict = event.to_response_dict() parsed_response = self._parser.parse(response_dict, self._output_shape) if response_dict['status_code'] == 200: return parsed_response else: raise EventStreamError(parsed_response, self._operation_name) def get_initial_response(self): try: initial_event = next(self._event_generator) event_type = initial_event.headers.get(':event-type') if event_type == 'initial-response': return initial_event except StopIteration: pass raise NoInitialResponseError() def close(self): """Closes the underlying streaming body.""" self._raw_stream.close()	19.8 KB	2025-05-25 12:26
📄 exceptions.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. from botocore.vendored import requests from botocore.vendored.requests.packages import urllib3 def _exception_from_packed_args(exception_cls, args=None, kwargs=None): # This is helpful for reducing Exceptions that only accept kwargs as # only positional arguments can be provided for __reduce__ # Ideally, this would also be a class method on the BotoCoreError # but instance methods cannot be pickled. if args is None: args = () if kwargs is None: kwargs = {} return exception_cls(args, kwargs) class BotoCoreError(Exception): """ The base exception class for BotoCore exceptions. :ivar msg: The descriptive message associated with the error. """ fmt = 'An unspecified error occurred' def __init__(self, kwargs): msg = self.fmt.format(kwargs) Exception.__init__(self, msg) self.kwargs = kwargs def __reduce__(self): return _exception_from_packed_args, (self.__class__, None, self.kwargs) class DataNotFoundError(BotoCoreError): """ The data associated with a particular path could not be loaded. :ivar data_path: The data path that the user attempted to load. """ fmt = 'Unable to load data for: {data_path}' class UnknownServiceError(DataNotFoundError): """Raised when trying to load data for an unknown service. :ivar service_name: The name of the unknown service. """ fmt = ( "Unknown service: '{service_name}'. Valid service names are: " "{known_service_names}" ) class UnknownRegionError(BotoCoreError): """Raised when trying to load data for an unknown region. :ivar region_name: The name of the unknown region. """ fmt = "Unknown region: '{region_name}'. {error_msg}" class ApiVersionNotFoundError(BotoCoreError): """ The data associated with either the API version or a compatible one could not be loaded. :ivar data_path: The data path that the user attempted to load. :ivar api_version: The API version that the user attempted to load. """ fmt = 'Unable to load data {data_path} for: {api_version}' class HTTPClientError(BotoCoreError): fmt = 'An HTTP Client raised an unhandled exception: {error}' def __init__(self, request=None, response=None, kwargs): self.request = request self.response = response super().__init__(kwargs) def __reduce__(self): return _exception_from_packed_args, ( self.__class__, (self.request, self.response), self.kwargs, ) class ConnectionError(BotoCoreError): fmt = 'An HTTP Client failed to establish a connection: {error}' class InvalidIMDSEndpointError(BotoCoreError): fmt = 'Invalid endpoint EC2 Instance Metadata endpoint: {endpoint}' class InvalidIMDSEndpointModeError(BotoCoreError): fmt = ( 'Invalid EC2 Instance Metadata endpoint mode: {mode}' ' Valid endpoint modes (case-insensitive): {valid_modes}.' ) class EndpointConnectionError(ConnectionError): fmt = 'Could not connect to the endpoint URL: "{endpoint_url}"' class SSLError(ConnectionError, requests.exceptions.SSLError): fmt = 'SSL validation failed for {endpoint_url} {error}' class ConnectionClosedError(HTTPClientError): fmt = ( 'Connection was closed before we received a valid response ' 'from endpoint URL: "{endpoint_url}".' ) class ReadTimeoutError( HTTPClientError, requests.exceptions.ReadTimeout, urllib3.exceptions.ReadTimeoutError, ): fmt = 'Read timeout on endpoint URL: "{endpoint_url}"' class ConnectTimeoutError(ConnectionError, requests.exceptions.ConnectTimeout): fmt = 'Connect timeout on endpoint URL: "{endpoint_url}"' class ProxyConnectionError(ConnectionError, requests.exceptions.ProxyError): fmt = 'Failed to connect to proxy URL: "{proxy_url}"' class ResponseStreamingError(HTTPClientError): fmt = 'An error occurred while reading from response stream: {error}' class NoCredentialsError(BotoCoreError): """ No credentials could be found. """ fmt = 'Unable to locate credentials' class NoAuthTokenError(BotoCoreError): """ No authorization token could be found. """ fmt = 'Unable to locate authorization token' class TokenRetrievalError(BotoCoreError): """ Error attempting to retrieve a token from a remote source. :ivar provider: The name of the token provider. :ivar error_msg: The msg explaining why the token could not be retrieved. """ fmt = 'Error when retrieving token from {provider}: {error_msg}' class PartialCredentialsError(BotoCoreError): """ Only partial credentials were found. :ivar cred_var: The missing credential variable name. """ fmt = 'Partial credentials found in {provider}, missing: {cred_var}' class CredentialRetrievalError(BotoCoreError): """ Error attempting to retrieve credentials from a remote source. :ivar provider: The name of the credential provider. :ivar error_msg: The msg explaining why credentials could not be retrieved. """ fmt = 'Error when retrieving credentials from {provider}: {error_msg}' class UnknownSignatureVersionError(BotoCoreError): """ Requested Signature Version is not known. :ivar signature_version: The name of the requested signature version. """ fmt = 'Unknown Signature Version: {signature_version}.' class ServiceNotInRegionError(BotoCoreError): """ The service is not available in requested region. :ivar service_name: The name of the service. :ivar region_name: The name of the region. """ fmt = 'Service {service_name} not available in region {region_name}' class BaseEndpointResolverError(BotoCoreError): """Base error for endpoint resolving errors. Should never be raised directly, but clients can catch this exception if they want to generically handle any errors during the endpoint resolution process. """ class NoRegionError(BaseEndpointResolverError): """No region was specified.""" fmt = 'You must specify a region.' class EndpointVariantError(BaseEndpointResolverError): """ Could not construct modeled endpoint variant. :ivar error_msg: The message explaining why the modeled endpoint variant is unable to be constructed. """ fmt = ( 'Unable to construct a modeled endpoint with the following ' 'variant(s) {tags}: ' ) class UnknownEndpointError(BaseEndpointResolverError, ValueError): """ Could not construct an endpoint. :ivar service_name: The name of the service. :ivar region_name: The name of the region. """ fmt = ( 'Unable to construct an endpoint for ' '{service_name} in region {region_name}' ) class UnknownFIPSEndpointError(BaseEndpointResolverError): """ Could not construct a FIPS endpoint. :ivar service_name: The name of the service. :ivar region_name: The name of the region. """ fmt = ( 'The provided FIPS pseudo-region "{region_name}" is not known for ' 'the service "{service_name}". A FIPS compliant endpoint cannot be ' 'constructed.' ) class ProfileNotFound(BotoCoreError): """ The specified configuration profile was not found in the configuration file. :ivar profile: The name of the profile the user attempted to load. """ fmt = 'The config profile ({profile}) could not be found' class ConfigParseError(BotoCoreError): """ The configuration file could not be parsed. :ivar path: The path to the configuration file. """ fmt = 'Unable to parse config file: {path}' class ConfigNotFound(BotoCoreError): """ The specified configuration file could not be found. :ivar path: The path to the configuration file. """ fmt = 'The specified config file ({path}) could not be found.' class MissingParametersError(BotoCoreError): """ One or more required parameters were not supplied. :ivar object: The object that has missing parameters. This can be an operation or a parameter (in the case of inner params). The str() of this object will be used so it doesn't need to implement anything other than str(). :ivar missing: The names of the missing parameters. """ fmt = ( 'The following required parameters are missing for ' '{object_name}: {missing}' ) class ValidationError(BotoCoreError): """ An exception occurred validating parameters. Subclasses must accept a ``value`` and ``param`` argument in their ``__init__``. :ivar value: The value that was being validated. :ivar param: The parameter that failed validation. :ivar type_name: The name of the underlying type. """ fmt = "Invalid value ('{value}') for param {param} " "of type {type_name} " class ParamValidationError(BotoCoreError): fmt = 'Parameter validation failed:\n{report}' # These exceptions subclass from ValidationError so that code # can just 'except ValidationError' to catch any possibly validation # error. class UnknownKeyError(ValidationError): """ Unknown key in a struct parameter. :ivar value: The value that was being checked. :ivar param: The name of the parameter. :ivar choices: The valid choices the value can be. """ fmt = ( "Unknown key '{value}' for param '{param}'. Must be one " "of: {choices}" ) class RangeError(ValidationError): """ A parameter value was out of the valid range. :ivar value: The value that was being checked. :ivar param: The parameter that failed validation. :ivar min_value: The specified minimum value. :ivar max_value: The specified maximum value. """ fmt = ( 'Value out of range for param {param}: ' '{min_value} <= {value} <= {max_value}' ) class UnknownParameterError(ValidationError): """ Unknown top level parameter. :ivar name: The name of the unknown parameter. :ivar operation: The name of the operation. :ivar choices: The valid choices the parameter name can be. """ fmt = ( "Unknown parameter '{name}' for operation {operation}. Must be one " "of: {choices}" ) class InvalidRegionError(ValidationError, ValueError): """ Invalid region_name provided to client or resource. :ivar region_name: region_name that was being validated. """ fmt = "Provided region_name '{region_name}' doesn't match a supported format." class AliasConflictParameterError(ValidationError): """ Error when an alias is provided for a parameter as well as the original. :ivar original: The name of the original parameter. :ivar alias: The name of the alias :ivar operation: The name of the operation. """ fmt = ( "Parameter '{original}' and its alias '{alias}' were provided " "for operation {operation}. Only one of them may be used." ) class UnknownServiceStyle(BotoCoreError): """ Unknown style of service invocation. :ivar service_style: The style requested. """ fmt = 'The service style ({service_style}) is not understood.' class PaginationError(BotoCoreError): fmt = 'Error during pagination: {message}' class OperationNotPageableError(BotoCoreError): fmt = 'Operation cannot be paginated: {operation_name}' class ChecksumError(BotoCoreError): """The expected checksum did not match the calculated checksum.""" fmt = ( 'Checksum {checksum_type} failed, expected checksum ' '{expected_checksum} did not match calculated checksum ' '{actual_checksum}.' ) class UnseekableStreamError(BotoCoreError): """Need to seek a stream, but stream does not support seeking.""" fmt = ( 'Need to rewind the stream {stream_object}, but stream ' 'is not seekable.' ) class WaiterError(BotoCoreError): """Waiter failed to reach desired state.""" fmt = 'Waiter {name} failed: {reason}' def __init__(self, name, reason, last_response): super().__init__(name=name, reason=reason) self.last_response = last_response class IncompleteReadError(BotoCoreError): """HTTP response did not return expected number of bytes.""" fmt = ( '{actual_bytes} read, but total bytes ' 'expected is {expected_bytes}.' ) class InvalidExpressionError(BotoCoreError): """Expression is either invalid or too complex.""" fmt = 'Invalid expression {expression}: Only dotted lookups are supported.' class UnknownCredentialError(BotoCoreError): """Tried to insert before/after an unregistered credential type.""" fmt = 'Credential named {name} not found.' class WaiterConfigError(BotoCoreError): """Error when processing waiter configuration.""" fmt = 'Error processing waiter config: {error_msg}' class UnknownClientMethodError(BotoCoreError): """Error when trying to access a method on a client that does not exist.""" fmt = 'Client does not have method: {method_name}' class UnsupportedSignatureVersionError(BotoCoreError): """Error when trying to use an unsupported Signature Version.""" fmt = 'Signature version(s) are not supported: {signature_version}' class ClientError(Exception): MSG_TEMPLATE = ( 'An error occurred ({error_code}) when calling the {operation_name} ' 'operation{retry_info}: {error_message}' ) def __init__(self, error_response, operation_name): retry_info = self._get_retry_info(error_response) error = error_response.get('Error', {}) msg = self.MSG_TEMPLATE.format( error_code=error.get('Code', 'Unknown'), error_message=error.get('Message', 'Unknown'), operation_name=operation_name, retry_info=retry_info, ) super().__init__(msg) self.response = error_response self.operation_name = operation_name def _get_retry_info(self, response): retry_info = '' if 'ResponseMetadata' in response: metadata = response['ResponseMetadata'] if metadata.get('MaxAttemptsReached', False): if 'RetryAttempts' in metadata: retry_info = ( f" (reached max retries: {metadata['RetryAttempts']})" ) return retry_info def __reduce__(self): # Subclasses of ClientError's are dynamically generated and # cannot be pickled unless they are attributes of a # module. So at the very least return a ClientError back. return ClientError, (self.response, self.operation_name) class EventStreamError(ClientError): pass class UnsupportedTLSVersionWarning(Warning): """Warn when an openssl version that uses TLS 1.2 is required""" pass class ImminentRemovalWarning(Warning): pass class InvalidDNSNameError(BotoCoreError): """Error when virtual host path is forced on a non-DNS compatible bucket""" fmt = ( 'Bucket named {bucket_name} is not DNS compatible. Virtual ' 'hosted-style addressing cannot be used. The addressing style ' 'can be configured by removing the addressing_style value ' 'or setting that value to \'path\' or \'auto\' in the AWS Config ' 'file or in the botocore.client.Config object.' ) class InvalidS3AddressingStyleError(BotoCoreError): """Error when an invalid path style is specified""" fmt = ( 'S3 addressing style {s3_addressing_style} is invalid. Valid options ' 'are: \'auto\', \'virtual\', and \'path\'' ) class UnsupportedS3ArnError(BotoCoreError): """Error when S3 ARN provided to Bucket parameter is not supported""" fmt = ( 'S3 ARN {arn} provided to "Bucket" parameter is invalid. Only ' 'ARNs for S3 access-points are supported.' ) class UnsupportedS3ControlArnError(BotoCoreError): """Error when S3 ARN provided to S3 control parameter is not supported""" fmt = 'S3 ARN "{arn}" provided is invalid for this operation. {msg}' class InvalidHostLabelError(BotoCoreError): """Error when an invalid host label would be bound to an endpoint""" fmt = ( 'Invalid host label to be bound to the hostname of the endpoint: ' '"{label}".' ) class UnsupportedOutpostResourceError(BotoCoreError): """Error when S3 Outpost ARN provided to Bucket parameter is incomplete""" fmt = ( 'S3 Outpost ARN resource "{resource_name}" provided to "Bucket" ' 'parameter is invalid. Only ARNs for S3 Outpost arns with an ' 'access-point sub-resource are supported.' ) class UnsupportedS3ConfigurationError(BotoCoreError): """Error when an unsupported configuration is used with access-points""" fmt = 'Unsupported configuration when using S3: {msg}' class UnsupportedS3AccesspointConfigurationError(BotoCoreError): """Error when an unsupported configuration is used with access-points""" fmt = 'Unsupported configuration when using S3 access-points: {msg}' class InvalidEndpointDiscoveryConfigurationError(BotoCoreError): """Error when invalid value supplied for endpoint_discovery_enabled""" fmt = ( 'Unsupported configuration value for endpoint_discovery_enabled. ' 'Expected one of ("true", "false", "auto") but got {config_value}.' ) class UnsupportedS3ControlConfigurationError(BotoCoreError): """Error when an unsupported configuration is used with S3 Control""" fmt = 'Unsupported configuration when using S3 Control: {msg}' class InvalidRetryConfigurationError(BotoCoreError): """Error when invalid retry configuration is specified""" fmt = ( 'Cannot provide retry configuration for "{retry_config_option}". ' 'Valid retry configuration options are: {valid_options}' ) class InvalidMaxRetryAttemptsError(InvalidRetryConfigurationError): """Error when invalid retry configuration is specified""" fmt = ( 'Value provided to "max_attempts": {provided_max_attempts} must ' 'be an integer greater than or equal to {min_value}.' ) class InvalidRetryModeError(InvalidRetryConfigurationError): """Error when invalid retry mode configuration is specified""" fmt = ( 'Invalid value provided to "mode": "{provided_retry_mode}" must ' 'be one of: {valid_modes}' ) class InvalidS3UsEast1RegionalEndpointConfigError(BotoCoreError): """Error for invalid s3 us-east-1 regional endpoints configuration""" fmt = ( 'S3 us-east-1 regional endpoint option ' '{s3_us_east_1_regional_endpoint_config} is ' 'invalid. Valid options are: "legacy", "regional"' ) class InvalidSTSRegionalEndpointsConfigError(BotoCoreError): """Error when invalid sts regional endpoints configuration is specified""" fmt = ( 'STS regional endpoints option {sts_regional_endpoints_config} is ' 'invalid. Valid options are: "legacy", "regional"' ) class StubResponseError(BotoCoreError): fmt = ( 'Error getting response stub for operation {operation_name}: {reason}' ) class StubAssertionError(StubResponseError, AssertionError): pass class UnStubbedResponseError(StubResponseError): pass class InvalidConfigError(BotoCoreError): fmt = '{error_msg}' class InfiniteLoopConfigError(InvalidConfigError): fmt = ( 'Infinite loop in credential configuration detected. Attempting to ' 'load from profile {source_profile} which has already been visited. ' 'Visited profiles: {visited_profiles}' ) class RefreshWithMFAUnsupportedError(BotoCoreError): fmt = 'Cannot refresh credentials: MFA token required.' class MD5UnavailableError(BotoCoreError): fmt = "This system does not support MD5 generation." class MissingDependencyException(BotoCoreError): fmt = "Missing Dependency: {msg}" class MetadataRetrievalError(BotoCoreError): fmt = "Error retrieving metadata: {error_msg}" class UndefinedModelAttributeError(Exception): pass class MissingServiceIdError(UndefinedModelAttributeError): fmt = ( "The model being used for the service {service_name} is missing the " "serviceId metadata property, which is required." ) def __init__(self, kwargs): msg = self.fmt.format(*kwargs) Exception.__init__(self, msg) self.kwargs = kwargs class SSOError(BotoCoreError): fmt = ( "An unspecified error happened when resolving AWS credentials or an " "access token from SSO." ) class SSOTokenLoadError(SSOError): fmt = "Error loading SSO Token: {error_msg}" class UnauthorizedSSOTokenError(SSOError): fmt = ( "The SSO session associated with this profile has expired or is " "otherwise invalid. To refresh this SSO session run aws sso login " "with the corresponding profile." ) class CapacityNotAvailableError(BotoCoreError): fmt = 'Insufficient request capacity available.' class InvalidProxiesConfigError(BotoCoreError): fmt = 'Invalid configuration value(s) provided for proxies_config.' class InvalidDefaultsMode(BotoCoreError): fmt = ( 'Client configured with invalid defaults mode: {mode}. ' 'Valid defaults modes include: {valid_modes}.' ) class AwsChunkedWrapperError(BotoCoreError): fmt = '{error_msg}' class FlexibleChecksumError(BotoCoreError): fmt = '{error_msg}' class InvalidEndpointConfigurationError(BotoCoreError): fmt = 'Invalid endpoint configuration: {msg}' class EndpointProviderError(BotoCoreError): """Base error for the EndpointProvider class""" fmt = '{msg}' class EndpointResolutionError(EndpointProviderError): """Error when input parameters resolve to an error rule""" fmt = '{msg}' class UnknownEndpointResolutionBuiltInName(EndpointProviderError): fmt = 'Unknown builtin variable name: {name}' class InvalidChecksumConfigError(BotoCoreError): """Error when an invalid checksum config value is supplied.""" fmt = ( 'Unsupported configuration value for {config_key}. ' 'Expected one of {valid_options} but got {config_value}.' ) class UnsupportedServiceProtocolsError(BotoCoreError): """Error when a service does not use any protocol supported by botocore.""" fmt = ( 'Botocore supports {botocore_supported_protocols}, but service {service} only ' 'supports {service_supported_protocols}.' )	22.82 KB	2025-05-25 12:26
📄 handlers.py # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Builtin event handlers. This module contains builtin handlers for events emitted by botocore. """ import base64 import copy import logging import os import re import uuid import warnings from io import BytesIO import botocore import botocore.auth from botocore import utils from botocore.compat import ( ETree, OrderedDict, XMLParseError, ensure_bytes, get_md5, json, quote, unquote, unquote_str, urlsplit, urlunsplit, ) from botocore.docs.utils import ( AppendParamDocumentation, AutoPopulatedParam, HideParamFromOperations, ) from botocore.endpoint_provider import VALID_HOST_LABEL_RE from botocore.exceptions import ( AliasConflictParameterError, ParamValidationError, UnsupportedTLSVersionWarning, ) from botocore.regions import EndpointResolverBuiltins from botocore.signers import ( add_dsql_generate_db_auth_token_methods, add_generate_db_auth_token, add_generate_presigned_post, add_generate_presigned_url, ) from botocore.utils import ( SAFE_CHARS, ArnParser, percent_encode, switch_host_with_param, ) # Keep these imported. There's pre-existing code that uses them. from botocore import retryhandler # noqa from botocore import translate # noqa from botocore.compat import MD5_AVAILABLE # noqa from botocore.exceptions import MissingServiceIdError # noqa from botocore.utils import hyphenize_service_id # noqa from botocore.utils import is_global_accesspoint # noqa from botocore.utils import SERVICE_NAME_ALIASES # noqa logger = logging.getLogger(__name__) REGISTER_FIRST = object() REGISTER_LAST = object() # From the S3 docs: # The rules for bucket names in the US Standard region allow bucket names # to be as long as 255 characters, and bucket names can contain any # combination of uppercase letters, lowercase letters, numbers, periods # (.), hyphens (-), and underscores (_). VALID_BUCKET = re.compile(r'^[a-zA-Z0-9.\-_]{1,255}$') _ACCESSPOINT_ARN = ( r'^arn:(aws).:(s3\|s3-object-lambda):[a-z\-0-9]:[0-9]{12}:accesspoint[/:]' r'[a-zA-Z0-9\-.]{1,63}$' ) _OUTPOST_ARN = ( r'^arn:(aws).:s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:]' r'[a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$' ) VALID_S3_ARN = re.compile('\|'.join([_ACCESSPOINT_ARN, _OUTPOST_ARN])) # signing names used for the services s3 and s3-control, for example in # botocore/data/s3/2006-03-01/endpoints-rule-set-1.json S3_SIGNING_NAMES = ('s3', 's3-outposts', 's3-object-lambda', 's3express') VERSION_ID_SUFFIX = re.compile(r'\?versionId=[^\s]+$') def handle_service_name_alias(service_name, kwargs): return SERVICE_NAME_ALIASES.get(service_name, service_name) def add_recursion_detection_header(params, kwargs): has_lambda_name = 'AWS_LAMBDA_FUNCTION_NAME' in os.environ trace_id = os.environ.get('_X_AMZN_TRACE_ID') if has_lambda_name and trace_id: headers = params['headers'] if 'X-Amzn-Trace-Id' not in headers: headers['X-Amzn-Trace-Id'] = quote(trace_id, safe='-=;:+&[]{}"\',') def escape_xml_payload(params, kwargs): # Replace \r and \n with the escaped sequence over the whole XML document # to avoid linebreak normalization modifying customer input when the # document is parsed. Ideally, we would do this in ElementTree.tostring, # but it doesn't allow us to override entity escaping for text fields. For # this operation \r and \n can only appear in the XML document if they were # passed as part of the customer input. body = params['body'] if b'\r' in body: body = body.replace(b'\r', b' ') if b'\n' in body: body = body.replace(b'\n', b' ') params['body'] = body def check_for_200_error(response, kwargs): """This function has been deprecated, but is kept for backwards compatibility.""" # From: http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectCOPY.html # There are two opportunities for a copy request to return an error. One # can occur when Amazon S3 receives the copy request and the other can # occur while Amazon S3 is copying the files. If the error occurs before # the copy operation starts, you receive a standard Amazon S3 error. If the # error occurs during the copy operation, the error response is embedded in # the 200 OK response. This means that a 200 OK response can contain either # a success or an error. Make sure to design your application to parse the # contents of the response and handle it appropriately. # # So this handler checks for this case. Even though the server sends a # 200 response, conceptually this should be handled exactly like a # 500 response (with respect to raising exceptions, retries, etc.) # We're connected before* all the other retry logic handlers, so as long # as we switch the error code to 500, we'll retry the error as expected. if response is None: # A None response can happen if an exception is raised while # trying to retrieve the response. See Endpoint._get_response(). return http_response, parsed = response if _looks_like_special_case_error( http_response.status_code, http_response.content ): logger.debug( "Error found for response with 200 status code, " "errors: %s, changing status code to " "500.", parsed, ) http_response.status_code = 500 def _looks_like_special_case_error(status_code, body): if status_code == 200 and body: try: parser = ETree.XMLParser( target=ETree.TreeBuilder(), encoding='utf-8' ) parser.feed(body) root = parser.close() except XMLParseError: # In cases of network disruptions, we may end up with a partial # streamed response from S3. We need to treat these cases as # 500 Service Errors and try again. return True if root.tag == 'Error': return True return False def set_operation_specific_signer(context, signing_name, *kwargs): """Choose the operation-specific signer. Individual operations may have a different auth type than the service as a whole. This will most often manifest as operations that should not be authenticated at all, but can include other auth modes such as sigv4 without body signing. """ auth_type = context.get('auth_type') # Auth type will be None if the operation doesn't have a configured auth # type. if not auth_type: return # Auth type will be the string value 'none' if the operation should not # be signed at all. if auth_type == 'none': return botocore.UNSIGNED if auth_type == 'bearer': return 'bearer' # If the operation needs an unsigned body, we set additional context # allowing the signer to be aware of this. if context.get('unsigned_payload') or auth_type == 'v4-unsigned-body': context['payload_signing_enabled'] = False if auth_type.startswith('v4'): if auth_type == 'v4-s3express': return auth_type if auth_type == 'v4a': # If sigv4a is chosen, we must add additional signing config for # global signature. region = _resolve_sigv4a_region(context) signing = {'region': region, 'signing_name': signing_name} if 'signing' in context: context['signing'].update(signing) else: context['signing'] = signing signature_version = 'v4a' else: signature_version = 'v4' # Signing names used by s3 and s3-control use customized signers "s3v4" # and "s3v4a". if signing_name in S3_SIGNING_NAMES: signature_version = f's3{signature_version}' return signature_version def _resolve_sigv4a_region(context): region = None if 'client_config' in context: region = context['client_config'].sigv4a_signing_region_set if not region and context.get('signing', {}).get('region'): region = context['signing']['region'] return region or '' def decode_console_output(parsed, kwargs): if 'Output' in parsed: try: # We're using 'replace' for errors because it is # possible that console output contains non string # chars we can't utf-8 decode. value = base64.b64decode( bytes(parsed['Output'], 'latin-1') ).decode('utf-8', 'replace') parsed['Output'] = value except (ValueError, TypeError, AttributeError): logger.debug('Error decoding base64', exc_info=True) def generate_idempotent_uuid(params, model, kwargs): for name in model.idempotent_members: if name not in params: params[name] = str(uuid.uuid4()) logger.debug( f"injecting idempotency token ({params[name]}) into param '{name}'." ) def decode_quoted_jsondoc(value): try: value = json.loads(unquote(value)) except (ValueError, TypeError): logger.debug('Error loading quoted JSON', exc_info=True) return value def json_decode_template_body(parsed, kwargs): if 'TemplateBody' in parsed: try: value = json.loads( parsed['TemplateBody'], object_pairs_hook=OrderedDict ) parsed['TemplateBody'] = value except (ValueError, TypeError): logger.debug('error loading JSON', exc_info=True) def validate_bucket_name(params, kwargs): if 'Bucket' not in params: return bucket = params['Bucket'] if not VALID_BUCKET.search(bucket) and not VALID_S3_ARN.search(bucket): error_msg = ( f'Invalid bucket name "{bucket}": Bucket name must match ' f'the regex "{VALID_BUCKET.pattern}" or be an ARN matching ' f'the regex "{VALID_S3_ARN.pattern}"' ) raise ParamValidationError(report=error_msg) def sse_md5(params, kwargs): """ S3 server-side encryption requires the encryption key to be sent to the server base64 encoded, as well as a base64-encoded MD5 hash of the encryption key. This handler does both if the MD5 has not been set by the caller. """ _sse_md5(params, 'SSECustomer') def copy_source_sse_md5(params, kwargs): """ S3 server-side encryption requires the encryption key to be sent to the server base64 encoded, as well as a base64-encoded MD5 hash of the encryption key. This handler does both if the MD5 has not been set by the caller specifically if the parameter is for the copy-source sse-c key. """ _sse_md5(params, 'CopySourceSSECustomer') def _sse_md5(params, sse_member_prefix='SSECustomer'): if not _needs_s3_sse_customization(params, sse_member_prefix): return sse_key_member = sse_member_prefix + 'Key' sse_md5_member = sse_member_prefix + 'KeyMD5' key_as_bytes = params[sse_key_member] if isinstance(key_as_bytes, str): key_as_bytes = key_as_bytes.encode('utf-8') key_md5_str = base64.b64encode(get_md5(key_as_bytes).digest()).decode( 'utf-8' ) key_b64_encoded = base64.b64encode(key_as_bytes).decode('utf-8') params[sse_key_member] = key_b64_encoded params[sse_md5_member] = key_md5_str def _needs_s3_sse_customization(params, sse_member_prefix): return ( params.get(sse_member_prefix + 'Key') is not None and sse_member_prefix + 'KeyMD5' not in params ) def disable_signing(kwargs): """ This handler disables request signing by setting the signer name to a special sentinel value. """ return botocore.UNSIGNED def add_expect_header(model, params, kwargs): if model.http.get('method', '') not in ['PUT', 'POST']: return if 'body' in params: body = params['body'] if hasattr(body, 'read'): check_body = utils.ensure_boolean( os.environ.get( 'BOTO_EXPERIMENTAL__NO_EMPTY_CONTINUE', False, ) ) if check_body and utils.determine_content_length(body) == 0: return # Any file like object will use an expect 100-continue # header regardless of size. logger.debug("Adding expect 100 continue header to request.") params['headers']['Expect'] = '100-continue' class DeprecatedServiceDocumenter: def __init__(self, replacement_service_name): self._replacement_service_name = replacement_service_name def inject_deprecation_notice(self, section, event_name, kwargs): section.style.start_important() section.write('This service client is deprecated. Please use ') section.style.ref( self._replacement_service_name, self._replacement_service_name, ) section.write(' instead.') section.style.end_important() def document_copy_source_form(section, event_name, kwargs): if 'request-example' in event_name: parent = section.get_section('structure-value') param_line = parent.get_section('CopySource') value_portion = param_line.get_section('member-value') value_portion.clear_text() value_portion.write( "'string' or {'Bucket': 'string', " "'Key': 'string', 'VersionId': 'string'}" ) elif 'request-params' in event_name: param_section = section.get_section('CopySource') type_section = param_section.get_section('param-type') type_section.clear_text() type_section.write(':type CopySource: str or dict') doc_section = param_section.get_section('param-documentation') doc_section.clear_text() doc_section.write( "The name of the source bucket, key name of the source object, " "and optional version ID of the source object. You can either " "provide this value as a string or a dictionary. The " "string form is {bucket}/{key} or " "{bucket}/{key}?versionId={versionId} if you want to copy a " "specific version. You can also provide this value as a " "dictionary. The dictionary format is recommended over " "the string format because it is more explicit. The dictionary " "format is: {'Bucket': 'bucket', 'Key': 'key', 'VersionId': 'id'}." " Note that the VersionId key is optional and may be omitted." " To specify an S3 access point, provide the access point" " ARN for the ``Bucket`` key in the copy source dictionary. If you" " want to provide the copy source for an S3 access point as a" " string instead of a dictionary, the ARN provided must be the" " full S3 access point object ARN" " (i.e. {accesspoint_arn}/object/{key})" ) def handle_copy_source_param(params, *kwargs): """Convert CopySource param for CopyObject/UploadPartCopy. This handler will deal with two cases: CopySource provided as a string. We'll make a best effort to URL encode the key name as required. This will require parsing the bucket and version id from the CopySource value and only encoding the key. * CopySource provided as a dict. In this case we're explicitly given the Bucket, Key, and VersionId so we're able to encode the key and ensure this value is serialized and correctly sent to S3. """ source = params.get('CopySource') if source is None: # The call will eventually fail but we'll let the # param validator take care of this. It will # give a better error message. return if isinstance(source, str): params['CopySource'] = _quote_source_header(source) elif isinstance(source, dict): params['CopySource'] = _quote_source_header_from_dict(source) def _quote_source_header_from_dict(source_dict): try: bucket = source_dict['Bucket'] key = source_dict['Key'] version_id = source_dict.get('VersionId') if VALID_S3_ARN.search(bucket): final = f'{bucket}/object/{key}' else: final = f'{bucket}/{key}' except KeyError as e: raise ParamValidationError( report=f'Missing required parameter: {str(e)}' ) final = percent_encode(final, safe=SAFE_CHARS + '/') if version_id is not None: final += f'?versionId={version_id}' return final def _quote_source_header(value): result = VERSION_ID_SUFFIX.search(value) if result is None: return percent_encode(value, safe=SAFE_CHARS + '/') else: first, version_id = value[: result.start()], value[result.start() :] return percent_encode(first, safe=SAFE_CHARS + '/') + version_id def _get_cross_region_presigned_url( request_signer, request_dict, model, source_region, destination_region ): # The better way to do this is to actually get the # endpoint_resolver and get the endpoint_url given the # source region. In this specific case, we know that # we can safely replace the dest region with the source # region because of the supported EC2 regions, but in # general this is not a safe assumption to make. # I think eventually we should try to plumb through something # that allows us to resolve endpoints from regions. request_dict_copy = copy.deepcopy(request_dict) request_dict_copy['body']['DestinationRegion'] = destination_region request_dict_copy['url'] = request_dict['url'].replace( destination_region, source_region ) request_dict_copy['method'] = 'GET' request_dict_copy['headers'] = {} return request_signer.generate_presigned_url( request_dict_copy, region_name=source_region, operation_name=model.name ) def _get_presigned_url_source_and_destination_regions(request_signer, params): # Gets the source and destination regions to be used destination_region = request_signer._region_name source_region = params.get('SourceRegion') return source_region, destination_region def inject_presigned_url_ec2(params, request_signer, model, kwargs): # The customer can still provide this, so we should pass if they do. if 'PresignedUrl' in params['body']: return src, dest = _get_presigned_url_source_and_destination_regions( request_signer, params['body'] ) url = _get_cross_region_presigned_url( request_signer, params, model, src, dest ) params['body']['PresignedUrl'] = url # EC2 Requires that the destination region be sent over the wire in # addition to the source region. params['body']['DestinationRegion'] = dest def inject_presigned_url_rds(params, request_signer, model, kwargs): # SourceRegion is not required for RDS operations, so it's possible that # it isn't set. In that case it's probably a local copy so we don't need # to do anything else. if 'SourceRegion' not in params['body']: return src, dest = _get_presigned_url_source_and_destination_regions( request_signer, params['body'] ) # Since SourceRegion isn't actually modeled for RDS, it needs to be # removed from the request params before we send the actual request. del params['body']['SourceRegion'] if 'PreSignedUrl' in params['body']: return url = _get_cross_region_presigned_url( request_signer, params, model, src, dest ) params['body']['PreSignedUrl'] = url def json_decode_policies(parsed, model, kwargs): # Any time an IAM operation returns a policy document # it is a string that is json that has been urlencoded, # i.e urlencode(json.dumps(policy_document)). # To give users something more useful, we will urldecode # this value and json.loads() the result so that they have # the policy document as a dictionary. output_shape = model.output_shape if output_shape is not None: _decode_policy_types(parsed, model.output_shape) def _decode_policy_types(parsed, shape): # IAM consistently uses the policyDocumentType shape to indicate # strings that have policy documents. shape_name = 'policyDocumentType' if shape.type_name == 'structure': for member_name, member_shape in shape.members.items(): if ( member_shape.type_name == 'string' and member_shape.name == shape_name and member_name in parsed ): parsed[member_name] = decode_quoted_jsondoc( parsed[member_name] ) elif member_name in parsed: _decode_policy_types(parsed[member_name], member_shape) if shape.type_name == 'list': shape_member = shape.member for item in parsed: _decode_policy_types(item, shape_member) def parse_get_bucket_location(parsed, http_response, kwargs): # s3.GetBucketLocation cannot be modeled properly. To # account for this we just manually parse the XML document. # The "parsed" passed in only has the ResponseMetadata # filled out. This handler will fill in the LocationConstraint # value. if http_response.raw is None: return response_body = http_response.content parser = ETree.XMLParser(target=ETree.TreeBuilder(), encoding='utf-8') parser.feed(response_body) root = parser.close() region = root.text parsed['LocationConstraint'] = region def base64_encode_user_data(params, kwargs): if 'UserData' in params: if isinstance(params['UserData'], str): # Encode it to bytes if it is text. params['UserData'] = params['UserData'].encode('utf-8') params['UserData'] = base64.b64encode(params['UserData']).decode( 'utf-8' ) def document_base64_encoding(param): description = ( 'This value will be base64 encoded automatically. Do ' 'not base64 encode this value prior to performing the ' 'operation.' ) append = AppendParamDocumentation(param, description) return append.append_documentation def validate_ascii_metadata(params, kwargs): """Verify S3 Metadata only contains ascii characters. From: http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadata.html "Amazon S3 stores user-defined metadata in lowercase. Each name, value pair must conform to US-ASCII when using REST and UTF-8 when using SOAP or browser-based uploads via POST." """ metadata = params.get('Metadata') if not metadata or not isinstance(metadata, dict): # We have to at least type check the metadata as a dict type # because this handler is called before param validation. # We'll go ahead and return because the param validator will # give a descriptive error message for us. # We might need a post-param validation event. return for key, value in metadata.items(): try: key.encode('ascii') value.encode('ascii') except UnicodeEncodeError: error_msg = ( 'Non ascii characters found in S3 metadata ' f'for key "{key}", value: "{value}". \nS3 metadata can only ' 'contain ASCII characters. ' ) raise ParamValidationError(report=error_msg) def fix_route53_ids(params, model, kwargs): """ Check for and split apart Route53 resource IDs, setting only the last piece. This allows the output of one operation (e.g. ``'foo/1234'``) to be used as input in another operation (e.g. it expects just ``'1234'``). """ input_shape = model.input_shape if not input_shape or not hasattr(input_shape, 'members'): return members = [ name for (name, shape) in input_shape.members.items() if shape.name in ['ResourceId', 'DelegationSetId', 'ChangeId'] ] for name in members: if name in params: orig_value = params[name] params[name] = orig_value.split('/')[-1] logger.debug('%s %s -> %s', name, orig_value, params[name]) def inject_account_id(params, kwargs): if params.get('accountId') is None: # Glacier requires accountId, but allows you # to specify '-' for the current owners account. # We add this default value if the user does not # provide the accountId as a convenience. params['accountId'] = '-' def add_glacier_version(model, params, kwargs): request_dict = params request_dict['headers']['x-amz-glacier-version'] = model.metadata[ 'apiVersion' ] def add_accept_header(model, params, kwargs): if params['headers'].get('Accept', None) is None: request_dict = params request_dict['headers']['Accept'] = 'application/json' def add_glacier_checksums(params, *kwargs): """Add glacier checksums to the http request. This will add two headers to the http request: x-amz-content-sha256 * x-amz-sha256-tree-hash These values will only be added if they are not present in the HTTP request. """ request_dict = params headers = request_dict['headers'] body = request_dict['body'] if isinstance(body, bytes): # If the user provided a bytes type instead of a file # like object, we're temporarily create a BytesIO object # so we can use the util functions to calculate the # checksums which assume file like objects. Note that # we're not actually changing the body in the request_dict. body = BytesIO(body) starting_position = body.tell() if 'x-amz-content-sha256' not in headers: headers['x-amz-content-sha256'] = utils.calculate_sha256( body, as_hex=True ) body.seek(starting_position) if 'x-amz-sha256-tree-hash' not in headers: headers['x-amz-sha256-tree-hash'] = utils.calculate_tree_hash(body) body.seek(starting_position) def document_glacier_tree_hash_checksum(): doc = ''' This is a required field. Ideally you will want to compute this value with checksums from previous uploaded parts, using the algorithm described in `Glacier documentation <http://docs.aws.amazon.com/amazonglacier/latest/dev/checksum-calculations.html>`_. But if you prefer, you can also use botocore.utils.calculate_tree_hash() to compute it from raw file by:: checksum = calculate_tree_hash(open('your_file.txt', 'rb')) ''' return AppendParamDocumentation('checksum', doc).append_documentation def document_cloudformation_get_template_return_type( section, event_name, *kwargs ): if 'response-params' in event_name: template_body_section = section.get_section('TemplateBody') type_section = template_body_section.get_section('param-type') type_section.clear_text() type_section.write('(dict) --') elif 'response-example' in event_name: parent = section.get_section('structure-value') param_line = parent.get_section('TemplateBody') value_portion = param_line.get_section('member-value') value_portion.clear_text() value_portion.write('{}') def switch_host_machinelearning(request, kwargs): switch_host_with_param(request, 'PredictEndpoint') def check_openssl_supports_tls_version_1_2(kwargs): import ssl try: openssl_version_tuple = ssl.OPENSSL_VERSION_INFO if openssl_version_tuple < (1, 0, 1): warnings.warn( f'Currently installed openssl version: {ssl.OPENSSL_VERSION} does not ' 'support TLS 1.2, which is required for use of iot-data. ' 'Please use python installed with openssl version 1.0.1 or ' 'higher.', UnsupportedTLSVersionWarning, ) # We cannot check the openssl version on python2.6, so we should just # pass on this conveniency check. except AttributeError: pass def change_get_to_post(request, kwargs): # This is useful when we need to change a potentially large GET request # into a POST with x-www-form-urlencoded encoding. if request.method == 'GET' and '?' in request.url: request.headers['Content-Type'] = 'application/x-www-form-urlencoded' request.method = 'POST' request.url, request.data = request.url.split('?', 1) def set_list_objects_encoding_type_url(params, context, kwargs): if 'EncodingType' not in params: # We set this context so that we know it wasn't the customer that # requested the encoding. context['encoding_type_auto_set'] = True params['EncodingType'] = 'url' def decode_list_object(parsed, context, kwargs): # This is needed because we are passing url as the encoding type. Since the # paginator is based on the key, we need to handle it before it can be # round tripped. # # From the documentation: If you specify encoding-type request parameter, # Amazon S3 includes this element in the response, and returns encoded key # name values in the following response elements: # Delimiter, Marker, Prefix, NextMarker, Key. _decode_list_object( top_level_keys=['Delimiter', 'Marker', 'NextMarker'], nested_keys=[('Contents', 'Key'), ('CommonPrefixes', 'Prefix')], parsed=parsed, context=context, ) def decode_list_object_v2(parsed, context, kwargs): # From the documentation: If you specify encoding-type request parameter, # Amazon S3 includes this element in the response, and returns encoded key # name values in the following response elements: # Delimiter, Prefix, ContinuationToken, Key, and StartAfter. _decode_list_object( top_level_keys=['Delimiter', 'Prefix', 'StartAfter'], nested_keys=[('Contents', 'Key'), ('CommonPrefixes', 'Prefix')], parsed=parsed, context=context, ) def decode_list_object_versions(parsed, context, kwargs): # From the documentation: If you specify encoding-type request parameter, # Amazon S3 includes this element in the response, and returns encoded key # name values in the following response elements: # KeyMarker, NextKeyMarker, Prefix, Key, and Delimiter. _decode_list_object( top_level_keys=[ 'KeyMarker', 'NextKeyMarker', 'Prefix', 'Delimiter', ], nested_keys=[ ('Versions', 'Key'), ('DeleteMarkers', 'Key'), ('CommonPrefixes', 'Prefix'), ], parsed=parsed, context=context, ) def _decode_list_object(top_level_keys, nested_keys, parsed, context): if parsed.get('EncodingType') == 'url' and context.get( 'encoding_type_auto_set' ): # URL decode top-level keys in the response if present. for key in top_level_keys: if key in parsed: parsed[key] = unquote_str(parsed[key]) # URL decode nested keys from the response if present. for top_key, child_key in nested_keys: if top_key in parsed: for member in parsed[top_key]: member[child_key] = unquote_str(member[child_key]) def convert_body_to_file_like_object(params, kwargs): if 'Body' in params: if isinstance(params['Body'], str): params['Body'] = BytesIO(ensure_bytes(params['Body'])) elif isinstance(params['Body'], bytes): params['Body'] = BytesIO(params['Body']) def _add_parameter_aliases(handler_list): # Mapping of original parameter to parameter alias. # The key is <service>.<operation>.parameter # The first part of the key is used for event registration. # The last part is the original parameter name and the value is the # alias to expose in documentation. aliases = { 'ec2..Filter': 'Filters', 'logs.CreateExportTask.from': 'fromTime', 'cloudsearchdomain.Search.return': 'returnFields', } for original, new_name in aliases.items(): event_portion, original_name = original.rsplit('.', 1) parameter_alias = ParameterAlias(original_name, new_name) # Add the handlers to the list of handlers. # One handler is to handle when users provide the alias. # The other handler is to update the documentation to show only # the alias. parameter_build_event_handler_tuple = ( 'before-parameter-build.' + event_portion, parameter_alias.alias_parameter_in_call, REGISTER_FIRST, ) docs_event_handler_tuple = ( 'docs..' + event_portion + '.complete-section', parameter_alias.alias_parameter_in_documentation, ) handler_list.append(parameter_build_event_handler_tuple) handler_list.append(docs_event_handler_tuple) class ParameterAlias: def __init__(self, original_name, alias_name): self._original_name = original_name self._alias_name = alias_name def alias_parameter_in_call(self, params, model, kwargs): if model.input_shape: # Only consider accepting the alias if it is modeled in the # input shape. if self._original_name in model.input_shape.members: if self._alias_name in params: if self._original_name in params: raise AliasConflictParameterError( original=self._original_name, alias=self._alias_name, operation=model.name, ) # Remove the alias parameter value and use the old name # instead. params[self._original_name] = params.pop(self._alias_name) def alias_parameter_in_documentation(self, event_name, section, kwargs): if event_name.startswith('docs.request-params'): if self._original_name not in section.available_sections: return # Replace the name for parameter type param_section = section.get_section(self._original_name) param_type_section = param_section.get_section('param-type') self._replace_content(param_type_section) # Replace the name for the parameter description param_name_section = param_section.get_section('param-name') self._replace_content(param_name_section) elif event_name.startswith('docs.request-example'): section = section.get_section('structure-value') if self._original_name not in section.available_sections: return # Replace the name for the example param_section = section.get_section(self._original_name) self._replace_content(param_section) def _replace_content(self, section): content = section.getvalue().decode('utf-8') updated_content = content.replace( self._original_name, self._alias_name ) section.clear_text() section.write(updated_content) class ClientMethodAlias: def __init__(self, actual_name): """Aliases a non-extant method to an existing method. :param actual_name: The name of the method that actually exists on the client. """ self._actual = actual_name def __call__(self, client, kwargs): return getattr(client, self._actual) # TODO: Remove this class as it is no longer used class HeaderToHostHoister: """Takes a header and moves it to the front of the hoststring.""" _VALID_HOSTNAME = re.compile(r'(?!-)[a-z\d-]{1,63}(?<!-)$', re.IGNORECASE) def __init__(self, header_name): self._header_name = header_name def hoist(self, params, kwargs): """Hoist a header to the hostname. Hoist a header to the beginning of the hostname with a suffix "." after it. The original header should be removed from the header map. This method is intended to be used as a target for the before-call event. """ if self._header_name not in params['headers']: return header_value = params['headers'][self._header_name] self._ensure_header_is_valid_host(header_value) original_url = params['url'] new_url = self._prepend_to_host(original_url, header_value) params['url'] = new_url def _ensure_header_is_valid_host(self, header): match = self._VALID_HOSTNAME.match(header) if not match: raise ParamValidationError( report=( 'Hostnames must contain only - and alphanumeric characters, ' 'and between 1 and 63 characters long.' ) ) def _prepend_to_host(self, url, prefix): url_components = urlsplit(url) parts = url_components.netloc.split('.') parts = [prefix] + parts new_netloc = '.'.join(parts) new_components = ( url_components.scheme, new_netloc, url_components.path, url_components.query, '', ) new_url = urlunsplit(new_components) return new_url def inject_api_version_header_if_needed(model, params, kwargs): if not model.is_endpoint_discovery_operation: return params['headers']['x-amz-api-version'] = model.service_model.api_version def remove_lex_v2_start_conversation(class_attributes, kwargs): """Operation requires h2 which is currently unsupported in Python""" if 'start_conversation' in class_attributes: del class_attributes['start_conversation'] def remove_qbusiness_chat(class_attributes, kwargs): """Operation requires h2 which is currently unsupported in Python""" if 'chat' in class_attributes: del class_attributes['chat'] def remove_bedrock_runtime_invoke_model_with_bidirectional_stream( class_attributes, kwargs ): """Operation requires h2 which is currently unsupported in Python""" if 'invoke_model_with_bidirectional_stream' in class_attributes: del class_attributes['invoke_model_with_bidirectional_stream'] def add_retry_headers(request, kwargs): retries_context = request.context.get('retries') if not retries_context: return headers = request.headers headers['amz-sdk-invocation-id'] = retries_context['invocation-id'] sdk_retry_keys = ('ttl', 'attempt', 'max') sdk_request_headers = [ f'{key}={retries_context[key]}' for key in sdk_retry_keys if key in retries_context ] headers['amz-sdk-request'] = '; '.join(sdk_request_headers) def remove_bucket_from_url_paths_from_model(params, model, context, kwargs): """Strips leading `{Bucket}/` from any operations that have it. The original value is retained in a separate "authPath" field. This is used in the HmacV1Auth signer. See HmacV1Auth.canonical_resource in botocore/auth.py for details. This change is applied to the operation model during the first time the operation is invoked and then stays in effect for the lifetime of the client object. When the ruleset based endpoint resolver is in effect, both the endpoint ruleset AND the service model place the bucket name in the final URL. The result is an invalid URL. This handler modifies the operation model to no longer place the bucket name. Previous versions of botocore fixed the URL after the fact when necessary. Since the introduction of ruleset based endpoint resolution, the problem exists in ALL URLs that contain a bucket name and can therefore be addressed before the URL gets assembled. """ req_uri = model.http['requestUri'] bucket_path = '/{Bucket}' if req_uri.startswith(bucket_path): model.http['requestUri'] = req_uri[len(bucket_path) :] # Strip query off the requestUri before using as authPath. The # HmacV1Auth signer will append query params to the authPath during # signing. req_uri = req_uri.split('?')[0] # If the request URI is ONLY a bucket, the auth_path must be # terminated with a '/' character to generate a signature that the # server will accept. needs_slash = req_uri == bucket_path model.http['authPath'] = f'{req_uri}/' if needs_slash else req_uri def remove_accid_host_prefix_from_model(params, model, context, kwargs): """Removes the `{AccountId}.` prefix from the operation model. This change is applied to the operation model during the first time the operation is invoked and then stays in effect for the lifetime of the client object. When the ruleset based endpoint resolver is in effect, both the endpoint ruleset AND the service model place the {AccountId}. prefix in the URL. The result is an invalid endpoint. This handler modifies the operation model to remove the `endpoint.hostPrefix` field while leaving the `RequiresAccountId` static context parameter in place. """ has_ctx_param = any( ctx_param.name == 'RequiresAccountId' and ctx_param.value is True for ctx_param in model.static_context_parameters ) if ( model.endpoint is not None and model.endpoint.get('hostPrefix') == '{AccountId}.' and has_ctx_param ): del model.endpoint['hostPrefix'] def remove_arn_from_signing_path(request, kwargs): auth_path = request.auth_path if isinstance(auth_path, str) and auth_path.startswith('/arn%3A'): auth_path_parts = auth_path.split('/') if len(auth_path_parts) > 1 and ArnParser.is_arn( unquote(auth_path_parts[1]) ): request.auth_path = '/'.join(['', auth_path_parts[2:]]) def customize_endpoint_resolver_builtins( builtins, model, params, context, kwargs ): """Modify builtin parameter values for endpoint resolver Modifies the builtins dict in place. Changes are in effect for one call. The corresponding event is emitted only if at least one builtin parameter value is required for endpoint resolution for the operation. """ bucket_name = params.get('Bucket') bucket_is_arn = bucket_name is not None and ArnParser.is_arn(bucket_name) # In some situations the host will return AuthorizationHeaderMalformed # when the signing region of a sigv4 request is not the bucket's # region (which is likely unknown by the user of GetBucketLocation). # Avoid this by always using path-style addressing. if model.name == 'GetBucketLocation': builtins[EndpointResolverBuiltins.AWS_S3_FORCE_PATH_STYLE] = True # All situations where the bucket name is an ARN are not compatible # with path style addressing. elif bucket_is_arn: builtins[EndpointResolverBuiltins.AWS_S3_FORCE_PATH_STYLE] = False # Bucket names that are invalid host labels require path-style addressing. # If path-style addressing was specifically requested, the default builtin # value is already set. path_style_required = ( bucket_name is not None and not VALID_HOST_LABEL_RE.match(bucket_name) ) path_style_requested = builtins[ EndpointResolverBuiltins.AWS_S3_FORCE_PATH_STYLE ] # Path-style addressing is incompatible with the global endpoint for # presigned URLs. If the bucket name is an ARN, the ARN's region should be # used in the endpoint. if ( context.get('use_global_endpoint') and not path_style_required and not path_style_requested and not bucket_is_arn and not utils.is_s3express_bucket(bucket_name) ): builtins[EndpointResolverBuiltins.AWS_REGION] = 'aws-global' builtins[EndpointResolverBuiltins.AWS_S3_USE_GLOBAL_ENDPOINT] = True def remove_content_type_header_for_presigning(request, kwargs): if ( request.context.get('is_presign_request') is True and 'Content-Type' in request.headers ): del request.headers['Content-Type'] def handle_expires_header( operation_model, response_dict, customized_response_dict, kwargs ): if _has_expires_shape(operation_model.output_shape): if expires_value := response_dict.get('headers', {}).get('Expires'): customized_response_dict['ExpiresString'] = expires_value try: utils.parse_timestamp(expires_value) except (ValueError, RuntimeError): logger.warning( f'Failed to parse the "Expires" member as a timestamp: {expires_value}. ' f'The unparsed value is available in the response under "ExpiresString".' ) del response_dict['headers']['Expires'] def _has_expires_shape(shape): if not shape: return False return any( member_shape.name == 'Expires' and member_shape.serialization.get('name') == 'Expires' for member_shape in shape.members.values() ) def document_expires_shape(section, event_name, kwargs): # Updates the documentation for S3 operations that include the 'Expires' member # in their response structure. Documents a synthetic member 'ExpiresString' and # includes a deprecation notice for 'Expires'. if 'response-example' in event_name: if not section.has_section('structure-value'): return parent = section.get_section('structure-value') if not parent.has_section('Expires'): return param_line = parent.get_section('Expires') param_line.add_new_section('ExpiresString') new_param_line = param_line.get_section('ExpiresString') new_param_line.write("'ExpiresString': 'string',") new_param_line.style.new_line() elif 'response-params' in event_name: if not section.has_section('Expires'): return param_section = section.get_section('Expires') # Add a deprecation notice for the "Expires" param doc_section = param_section.get_section('param-documentation') doc_section.style.start_note() doc_section.write( 'This member has been deprecated. Please use ``ExpiresString`` instead.' ) doc_section.style.end_note() # Document the "ExpiresString" param new_param_section = param_section.add_new_section('ExpiresString') new_param_section.style.new_paragraph() new_param_section.write('- ExpiresString (string) --') new_param_section.style.indent() new_param_section.style.new_paragraph() new_param_section.write( 'The raw, unparsed value of the ``Expires`` field.' ) def _handle_200_error(operation_model, response_dict, kwargs): # S3 can return a 200 response with an error embedded in the body. # Convert the 200 to a 500 for retry resolution in ``_update_status_code``. if not _should_handle_200_error(operation_model, response_dict): # Operations with streaming response blobs are excluded as they # can't be reliably distinguished from an S3 error. return if _looks_like_special_case_error( response_dict['status_code'], response_dict['body'] ): response_dict['status_code'] = 500 logger.debug( f"Error found for response with 200 status code: {response_dict['body']}." ) def _should_handle_200_error(operation_model, response_dict): output_shape = operation_model.output_shape if ( not response_dict or operation_model.has_event_stream_output or not output_shape ): return False payload = output_shape.serialization.get('payload') if payload is not None: payload_shape = output_shape.members[payload] if payload_shape.type_name in ('blob', 'string'): return False return True def _update_status_code(response, kwargs): # Update the http_response status code when the parsed response has been # modified in a handler. This enables retries for cases like ``_handle_200_error``. if response is None: return http_response, parsed = response parsed_status_code = parsed.get('ResponseMetadata', {}).get( 'HTTPStatusCode', http_response.status_code ) if http_response.status_code != parsed_status_code: http_response.status_code = parsed_status_code def add_query_compatibility_header(model, params, kwargs): if not model.service_model.is_query_compatible: return params['headers']['x-amzn-query-mode'] = 'true' def _handle_request_validation_mode_member(params, model, kwargs): client_config = kwargs.get("context", {}).get("client_config") if client_config is None: return response_checksum_validation = client_config.response_checksum_validation http_checksum = model.http_checksum mode_member = http_checksum.get("requestValidationModeMember") if ( mode_member is not None and response_checksum_validation == "when_supported" ): params.setdefault(mode_member, "ENABLED") def _set_extra_headers_for_unsigned_request( request, signature_version, *kwargs ): # When sending a checksum in the trailer of an unsigned chunked request, S3 # requires us to set the "X-Amz-Content-SHA256" header to "STREAMING-UNSIGNED-PAYLOAD-TRAILER". checksum_context = request.context.get("checksum", {}) algorithm = checksum_context.get("request_algorithm", {}) in_trailer = algorithm.get("in") == "trailer" headers = request.headers if signature_version == botocore.UNSIGNED and in_trailer: headers["X-Amz-Content-SHA256"] = "STREAMING-UNSIGNED-PAYLOAD-TRAILER" # This is a list of (event_name, handler). # When a Session is created, everything in this list will be # automatically registered with that Session. BUILTIN_HANDLERS = [ ('choose-service-name', handle_service_name_alias), ( 'getattr.mturk.list_hi_ts_for_qualification_type', ClientMethodAlias('list_hits_for_qualification_type'), ), ( 'getattr.socialmessaging.delete_whatsapp_media_message', ClientMethodAlias('delete_whatsapp_message_media'), ), ( 'before-parameter-build.s3.UploadPart', convert_body_to_file_like_object, REGISTER_LAST, ), ( 'before-parameter-build.s3.PutObject', convert_body_to_file_like_object, REGISTER_LAST, ), ('creating-client-class', add_generate_presigned_url), ('creating-client-class.s3', add_generate_presigned_post), ('creating-client-class.iot-data', check_openssl_supports_tls_version_1_2), ('creating-client-class.lex-runtime-v2', remove_lex_v2_start_conversation), ('creating-client-class.qbusiness', remove_qbusiness_chat), ( 'creating-client-class.bedrock-runtime', remove_bedrock_runtime_invoke_model_with_bidirectional_stream, ), ('after-call.iam', json_decode_policies), ('after-call.ec2.GetConsoleOutput', decode_console_output), ('after-call.cloudformation.GetTemplate', json_decode_template_body), ('after-call.s3.GetBucketLocation', parse_get_bucket_location), ('before-parse.s3.', handle_expires_header), ('before-parse.s3.', _handle_200_error, REGISTER_FIRST), ('before-parameter-build', generate_idempotent_uuid), ('before-parameter-build', _handle_request_validation_mode_member), ('before-parameter-build.s3', validate_bucket_name), ('before-parameter-build.s3', remove_bucket_from_url_paths_from_model), ( 'before-parameter-build.s3.ListObjects', set_list_objects_encoding_type_url, ), ( 'before-parameter-build.s3.ListObjectsV2', set_list_objects_encoding_type_url, ), ( 'before-parameter-build.s3.ListObjectVersions', set_list_objects_encoding_type_url, ), ('before-parameter-build.s3.CopyObject', handle_copy_source_param), ('before-parameter-build.s3.UploadPartCopy', handle_copy_source_param), ('before-parameter-build.s3.CopyObject', validate_ascii_metadata), ('before-parameter-build.s3.PutObject', validate_ascii_metadata), ( 'before-parameter-build.s3.CreateMultipartUpload', validate_ascii_metadata, ), ('before-parameter-build.s3-control', remove_accid_host_prefix_from_model), ('docs..s3.CopyObject.complete-section', document_copy_source_form), ('docs..s3.UploadPartCopy.complete-section', document_copy_source_form), ('docs.response-example.s3..complete-section', document_expires_shape), ('docs.response-params.s3..complete-section', document_expires_shape), ('before-endpoint-resolution.s3', customize_endpoint_resolver_builtins), ('before-call', add_recursion_detection_header), ('before-call', add_query_compatibility_header), ('before-call.s3', add_expect_header), ('before-call.glacier', add_glacier_version), ('before-call.apigateway', add_accept_header), ('before-call.s3.DeleteObjects', escape_xml_payload), ('before-call.s3.PutBucketLifecycleConfiguration', escape_xml_payload), ('before-call.glacier.UploadArchive', add_glacier_checksums), ('before-call.glacier.UploadMultipartPart', add_glacier_checksums), ('before-call.ec2.CopySnapshot', inject_presigned_url_ec2), ('request-created', add_retry_headers), ('request-created.machinelearning.Predict', switch_host_machinelearning), ('needs-retry.s3.', _update_status_code, REGISTER_FIRST), ('choose-signer.cognito-identity.GetId', disable_signing), ('choose-signer.cognito-identity.GetOpenIdToken', disable_signing), ('choose-signer.cognito-identity.UnlinkIdentity', disable_signing), ( 'choose-signer.cognito-identity.GetCredentialsForIdentity', disable_signing, ), ('choose-signer.sts.AssumeRoleWithSAML', disable_signing), ('choose-signer.sts.AssumeRoleWithWebIdentity', disable_signing), ('choose-signer', set_operation_specific_signer), ('before-parameter-build.s3.HeadObject', sse_md5), ('before-parameter-build.s3.GetObject', sse_md5), ('before-parameter-build.s3.PutObject', sse_md5), ('before-parameter-build.s3.CopyObject', sse_md5), ('before-parameter-build.s3.CopyObject', copy_source_sse_md5), ('before-parameter-build.s3.CreateMultipartUpload', sse_md5), ('before-parameter-build.s3.UploadPart', sse_md5), ('before-parameter-build.s3.UploadPartCopy', sse_md5), ('before-parameter-build.s3.UploadPartCopy', copy_source_sse_md5), ('before-parameter-build.s3.CompleteMultipartUpload', sse_md5), ('before-parameter-build.s3.SelectObjectContent', sse_md5), ('before-parameter-build.ec2.RunInstances', base64_encode_user_data), ( 'before-parameter-build.autoscaling.CreateLaunchConfiguration', base64_encode_user_data, ), ('before-parameter-build.route53', fix_route53_ids), ('before-parameter-build.glacier', inject_account_id), ('before-sign.s3', remove_arn_from_signing_path), ('before-sign.s3', _set_extra_headers_for_unsigned_request), ( 'before-sign.polly.SynthesizeSpeech', remove_content_type_header_for_presigning, ), ('after-call.s3.ListObjects', decode_list_object), ('after-call.s3.ListObjectsV2', decode_list_object_v2), ('after-call.s3.ListObjectVersions', decode_list_object_versions), # Cloudsearchdomain search operation will be sent by HTTP POST ('request-created.cloudsearchdomain.Search', change_get_to_post), # Glacier documentation customizations ( 'docs..glacier..complete-section', AutoPopulatedParam( 'accountId', 'Note: this parameter is set to "-" by' 'default if no value is not specified.', ).document_auto_populated_param, ), ( 'docs..glacier.UploadArchive.complete-section', AutoPopulatedParam('checksum').document_auto_populated_param, ), ( 'docs..glacier.UploadMultipartPart.complete-section', AutoPopulatedParam('checksum').document_auto_populated_param, ), ( 'docs.request-params.glacier.CompleteMultipartUpload.complete-section', document_glacier_tree_hash_checksum(), ), # Cloudformation documentation customizations ( 'docs..cloudformation.GetTemplate.complete-section', document_cloudformation_get_template_return_type, ), # UserData base64 encoding documentation customizations ( 'docs..ec2.RunInstances.complete-section', document_base64_encoding('UserData'), ), ( 'docs..autoscaling.CreateLaunchConfiguration.complete-section', document_base64_encoding('UserData'), ), # EC2 CopySnapshot documentation customizations ( 'docs..ec2.CopySnapshot.complete-section', AutoPopulatedParam('PresignedUrl').document_auto_populated_param, ), ( 'docs..ec2.CopySnapshot.complete-section', AutoPopulatedParam('DestinationRegion').document_auto_populated_param, ), # S3 SSE documentation modifications ( 'docs..s3..complete-section', AutoPopulatedParam('SSECustomerKeyMD5').document_auto_populated_param, ), # S3 SSE Copy Source documentation modifications ( 'docs..s3..complete-section', AutoPopulatedParam( 'CopySourceSSECustomerKeyMD5' ).document_auto_populated_param, ), # Add base64 information to Lambda ( 'docs..lambda.UpdateFunctionCode.complete-section', document_base64_encoding('ZipFile'), ), # The following S3 operations cannot actually accept a ContentMD5 ( 'docs..s3..complete-section', HideParamFromOperations( 's3', 'ContentMD5', [ 'DeleteObjects', 'PutBucketAcl', 'PutBucketCors', 'PutBucketLifecycle', 'PutBucketLogging', 'PutBucketNotification', 'PutBucketPolicy', 'PutBucketReplication', 'PutBucketRequestPayment', 'PutBucketTagging', 'PutBucketVersioning', 'PutBucketWebsite', 'PutObjectAcl', ], ).hide_param, ), ############# # DSQL ############# ('creating-client-class.dsql', add_dsql_generate_db_auth_token_methods), ############# # RDS ############# ('creating-client-class.rds', add_generate_db_auth_token), ('before-call.rds.CopyDBClusterSnapshot', inject_presigned_url_rds), ('before-call.rds.CreateDBCluster', inject_presigned_url_rds), ('before-call.rds.CopyDBSnapshot', inject_presigned_url_rds), ('before-call.rds.CreateDBInstanceReadReplica', inject_presigned_url_rds), ( 'before-call.rds.StartDBInstanceAutomatedBackupsReplication', inject_presigned_url_rds, ), # RDS PresignedUrl documentation customizations ( 'docs..rds.CopyDBClusterSnapshot.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ( 'docs..rds.CreateDBCluster.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ( 'docs..rds.CopyDBSnapshot.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ( 'docs..rds.CreateDBInstanceReadReplica.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ( 'docs..rds.StartDBInstanceAutomatedBackupsReplication.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ############# # Neptune ############# ('before-call.neptune.CopyDBClusterSnapshot', inject_presigned_url_rds), ('before-call.neptune.CreateDBCluster', inject_presigned_url_rds), # Neptune PresignedUrl documentation customizations ( 'docs..neptune.CopyDBClusterSnapshot.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ( 'docs..neptune.CreateDBCluster.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ############# # DocDB ############# ('before-call.docdb.CopyDBClusterSnapshot', inject_presigned_url_rds), ('before-call.docdb.CreateDBCluster', inject_presigned_url_rds), # DocDB PresignedUrl documentation customizations ( 'docs..docdb.CopyDBClusterSnapshot.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ( 'docs.*.docdb.CreateDBCluster.complete-section', AutoPopulatedParam('PreSignedUrl').document_auto_populated_param, ), ('before-call', inject_api_version_header_if_needed), ] _add_parameter_aliases(BUILTIN_HANDLERS)	60.73 KB	2025-05-25 12:26
📄 history.py # Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import logging HISTORY_RECORDER = None logger = logging.getLogger(__name__) class BaseHistoryHandler: def emit(self, event_type, payload, source): raise NotImplementedError('emit()') class HistoryRecorder: def __init__(self): self._enabled = False self._handlers = [] def enable(self): self._enabled = True def disable(self): self._enabled = False def add_handler(self, handler): self._handlers.append(handler) def record(self, event_type, payload, source='BOTOCORE'): if self._enabled and self._handlers: for handler in self._handlers: try: handler.emit(event_type, payload, source) except Exception: # Never let the process die because we had a failure in # a record collection handler. logger.debug( "Exception raised in %s.", handler, exc_info=True ) def get_global_history_recorder(): global HISTORY_RECORDER if HISTORY_RECORDER is None: HISTORY_RECORDER = HistoryRecorder() return HISTORY_RECORDER	1.7 KB	2025-05-25 12:26
📄 hooks.py # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import copy import logging from collections import deque, namedtuple from botocore.compat import accepts_kwargs from botocore.utils import EVENT_ALIASES logger = logging.getLogger(__name__) _NodeList = namedtuple('NodeList', ['first', 'middle', 'last']) _FIRST = 0 _MIDDLE = 1 _LAST = 2 class NodeList(_NodeList): def __copy__(self): first_copy = copy.copy(self.first) middle_copy = copy.copy(self.middle) last_copy = copy.copy(self.last) copied = NodeList(first_copy, middle_copy, last_copy) return copied def first_non_none_response(responses, default=None): """Find first non None response in a list of tuples. This function can be used to find the first non None response from handlers connected to an event. This is useful if you are interested in the returned responses from event handlers. Example usage:: print(first_non_none_response([(func1, None), (func2, 'foo'), (func3, 'bar')])) # This will print 'foo' :type responses: list of tuples :param responses: The responses from the ``EventHooks.emit`` method. This is a list of tuples, and each tuple is (handler, handler_response). :param default: If no non-None responses are found, then this default value will be returned. :return: The first non-None response in the list of tuples. """ for response in responses: if response[1] is not None: return response[1] return default class BaseEventHooks: def emit(self, event_name, kwargs): """Call all handlers subscribed to an event. :type event_name: str :param event_name: The name of the event to emit. :type kwargs: dict :param kwargs: Arbitrary kwargs to pass through to the subscribed handlers. The ``event_name`` will be injected into the kwargs so it's not necessary to add this to kwargs. :rtype: list of tuples :return: A list of ``(handler_func, handler_func_return_value)`` """ return [] def register( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): """Register an event handler for a given event. If a ``unique_id`` is given, the handler will not be registered if a handler with the ``unique_id`` has already been registered. Handlers are called in the order they have been registered. Note handlers can also be registered with ``register_first()`` and ``register_last()``. All handlers registered with ``register_first()`` are called before handlers registered with ``register()`` which are called before handlers registered with ``register_last()``. """ self._verify_and_register( event_name, handler, unique_id, register_method=self._register, unique_id_uses_count=unique_id_uses_count, ) def register_first( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): """Register an event handler to be called first for an event. All event handlers registered with ``register_first()`` will be called before handlers registered with ``register()`` and ``register_last()``. """ self._verify_and_register( event_name, handler, unique_id, register_method=self._register_first, unique_id_uses_count=unique_id_uses_count, ) def register_last( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): """Register an event handler to be called last for an event. All event handlers registered with ``register_last()`` will be called after handlers registered with ``register_first()`` and ``register()``. """ self._verify_and_register( event_name, handler, unique_id, register_method=self._register_last, unique_id_uses_count=unique_id_uses_count, ) def _verify_and_register( self, event_name, handler, unique_id, register_method, unique_id_uses_count, ): self._verify_is_callable(handler) self._verify_accept_kwargs(handler) register_method(event_name, handler, unique_id, unique_id_uses_count) def unregister( self, event_name, handler=None, unique_id=None, unique_id_uses_count=False, ): """Unregister an event handler for a given event. If no ``unique_id`` was given during registration, then the first instance of the event handler is removed (if the event handler has been registered multiple times). """ pass def _verify_is_callable(self, func): if not callable(func): raise ValueError(f"Event handler {func} must be callable.") def _verify_accept_kwargs(self, func): """Verifies a callable accepts kwargs :type func: callable :param func: A callable object. :returns: True, if ``func`` accepts kwargs, otherwise False. """ try: if not accepts_kwargs(func): raise ValueError( f"Event handler {func} must accept keyword " f"arguments (kwargs)" ) except TypeError: return False class HierarchicalEmitter(BaseEventHooks): def __init__(self): # We keep a reference to the handlers for quick # read only access (we never modify self._handlers). # A cache of event name to handler list. self._lookup_cache = {} self._handlers = _PrefixTrie() # This is used to ensure that unique_id's are only # registered once. self._unique_id_handlers = {} def _emit(self, event_name, kwargs, stop_on_response=False): """ Emit an event with optional keyword arguments. :type event_name: string :param event_name: Name of the event :type kwargs: dict :param kwargs: Arguments to be passed to the handler functions. :type stop_on_response: boolean :param stop_on_response: Whether to stop on the first non-None response. If False, then all handlers will be called. This is especially useful to handlers which mutate data and then want to stop propagation of the event. :rtype: list :return: List of (handler, response) tuples from all processed handlers. """ responses = [] # Invoke the event handlers from most specific # to least specific, each time stripping off a dot. handlers_to_call = self._lookup_cache.get(event_name) if handlers_to_call is None: handlers_to_call = self._handlers.prefix_search(event_name) self._lookup_cache[event_name] = handlers_to_call elif not handlers_to_call: # Short circuit and return an empty response is we have # no handlers to call. This is the common case where # for the majority of signals, nothing is listening. return [] kwargs['event_name'] = event_name responses = [] for handler in handlers_to_call: logger.debug('Event %s: calling handler %s', event_name, handler) response = handler(kwargs) responses.append((handler, response)) if stop_on_response and response is not None: return responses return responses def emit(self, event_name, kwargs): """ Emit an event by name with arguments passed as keyword args. >>> responses = emitter.emit( ... 'my-event.service.operation', arg1='one', arg2='two') :rtype: list :return: List of (handler, response) tuples from all processed handlers. """ return self._emit(event_name, kwargs) def emit_until_response(self, event_name, kwargs): """ Emit an event by name with arguments passed as keyword args, until the first non-``None`` response is received. This method prevents subsequent handlers from being invoked. >>> handler, response = emitter.emit_until_response( 'my-event.service.operation', arg1='one', arg2='two') :rtype: tuple :return: The first (handler, response) tuple where the response is not ``None``, otherwise (``None``, ``None``). """ responses = self._emit(event_name, kwargs, stop_on_response=True) if responses: return responses[-1] else: return (None, None) def _register( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): self._register_section( event_name, handler, unique_id, unique_id_uses_count, section=_MIDDLE, ) def _register_first( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): self._register_section( event_name, handler, unique_id, unique_id_uses_count, section=_FIRST, ) def _register_last( self, event_name, handler, unique_id, unique_id_uses_count=False ): self._register_section( event_name, handler, unique_id, unique_id_uses_count, section=_LAST ) def _register_section( self, event_name, handler, unique_id, unique_id_uses_count, section ): if unique_id is not None: if unique_id in self._unique_id_handlers: # We've already registered a handler using this unique_id # so we don't need to register it again. count = self._unique_id_handlers[unique_id].get('count', None) if unique_id_uses_count: if not count: raise ValueError( f"Initial registration of unique id {unique_id} was " "specified to use a counter. Subsequent register " "calls to unique id must specify use of a counter " "as well." ) else: self._unique_id_handlers[unique_id]['count'] += 1 else: if count: raise ValueError( f"Initial registration of unique id {unique_id} was " "specified to not use a counter. Subsequent " "register calls to unique id must specify not to " "use a counter as well." ) return else: # Note that the trie knows nothing about the unique # id. We track uniqueness in this class via the # _unique_id_handlers. self._handlers.append_item( event_name, handler, section=section ) unique_id_handler_item = {'handler': handler} if unique_id_uses_count: unique_id_handler_item['count'] = 1 self._unique_id_handlers[unique_id] = unique_id_handler_item else: self._handlers.append_item(event_name, handler, section=section) # Super simple caching strategy for now, if we change the registrations # clear the cache. This has the opportunity for smarter invalidations. self._lookup_cache = {} def unregister( self, event_name, handler=None, unique_id=None, unique_id_uses_count=False, ): if unique_id is not None: try: count = self._unique_id_handlers[unique_id].get('count', None) except KeyError: # There's no handler matching that unique_id so we have # nothing to unregister. return if unique_id_uses_count: if count is None: raise ValueError( f"Initial registration of unique id {unique_id} was specified to " "use a counter. Subsequent unregister calls to unique " "id must specify use of a counter as well." ) elif count == 1: handler = self._unique_id_handlers.pop(unique_id)[ 'handler' ] else: self._unique_id_handlers[unique_id]['count'] -= 1 return else: if count: raise ValueError( f"Initial registration of unique id {unique_id} was specified " "to not use a counter. Subsequent unregister calls " "to unique id must specify not to use a counter as " "well." ) handler = self._unique_id_handlers.pop(unique_id)['handler'] try: self._handlers.remove_item(event_name, handler) self._lookup_cache = {} except ValueError: pass def __copy__(self): new_instance = self.__class__() new_state = self.__dict__.copy() new_state['_handlers'] = copy.copy(self._handlers) new_state['_unique_id_handlers'] = copy.copy(self._unique_id_handlers) new_instance.__dict__ = new_state return new_instance class EventAliaser(BaseEventHooks): def __init__(self, event_emitter, event_aliases=None): self._event_aliases = event_aliases if event_aliases is None: self._event_aliases = EVENT_ALIASES self._alias_name_cache = {} self._emitter = event_emitter def emit(self, event_name, kwargs): aliased_event_name = self._alias_event_name(event_name) return self._emitter.emit(aliased_event_name, kwargs) def emit_until_response(self, event_name, kwargs): aliased_event_name = self._alias_event_name(event_name) return self._emitter.emit_until_response(aliased_event_name, kwargs) def register( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): aliased_event_name = self._alias_event_name(event_name) return self._emitter.register( aliased_event_name, handler, unique_id, unique_id_uses_count ) def register_first( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): aliased_event_name = self._alias_event_name(event_name) return self._emitter.register_first( aliased_event_name, handler, unique_id, unique_id_uses_count ) def register_last( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): aliased_event_name = self._alias_event_name(event_name) return self._emitter.register_last( aliased_event_name, handler, unique_id, unique_id_uses_count ) def unregister( self, event_name, handler=None, unique_id=None, unique_id_uses_count=False, ): aliased_event_name = self._alias_event_name(event_name) return self._emitter.unregister( aliased_event_name, handler, unique_id, unique_id_uses_count ) def _alias_event_name(self, event_name): if event_name in self._alias_name_cache: return self._alias_name_cache[event_name] for old_part, new_part in self._event_aliases.items(): # We can't simply do a string replace for everything, otherwise we # might end up translating substrings that we never intended to # translate. When there aren't any dots in the old event name # part, then we can quickly replace the item in the list if it's # there. event_parts = event_name.split('.') if '.' not in old_part: try: # Theoretically a given event name could have the same part # repeated, but in practice this doesn't happen event_parts[event_parts.index(old_part)] = new_part except ValueError: continue # If there's dots in the name, it gets more complicated. Now we # have to replace multiple sections of the original event. elif old_part in event_name: old_parts = old_part.split('.') self._replace_subsection(event_parts, old_parts, new_part) else: continue new_name = '.'.join(event_parts) logger.debug( f"Changing event name from {event_name} to {new_name}" ) self._alias_name_cache[event_name] = new_name return new_name self._alias_name_cache[event_name] = event_name return event_name def _replace_subsection(self, sections, old_parts, new_part): for i in range(len(sections)): if ( sections[i] == old_parts[0] and sections[i : i + len(old_parts)] == old_parts ): sections[i : i + len(old_parts)] = [new_part] return def __copy__(self): return self.__class__( copy.copy(self._emitter), copy.copy(self._event_aliases) ) class _PrefixTrie: """Specialized prefix trie that handles wildcards. The prefixes in this case are based on dot separated names so 'foo.bar.baz' is:: foo -> bar -> baz Wildcard support just means that having a key such as 'foo.bar..baz' will be matched with a call to ``get_items(key='foo.bar.ANYTHING.baz')``. You can think of this prefix trie as the equivalent as defaultdict(list), except that it can do prefix searches: foo.bar.baz -> A foo.bar -> B foo -> C Calling ``get_items('foo.bar.baz')`` will return [A + B + C], from most specific to least specific. """ def __init__(self): # Each dictionary can be though of as a node, where a node # has values associated with the node, and children is a link # to more nodes. So 'foo.bar' would have a 'foo' node with # a 'bar' node as a child of foo. # {'foo': {'children': {'bar': {...}}}}. self._root = {'chunk': None, 'children': {}, 'values': None} def append_item(self, key, value, section=_MIDDLE): """Add an item to a key. If a value is already associated with that key, the new value is appended to the list for the key. """ key_parts = key.split('.') current = self._root for part in key_parts: if part not in current['children']: new_child = {'chunk': part, 'values': None, 'children': {}} current['children'][part] = new_child current = new_child else: current = current['children'][part] if current['values'] is None: current['values'] = NodeList([], [], []) current['values'][section].append(value) def prefix_search(self, key): """Collect all items that are prefixes of key. Prefix in this case are delineated by '.' characters so 'foo.bar.baz' is a 3 chunk sequence of 3 "prefixes" ( "foo", "bar", and "baz"). """ collected = deque() key_parts = key.split('.') current = self._root self._get_items(current, key_parts, collected, 0) return collected def _get_items(self, starting_node, key_parts, collected, starting_index): stack = [(starting_node, starting_index)] key_parts_len = len(key_parts) # Traverse down the nodes, where at each level we add the # next part from key_parts as well as the wildcard element ''. # This means for each node we see we potentially add two more # elements to our stack. while stack: current_node, index = stack.pop() if current_node['values']: # We're using extendleft because we want # the values associated with the node furthest # from the root to come before nodes closer # to the root. extendleft() also adds its items # in right-left order so .extendleft([1, 2, 3]) # will result in final_list = [3, 2, 1], which is # why we reverse the lists. node_list = current_node['values'] complete_order = ( node_list.first + node_list.middle + node_list.last ) collected.extendleft(reversed(complete_order)) if not index == key_parts_len: children = current_node['children'] directs = children.get(key_parts[index]) wildcard = children.get('*') next_index = index + 1 if wildcard is not None: stack.append((wildcard, next_index)) if directs is not None: stack.append((directs, next_index)) def remove_item(self, key, value): """Remove an item associated with a key. If the value is not associated with the key a ``ValueError`` will be raised. If the key does not exist in the trie, a ``ValueError`` will be raised. """ key_parts = key.split('.') current = self._root self._remove_item(current, key_parts, value, index=0) def _remove_item(self, current_node, key_parts, value, index): if current_node is None: return elif index < len(key_parts): next_node = current_node['children'].get(key_parts[index]) if next_node is not None: self._remove_item(next_node, key_parts, value, index + 1) if index == len(key_parts) - 1: node_list = next_node['values'] if value in node_list.first: node_list.first.remove(value) elif value in node_list.middle: node_list.middle.remove(value) elif value in node_list.last: node_list.last.remove(value) if not next_node['children'] and not next_node['values']: # Then this is a leaf node with no values so # we can just delete this link from the parent node. # This makes subsequent search faster in the case # where a key does not exist. del current_node['children'][key_parts[index]] else: raise ValueError(f"key is not in trie: {'.'.join(key_parts)}") def __copy__(self): # The fact that we're using a nested dict under the covers # is an implementation detail, and the user shouldn't have # to know that they'd normally need a deepcopy so we expose # __copy__ instead of __deepcopy__. new_copy = self.__class__() copied_attrs = self._recursive_copy(self.__dict__) new_copy.__dict__ = copied_attrs return new_copy def _recursive_copy(self, node): # We can't use copy.deepcopy because we actually only want to copy # the structure of the trie, not the handlers themselves. # Each node has a chunk, children, and values. copied_node = {} for key, value in node.items(): if isinstance(value, NodeList): copied_node[key] = copy.copy(value) elif isinstance(value, dict): copied_node[key] = self._recursive_copy(value) else: copied_node[key] = value return copied_node	24.46 KB	2025-05-25 12:26
📄 httpchecksum.py # Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """The interfaces in this module are not intended for public use. This module defines interfaces for applying checksums to HTTP requests within the context of botocore. This involves both resolving the checksum to be used based on client configuration and environment, as well as application of the checksum to the request. """ import base64 import io import logging from binascii import crc32 from hashlib import sha1, sha256 from botocore.compat import HAS_CRT, has_minimum_crt_version, urlparse from botocore.exceptions import ( AwsChunkedWrapperError, FlexibleChecksumError, MissingDependencyException, ) from botocore.model import StructureShape from botocore.response import StreamingBody from botocore.useragent import register_feature_id from botocore.utils import ( conditionally_calculate_md5, determine_content_length, has_checksum_header, ) if HAS_CRT: from awscrt import checksums as crt_checksums else: crt_checksums = None logger = logging.getLogger(__name__) DEFAULT_CHECKSUM_ALGORITHM = "CRC32" class BaseChecksum: _CHUNK_SIZE = 1024 * 1024 def update(self, chunk): pass def digest(self): pass def b64digest(self): bs = self.digest() return base64.b64encode(bs).decode("ascii") def _handle_fileobj(self, fileobj): start_position = fileobj.tell() for chunk in iter(lambda: fileobj.read(self._CHUNK_SIZE), b""): self.update(chunk) fileobj.seek(start_position) def handle(self, body): if isinstance(body, (bytes, bytearray)): self.update(body) else: self._handle_fileobj(body) return self.b64digest() class Crc32Checksum(BaseChecksum): def __init__(self): self._int_crc32 = 0 def update(self, chunk): self._int_crc32 = crc32(chunk, self._int_crc32) & 0xFFFFFFFF def digest(self): return self._int_crc32.to_bytes(4, byteorder="big") class CrtCrc32Checksum(BaseChecksum): # Note: This class is only used if the CRT is available def __init__(self): self._int_crc32 = 0 def update(self, chunk): new_checksum = crt_checksums.crc32(chunk, self._int_crc32) self._int_crc32 = new_checksum & 0xFFFFFFFF def digest(self): return self._int_crc32.to_bytes(4, byteorder="big") class CrtCrc32cChecksum(BaseChecksum): # Note: This class is only used if the CRT is available def __init__(self): self._int_crc32c = 0 def update(self, chunk): new_checksum = crt_checksums.crc32c(chunk, self._int_crc32c) self._int_crc32c = new_checksum & 0xFFFFFFFF def digest(self): return self._int_crc32c.to_bytes(4, byteorder="big") class CrtCrc64NvmeChecksum(BaseChecksum): # Note: This class is only used if the CRT is available def __init__(self): self._int_crc64nvme = 0 def update(self, chunk): new_checksum = crt_checksums.crc64nvme(chunk, self._int_crc64nvme) self._int_crc64nvme = new_checksum & 0xFFFFFFFFFFFFFFFF def digest(self): return self._int_crc64nvme.to_bytes(8, byteorder="big") class Sha1Checksum(BaseChecksum): def __init__(self): self._checksum = sha1() def update(self, chunk): self._checksum.update(chunk) def digest(self): return self._checksum.digest() class Sha256Checksum(BaseChecksum): def __init__(self): self._checksum = sha256() def update(self, chunk): self._checksum.update(chunk) def digest(self): return self._checksum.digest() class AwsChunkedWrapper: _DEFAULT_CHUNK_SIZE = 1024 * 1024 def __init__( self, raw, checksum_cls=None, checksum_name="x-amz-checksum", chunk_size=None, ): self._raw = raw self._checksum_name = checksum_name self._checksum_cls = checksum_cls self._reset() if chunk_size is None: chunk_size = self._DEFAULT_CHUNK_SIZE self._chunk_size = chunk_size def _reset(self): self._remaining = b"" self._complete = False self._checksum = None if self._checksum_cls: self._checksum = self._checksum_cls() def seek(self, offset, whence=0): if offset != 0 or whence != 0: raise AwsChunkedWrapperError( error_msg="Can only seek to start of stream" ) self._reset() self._raw.seek(0) def read(self, size=None): # Normalize "read all" size values to None if size is not None and size <= 0: size = None # If the underlying body is done and we have nothing left then # end the stream if self._complete and not self._remaining: return b"" # While we're not done and want more bytes want_more_bytes = size is None or size > len(self._remaining) while not self._complete and want_more_bytes: self._remaining += self._make_chunk() want_more_bytes = size is None or size > len(self._remaining) # If size was None, we want to return everything if size is None: size = len(self._remaining) # Return a chunk up to the size asked for to_return = self._remaining[:size] self._remaining = self._remaining[size:] return to_return def _make_chunk(self): # NOTE: Chunk size is not deterministic as read could return less. This # means we cannot know the content length of the encoded aws-chunked # stream ahead of time without ensuring a consistent chunk size raw_chunk = self._raw.read(self._chunk_size) hex_len = hex(len(raw_chunk))[2:].encode("ascii") self._complete = not raw_chunk if self._checksum: self._checksum.update(raw_chunk) if self._checksum and self._complete: name = self._checksum_name.encode("ascii") checksum = self._checksum.b64digest().encode("ascii") return b"0\r\n%s:%s\r\n\r\n" % (name, checksum) return b"%s\r\n%s\r\n" % (hex_len, raw_chunk) def __iter__(self): while not self._complete: yield self._make_chunk() class StreamingChecksumBody(StreamingBody): def __init__(self, raw_stream, content_length, checksum, expected): super().__init__(raw_stream, content_length) self._checksum = checksum self._expected = expected def read(self, amt=None): chunk = super().read(amt=amt) self._checksum.update(chunk) if amt is None or (not chunk and amt > 0): self._validate_checksum() return chunk def readinto(self, b): amount_read = super().readinto(b) if amount_read == len(b): view = b else: view = memoryview(b)[:amount_read] self._checksum.update(view) if amount_read == 0 and len(b) > 0: self._validate_checksum() return amount_read def _validate_checksum(self): if self._checksum.digest() != base64.b64decode(self._expected): error_msg = ( f"Expected checksum {self._expected} did not match calculated " f"checksum: {self._checksum.b64digest()}" ) raise FlexibleChecksumError(error_msg=error_msg) def resolve_checksum_context(request, operation_model, params): resolve_request_checksum_algorithm(request, operation_model, params) resolve_response_checksum_algorithms(request, operation_model, params) def resolve_request_checksum_algorithm( request, operation_model, params, supported_algorithms=None, ): # If the header is already set by the customer, skip calculation if has_checksum_header(request): return checksum_context = request["context"].get("checksum", {}) request_checksum_calculation = request["context"][ "client_config" ].request_checksum_calculation http_checksum = operation_model.http_checksum request_checksum_required = ( operation_model.http_checksum_required or http_checksum.get("requestChecksumRequired") ) algorithm_member = http_checksum.get("requestAlgorithmMember") if algorithm_member and algorithm_member in params: # If the client has opted into using flexible checksums and the # request supports it, use that instead of checksum required if supported_algorithms is None: supported_algorithms = _SUPPORTED_CHECKSUM_ALGORITHMS algorithm_name = params[algorithm_member].lower() if algorithm_name not in supported_algorithms: if not HAS_CRT and algorithm_name in _CRT_CHECKSUM_ALGORITHMS: raise MissingDependencyException( msg=( f"Using {algorithm_name.upper()} requires an " "additional dependency. You will need to pip install " "botocore[crt] before proceeding." ) ) raise FlexibleChecksumError( error_msg=f"Unsupported checksum algorithm: {algorithm_name}" ) elif request_checksum_required or ( algorithm_member and request_checksum_calculation == "when_supported" ): # Don't use a default checksum for presigned requests. if request["context"].get("is_presign_request"): return algorithm_name = DEFAULT_CHECKSUM_ALGORITHM.lower() algorithm_member_header = _get_request_algorithm_member_header( operation_model, request, algorithm_member ) if algorithm_member_header is not None: checksum_context["request_algorithm_header"] = { "name": algorithm_member_header, "value": DEFAULT_CHECKSUM_ALGORITHM, } else: return location_type = "header" if ( operation_model.has_streaming_input and urlparse(request["url"]).scheme == "https" ): if request["context"]["client_config"].signature_version != 's3': # Operations with streaming input must support trailers. # We only support unsigned trailer checksums currently. As this # disables payload signing we'll only use trailers over TLS. location_type = "trailer" algorithm = { "algorithm": algorithm_name, "in": location_type, "name": f"x-amz-checksum-{algorithm_name}", } checksum_context["request_algorithm"] = algorithm request["context"]["checksum"] = checksum_context def _get_request_algorithm_member_header( operation_model, request, algorithm_member ): """Get the name of the header targeted by the "requestAlgorithmMember".""" operation_input_shape = operation_model.input_shape if not isinstance(operation_input_shape, StructureShape): return algorithm_member_shape = operation_input_shape.members.get( algorithm_member ) if algorithm_member_shape: return algorithm_member_shape.serialization.get("name") def apply_request_checksum(request): checksum_context = request.get("context", {}).get("checksum", {}) algorithm = checksum_context.get("request_algorithm") if not algorithm: return if algorithm == "conditional-md5": # Special case to handle the http checksum required trait conditionally_calculate_md5(request) elif algorithm["in"] == "header": _apply_request_header_checksum(request) elif algorithm["in"] == "trailer": _apply_request_trailer_checksum(request) else: raise FlexibleChecksumError( error_msg="Unknown checksum variant: {}".format(algorithm["in"]) ) if "request_algorithm_header" in checksum_context: request_algorithm_header = checksum_context["request_algorithm_header"] request["headers"][request_algorithm_header["name"]] = ( request_algorithm_header["value"] ) def _apply_request_header_checksum(request): checksum_context = request.get("context", {}).get("checksum", {}) algorithm = checksum_context.get("request_algorithm") location_name = algorithm["name"] if location_name in request["headers"]: # If the header is already set by the customer, skip calculation return checksum_cls = _CHECKSUM_CLS.get(algorithm["algorithm"]) digest = checksum_cls().handle(request["body"]) request["headers"][location_name] = digest _register_checksum_algorithm_feature_id(algorithm) def _apply_request_trailer_checksum(request): checksum_context = request.get("context", {}).get("checksum", {}) algorithm = checksum_context.get("request_algorithm") location_name = algorithm["name"] checksum_cls = _CHECKSUM_CLS.get(algorithm["algorithm"]) headers = request["headers"] body = request["body"] if location_name in headers: # If the header is already set by the customer, skip calculation return headers["Transfer-Encoding"] = "chunked" if "Content-Encoding" in headers: # We need to preserve the existing content encoding and add # aws-chunked as a new content encoding. headers["Content-Encoding"] += ",aws-chunked" else: headers["Content-Encoding"] = "aws-chunked" headers["X-Amz-Trailer"] = location_name _register_checksum_algorithm_feature_id(algorithm) content_length = determine_content_length(body) if content_length is not None: # Send the decoded content length if we can determine it. Some # services such as S3 may require the decoded content length headers["X-Amz-Decoded-Content-Length"] = str(content_length) if "Content-Length" in headers: del headers["Content-Length"] logger.debug( "Removing the Content-Length header since 'chunked' is specified for Transfer-Encoding." ) if isinstance(body, (bytes, bytearray)): body = io.BytesIO(body) request["body"] = AwsChunkedWrapper( body, checksum_cls=checksum_cls, checksum_name=location_name, ) def _register_checksum_algorithm_feature_id(algorithm): checksum_algorithm_name = algorithm["algorithm"].upper() if checksum_algorithm_name == "CRC64NVME": checksum_algorithm_name = "CRC64" checksum_algorithm_name_feature_id = ( f"FLEXIBLE_CHECKSUMS_REQ_{checksum_algorithm_name}" ) register_feature_id(checksum_algorithm_name_feature_id) def resolve_response_checksum_algorithms( request, operation_model, params, supported_algorithms=None ): http_checksum = operation_model.http_checksum mode_member = http_checksum.get("requestValidationModeMember") if mode_member and mode_member in params: if supported_algorithms is None: supported_algorithms = _SUPPORTED_CHECKSUM_ALGORITHMS response_algorithms = { a.lower() for a in http_checksum.get("responseAlgorithms", []) } usable_algorithms = [] for algorithm in _ALGORITHMS_PRIORITY_LIST: if algorithm not in response_algorithms: continue if algorithm in supported_algorithms: usable_algorithms.append(algorithm) checksum_context = request["context"].get("checksum", {}) checksum_context["response_algorithms"] = usable_algorithms request["context"]["checksum"] = checksum_context def handle_checksum_body(http_response, response, context, operation_model): headers = response["headers"] checksum_context = context.get("checksum", {}) algorithms = checksum_context.get("response_algorithms") if not algorithms: return for algorithm in algorithms: header_name = f"x-amz-checksum-{algorithm}" # If the header is not found, check the next algorithm if header_name not in headers: continue # If a - is in the checksum this is not valid Base64. S3 returns # checksums that include a -# suffix to indicate a checksum derived # from the hash of all part checksums. We cannot wrap this response if "-" in headers[header_name]: continue if operation_model.has_streaming_output: response["body"] = _handle_streaming_response( http_response, response, algorithm ) else: response["body"] = _handle_bytes_response( http_response, response, algorithm ) # Expose metadata that the checksum check actually occurred checksum_context = response["context"].get("checksum", {}) checksum_context["response_algorithm"] = algorithm response["context"]["checksum"] = checksum_context return logger.debug( f'Skipping checksum validation. Response did not contain one of the ' f'following algorithms: {algorithms}.' ) def _handle_streaming_response(http_response, response, algorithm): checksum_cls = _CHECKSUM_CLS.get(algorithm) header_name = f"x-amz-checksum-{algorithm}" return StreamingChecksumBody( http_response.raw, response["headers"].get("content-length"), checksum_cls(), response["headers"][header_name], ) def _handle_bytes_response(http_response, response, algorithm): body = http_response.content header_name = f"x-amz-checksum-{algorithm}" checksum_cls = _CHECKSUM_CLS.get(algorithm) checksum = checksum_cls() checksum.update(body) expected = response["headers"][header_name] if checksum.digest() != base64.b64decode(expected): error_msg = ( f"Expected checksum {expected} did not match calculated " f"checksum: {checksum.b64digest()}" ) raise FlexibleChecksumError(error_msg=error_msg) return body _CHECKSUM_CLS = { "crc32": Crc32Checksum, "sha1": Sha1Checksum, "sha256": Sha256Checksum, } _CRT_CHECKSUM_ALGORITHMS = ["crc32", "crc32c", "crc64nvme"] if HAS_CRT: # Use CRT checksum implementations if available _CRT_CHECKSUM_CLS = { "crc32": CrtCrc32Checksum, "crc32c": CrtCrc32cChecksum, } if has_minimum_crt_version((0, 23, 4)): # CRC64NVME support wasn't officially added until 0.23.4 _CRT_CHECKSUM_CLS["crc64nvme"] = CrtCrc64NvmeChecksum _CHECKSUM_CLS.update(_CRT_CHECKSUM_CLS) # Validate this list isn't out of sync with _CRT_CHECKSUM_CLS keys assert all( name in _CRT_CHECKSUM_ALGORITHMS for name in _CRT_CHECKSUM_CLS.keys() ) _SUPPORTED_CHECKSUM_ALGORITHMS = list(_CHECKSUM_CLS.keys()) _ALGORITHMS_PRIORITY_LIST = ['crc64nvme', 'crc32c', 'crc32', 'sha1', 'sha256']	19 KB	2025-05-25 12:26
📄 httpsession.py import logging import os import os.path import socket import sys import warnings from base64 import b64encode from urllib3 import PoolManager, Timeout, proxy_from_url from urllib3.exceptions import ( ConnectTimeoutError as URLLib3ConnectTimeoutError, ) from urllib3.exceptions import ( LocationParseError, NewConnectionError, ProtocolError, ProxyError, ) from urllib3.exceptions import ReadTimeoutError as URLLib3ReadTimeoutError from urllib3.exceptions import SSLError as URLLib3SSLError from urllib3.util.retry import Retry from urllib3.util.ssl_ import ( OP_NO_COMPRESSION, PROTOCOL_TLS, OP_NO_SSLv2, OP_NO_SSLv3, is_ipaddress, ssl, ) from urllib3.util.url import parse_url try: from urllib3.util.ssl_ import OP_NO_TICKET, PROTOCOL_TLS_CLIENT except ImportError: # Fallback directly to ssl for version of urllib3 before 1.26. # They are available in the standard library starting in Python 3.6. from ssl import OP_NO_TICKET, PROTOCOL_TLS_CLIENT try: # pyopenssl will be removed in urllib3 2.0, we'll fall back to ssl_ at that point. # This can be removed once our urllib3 floor is raised to >= 2.0. with warnings.catch_warnings(): warnings.simplefilter("ignore", category=DeprecationWarning) # Always import the original SSLContext, even if it has been patched from urllib3.contrib.pyopenssl import ( orig_util_SSLContext as SSLContext, ) except ImportError: from urllib3.util.ssl_ import SSLContext try: from urllib3.util.ssl_ import DEFAULT_CIPHERS except ImportError: # Defer to system configuration starting with # urllib3 2.0. This will choose the ciphers provided by # Openssl 1.1.1+ or secure system defaults. DEFAULT_CIPHERS = None import botocore.awsrequest from botocore.compat import ( IPV6_ADDRZ_RE, ensure_bytes, filter_ssl_warnings, unquote, urlparse, ) from botocore.exceptions import ( ConnectionClosedError, ConnectTimeoutError, EndpointConnectionError, HTTPClientError, InvalidProxiesConfigError, ProxyConnectionError, ReadTimeoutError, SSLError, ) filter_ssl_warnings() logger = logging.getLogger(__name__) DEFAULT_TIMEOUT = 60 MAX_POOL_CONNECTIONS = 10 DEFAULT_CA_BUNDLE = os.path.join(os.path.dirname(__file__), 'cacert.pem') try: from certifi import where except ImportError: def where(): return DEFAULT_CA_BUNDLE def get_cert_path(verify): if verify is not True: return verify cert_path = where() logger.debug(f"Certificate path: {cert_path}") return cert_path def create_urllib3_context( ssl_version=None, cert_reqs=None, options=None, ciphers=None ): """This function is a vendored version of the same function in urllib3 We vendor this function to ensure that the SSL contexts we construct always use the std lib SSLContext instead of pyopenssl. """ # PROTOCOL_TLS is deprecated in Python 3.10 if not ssl_version or ssl_version == PROTOCOL_TLS: ssl_version = PROTOCOL_TLS_CLIENT context = SSLContext(ssl_version) if ciphers: context.set_ciphers(ciphers) elif DEFAULT_CIPHERS: context.set_ciphers(DEFAULT_CIPHERS) # Setting the default here, as we may have no ssl module on import cert_reqs = ssl.CERT_REQUIRED if cert_reqs is None else cert_reqs if options is None: options = 0 # SSLv2 is easily broken and is considered harmful and dangerous options \|= OP_NO_SSLv2 # SSLv3 has several problems and is now dangerous options \|= OP_NO_SSLv3 # Disable compression to prevent CRIME attacks for OpenSSL 1.0+ # (issue urllib3#309) options \|= OP_NO_COMPRESSION # TLSv1.2 only. Unless set explicitly, do not request tickets. # This may save some bandwidth on wire, and although the ticket is encrypted, # there is a risk associated with it being on wire, # if the server is not rotating its ticketing keys properly. options \|= OP_NO_TICKET context.options \|= options # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is # necessary for conditional client cert authentication with TLS 1.3. # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older # versions of Python. We only enable on Python 3.7.4+ or if certificate # verification is enabled to work around Python issue #37428 # See: https://bugs.python.org/issue37428 if ( cert_reqs == ssl.CERT_REQUIRED or sys.version_info >= (3, 7, 4) ) and getattr(context, "post_handshake_auth", None) is not None: context.post_handshake_auth = True def disable_check_hostname(): if ( getattr(context, "check_hostname", None) is not None ): # Platform-specific: Python 3.2 # We do our own verification, including fingerprints and alternative # hostnames. So disable it here context.check_hostname = False # The order of the below lines setting verify_mode and check_hostname # matter due to safe-guards SSLContext has to prevent an SSLContext with # check_hostname=True, verify_mode=NONE/OPTIONAL. This is made even more # complex because we don't know whether PROTOCOL_TLS_CLIENT will be used # or not so we don't know the initial state of the freshly created SSLContext. if cert_reqs == ssl.CERT_REQUIRED: context.verify_mode = cert_reqs disable_check_hostname() else: disable_check_hostname() context.verify_mode = cert_reqs # Enable logging of TLS session keys via defacto standard environment variable # 'SSLKEYLOGFILE', if the feature is available (Python 3.8+). Skip empty values. if hasattr(context, "keylog_filename"): sslkeylogfile = os.environ.get("SSLKEYLOGFILE") if sslkeylogfile and not sys.flags.ignore_environment: context.keylog_filename = sslkeylogfile return context def ensure_boolean(val): """Ensures a boolean value if a string or boolean is provided For strings, the value for True/False is case insensitive """ if isinstance(val, bool): return val else: return val.lower() == 'true' def mask_proxy_url(proxy_url): """ Mask proxy url credentials. :type proxy_url: str :param proxy_url: The proxy url, i.e. https://username:password@proxy.com :return: Masked proxy url, i.e. https://*:@proxy.com """ mask = '' * 3 parsed_url = urlparse(proxy_url) if parsed_url.username: proxy_url = proxy_url.replace(parsed_url.username, mask, 1) if parsed_url.password: proxy_url = proxy_url.replace(parsed_url.password, mask, 1) return proxy_url def _is_ipaddress(host): """Wrap urllib3's is_ipaddress to support bracketed IPv6 addresses.""" return is_ipaddress(host) or bool(IPV6_ADDRZ_RE.match(host)) class ProxyConfiguration: """Represents a proxy configuration dictionary and additional settings. This class represents a proxy configuration dictionary and provides utility functions to retrieve well structured proxy urls and proxy headers from the proxy configuration dictionary. """ def __init__(self, proxies=None, proxies_settings=None): if proxies is None: proxies = {} if proxies_settings is None: proxies_settings = {} self._proxies = proxies self._proxies_settings = proxies_settings def proxy_url_for(self, url): """Retrieves the corresponding proxy url for a given url.""" parsed_url = urlparse(url) proxy = self._proxies.get(parsed_url.scheme) if proxy: proxy = self._fix_proxy_url(proxy) return proxy def proxy_headers_for(self, proxy_url): """Retrieves the corresponding proxy headers for a given proxy url.""" headers = {} username, password = self._get_auth_from_url(proxy_url) if username and password: basic_auth = self._construct_basic_auth(username, password) headers['Proxy-Authorization'] = basic_auth return headers @property def settings(self): return self._proxies_settings def _fix_proxy_url(self, proxy_url): if proxy_url.startswith('http:') or proxy_url.startswith('https:'): return proxy_url elif proxy_url.startswith('//'): return 'http:' + proxy_url else: return 'http://' + proxy_url def _construct_basic_auth(self, username, password): auth_str = f'{username}:{password}' encoded_str = b64encode(auth_str.encode('ascii')).strip().decode() return f'Basic {encoded_str}' def _get_auth_from_url(self, url): parsed_url = urlparse(url) try: return unquote(parsed_url.username), unquote(parsed_url.password) except (AttributeError, TypeError): return None, None class URLLib3Session: """A basic HTTP client that supports connection pooling and proxies. This class is inspired by requests.adapters.HTTPAdapter, but has been boiled down to meet the use cases needed by botocore. For the most part this classes matches the functionality of HTTPAdapter in requests v2.7.0 (the same as our vendored version). The only major difference of note is that we currently do not support sending chunked requests. While requests v2.7.0 implemented this themselves, later version urllib3 support this directly via a flag to urlopen so enabling it if needed should be trivial. """ def __init__( self, verify=True, proxies=None, timeout=None, max_pool_connections=MAX_POOL_CONNECTIONS, socket_options=None, client_cert=None, proxies_config=None, ): self._verify = verify self._proxy_config = ProxyConfiguration( proxies=proxies, proxies_settings=proxies_config ) self._pool_classes_by_scheme = { 'http': botocore.awsrequest.AWSHTTPConnectionPool, 'https': botocore.awsrequest.AWSHTTPSConnectionPool, } if timeout is None: timeout = DEFAULT_TIMEOUT if not isinstance(timeout, (int, float)): timeout = Timeout(connect=timeout[0], read=timeout[1]) self._cert_file = None self._key_file = None if isinstance(client_cert, str): self._cert_file = client_cert elif isinstance(client_cert, tuple): self._cert_file, self._key_file = client_cert self._timeout = timeout self._max_pool_connections = max_pool_connections self._socket_options = socket_options if socket_options is None: self._socket_options = [] self._proxy_managers = {} self._manager = PoolManager(self._get_pool_manager_kwargs()) self._manager.pool_classes_by_scheme = self._pool_classes_by_scheme def _proxies_kwargs(self, kwargs): proxies_settings = self._proxy_config.settings proxies_kwargs = { 'use_forwarding_for_https': proxies_settings.get( 'proxy_use_forwarding_for_https' ), kwargs, } return {k: v for k, v in proxies_kwargs.items() if v is not None} def _get_pool_manager_kwargs(self, extra_kwargs): pool_manager_kwargs = { 'timeout': self._timeout, 'maxsize': self._max_pool_connections, 'ssl_context': self._get_ssl_context(), 'socket_options': self._socket_options, 'cert_file': self._cert_file, 'key_file': self._key_file, } pool_manager_kwargs.update(extra_kwargs) return pool_manager_kwargs def _get_ssl_context(self): return create_urllib3_context() def _get_proxy_manager(self, proxy_url): if proxy_url not in self._proxy_managers: proxy_headers = self._proxy_config.proxy_headers_for(proxy_url) proxy_ssl_context = self._setup_proxy_ssl_context(proxy_url) proxy_manager_kwargs = self._get_pool_manager_kwargs( proxy_headers=proxy_headers ) proxy_manager_kwargs.update( self._proxies_kwargs(proxy_ssl_context=proxy_ssl_context) ) proxy_manager = proxy_from_url(proxy_url, proxy_manager_kwargs) proxy_manager.pool_classes_by_scheme = self._pool_classes_by_scheme self._proxy_managers[proxy_url] = proxy_manager return self._proxy_managers[proxy_url] def _path_url(self, url): parsed_url = urlparse(url) path = parsed_url.path if not path: path = '/' if parsed_url.query: path = path + '?' + parsed_url.query return path def _setup_ssl_cert(self, conn, url, verify): if url.lower().startswith('https') and verify: conn.cert_reqs = 'CERT_REQUIRED' conn.ca_certs = get_cert_path(verify) else: conn.cert_reqs = 'CERT_NONE' conn.ca_certs = None def _setup_proxy_ssl_context(self, proxy_url): proxies_settings = self._proxy_config.settings proxy_ca_bundle = proxies_settings.get('proxy_ca_bundle') proxy_cert = proxies_settings.get('proxy_client_cert') if proxy_ca_bundle is None and proxy_cert is None: return None context = self._get_ssl_context() try: url = parse_url(proxy_url) # urllib3 disables this by default but we need it for proper # proxy tls negotiation when proxy_url is not an IP Address if not _is_ipaddress(url.host): context.check_hostname = True if proxy_ca_bundle is not None: context.load_verify_locations(cafile=proxy_ca_bundle) if isinstance(proxy_cert, tuple): context.load_cert_chain(proxy_cert[0], keyfile=proxy_cert[1]) elif isinstance(proxy_cert, str): context.load_cert_chain(proxy_cert) return context except (OSError, URLLib3SSLError, LocationParseError) as e: raise InvalidProxiesConfigError(error=e) def _get_connection_manager(self, url, proxy_url=None): if proxy_url: manager = self._get_proxy_manager(proxy_url) else: manager = self._manager return manager def _get_request_target(self, url, proxy_url): has_proxy = proxy_url is not None if not has_proxy: return self._path_url(url) # HTTP proxies expect the request_target to be the absolute url to know # which host to establish a connection to. urllib3 also supports # forwarding for HTTPS through the 'use_forwarding_for_https' parameter. proxy_scheme = urlparse(proxy_url).scheme using_https_forwarding_proxy = ( proxy_scheme == 'https' and self._proxies_kwargs().get('use_forwarding_for_https', False) ) if using_https_forwarding_proxy or url.startswith('http:'): return url else: return self._path_url(url) def _chunked(self, headers): transfer_encoding = headers.get('Transfer-Encoding', b'') transfer_encoding = ensure_bytes(transfer_encoding) return transfer_encoding.lower() == b'chunked' def close(self): self._manager.clear() for manager in self._proxy_managers.values(): manager.clear() def send(self, request): try: proxy_url = self._proxy_config.proxy_url_for(request.url) manager = self._get_connection_manager(request.url, proxy_url) conn = manager.connection_from_url(request.url) self._setup_ssl_cert(conn, request.url, self._verify) if ensure_boolean( os.environ.get('BOTO_EXPERIMENTAL__ADD_PROXY_HOST_HEADER', '') ): # This is currently an "experimental" feature which provides # no guarantees of backwards compatibility. It may be subject # to change or removal in any patch version. Anyone opting in # to this feature should strictly pin botocore. host = urlparse(request.url).hostname conn.proxy_headers['host'] = host request_target = self._get_request_target(request.url, proxy_url) urllib_response = conn.urlopen( method=request.method, url=request_target, body=request.body, headers=request.headers, retries=Retry(False), assert_same_host=False, preload_content=False, decode_content=False, chunked=self._chunked(request.headers), ) http_response = botocore.awsrequest.AWSResponse( request.url, urllib_response.status, urllib_response.headers, urllib_response, ) if not request.stream_output: # Cause the raw stream to be exhausted immediately. We do it # this way instead of using preload_content because # preload_content will never buffer chunked responses http_response.content return http_response except URLLib3SSLError as e: raise SSLError(endpoint_url=request.url, error=e) except (NewConnectionError, socket.gaierror) as e: raise EndpointConnectionError(endpoint_url=request.url, error=e) except ProxyError as e: raise ProxyConnectionError( proxy_url=mask_proxy_url(proxy_url), error=e ) except URLLib3ConnectTimeoutError as e: raise ConnectTimeoutError(endpoint_url=request.url, error=e) except URLLib3ReadTimeoutError as e: raise ReadTimeoutError(endpoint_url=request.url, error=e) except ProtocolError as e: raise ConnectionClosedError( error=e, request=request, endpoint_url=request.url ) except Exception as e: message = 'Exception received when sending urllib3 HTTP request' logger.debug(message, exc_info=True) raise HTTPClientError(error=e)	18.15 KB	2025-05-25 12:26
📄 loaders.py # Copyright 2012-2015 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Module for loading various model files. This module provides the classes that are used to load models used by botocore. This can include: * Service models (e.g. the model for EC2, S3, DynamoDB, etc.) * Service model extras which customize the service models * Other models associated with a service (pagination, waiters) * Non service-specific config (Endpoint data, retry config) Loading a module is broken down into several steps: * Determining the path to load * Search the data_path for files to load * The mechanics of loading the file * Searching for extras and applying them to the loaded file The last item is used so that other faster loading mechanism besides the default JSON loader can be used. The Search Path =============== Similar to how the PATH environment variable is to finding executables and the PYTHONPATH environment variable is to finding python modules to import, the botocore loaders have the concept of a data path exposed through AWS_DATA_PATH. This enables end users to provide additional search paths where we will attempt to load models outside of the models we ship with botocore. When you create a ``Loader``, there are two paths automatically added to the model search path: * <botocore root>/data/ * ~/.aws/models The first value is the path where all the model files shipped with botocore are located. The second path is so that users can just drop new model files in ``~/.aws/models`` without having to mess around with the AWS_DATA_PATH. The AWS_DATA_PATH using the platform specific path separator to separate entries (typically ``:`` on linux and ``;`` on windows). Directory Layout ================ The Loader expects a particular directory layout. In order for any directory specified in AWS_DATA_PATH to be considered, it must have this structure for service models:: <root> \| \|-- servicename1 \| \|-- 2012-10-25 \| \|-- service-2.json \|-- ec2 \| \|-- 2014-01-01 \| \| \|-- paginators-1.json \| \| \|-- service-2.json \| \| \|-- waiters-2.json \| \|-- 2015-03-01 \| \|-- paginators-1.json \| \|-- service-2.json \| \|-- waiters-2.json \| \|-- service-2.sdk-extras.json That is: * The root directory contains sub directories that are the name of the services. * Within each service directory, there's a sub directory for each available API version. * Within each API version, there are model specific files, including (but not limited to): service-2.json, waiters-2.json, paginators-1.json The ``-1`` and ``-2`` suffix at the end of the model files denote which version schema is used within the model. Even though this information is available in the ``version`` key within the model, this version is also part of the filename so that code does not need to load the JSON model in order to determine which version to use. The ``sdk-extras`` and similar files represent extra data that needs to be applied to the model after it is loaded. Data in these files might represent information that doesn't quite fit in the original models, but is still needed for the sdk. For instance, additional operation parameters might be added here which don't represent the actual service api. """ import logging import os from botocore import BOTOCORE_ROOT from botocore.compat import HAS_GZIP, OrderedDict, json from botocore.exceptions import DataNotFoundError, UnknownServiceError from botocore.utils import deep_merge _JSON_OPEN_METHODS = { '.json': open, } if HAS_GZIP: from gzip import open as gzip_open _JSON_OPEN_METHODS['.json.gz'] = gzip_open logger = logging.getLogger(__name__) def instance_cache(func): """Cache the result of a method on a per instance basis. This is not a general purpose caching decorator. In order for this to be used, it must be used on methods on an instance, and that instance must provide a ``self._cache`` dictionary. """ def _wrapper(self, args, kwargs): key = (func.__name__,) + args for pair in sorted(kwargs.items()): key += pair if key in self._cache: return self._cache[key] data = func(self, args, *kwargs) self._cache[key] = data return data return _wrapper class JSONFileLoader: """Loader JSON files. This class can load the default format of models, which is a JSON file. """ def exists(self, file_path): """Checks if the file exists. :type file_path: str :param file_path: The full path to the file to load without the '.json' extension. :return: True if file path exists, False otherwise. """ for ext in _JSON_OPEN_METHODS: if os.path.isfile(file_path + ext): return True return False def _load_file(self, full_path, open_method): if not os.path.isfile(full_path): return # By default the file will be opened with locale encoding on Python 3. # We specify "utf8" here to ensure the correct behavior. with open_method(full_path, 'rb') as fp: payload = fp.read().decode('utf-8') logger.debug("Loading JSON file: %s", full_path) return json.loads(payload, object_pairs_hook=OrderedDict) def load_file(self, file_path): """Attempt to load the file path. :type file_path: str :param file_path: The full path to the file to load without the '.json' extension. :return: The loaded data if it exists, otherwise None. """ for ext, open_method in _JSON_OPEN_METHODS.items(): data = self._load_file(file_path + ext, open_method) if data is not None: return data return None def create_loader(search_path_string=None): """Create a Loader class. This factory function creates a loader given a search string path. :type search_string_path: str :param search_string_path: The AWS_DATA_PATH value. A string of data path values separated by the ``os.path.pathsep`` value, which is typically ``:`` on POSIX platforms and ``;`` on windows. :return: A ``Loader`` instance. """ if search_path_string is None: return Loader() paths = [] extra_paths = search_path_string.split(os.pathsep) for path in extra_paths: path = os.path.expanduser(os.path.expandvars(path)) paths.append(path) return Loader(extra_search_paths=paths) class Loader: """Find and load data models. This class will handle searching for and loading data models. The main method used here is ``load_service_model``, which is a convenience method over ``load_data`` and ``determine_latest_version``. """ FILE_LOADER_CLASS = JSONFileLoader # The included models in botocore/data/ that we ship with botocore. BUILTIN_DATA_PATH = os.path.join(BOTOCORE_ROOT, 'data') # For convenience we automatically add ~/.aws/models to the data path. CUSTOMER_DATA_PATH = os.path.join( os.path.expanduser('~'), '.aws', 'models' ) BUILTIN_EXTRAS_TYPES = ['sdk'] def __init__( self, extra_search_paths=None, file_loader=None, cache=None, include_default_search_paths=True, include_default_extras=True, ): self._cache = {} if file_loader is None: file_loader = self.FILE_LOADER_CLASS() self.file_loader = file_loader if extra_search_paths is not None: self._search_paths = extra_search_paths else: self._search_paths = [] if include_default_search_paths: self._search_paths.extend( [self.CUSTOMER_DATA_PATH, self.BUILTIN_DATA_PATH] ) self._extras_types = [] if include_default_extras: self._extras_types.extend(self.BUILTIN_EXTRAS_TYPES) self._extras_processor = ExtrasProcessor() @property def search_paths(self): return self._search_paths @property def extras_types(self): return self._extras_types @instance_cache def list_available_services(self, type_name): """List all known services. This will traverse the search path and look for all known services. :type type_name: str :param type_name: The type of the service (service-2, paginators-1, waiters-2, etc). This is needed because the list of available services depends on the service type. For example, the latest API version available for a resource-1.json file may not be the latest API version available for a services-2.json file. :return: A list of all services. The list of services will be sorted. """ services = set() for possible_path in self._potential_locations(): # Any directory in the search path is potentially a service. # We'll collect any initial list of potential services, # but we'll then need to further process these directories # by searching for the corresponding type_name in each # potential directory. possible_services = [ d for d in os.listdir(possible_path) if os.path.isdir(os.path.join(possible_path, d)) ] for service_name in possible_services: full_dirname = os.path.join(possible_path, service_name) api_versions = os.listdir(full_dirname) for api_version in api_versions: full_load_path = os.path.join( full_dirname, api_version, type_name ) if self.file_loader.exists(full_load_path): services.add(service_name) break return sorted(services) @instance_cache def determine_latest_version(self, service_name, type_name): """Find the latest API version available for a service. :type service_name: str :param service_name: The name of the service. :type type_name: str :param type_name: The type of the service (service-2, paginators-1, waiters-2, etc). This is needed because the latest API version available can depend on the service type. For example, the latest API version available for a resource-1.json file may not be the latest API version available for a services-2.json file. :rtype: str :return: The latest API version. If the service does not exist or does not have any available API data, then a ``DataNotFoundError`` exception will be raised. """ return max(self.list_api_versions(service_name, type_name)) @instance_cache def list_api_versions(self, service_name, type_name): """List all API versions available for a particular service type :type service_name: str :param service_name: The name of the service :type type_name: str :param type_name: The type name for the service (i.e service-2, paginators-1, etc.) :rtype: list :return: A list of API version strings in sorted order. """ known_api_versions = set() for possible_path in self._potential_locations( service_name, must_exist=True, is_dir=True ): for dirname in os.listdir(possible_path): full_path = os.path.join(possible_path, dirname, type_name) # Only add to the known_api_versions if the directory # contains a service-2, paginators-1, etc. file corresponding # to the type_name passed in. if self.file_loader.exists(full_path): known_api_versions.add(dirname) if not known_api_versions: raise DataNotFoundError(data_path=service_name) return sorted(known_api_versions) @instance_cache def load_service_model(self, service_name, type_name, api_version=None): """Load a botocore service model This is the main method for loading botocore models (e.g. a service model, pagination configs, waiter configs, etc.). :type service_name: str :param service_name: The name of the service (e.g ``ec2``, ``s3``). :type type_name: str :param type_name: The model type. Valid types include, but are not limited to: ``service-2``, ``paginators-1``, ``waiters-2``. :type api_version: str :param api_version: The API version to load. If this is not provided, then the latest API version will be used. :type load_extras: bool :param load_extras: Whether or not to load the tool extras which contain additional data to be added to the model. :raises: UnknownServiceError if there is no known service with the provided service_name. :raises: DataNotFoundError if no data could be found for the service_name/type_name/api_version. :return: The loaded data, as a python type (e.g. dict, list, etc). """ # Wrapper around the load_data. This will calculate the path # to call load_data with. known_services = self.list_available_services(type_name) if service_name not in known_services: raise UnknownServiceError( service_name=service_name, known_service_names=', '.join(sorted(known_services)), ) if api_version is None: api_version = self.determine_latest_version( service_name, type_name ) full_path = os.path.join(service_name, api_version, type_name) model = self.load_data(full_path) # Load in all the extras extras_data = self._find_extras(service_name, type_name, api_version) self._extras_processor.process(model, extras_data) return model def _find_extras(self, service_name, type_name, api_version): """Creates an iterator over all the extras data.""" for extras_type in self.extras_types: extras_name = f'{type_name}.{extras_type}-extras' full_path = os.path.join(service_name, api_version, extras_name) try: yield self.load_data(full_path) except DataNotFoundError: pass @instance_cache def load_data_with_path(self, name): """Same as ``load_data`` but returns file path as second return value. :type name: str :param name: The data path, i.e ``ec2/2015-03-01/service-2``. :return: Tuple of the loaded data and the path to the data file where the data was loaded from. If no data could be found then a DataNotFoundError is raised. """ for possible_path in self._potential_locations(name): found = self.file_loader.load_file(possible_path) if found is not None: return found, possible_path # We didn't find anything that matched on any path. raise DataNotFoundError(data_path=name) def load_data(self, name): """Load data given a data path. This is a low level method that will search through the various search paths until it's able to load a value. This is typically only needed to load non* model files (such as _endpoints and _retry). If you need to load model files, you should prefer ``load_service_model``. Use ``load_data_with_path`` to get the data path of the data file as second return value. :type name: str :param name: The data path, i.e ``ec2/2015-03-01/service-2``. :return: The loaded data. If no data could be found then a DataNotFoundError is raised. """ data, _ = self.load_data_with_path(name) return data def _potential_locations(self, name=None, must_exist=False, is_dir=False): # Will give an iterator over the full path of potential locations # according to the search path. for path in self.search_paths: if os.path.isdir(path): full_path = path if name is not None: full_path = os.path.join(path, name) if not must_exist: yield full_path else: if is_dir and os.path.isdir(full_path): yield full_path elif os.path.exists(full_path): yield full_path def is_builtin_path(self, path): """Whether a given path is within the package's data directory. This method can be used together with load_data_with_path(name) to determine if data has been loaded from a file bundled with the package, as opposed to a file in a separate location. :type path: str :param path: The file path to check. :return: Whether the given path is within the package's data directory. """ path = os.path.expanduser(os.path.expandvars(path)) return path.startswith(self.BUILTIN_DATA_PATH) class ExtrasProcessor: """Processes data from extras files into service models.""" def process(self, original_model, extra_models): """Processes data from a list of loaded extras files into a model :type original_model: dict :param original_model: The service model to load all the extras into. :type extra_models: iterable of dict :param extra_models: A list of loaded extras models. """ for extras in extra_models: self._process(original_model, extras) def _process(self, model, extra_model): """Process a single extras model into a service model.""" if 'merge' in extra_model: deep_merge(model, extra_model['merge'])	18.39 KB	2025-05-25 12:26
📄 model.py # Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Abstractions to interact with service models.""" from collections import defaultdict from typing import NamedTuple, Union from botocore.auth import resolve_auth_type from botocore.compat import OrderedDict from botocore.exceptions import ( MissingServiceIdError, UndefinedModelAttributeError, ) from botocore.utils import CachedProperty, hyphenize_service_id, instance_cache NOT_SET = object() class NoShapeFoundError(Exception): pass class InvalidShapeError(Exception): pass class OperationNotFoundError(Exception): pass class InvalidShapeReferenceError(Exception): pass class ServiceId(str): def hyphenize(self): return hyphenize_service_id(self) class Shape: """Object representing a shape from the service model.""" # To simplify serialization logic, all shape params that are # related to serialization are moved from the top level hash into # a 'serialization' hash. This list below contains the names of all # the attributes that should be moved. SERIALIZED_ATTRS = [ 'locationName', 'queryName', 'flattened', 'location', 'payload', 'streaming', 'timestampFormat', 'xmlNamespace', 'resultWrapper', 'xmlAttribute', 'eventstream', 'event', 'eventheader', 'eventpayload', 'jsonvalue', 'timestampFormat', 'hostLabel', ] METADATA_ATTRS = [ 'required', 'min', 'max', 'pattern', 'sensitive', 'enum', 'idempotencyToken', 'error', 'exception', 'endpointdiscoveryid', 'retryable', 'document', 'union', 'contextParam', 'clientContextParams', 'requiresLength', ] MAP_TYPE = OrderedDict def __init__(self, shape_name, shape_model, shape_resolver=None): """ :type shape_name: string :param shape_name: The name of the shape. :type shape_model: dict :param shape_model: The shape model. This would be the value associated with the key in the "shapes" dict of the service model (i.e ``model['shapes'][shape_name]``) :type shape_resolver: botocore.model.ShapeResolver :param shape_resolver: A shape resolver object. This is used to resolve references to other shapes. For scalar shape types (string, integer, boolean, etc.), this argument is not required. If a shape_resolver is not provided for a complex type, then a ``ValueError`` will be raised when an attempt to resolve a shape is made. """ self.name = shape_name self.type_name = shape_model['type'] self.documentation = shape_model.get('documentation', '') self._shape_model = shape_model if shape_resolver is None: # If a shape_resolver is not provided, we create an object # that will throw errors if you attempt to resolve # a shape. This is actually ok for scalar shapes # because they don't need to resolve shapes and shouldn't # be required to provide an object they won't use. shape_resolver = UnresolvableShapeMap() self._shape_resolver = shape_resolver self._cache = {} @CachedProperty def serialization(self): """Serialization information about the shape. This contains information that may be needed for input serialization or response parsing. This can include: * name * queryName * flattened * location * payload * streaming * xmlNamespace * resultWrapper * xmlAttribute * jsonvalue * timestampFormat :rtype: dict :return: Serialization information about the shape. """ model = self._shape_model serialization = {} for attr in self.SERIALIZED_ATTRS: if attr in self._shape_model: serialization[attr] = model[attr] # For consistency, locationName is renamed to just 'name'. if 'locationName' in serialization: serialization['name'] = serialization.pop('locationName') return serialization @CachedProperty def metadata(self): """Metadata about the shape. This requires optional information about the shape, including: * min * max * pattern * enum * sensitive * required * idempotencyToken * document * union * contextParam * clientContextParams * requiresLength :rtype: dict :return: Metadata about the shape. """ model = self._shape_model metadata = {} for attr in self.METADATA_ATTRS: if attr in self._shape_model: metadata[attr] = model[attr] return metadata @CachedProperty def required_members(self): """A list of members that are required. A structure shape can define members that are required. This value will return a list of required members. If there are no required members an empty list is returned. """ return self.metadata.get('required', []) def _resolve_shape_ref(self, shape_ref): return self._shape_resolver.resolve_shape_ref(shape_ref) def __repr__(self): return f"<{self.__class__.__name__}({self.name})>" @property def event_stream_name(self): return None class StructureShape(Shape): @CachedProperty def members(self): members = self._shape_model.get('members', self.MAP_TYPE()) # The members dict looks like: # 'members': { # 'MemberName': {'shape': 'shapeName'}, # 'MemberName2': {'shape': 'shapeName'}, # } # We return a dict of member name to Shape object. shape_members = self.MAP_TYPE() for name, shape_ref in members.items(): shape_members[name] = self._resolve_shape_ref(shape_ref) return shape_members @CachedProperty def event_stream_name(self): for member_name, member in self.members.items(): if member.serialization.get('eventstream'): return member_name return None @CachedProperty def error_code(self): if not self.metadata.get('exception', False): return None error_metadata = self.metadata.get("error", {}) code = error_metadata.get("code") if code: return code # Use the exception name if there is no explicit code modeled return self.name @CachedProperty def is_document_type(self): return self.metadata.get('document', False) @CachedProperty def is_tagged_union(self): return self.metadata.get('union', False) class ListShape(Shape): @CachedProperty def member(self): return self._resolve_shape_ref(self._shape_model['member']) class MapShape(Shape): @CachedProperty def key(self): return self._resolve_shape_ref(self._shape_model['key']) @CachedProperty def value(self): return self._resolve_shape_ref(self._shape_model['value']) class StringShape(Shape): @CachedProperty def enum(self): return self.metadata.get('enum', []) class StaticContextParameter(NamedTuple): name: str value: Union[bool, str] class ContextParameter(NamedTuple): name: str member_name: str class ClientContextParameter(NamedTuple): name: str type: str documentation: str class ServiceModel: """ :ivar service_description: The parsed service description dictionary. """ def __init__(self, service_description, service_name=None): """ :type service_description: dict :param service_description: The service description model. This value is obtained from a botocore.loader.Loader, or from directly loading the file yourself:: service_description = json.load( open('/path/to/service-description-model.json')) model = ServiceModel(service_description) :type service_name: str :param service_name: The name of the service. Normally this is the endpoint prefix defined in the service_description. However, you can override this value to provide a more convenient name. This is done in a few places in botocore (ses instead of email, emr instead of elasticmapreduce). If this value is not provided, it will default to the endpointPrefix defined in the model. """ self._service_description = service_description # We want clients to be able to access metadata directly. self.metadata = service_description.get('metadata', {}) self._shape_resolver = ShapeResolver( service_description.get('shapes', {}) ) self._signature_version = NOT_SET self._service_name = service_name self._instance_cache = {} def shape_for(self, shape_name, member_traits=None): return self._shape_resolver.get_shape_by_name( shape_name, member_traits ) def shape_for_error_code(self, error_code): return self._error_code_cache.get(error_code, None) @CachedProperty def _error_code_cache(self): error_code_cache = {} for error_shape in self.error_shapes: code = error_shape.error_code error_code_cache[code] = error_shape return error_code_cache def resolve_shape_ref(self, shape_ref): return self._shape_resolver.resolve_shape_ref(shape_ref) @CachedProperty def shape_names(self): return list(self._service_description.get('shapes', {})) @CachedProperty def error_shapes(self): error_shapes = [] for shape_name in self.shape_names: error_shape = self.shape_for(shape_name) if error_shape.metadata.get('exception', False): error_shapes.append(error_shape) return error_shapes @instance_cache def operation_model(self, operation_name): try: model = self._service_description['operations'][operation_name] except KeyError: raise OperationNotFoundError(operation_name) return OperationModel(model, self, operation_name) @CachedProperty def documentation(self): return self._service_description.get('documentation', '') @CachedProperty def operation_names(self): return list(self._service_description.get('operations', [])) @CachedProperty def service_name(self): """The name of the service. This defaults to the endpointPrefix defined in the service model. However, this value can be overriden when a ``ServiceModel`` is created. If a service_name was not provided when the ``ServiceModel`` was created and if there is no endpointPrefix defined in the service model, then an ``UndefinedModelAttributeError`` exception will be raised. """ if self._service_name is not None: return self._service_name else: return self.endpoint_prefix @CachedProperty def service_id(self): try: return ServiceId(self._get_metadata_property('serviceId')) except UndefinedModelAttributeError: raise MissingServiceIdError(service_name=self._service_name) @CachedProperty def signing_name(self): """The name to use when computing signatures. If the model does not define a signing name, this value will be the endpoint prefix defined in the model. """ signing_name = self.metadata.get('signingName') if signing_name is None: signing_name = self.endpoint_prefix return signing_name @CachedProperty def api_version(self): return self._get_metadata_property('apiVersion') @CachedProperty def protocol(self): return self._get_metadata_property('protocol') @CachedProperty def protocols(self): return self._get_metadata_property('protocols') @CachedProperty def endpoint_prefix(self): return self._get_metadata_property('endpointPrefix') @CachedProperty def endpoint_discovery_operation(self): for operation in self.operation_names: model = self.operation_model(operation) if model.is_endpoint_discovery_operation: return model @CachedProperty def endpoint_discovery_required(self): for operation in self.operation_names: model = self.operation_model(operation) if ( model.endpoint_discovery is not None and model.endpoint_discovery.get('required') ): return True return False @CachedProperty def client_context_parameters(self): params = self._service_description.get('clientContextParams', {}) return [ ClientContextParameter( name=param_name, type=param_val['type'], documentation=param_val['documentation'], ) for param_name, param_val in params.items() ] def _get_metadata_property(self, name): try: return self.metadata[name] except KeyError: raise UndefinedModelAttributeError( f'"{name}" not defined in the metadata of the model: {self}' ) # Signature version is one of the rare properties # that can be modified so a CachedProperty is not used here. @property def signature_version(self): if self._signature_version is NOT_SET: signature_version = self.metadata.get('signatureVersion') self._signature_version = signature_version return self._signature_version @signature_version.setter def signature_version(self, value): self._signature_version = value @CachedProperty def is_query_compatible(self): return 'awsQueryCompatible' in self.metadata def __repr__(self): return f'{self.__class__.__name__}({self.service_name})' class OperationModel: def __init__(self, operation_model, service_model, name=None): """ :type operation_model: dict :param operation_model: The operation model. This comes from the service model, and is the value associated with the operation name in the service model (i.e ``model['operations'][op_name]``). :type service_model: botocore.model.ServiceModel :param service_model: The service model associated with the operation. :type name: string :param name: The operation name. This is the operation name exposed to the users of this model. This can potentially be different from the "wire_name", which is the operation name that must by provided over the wire. For example, given:: "CreateCloudFrontOriginAccessIdentity":{ "name":"CreateCloudFrontOriginAccessIdentity2014_11_06", ... } The ``name`` would be ``CreateCloudFrontOriginAccessIdentity``, but the ``self.wire_name`` would be ``CreateCloudFrontOriginAccessIdentity2014_11_06``, which is the value we must send in the corresponding HTTP request. """ self._operation_model = operation_model self._service_model = service_model self._api_name = name # Clients can access '.name' to get the operation name # and '.metadata' to get the top level metdata of the service. self._wire_name = operation_model.get('name') self.metadata = service_model.metadata self.http = operation_model.get('http', {}) @CachedProperty def name(self): if self._api_name is not None: return self._api_name else: return self.wire_name @property def wire_name(self): """The wire name of the operation. In many situations this is the same value as the ``name``, value, but in some services, the operation name exposed to the user is different from the operation name we send across the wire (e.g cloudfront). Any serialization code should use ``wire_name``. """ return self._operation_model.get('name') @property def service_model(self): return self._service_model @CachedProperty def documentation(self): return self._operation_model.get('documentation', '') @CachedProperty def deprecated(self): return self._operation_model.get('deprecated', False) @CachedProperty def endpoint_discovery(self): # Explicit None default. An empty dictionary for this trait means it is # enabled but not required to be used. return self._operation_model.get('endpointdiscovery', None) @CachedProperty def is_endpoint_discovery_operation(self): return self._operation_model.get('endpointoperation', False) @CachedProperty def input_shape(self): if 'input' not in self._operation_model: # Some operations do not accept any input and do not define an # input shape. return None return self._service_model.resolve_shape_ref( self._operation_model['input'] ) @CachedProperty def output_shape(self): if 'output' not in self._operation_model: # Some operations do not define an output shape, # in which case we return None to indicate the # operation has no expected output. return None return self._service_model.resolve_shape_ref( self._operation_model['output'] ) @CachedProperty def idempotent_members(self): input_shape = self.input_shape if not input_shape: return [] return [ name for (name, shape) in input_shape.members.items() if 'idempotencyToken' in shape.metadata and shape.metadata['idempotencyToken'] ] @CachedProperty def static_context_parameters(self): params = self._operation_model.get('staticContextParams', {}) return [ StaticContextParameter(name=name, value=props.get('value')) for name, props in params.items() ] @CachedProperty def context_parameters(self): if not self.input_shape: return [] return [ ContextParameter( name=shape.metadata['contextParam']['name'], member_name=name, ) for name, shape in self.input_shape.members.items() if 'contextParam' in shape.metadata and 'name' in shape.metadata['contextParam'] ] @CachedProperty def operation_context_parameters(self): return self._operation_model.get('operationContextParams', []) @CachedProperty def request_compression(self): return self._operation_model.get('requestcompression') @CachedProperty def auth(self): return self._operation_model.get('auth') @CachedProperty def auth_type(self): return self._operation_model.get('authtype') @CachedProperty def resolved_auth_type(self): if self.auth: return resolve_auth_type(self.auth) return self.auth_type @CachedProperty def unsigned_payload(self): return self._operation_model.get('unsignedPayload') @CachedProperty def error_shapes(self): shapes = self._operation_model.get("errors", []) return list(self._service_model.resolve_shape_ref(s) for s in shapes) @CachedProperty def endpoint(self): return self._operation_model.get('endpoint') @CachedProperty def http_checksum_required(self): return self._operation_model.get('httpChecksumRequired', False) @CachedProperty def http_checksum(self): return self._operation_model.get('httpChecksum', {}) @CachedProperty def has_event_stream_input(self): return self.get_event_stream_input() is not None @CachedProperty def has_event_stream_output(self): return self.get_event_stream_output() is not None def get_event_stream_input(self): return self._get_event_stream(self.input_shape) def get_event_stream_output(self): return self._get_event_stream(self.output_shape) def _get_event_stream(self, shape): """Returns the event stream member's shape if any or None otherwise.""" if shape is None: return None event_name = shape.event_stream_name if event_name: return shape.members[event_name] return None @CachedProperty def has_streaming_input(self): return self.get_streaming_input() is not None @CachedProperty def has_streaming_output(self): return self.get_streaming_output() is not None def get_streaming_input(self): return self._get_streaming_body(self.input_shape) def get_streaming_output(self): return self._get_streaming_body(self.output_shape) def _get_streaming_body(self, shape): """Returns the streaming member's shape if any; or None otherwise.""" if shape is None: return None payload = shape.serialization.get('payload') if payload is not None: payload_shape = shape.members[payload] if payload_shape.type_name == 'blob': return payload_shape return None def __repr__(self): return f'{self.__class__.__name__}(name={self.name})' class ShapeResolver: """Resolves shape references.""" # Any type not in this mapping will default to the Shape class. SHAPE_CLASSES = { 'structure': StructureShape, 'list': ListShape, 'map': MapShape, 'string': StringShape, } def __init__(self, shape_map): self._shape_map = shape_map self._shape_cache = {} def get_shape_by_name(self, shape_name, member_traits=None): try: shape_model = self._shape_map[shape_name] except KeyError: raise NoShapeFoundError(shape_name) try: shape_cls = self.SHAPE_CLASSES.get(shape_model['type'], Shape) except KeyError: raise InvalidShapeError( f"Shape is missing required key 'type': {shape_model}" ) if member_traits: shape_model = shape_model.copy() shape_model.update(member_traits) result = shape_cls(shape_name, shape_model, self) return result def resolve_shape_ref(self, shape_ref): # A shape_ref is a dict that has a 'shape' key that # refers to a shape name as well as any additional # member traits that are then merged over the shape # definition. For example: # {"shape": "StringType", "locationName": "Foobar"} if len(shape_ref) == 1 and 'shape' in shape_ref: # It's just a shape ref with no member traits, we can avoid # a .copy(). This is the common case so it's specifically # called out here. return self.get_shape_by_name(shape_ref['shape']) else: member_traits = shape_ref.copy() try: shape_name = member_traits.pop('shape') except KeyError: raise InvalidShapeReferenceError( f"Invalid model, missing shape reference: {shape_ref}" ) return self.get_shape_by_name(shape_name, member_traits) class UnresolvableShapeMap: """A ShapeResolver that will throw ValueErrors when shapes are resolved.""" def get_shape_by_name(self, shape_name, member_traits=None): raise ValueError( f"Attempted to lookup shape '{shape_name}', but no shape map was provided." ) def resolve_shape_ref(self, shape_ref): raise ValueError( f"Attempted to resolve shape '{shape_ref}', but no shape " f"map was provided." ) class DenormalizedStructureBuilder: """Build a StructureShape from a denormalized model. This is a convenience builder class that makes it easy to construct ``StructureShape``s based on a denormalized model. It will handle the details of creating unique shape names and creating the appropriate shape map needed by the ``StructureShape`` class. Example usage:: builder = DenormalizedStructureBuilder() shape = builder.with_members({ 'A': { 'type': 'structure', 'members': { 'B': { 'type': 'structure', 'members': { 'C': { 'type': 'string', } } } } } }).build_model() # ``shape`` is now an instance of botocore.model.StructureShape :type dict_type: class :param dict_type: The dictionary type to use, allowing you to opt-in to using OrderedDict or another dict type. This can be particularly useful for testing when order matters, such as for documentation. """ SCALAR_TYPES = ( 'string', 'integer', 'boolean', 'blob', 'float', 'timestamp', 'long', 'double', 'char', ) def __init__(self, name=None): self.members = OrderedDict() self._name_generator = ShapeNameGenerator() if name is None: self.name = self._name_generator.new_shape_name('structure') def with_members(self, members): """ :type members: dict :param members: The denormalized members. :return: self """ self._members = members return self def build_model(self): """Build the model based on the provided members. :rtype: botocore.model.StructureShape :return: The built StructureShape object. """ shapes = OrderedDict() denormalized = { 'type': 'structure', 'members': self._members, } self._build_model(denormalized, shapes, self.name) resolver = ShapeResolver(shape_map=shapes) return StructureShape( shape_name=self.name, shape_model=shapes[self.name], shape_resolver=resolver, ) def _build_model(self, model, shapes, shape_name): if model['type'] == 'structure': shapes[shape_name] = self._build_structure(model, shapes) elif model['type'] == 'list': shapes[shape_name] = self._build_list(model, shapes) elif model['type'] == 'map': shapes[shape_name] = self._build_map(model, shapes) elif model['type'] in self.SCALAR_TYPES: shapes[shape_name] = self._build_scalar(model) else: raise InvalidShapeError(f"Unknown shape type: {model['type']}") def _build_structure(self, model, shapes): members = OrderedDict() shape = self._build_initial_shape(model) shape['members'] = members for name, member_model in model.get('members', OrderedDict()).items(): member_shape_name = self._get_shape_name(member_model) members[name] = {'shape': member_shape_name} self._build_model(member_model, shapes, member_shape_name) return shape def _build_list(self, model, shapes): member_shape_name = self._get_shape_name(model) shape = self._build_initial_shape(model) shape['member'] = {'shape': member_shape_name} self._build_model(model['member'], shapes, member_shape_name) return shape def _build_map(self, model, shapes): key_shape_name = self._get_shape_name(model['key']) value_shape_name = self._get_shape_name(model['value']) shape = self._build_initial_shape(model) shape['key'] = {'shape': key_shape_name} shape['value'] = {'shape': value_shape_name} self._build_model(model['key'], shapes, key_shape_name) self._build_model(model['value'], shapes, value_shape_name) return shape def _build_initial_shape(self, model): shape = { 'type': model['type'], } if 'documentation' in model: shape['documentation'] = model['documentation'] for attr in Shape.METADATA_ATTRS: if attr in model: shape[attr] = model[attr] return shape def _build_scalar(self, model): return self._build_initial_shape(model) def _get_shape_name(self, model): if 'shape_name' in model: return model['shape_name'] else: return self._name_generator.new_shape_name(model['type']) class ShapeNameGenerator: """Generate unique shape names for a type. This class can be used in conjunction with the DenormalizedStructureBuilder to generate unique shape names for a given type. """ def __init__(self): self._name_cache = defaultdict(int) def new_shape_name(self, type_name): """Generate a unique shape name. This method will guarantee a unique shape name each time it is called with the same type. :: >>> s = ShapeNameGenerator() >>> s.new_shape_name('structure') 'StructureType1' >>> s.new_shape_name('structure') 'StructureType2' >>> s.new_shape_name('list') 'ListType1' >>> s.new_shape_name('list') 'ListType2' :type type_name: string :param type_name: The type name (structure, list, map, string, etc.) :rtype: string :return: A unique shape name for the given type """ self._name_cache[type_name] += 1 current_index = self._name_cache[type_name] return f'{type_name.capitalize()}Type{current_index}'	30.63 KB	2025-05-25 12:26
📄 monitoring.py # Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import json import logging import re import time from botocore.compat import ensure_bytes, ensure_unicode, urlparse from botocore.retryhandler import EXCEPTION_MAP as RETRYABLE_EXCEPTIONS logger = logging.getLogger(__name__) class Monitor: _EVENTS_TO_REGISTER = [ 'before-parameter-build', 'request-created', 'response-received', 'after-call', 'after-call-error', ] def __init__(self, adapter, publisher): """Abstraction for monitoring clients API calls :param adapter: An adapter that takes event emitter events and produces monitor events :param publisher: A publisher for generated monitor events """ self._adapter = adapter self._publisher = publisher def register(self, event_emitter): """Register an event emitter to the monitor""" for event_to_register in self._EVENTS_TO_REGISTER: event_emitter.register_last(event_to_register, self.capture) def capture(self, event_name, payload): """Captures an incoming event from the event emitter It will feed an event emitter event to the monitor's adaptor to create a monitor event and then publish that event to the monitor's publisher. """ try: monitor_event = self._adapter.feed(event_name, payload) if monitor_event: self._publisher.publish(monitor_event) except Exception as e: logger.debug( 'Exception %s raised by client monitor in handling event %s', e, event_name, exc_info=True, ) class MonitorEventAdapter: def __init__(self, time=time.time): """Adapts event emitter events to produce monitor events :type time: callable :param time: A callable that produces the current time """ self._time = time def feed(self, emitter_event_name, emitter_payload): """Feed an event emitter event to generate a monitor event :type emitter_event_name: str :param emitter_event_name: The name of the event emitted :type emitter_payload: dict :param emitter_payload: The payload to associated to the event emitted :rtype: BaseMonitorEvent :returns: A monitor event based on the event emitter events fired """ return self._get_handler(emitter_event_name)(emitter_payload) def _get_handler(self, event_name): return getattr( self, '_handle_' + event_name.split('.')[0].replace('-', '_') ) def _handle_before_parameter_build(self, model, context, kwargs): context['current_api_call_event'] = APICallEvent( service=model.service_model.service_id, operation=model.wire_name, timestamp=self._get_current_time(), ) def _handle_request_created(self, request, kwargs): context = request.context new_attempt_event = context[ 'current_api_call_event' ].new_api_call_attempt(timestamp=self._get_current_time()) new_attempt_event.request_headers = request.headers new_attempt_event.url = request.url context['current_api_call_attempt_event'] = new_attempt_event def _handle_response_received( self, parsed_response, context, exception, kwargs ): attempt_event = context.pop('current_api_call_attempt_event') attempt_event.latency = self._get_latency(attempt_event) if parsed_response is not None: attempt_event.http_status_code = parsed_response[ 'ResponseMetadata' ]['HTTPStatusCode'] attempt_event.response_headers = parsed_response[ 'ResponseMetadata' ]['HTTPHeaders'] attempt_event.parsed_error = parsed_response.get('Error') else: attempt_event.wire_exception = exception return attempt_event def _handle_after_call(self, context, parsed, kwargs): context['current_api_call_event'].retries_exceeded = parsed[ 'ResponseMetadata' ].get('MaxAttemptsReached', False) return self._complete_api_call(context) def _handle_after_call_error(self, context, exception, kwargs): # If the after-call-error was emitted and the error being raised # was a retryable connection error, then the retries must have exceeded # for that exception as this event gets emitted after** retries # happen. context[ 'current_api_call_event' ].retries_exceeded = self._is_retryable_exception(exception) return self._complete_api_call(context) def _is_retryable_exception(self, exception): return isinstance( exception, tuple(RETRYABLE_EXCEPTIONS['GENERAL_CONNECTION_ERROR']) ) def _complete_api_call(self, context): call_event = context.pop('current_api_call_event') call_event.latency = self._get_latency(call_event) return call_event def _get_latency(self, event): return self._get_current_time() - event.timestamp def _get_current_time(self): return int(self._time() * 1000) class BaseMonitorEvent: def __init__(self, service, operation, timestamp): """Base monitor event :type service: str :param service: A string identifying the service associated to the event :type operation: str :param operation: A string identifying the operation of service associated to the event :type timestamp: int :param timestamp: Epoch time in milliseconds from when the event began """ self.service = service self.operation = operation self.timestamp = timestamp def __repr__(self): return f'{self.__class__.__name__}({self.__dict__!r})' def __eq__(self, other): if isinstance(other, self.__class__): return self.__dict__ == other.__dict__ return False class APICallEvent(BaseMonitorEvent): def __init__( self, service, operation, timestamp, latency=None, attempts=None, retries_exceeded=False, ): """Monitor event for a single API call This event corresponds to a single client method call, which includes every HTTP requests attempt made in order to complete the client call :type service: str :param service: A string identifying the service associated to the event :type operation: str :param operation: A string identifying the operation of service associated to the event :type timestamp: int :param timestamp: Epoch time in milliseconds from when the event began :type latency: int :param latency: The time in milliseconds to complete the client call :type attempts: list :param attempts: The list of APICallAttempts associated to the APICall :type retries_exceeded: bool :param retries_exceeded: True if API call exceeded retries. False otherwise """ super().__init__( service=service, operation=operation, timestamp=timestamp ) self.latency = latency self.attempts = attempts if attempts is None: self.attempts = [] self.retries_exceeded = retries_exceeded def new_api_call_attempt(self, timestamp): """Instantiates APICallAttemptEvent associated to the APICallEvent :type timestamp: int :param timestamp: Epoch time in milliseconds to associate to the APICallAttemptEvent """ attempt_event = APICallAttemptEvent( service=self.service, operation=self.operation, timestamp=timestamp ) self.attempts.append(attempt_event) return attempt_event class APICallAttemptEvent(BaseMonitorEvent): def __init__( self, service, operation, timestamp, latency=None, url=None, http_status_code=None, request_headers=None, response_headers=None, parsed_error=None, wire_exception=None, ): """Monitor event for a single API call attempt This event corresponds to a single HTTP request attempt in completing the entire client method call. :type service: str :param service: A string identifying the service associated to the event :type operation: str :param operation: A string identifying the operation of service associated to the event :type timestamp: int :param timestamp: Epoch time in milliseconds from when the HTTP request started :type latency: int :param latency: The time in milliseconds to complete the HTTP request whether it succeeded or failed :type url: str :param url: The URL the attempt was sent to :type http_status_code: int :param http_status_code: The HTTP status code of the HTTP response if there was a response :type request_headers: dict :param request_headers: The HTTP headers sent in making the HTTP request :type response_headers: dict :param response_headers: The HTTP headers returned in the HTTP response if there was a response :type parsed_error: dict :param parsed_error: The error parsed if the service returned an error back :type wire_exception: Exception :param wire_exception: The exception raised in sending the HTTP request (i.e. ConnectionError) """ super().__init__( service=service, operation=operation, timestamp=timestamp ) self.latency = latency self.url = url self.http_status_code = http_status_code self.request_headers = request_headers self.response_headers = response_headers self.parsed_error = parsed_error self.wire_exception = wire_exception class CSMSerializer: _MAX_CLIENT_ID_LENGTH = 255 _MAX_EXCEPTION_CLASS_LENGTH = 128 _MAX_ERROR_CODE_LENGTH = 128 _MAX_USER_AGENT_LENGTH = 256 _MAX_MESSAGE_LENGTH = 512 _RESPONSE_HEADERS_TO_EVENT_ENTRIES = { 'x-amzn-requestid': 'XAmznRequestId', 'x-amz-request-id': 'XAmzRequestId', 'x-amz-id-2': 'XAmzId2', } _AUTH_REGEXS = { 'v4': re.compile( r'AWS4-HMAC-SHA256 ' r'Credential=(?P<access_key>\w+)/\d+/' r'(?P<signing_region>[a-z0-9-]+)/' ), 's3': re.compile(r'AWS (?P<access_key>\w+):'), } _SERIALIZEABLE_EVENT_PROPERTIES = [ 'service', 'operation', 'timestamp', 'attempts', 'latency', 'retries_exceeded', 'url', 'request_headers', 'http_status_code', 'response_headers', 'parsed_error', 'wire_exception', ] def __init__(self, csm_client_id): """Serializes monitor events to CSM (Client Side Monitoring) format :type csm_client_id: str :param csm_client_id: The application identifier to associate to the serialized events """ self._validate_client_id(csm_client_id) self.csm_client_id = csm_client_id def _validate_client_id(self, csm_client_id): if len(csm_client_id) > self._MAX_CLIENT_ID_LENGTH: raise ValueError( f'The value provided for csm_client_id: {csm_client_id} exceeds ' f'the maximum length of {self._MAX_CLIENT_ID_LENGTH} characters' ) def serialize(self, event): """Serializes a monitor event to the CSM format :type event: BaseMonitorEvent :param event: The event to serialize to bytes :rtype: bytes :returns: The CSM serialized form of the event """ event_dict = self._get_base_event_dict(event) event_type = self._get_event_type(event) event_dict['Type'] = event_type for attr in self._SERIALIZEABLE_EVENT_PROPERTIES: value = getattr(event, attr, None) if value is not None: getattr(self, '_serialize_' + attr)( value, event_dict, event_type=event_type ) return ensure_bytes(json.dumps(event_dict, separators=(',', ':'))) def _get_base_event_dict(self, event): return { 'Version': 1, 'ClientId': self.csm_client_id, } def _serialize_service(self, service, event_dict, kwargs): event_dict['Service'] = service def _serialize_operation(self, operation, event_dict, kwargs): event_dict['Api'] = operation def _serialize_timestamp(self, timestamp, event_dict, kwargs): event_dict['Timestamp'] = timestamp def _serialize_attempts(self, attempts, event_dict, kwargs): event_dict['AttemptCount'] = len(attempts) if attempts: self._add_fields_from_last_attempt(event_dict, attempts[-1]) def _add_fields_from_last_attempt(self, event_dict, last_attempt): if last_attempt.request_headers: # It does not matter which attempt to use to grab the region # for the ApiCall event, but SDKs typically do the last one. region = self._get_region(last_attempt.request_headers) if region is not None: event_dict['Region'] = region event_dict['UserAgent'] = self._get_user_agent( last_attempt.request_headers ) if last_attempt.http_status_code is not None: event_dict['FinalHttpStatusCode'] = last_attempt.http_status_code if last_attempt.parsed_error is not None: self._serialize_parsed_error( last_attempt.parsed_error, event_dict, 'ApiCall' ) if last_attempt.wire_exception is not None: self._serialize_wire_exception( last_attempt.wire_exception, event_dict, 'ApiCall' ) def _serialize_latency(self, latency, event_dict, event_type): if event_type == 'ApiCall': event_dict['Latency'] = latency elif event_type == 'ApiCallAttempt': event_dict['AttemptLatency'] = latency def _serialize_retries_exceeded( self, retries_exceeded, event_dict, kwargs ): event_dict['MaxRetriesExceeded'] = 1 if retries_exceeded else 0 def _serialize_url(self, url, event_dict, kwargs): event_dict['Fqdn'] = urlparse(url).netloc def _serialize_request_headers( self, request_headers, event_dict, kwargs ): event_dict['UserAgent'] = self._get_user_agent(request_headers) if self._is_signed(request_headers): event_dict['AccessKey'] = self._get_access_key(request_headers) region = self._get_region(request_headers) if region is not None: event_dict['Region'] = region if 'X-Amz-Security-Token' in request_headers: event_dict['SessionToken'] = request_headers[ 'X-Amz-Security-Token' ] def _serialize_http_status_code( self, http_status_code, event_dict, kwargs ): event_dict['HttpStatusCode'] = http_status_code def _serialize_response_headers( self, response_headers, event_dict, kwargs ): for header, entry in self._RESPONSE_HEADERS_TO_EVENT_ENTRIES.items(): if header in response_headers: event_dict[entry] = response_headers[header] def _serialize_parsed_error( self, parsed_error, event_dict, event_type, kwargs ): field_prefix = 'Final' if event_type == 'ApiCall' else '' event_dict[field_prefix + 'AwsException'] = self._truncate( parsed_error['Code'], self._MAX_ERROR_CODE_LENGTH ) event_dict[field_prefix + 'AwsExceptionMessage'] = self._truncate( parsed_error['Message'], self._MAX_MESSAGE_LENGTH ) def _serialize_wire_exception( self, wire_exception, event_dict, event_type, *kwargs ): field_prefix = 'Final' if event_type == 'ApiCall' else '' event_dict[field_prefix + 'SdkException'] = self._truncate( wire_exception.__class__.__name__, self._MAX_EXCEPTION_CLASS_LENGTH ) event_dict[field_prefix + 'SdkExceptionMessage'] = self._truncate( str(wire_exception), self._MAX_MESSAGE_LENGTH ) def _get_event_type(self, event): if isinstance(event, APICallEvent): return 'ApiCall' elif isinstance(event, APICallAttemptEvent): return 'ApiCallAttempt' def _get_access_key(self, request_headers): auth_val = self._get_auth_value(request_headers) _, auth_match = self._get_auth_match(auth_val) return auth_match.group('access_key') def _get_region(self, request_headers): if not self._is_signed(request_headers): return None auth_val = self._get_auth_value(request_headers) signature_version, auth_match = self._get_auth_match(auth_val) if signature_version != 'v4': return None return auth_match.group('signing_region') def _get_user_agent(self, request_headers): return self._truncate( ensure_unicode(request_headers.get('User-Agent', '')), self._MAX_USER_AGENT_LENGTH, ) def _is_signed(self, request_headers): return 'Authorization' in request_headers def _get_auth_value(self, request_headers): return ensure_unicode(request_headers['Authorization']) def _get_auth_match(self, auth_val): for signature_version, regex in self._AUTH_REGEXS.items(): match = regex.match(auth_val) if match: return signature_version, match return None, None def _truncate(self, text, max_length): if len(text) > max_length: logger.debug( 'Truncating following value to maximum length of ' '%s: %s', text, max_length, ) return text[:max_length] return text class SocketPublisher: _MAX_MONITOR_EVENT_LENGTH = 8 1024 def __init__(self, socket, host, port, serializer): """Publishes monitor events to a socket :type socket: socket.socket :param socket: The socket object to use to publish events :type host: string :param host: The host to send events to :type port: integer :param port: The port on the host to send events to :param serializer: The serializer to use to serialize the event to a form that can be published to the socket. This must have a `serialize()` method that accepts a monitor event and return bytes """ self._socket = socket self._address = (host, port) self._serializer = serializer def publish(self, event): """Publishes a specified monitor event :type event: BaseMonitorEvent :param event: The monitor event to be sent over the publisher's socket to the desired address. """ serialized_event = self._serializer.serialize(event) if len(serialized_event) > self._MAX_MONITOR_EVENT_LENGTH: logger.debug( 'Serialized event of size %s exceeds the maximum length ' 'allowed: %s. Not sending event to socket.', len(serialized_event), self._MAX_MONITOR_EVENT_LENGTH, ) return self._socket.sendto(serialized_event, self._address)	20.11 KB	2025-05-25 12:26
📄 paginate.py # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import base64 import json import logging from functools import partial from itertools import tee import jmespath from botocore.context import with_current_context from botocore.exceptions import PaginationError from botocore.useragent import register_feature_id from botocore.utils import merge_dicts, set_value_from_jmespath log = logging.getLogger(__name__) class TokenEncoder: """Encodes dictionaries into opaque strings. This for the most part json dumps + base64 encoding, but also supports having bytes in the dictionary in addition to the types that json can handle by default. This is intended for use in encoding pagination tokens, which in some cases can be complex structures and / or contain bytes. """ def encode(self, token): """Encodes a dictionary to an opaque string. :type token: dict :param token: A dictionary containing pagination information, particularly the service pagination token(s) but also other boto metadata. :rtype: str :returns: An opaque string """ try: # Try just using json dumps first to avoid having to traverse # and encode the dict. In 99.9999% of cases this will work. json_string = json.dumps(token) except (TypeError, UnicodeDecodeError): # If normal dumping failed, go through and base64 encode all bytes. encoded_token, encoded_keys = self._encode(token, []) # Save the list of all the encoded key paths. We can safely # assume that no service will ever use this key. encoded_token['boto_encoded_keys'] = encoded_keys # Now that the bytes are all encoded, dump the json. json_string = json.dumps(encoded_token) # base64 encode the json string to produce an opaque token string. return base64.b64encode(json_string.encode('utf-8')).decode('utf-8') def _encode(self, data, path): """Encode bytes in given data, keeping track of the path traversed.""" if isinstance(data, dict): return self._encode_dict(data, path) elif isinstance(data, list): return self._encode_list(data, path) elif isinstance(data, bytes): return self._encode_bytes(data, path) else: return data, [] def _encode_list(self, data, path): """Encode any bytes in a list, noting the index of what is encoded.""" new_data = [] encoded = [] for i, value in enumerate(data): new_path = path + [i] new_value, new_encoded = self._encode(value, new_path) new_data.append(new_value) encoded.extend(new_encoded) return new_data, encoded def _encode_dict(self, data, path): """Encode any bytes in a dict, noting the index of what is encoded.""" new_data = {} encoded = [] for key, value in data.items(): new_path = path + [key] new_value, new_encoded = self._encode(value, new_path) new_data[key] = new_value encoded.extend(new_encoded) return new_data, encoded def _encode_bytes(self, data, path): """Base64 encode a byte string.""" return base64.b64encode(data).decode('utf-8'), [path] class TokenDecoder: """Decodes token strings back into dictionaries. This performs the inverse operation to the TokenEncoder, accepting opaque strings and decoding them into a useable form. """ def decode(self, token): """Decodes an opaque string to a dictionary. :type token: str :param token: A token string given by the botocore pagination interface. :rtype: dict :returns: A dictionary containing pagination information, particularly the service pagination token(s) but also other boto metadata. """ json_string = base64.b64decode(token.encode('utf-8')).decode('utf-8') decoded_token = json.loads(json_string) # Remove the encoding metadata as it is read since it will no longer # be needed. encoded_keys = decoded_token.pop('boto_encoded_keys', None) if encoded_keys is None: return decoded_token else: return self._decode(decoded_token, encoded_keys) def _decode(self, token, encoded_keys): """Find each encoded value and decode it.""" for key in encoded_keys: encoded = self._path_get(token, key) decoded = base64.b64decode(encoded.encode('utf-8')) self._path_set(token, key, decoded) return token def _path_get(self, data, path): """Return the nested data at the given path. For instance: data = {'foo': ['bar', 'baz']} path = ['foo', 0] ==> 'bar' """ # jmespath isn't used here because it would be difficult to actually # create the jmespath query when taking all of the unknowns of key # structure into account. Gross though this is, it is simple and not # very error prone. d = data for step in path: d = d[step] return d def _path_set(self, data, path, value): """Set the value of a key in the given data. Example: data = {'foo': ['bar', 'baz']} path = ['foo', 1] value = 'bin' ==> data = {'foo': ['bar', 'bin']} """ container = self._path_get(data, path[:-1]) container[path[-1]] = value class PaginatorModel: def __init__(self, paginator_config): self._paginator_config = paginator_config['pagination'] def get_paginator(self, operation_name): try: single_paginator_config = self._paginator_config[operation_name] except KeyError: raise ValueError( f"Paginator for operation does not exist: {operation_name}" ) return single_paginator_config class PageIterator: """An iterable object to paginate API results. Please note it is NOT a python iterator. Use ``iter`` to wrap this as a generator. """ def __init__( self, method, input_token, output_token, more_results, result_keys, non_aggregate_keys, limit_key, max_items, starting_token, page_size, op_kwargs, ): self._method = method self._input_token = input_token self._output_token = output_token self._more_results = more_results self._result_keys = result_keys self._max_items = max_items self._limit_key = limit_key self._starting_token = starting_token self._page_size = page_size self._op_kwargs = op_kwargs self._resume_token = None self._non_aggregate_key_exprs = non_aggregate_keys self._non_aggregate_part = {} self._token_encoder = TokenEncoder() self._token_decoder = TokenDecoder() @property def result_keys(self): return self._result_keys @property def resume_token(self): """Token to specify to resume pagination.""" return self._resume_token @resume_token.setter def resume_token(self, value): if not isinstance(value, dict): raise ValueError(f"Bad starting token: {value}") if 'boto_truncate_amount' in value: token_keys = sorted(self._input_token + ['boto_truncate_amount']) else: token_keys = sorted(self._input_token) dict_keys = sorted(value.keys()) if token_keys == dict_keys: self._resume_token = self._token_encoder.encode(value) else: raise ValueError(f"Bad starting token: {value}") @property def non_aggregate_part(self): return self._non_aggregate_part def __iter__(self): current_kwargs = self._op_kwargs previous_next_token = None next_token = {key: None for key in self._input_token} if self._starting_token is not None: # If the starting token exists, populate the next_token with the # values inside it. This ensures that we have the service's # pagination token on hand if we need to truncate after the # first response. next_token = self._parse_starting_token()[0] # The number of items from result_key we've seen so far. total_items = 0 first_request = True primary_result_key = self.result_keys[0] starting_truncation = 0 self._inject_starting_params(current_kwargs) while True: response = self._make_request(current_kwargs) parsed = self._extract_parsed_response(response) if first_request: # The first request is handled differently. We could # possibly have a resume/starting token that tells us where # to index into the retrieved page. if self._starting_token is not None: starting_truncation = self._handle_first_request( parsed, primary_result_key, starting_truncation ) first_request = False self._record_non_aggregate_key_values(parsed) else: # If this isn't the first request, we have already sliced into # the first request and had to make additional requests after. # We no longer need to add this to truncation. starting_truncation = 0 current_response = primary_result_key.search(parsed) if current_response is None: current_response = [] num_current_response = len(current_response) truncate_amount = 0 if self._max_items is not None: truncate_amount = ( total_items + num_current_response - self._max_items ) if truncate_amount > 0: self._truncate_response( parsed, primary_result_key, truncate_amount, starting_truncation, next_token, ) yield response break else: yield response total_items += num_current_response next_token = self._get_next_token(parsed) if all(t is None for t in next_token.values()): break if ( self._max_items is not None and total_items == self._max_items ): # We're on a page boundary so we can set the current # next token to be the resume token. self.resume_token = next_token break if ( previous_next_token is not None and previous_next_token == next_token ): message = ( f"The same next token was received " f"twice: {next_token}" ) raise PaginationError(message=message) self._inject_token_into_kwargs(current_kwargs, next_token) previous_next_token = next_token def search(self, expression): """Applies a JMESPath expression to a paginator Each page of results is searched using the provided JMESPath expression. If the result is not a list, it is yielded directly. If the result is a list, each element in the result is yielded individually (essentially implementing a flatmap in which the JMESPath search is the mapping function). :type expression: str :param expression: JMESPath expression to apply to each page. :return: Returns an iterator that yields the individual elements of applying a JMESPath expression to each page of results. """ compiled = jmespath.compile(expression) for page in self: results = compiled.search(page) if isinstance(results, list): yield from results else: # Yield result directly if it is not a list. yield results @with_current_context(partial(register_feature_id, 'PAGINATOR')) def _make_request(self, current_kwargs): return self._method(current_kwargs) def _extract_parsed_response(self, response): return response def _record_non_aggregate_key_values(self, response): non_aggregate_keys = {} for expression in self._non_aggregate_key_exprs: result = expression.search(response) set_value_from_jmespath( non_aggregate_keys, expression.expression, result ) self._non_aggregate_part = non_aggregate_keys def _inject_starting_params(self, op_kwargs): # If the user has specified a starting token we need to # inject that into the operation's kwargs. if self._starting_token is not None: # Don't need to do anything special if there is no starting # token specified. next_token = self._parse_starting_token()[0] self._inject_token_into_kwargs(op_kwargs, next_token) if self._page_size is not None: # Pass the page size as the parameter name for limiting # page size, also known as the limit_key. op_kwargs[self._limit_key] = self._page_size def _inject_token_into_kwargs(self, op_kwargs, next_token): for name, token in next_token.items(): if (token is not None) and (token != 'None'): op_kwargs[name] = token elif name in op_kwargs: del op_kwargs[name] def _handle_first_request( self, parsed, primary_result_key, starting_truncation ): # If the payload is an array or string, we need to slice into it # and only return the truncated amount. starting_truncation = self._parse_starting_token()[1] all_data = primary_result_key.search(parsed) if isinstance(all_data, (list, str)): data = all_data[starting_truncation:] else: data = None set_value_from_jmespath(parsed, primary_result_key.expression, data) # We also need to truncate any secondary result keys # because they were not truncated in the previous last # response. for token in self.result_keys: if token == primary_result_key: continue sample = token.search(parsed) if isinstance(sample, list): empty_value = [] elif isinstance(sample, str): empty_value = '' elif isinstance(sample, (int, float)): empty_value = 0 else: empty_value = None set_value_from_jmespath(parsed, token.expression, empty_value) return starting_truncation def _truncate_response( self, parsed, primary_result_key, truncate_amount, starting_truncation, next_token, ): original = primary_result_key.search(parsed) if original is None: original = [] amount_to_keep = len(original) - truncate_amount truncated = original[:amount_to_keep] set_value_from_jmespath( parsed, primary_result_key.expression, truncated ) # The issue here is that even though we know how much we've truncated # we need to account for this globally including any starting # left truncation. For example: # Raw response: [0,1,2,3] # Starting index: 1 # Max items: 1 # Starting left truncation: [1, 2, 3] # End right truncation for max items: [1] # However, even though we only kept 1, this is post # left truncation so the next starting index should be 2, not 1 # (left_truncation + amount_to_keep). next_token['boto_truncate_amount'] = ( amount_to_keep + starting_truncation ) self.resume_token = next_token def _get_next_token(self, parsed): if self._more_results is not None: if not self._more_results.search(parsed): return {} next_tokens = {} for output_token, input_key in zip( self._output_token, self._input_token ): next_token = output_token.search(parsed) # We do not want to include any empty strings as actual tokens. # Treat them as None. if next_token: next_tokens[input_key] = next_token else: next_tokens[input_key] = None return next_tokens def result_key_iters(self): teed_results = tee(self, len(self.result_keys)) return [ ResultKeyIterator(i, result_key) for i, result_key in zip(teed_results, self.result_keys) ] def build_full_result(self): complete_result = {} for response in self: page = response # We want to try to catch operation object pagination # and format correctly for those. They come in the form # of a tuple of two elements: (http_response, parsed_responsed). # We want the parsed_response as that is what the page iterator # uses. We can remove it though once operation objects are removed. if isinstance(response, tuple) and len(response) == 2: page = response[1] # We're incrementally building the full response page # by page. For each page in the response we need to # inject the necessary components from the page # into the complete_result. for result_expression in self.result_keys: # In order to incrementally update a result key # we need to search the existing value from complete_result, # then we need to search the _current_ page for the # current result key value. Then we append the current # value onto the existing value, and re-set that value # as the new value. result_value = result_expression.search(page) if result_value is None: continue existing_value = result_expression.search(complete_result) if existing_value is None: # Set the initial result set_value_from_jmespath( complete_result, result_expression.expression, result_value, ) continue # Now both result_value and existing_value contain something if isinstance(result_value, list): existing_value.extend(result_value) elif isinstance(result_value, (int, float, str)): # Modify the existing result with the sum or concatenation set_value_from_jmespath( complete_result, result_expression.expression, existing_value + result_value, ) merge_dicts(complete_result, self.non_aggregate_part) if self.resume_token is not None: complete_result['NextToken'] = self.resume_token return complete_result def _parse_starting_token(self): if self._starting_token is None: return None # The starting token is a dict passed as a base64 encoded string. next_token = self._starting_token try: next_token = self._token_decoder.decode(next_token) index = 0 if 'boto_truncate_amount' in next_token: index = next_token.get('boto_truncate_amount') del next_token['boto_truncate_amount'] except (ValueError, TypeError): next_token, index = self._parse_starting_token_deprecated() return next_token, index def _parse_starting_token_deprecated(self): """ This handles parsing of old style starting tokens, and attempts to coerce them into the new style. """ log.debug( "Attempting to fall back to old starting token parser. For " f"token: {self._starting_token}" ) if self._starting_token is None: return None parts = self._starting_token.split('___') next_token = [] index = 0 if len(parts) == len(self._input_token) + 1: try: index = int(parts.pop()) except ValueError: # This doesn't look like a valid old-style token, so we're # passing it along as an opaque service token. parts = [self._starting_token] for part in parts: if part == 'None': next_token.append(None) else: next_token.append(part) return self._convert_deprecated_starting_token(next_token), index def _convert_deprecated_starting_token(self, deprecated_token): """ This attempts to convert a deprecated starting token into the new style. """ len_deprecated_token = len(deprecated_token) len_input_token = len(self._input_token) if len_deprecated_token > len_input_token: raise ValueError(f"Bad starting token: {self._starting_token}") elif len_deprecated_token < len_input_token: log.debug( "Old format starting token does not contain all input " "tokens. Setting the rest, in order, as None." ) for i in range(len_input_token - len_deprecated_token): deprecated_token.append(None) return dict(zip(self._input_token, deprecated_token)) class Paginator: PAGE_ITERATOR_CLS = PageIterator def __init__(self, method, pagination_config, model): self._model = model self._method = method self._pagination_cfg = pagination_config self._output_token = self._get_output_tokens(self._pagination_cfg) self._input_token = self._get_input_tokens(self._pagination_cfg) self._more_results = self._get_more_results_token(self._pagination_cfg) self._non_aggregate_keys = self._get_non_aggregate_keys( self._pagination_cfg ) self._result_keys = self._get_result_keys(self._pagination_cfg) self._limit_key = self._get_limit_key(self._pagination_cfg) @property def result_keys(self): return self._result_keys def _get_non_aggregate_keys(self, config): keys = [] for key in config.get('non_aggregate_keys', []): keys.append(jmespath.compile(key)) return keys def _get_output_tokens(self, config): output = [] output_token = config['output_token'] if not isinstance(output_token, list): output_token = [output_token] for config in output_token: output.append(jmespath.compile(config)) return output def _get_input_tokens(self, config): input_token = self._pagination_cfg['input_token'] if not isinstance(input_token, list): input_token = [input_token] return input_token def _get_more_results_token(self, config): more_results = config.get('more_results') if more_results is not None: return jmespath.compile(more_results) def _get_result_keys(self, config): result_key = config.get('result_key') if result_key is not None: if not isinstance(result_key, list): result_key = [result_key] result_key = [jmespath.compile(rk) for rk in result_key] return result_key def _get_limit_key(self, config): return config.get('limit_key') def paginate(self, kwargs): """Create paginator object for an operation. This returns an iterable object. Iterating over this object will yield a single page of a response at a time. """ page_params = self._extract_paging_params(kwargs) return self.PAGE_ITERATOR_CLS( self._method, self._input_token, self._output_token, self._more_results, self._result_keys, self._non_aggregate_keys, self._limit_key, page_params['MaxItems'], page_params['StartingToken'], page_params['PageSize'], kwargs, ) def _extract_paging_params(self, kwargs): pagination_config = kwargs.pop('PaginationConfig', {}) max_items = pagination_config.get('MaxItems', None) if max_items is not None: max_items = int(max_items) page_size = pagination_config.get('PageSize', None) if page_size is not None: if self._limit_key is None: raise PaginationError( message="PageSize parameter is not supported for the " "pagination interface for this operation." ) input_members = self._model.input_shape.members limit_key_shape = input_members.get(self._limit_key) if limit_key_shape.type_name == 'string': if not isinstance(page_size, str): page_size = str(page_size) else: page_size = int(page_size) return { 'MaxItems': max_items, 'StartingToken': pagination_config.get('StartingToken', None), 'PageSize': page_size, } class ResultKeyIterator: """Iterates over the results of paginated responses. Each iterator is associated with a single result key. Iterating over this object will give you each element in the result key list. :param pages_iterator: An iterator that will give you pages of results (a ``PageIterator`` class). :param result_key: The JMESPath expression representing the result key. """ def __init__(self, pages_iterator, result_key): self._pages_iterator = pages_iterator self.result_key = result_key def __iter__(self): for page in self._pages_iterator: results = self.result_key.search(page) if results is None: results = [] yield from results	26.94 KB	2025-05-25 12:26
📄 parsers.py # Copyright 2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Response parsers for the various protocol types. The module contains classes that can take an HTTP response, and given an output shape, parse the response into a dict according to the rules in the output shape. There are many similarities amongst the different protocols with regard to response parsing, and the code is structured in a way to avoid code duplication when possible. The diagram below is a diagram showing the inheritance hierarchy of the response classes. :: +-------------------+ \| ResponseParser \| +-------------------+ ^ ^ ^ ^ ^ \| \| \| \| \| \| \| \| \| +--------------------------------------------+ \| \| \| +-----------------------------+ \| \| \| \| \| \| +--------------------+ \| +----------------+ \| \| \| \| \| \| \| +----------+----------+ +------+-------+ +-------+------+ +------+-------+ +------+--------+ \|BaseXMLResponseParser\| \|BaseRestParser\| \|BaseJSONParser\| \|BaseCBORParser\| \|BaseRpcV2Parser\| +---------------------+ +--------------+ +--------------+ +----------+---+ +-+-------------+ ^ ^ ^ ^ ^ ^ ^ ^ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| ++----------+-+ +-+--------+---+ \| +---+---------+-+ \| \|RestXMLParser\| \|RestJSONParser\| \| \|RpcV2CBORParser\| +-----+-----+ +-------------+ +--------------+ \| +---+---------+-+ \|QueryParser\| \| +-----------+ +----+-----+ \|JSONParser\| +----------+ The diagram above shows that there is a base class, ``ResponseParser`` that contains logic that is similar amongst all the different protocols (``query``, ``json``, ``rest-json``, ``rest-xml``, ``smithy-rpc-v2-cbor``). Amongst the various services there is shared logic that can be grouped several ways: * The ``query`` and ``rest-xml`` both have XML bodies that are parsed in the same way. * The ``json`` and ``rest-json`` protocols both have JSON bodies that are parsed in the same way. * The ``rest-json`` and ``rest-xml`` protocols have additional attributes besides body parameters that are parsed the same (headers, query string, status code). This is reflected in the class diagram above. The ``BaseXMLResponseParser`` and the BaseJSONParser contain logic for parsing the XML/JSON body, and the BaseRestParser contains logic for parsing out attributes that come from other parts of the HTTP response. Classes like the ``RestXMLParser`` inherit from the ``BaseXMLResponseParser`` to get the XML body parsing logic and the ``BaseRestParser`` to get the HTTP header/status code/query string parsing. Additionally, there are event stream parsers that are used by the other parsers to wrap streaming bodies that represent a stream of events. The BaseEventStreamParser extends from ResponseParser and defines the logic for parsing values from the headers and payload of a message from the underlying binary encoding protocol. Currently, event streams support parsing bodies encoded as JSON and XML through the following hierarchy. +--------------+ \|ResponseParser\| +--------------+ ^ ^ ^ +--------------------+ \| +------------------+ \| \| \| +----------+----------+ +----------+----------+ +-------+------+ \|BaseXMLResponseParser\| \|BaseEventStreamParser\| \|BaseJSONParser\| +---------------------+ +---------------------+ +--------------+ ^ ^ ^ ^ \| \| \| \| \| \| \| \| +-+----------------+-+ +-+-----------------+-+ \|EventStreamXMLParser\| \|EventStreamJSONParser\| +--------------------+ +---------------------+ Return Values ============= Each call to ``parse()`` returns a dict has this form:: Standard Response { "ResponseMetadata": {"RequestId": <requestid>} <response keys> } Error response { "ResponseMetadata": {"RequestId": <requestid>} "Error": { "Code": <string>, "Message": <string>, "Type": <string>, <additional keys> } } """ import base64 import http.client import io import json import logging import os import re import struct from botocore.compat import ETree, XMLParseError from botocore.eventstream import EventStream, NoInitialResponseError from botocore.utils import ( CachedProperty, ensure_boolean, is_json_value_header, lowercase_dict, merge_dicts, parse_timestamp, ) LOG = logging.getLogger(__name__) DEFAULT_TIMESTAMP_PARSER = parse_timestamp class ResponseParserFactory: def __init__(self): self._defaults = {} def set_parser_defaults(self, *kwargs): """Set default arguments when a parser instance is created. You can specify any kwargs that are allowed by a ResponseParser class. There are currently two arguments: timestamp_parser - A callable that can parse a timestamp string * blob_parser - A callable that can parse a blob type """ self._defaults.update(kwargs) def create_parser(self, protocol_name): parser_cls = PROTOCOL_PARSERS[protocol_name] return parser_cls(*self._defaults) def create_parser(protocol): return ResponseParserFactory().create_parser(protocol) def _text_content(func): # This decorator hides the difference between # an XML node with text or a plain string. It's used # to ensure that scalar processing operates only on text # strings, which allows the same scalar handlers to be used # for XML nodes from the body and HTTP headers. def _get_text_content(self, shape, node_or_string): if hasattr(node_or_string, 'text'): text = node_or_string.text if text is None: # If an XML node is empty <foo></foo>, # we want to parse that as an empty string, # not as a null/None value. text = '' else: text = node_or_string return func(self, shape, text) return _get_text_content class ResponseParserError(Exception): pass class ResponseParser: """Base class for response parsing. This class represents the interface that all ResponseParsers for the various protocols must implement. This class will take an HTTP response and a model shape and parse the HTTP response into a dictionary. There is a single public method exposed: ``parse``. See the ``parse`` docstring for more info. """ DEFAULT_ENCODING = 'utf-8' EVENT_STREAM_PARSER_CLS = None def __init__(self, timestamp_parser=None, blob_parser=None): if timestamp_parser is None: timestamp_parser = DEFAULT_TIMESTAMP_PARSER self._timestamp_parser = timestamp_parser if blob_parser is None: blob_parser = self._default_blob_parser self._blob_parser = blob_parser self._event_stream_parser = None if self.EVENT_STREAM_PARSER_CLS is not None: self._event_stream_parser = self.EVENT_STREAM_PARSER_CLS( timestamp_parser, blob_parser ) def _default_blob_parser(self, value): # Blobs are always returned as bytes type (this matters on python3). # We don't decode this to a str because it's entirely possible that the # blob contains binary data that actually can't be decoded. return base64.b64decode(value) def parse(self, response, shape): """Parse the HTTP response given a shape. :param response: The HTTP response dictionary. This is a dictionary that represents the HTTP request. The dictionary must have the following keys, ``body``, ``headers``, and ``status_code``. :param shape: The model shape describing the expected output. :return: Returns a dictionary representing the parsed response described by the model. In addition to the shape described from the model, each response will also have a ``ResponseMetadata`` which contains metadata about the response, which contains at least two keys containing ``RequestId`` and ``HTTPStatusCode``. Some responses may populate additional keys, but ``RequestId`` will always be present. """ LOG.debug('Response headers: %r', response['headers']) LOG.debug('Response body:\n%r', response['body']) if response['status_code'] >= 301: if self._is_generic_error_response(response): parsed = self._do_generic_error_parse(response) elif self._is_modeled_error_shape(shape): parsed = self._do_modeled_error_parse(response, shape) # We don't want to decorate the modeled fields with metadata return parsed else: parsed = self._do_error_parse(response, shape) else: parsed = self._do_parse(response, shape) # We don't want to decorate event stream responses with metadata if shape and shape.serialization.get('eventstream'): return parsed # Add ResponseMetadata if it doesn't exist and inject the HTTP # status code and headers from the response. if isinstance(parsed, dict): response_metadata = parsed.get('ResponseMetadata', {}) response_metadata['HTTPStatusCode'] = response['status_code'] # Ensure that the http header keys are all lower cased. Older # versions of urllib3 (< 1.11) would unintentionally do this for us # (see urllib3#633). We need to do this conversion manually now. headers = response['headers'] response_metadata['HTTPHeaders'] = lowercase_dict(headers) parsed['ResponseMetadata'] = response_metadata self._add_checksum_response_metadata(response, response_metadata) return parsed def _add_checksum_response_metadata(self, response, response_metadata): checksum_context = response.get('context', {}).get('checksum', {}) algorithm = checksum_context.get('response_algorithm') if algorithm: response_metadata['ChecksumAlgorithm'] = algorithm def _is_modeled_error_shape(self, shape): return shape is not None and shape.metadata.get('exception', False) def _is_generic_error_response(self, response): # There are times when a service will respond with a generic # error response such as: # '<html><body><b>Http/1.1 Service Unavailable</b></body></html>' # # This can also happen if you're going through a proxy. # In this case the protocol specific _do_error_parse will either # fail to parse the response (in the best case) or silently succeed # and treat the HTML above as an XML response and return # non sensical parsed data. # To prevent this case from happening we first need to check # whether or not this response looks like the generic response. if response['status_code'] >= 500: if 'body' not in response or response['body'] is None: return True body = response['body'].strip() return body.startswith(b'<html>') or not body def _do_generic_error_parse(self, response): # There's not really much we can do when we get a generic # html response. LOG.debug( "Received a non protocol specific error response from the " "service, unable to populate error code and message." ) return { 'Error': { 'Code': str(response['status_code']), 'Message': http.client.responses.get( response['status_code'], '' ), }, 'ResponseMetadata': {}, } def _do_parse(self, response, shape): raise NotImplementedError(f"{self.__class__.__name__}._do_parse") def _do_error_parse(self, response, shape): raise NotImplementedError(f"{self.__class__.__name__}._do_error_parse") def _do_modeled_error_parse(self, response, shape, parsed): raise NotImplementedError( f"{self.__class__.__name__}._do_modeled_error_parse" ) def _parse_shape(self, shape, node): handler = getattr( self, f'_handle_{shape.type_name}', self._default_handle ) return handler(shape, node) def _handle_list(self, shape, node): # Enough implementations share list serialization that it's moved # up here in the base class. parsed = [] member_shape = shape.member for item in node: parsed.append(self._parse_shape(member_shape, item)) return parsed def _default_handle(self, shape, value): return value def _create_event_stream(self, response, shape): parser = self._event_stream_parser name = response['context'].get('operation_name') return EventStream(response['body'], shape, parser, name) def _get_first_key(self, value): return list(value)[0] def _has_unknown_tagged_union_member(self, shape, value): if shape.is_tagged_union: cleaned_value = value.copy() cleaned_value.pop("__type", None) cleaned_value = { k: v for k, v in cleaned_value.items() if v is not None } if len(cleaned_value) != 1: error_msg = ( "Invalid service response: %s must have one and only " "one member set." ) raise ResponseParserError(error_msg % shape.name) tag = self._get_first_key(cleaned_value) serialized_member_names = [ shape.members[member].serialization.get('name', member) for member in shape.members ] if tag not in serialized_member_names: msg = ( "Received a tagged union response with member " "unknown to client: %s. Please upgrade SDK for full " "response support." ) LOG.info(msg % tag) return True return False def _handle_unknown_tagged_union_member(self, tag): return {'SDK_UNKNOWN_MEMBER': {'name': tag}} def _do_query_compatible_error_parse(self, code, headers, error): """ Error response may contain an x-amzn-query-error header to translate errors codes from former `query` services into other protocols. We use this to do our lookup in the errorfactory for modeled errors. """ query_error = headers['x-amzn-query-error'] query_error_components = query_error.split(';') if len(query_error_components) == 2 and query_error_components[0]: error['Error']['QueryErrorCode'] = code error['Error']['Type'] = query_error_components[1] return query_error_components[0] return code class BaseXMLResponseParser(ResponseParser): def __init__(self, timestamp_parser=None, blob_parser=None): super().__init__(timestamp_parser, blob_parser) self._namespace_re = re.compile('{.}') def _handle_map(self, shape, node): parsed = {} key_shape = shape.key value_shape = shape.value key_location_name = key_shape.serialization.get('name') or 'key' value_location_name = value_shape.serialization.get('name') or 'value' if shape.serialization.get('flattened') and not isinstance(node, list): node = [node] for keyval_node in node: for single_pair in keyval_node: # Within each <entry> there's a <key> and a <value> tag_name = self._node_tag(single_pair) if tag_name == key_location_name: key_name = self._parse_shape(key_shape, single_pair) elif tag_name == value_location_name: val_name = self._parse_shape(value_shape, single_pair) else: raise ResponseParserError(f"Unknown tag: {tag_name}") parsed[key_name] = val_name return parsed def _node_tag(self, node): return self._namespace_re.sub('', node.tag) def _handle_list(self, shape, node): # When we use _build_name_to_xml_node, repeated elements are aggregated # into a list. However, we can't tell the difference between a scalar # value and a single element flattened list. So before calling the # real _handle_list, we know that "node" should actually be a list if # it's flattened, and if it's not, then we make it a one element list. if shape.serialization.get('flattened') and not isinstance(node, list): node = [node] return super()._handle_list(shape, node) def _handle_structure(self, shape, node): parsed = {} members = shape.members if shape.metadata.get('exception', False): node = self._get_error_root(node) xml_dict = self._build_name_to_xml_node(node) if self._has_unknown_tagged_union_member(shape, xml_dict): tag = self._get_first_key(xml_dict) return self._handle_unknown_tagged_union_member(tag) for member_name in members: member_shape = members[member_name] if ( 'location' in member_shape.serialization or member_shape.serialization.get('eventheader') ): # All members with locations have already been handled, # so we don't need to parse these members. continue xml_name = self._member_key_name(member_shape, member_name) member_node = xml_dict.get(xml_name) if member_node is not None: parsed[member_name] = self._parse_shape( member_shape, member_node ) elif member_shape.serialization.get('xmlAttribute'): attribs = {} location_name = member_shape.serialization['name'] for key, value in node.attrib.items(): new_key = self._namespace_re.sub( location_name.split(':')[0] + ':', key ) attribs[new_key] = value if location_name in attribs: parsed[member_name] = attribs[location_name] return parsed def _get_error_root(self, original_root): if self._node_tag(original_root) == 'ErrorResponse': for child in original_root: if self._node_tag(child) == 'Error': return child return original_root def _member_key_name(self, shape, member_name): # This method is needed because we have to special case flattened list # with a serialization name. If this is the case we use the # locationName from the list's member shape as the key name for the # surrounding structure. if shape.type_name == 'list' and shape.serialization.get('flattened'): list_member_serialized_name = shape.member.serialization.get( 'name' ) if list_member_serialized_name is not None: return list_member_serialized_name serialized_name = shape.serialization.get('name') if serialized_name is not None: return serialized_name return member_name def _build_name_to_xml_node(self, parent_node): # If the parent node is actually a list. We should not be trying # to serialize it to a dictionary. Instead, return the first element # in the list. if isinstance(parent_node, list): return self._build_name_to_xml_node(parent_node[0]) xml_dict = {} for item in parent_node: key = self._node_tag(item) if key in xml_dict: # If the key already exists, the most natural # way to handle this is to aggregate repeated # keys into a single list. # <foo>1</foo><foo>2</foo> -> {'foo': [Node(1), Node(2)]} if isinstance(xml_dict[key], list): xml_dict[key].append(item) else: # Convert from a scalar to a list. xml_dict[key] = [xml_dict[key], item] else: xml_dict[key] = item return xml_dict def _parse_xml_string_to_dom(self, xml_string): try: parser = ETree.XMLParser( target=ETree.TreeBuilder(), encoding=self.DEFAULT_ENCODING ) parser.feed(xml_string) root = parser.close() except XMLParseError as e: raise ResponseParserError( f"Unable to parse response ({e}), " f"invalid XML received. Further retries may succeed:\n{xml_string}" ) return root def _replace_nodes(self, parsed): for key, value in parsed.items(): if list(value): sub_dict = self._build_name_to_xml_node(value) parsed[key] = self._replace_nodes(sub_dict) else: parsed[key] = value.text return parsed @_text_content def _handle_boolean(self, shape, text): if text == 'true': return True else: return False @_text_content def _handle_float(self, shape, text): return float(text) @_text_content def _handle_timestamp(self, shape, text): return self._timestamp_parser(text) @_text_content def _handle_integer(self, shape, text): return int(text) @_text_content def _handle_string(self, shape, text): return text @_text_content def _handle_blob(self, shape, text): return self._blob_parser(text) _handle_character = _handle_string _handle_double = _handle_float _handle_long = _handle_integer class QueryParser(BaseXMLResponseParser): def _do_error_parse(self, response, shape): xml_contents = response['body'] root = self._parse_xml_string_to_dom(xml_contents) parsed = self._build_name_to_xml_node(root) self._replace_nodes(parsed) # Once we've converted xml->dict, we need to make one or two # more adjustments to extract nested errors and to be consistent # with ResponseMetadata for non-error responses: # 1. {"Errors": {"Error": {...}}} -> {"Error": {...}} # 2. {"RequestId": "id"} -> {"ResponseMetadata": {"RequestId": "id"}} if 'Errors' in parsed: parsed.update(parsed.pop('Errors')) if 'RequestId' in parsed: parsed['ResponseMetadata'] = {'RequestId': parsed.pop('RequestId')} return parsed def _do_modeled_error_parse(self, response, shape): return self._parse_body_as_xml(response, shape, inject_metadata=False) def _do_parse(self, response, shape): return self._parse_body_as_xml(response, shape, inject_metadata=True) def _parse_body_as_xml(self, response, shape, inject_metadata=True): xml_contents = response['body'] root = self._parse_xml_string_to_dom(xml_contents) parsed = {} if shape is not None: start = root if 'resultWrapper' in shape.serialization: start = self._find_result_wrapped_shape( shape.serialization['resultWrapper'], root ) parsed = self._parse_shape(shape, start) if inject_metadata: self._inject_response_metadata(root, parsed) return parsed def _find_result_wrapped_shape(self, element_name, xml_root_node): mapping = self._build_name_to_xml_node(xml_root_node) return mapping[element_name] def _inject_response_metadata(self, node, inject_into): mapping = self._build_name_to_xml_node(node) child_node = mapping.get('ResponseMetadata') if child_node is not None: sub_mapping = self._build_name_to_xml_node(child_node) for key, value in sub_mapping.items(): sub_mapping[key] = value.text inject_into['ResponseMetadata'] = sub_mapping class EC2QueryParser(QueryParser): def _inject_response_metadata(self, node, inject_into): mapping = self._build_name_to_xml_node(node) child_node = mapping.get('requestId') if child_node is not None: inject_into['ResponseMetadata'] = {'RequestId': child_node.text} def _do_error_parse(self, response, shape): # EC2 errors look like: # <Response> # <Errors> # <Error> # <Code>InvalidInstanceID.Malformed</Code> # <Message>Invalid id: "1343124"</Message> # </Error> # </Errors> # <RequestID>12345</RequestID> # </Response> # This is different from QueryParser in that it's RequestID, # not RequestId original = super()._do_error_parse(response, shape) if 'RequestID' in original: original['ResponseMetadata'] = { 'RequestId': original.pop('RequestID') } return original def _get_error_root(self, original_root): for child in original_root: if self._node_tag(child) == 'Errors': for errors_child in child: if self._node_tag(errors_child) == 'Error': return errors_child return original_root class BaseJSONParser(ResponseParser): def _handle_structure(self, shape, value): final_parsed = {} if shape.is_document_type: final_parsed = value else: member_shapes = shape.members if value is None: # If the comes across the wire as "null" (None in python), # we should be returning this unchanged, instead of as an # empty dict. return None final_parsed = {} if self._has_unknown_tagged_union_member(shape, value): tag = self._get_first_key(value) return self._handle_unknown_tagged_union_member(tag) for member_name in member_shapes: member_shape = member_shapes[member_name] json_name = member_shape.serialization.get('name', member_name) raw_value = value.get(json_name) if raw_value is not None: final_parsed[member_name] = self._parse_shape( member_shapes[member_name], raw_value ) return final_parsed def _handle_map(self, shape, value): parsed = {} key_shape = shape.key value_shape = shape.value for key, value in value.items(): actual_key = self._parse_shape(key_shape, key) actual_value = self._parse_shape(value_shape, value) parsed[actual_key] = actual_value return parsed def _handle_blob(self, shape, value): return self._blob_parser(value) def _handle_timestamp(self, shape, value): return self._timestamp_parser(value) def _do_error_parse(self, response, shape): body = self._parse_body_as_json(response['body']) error = {"Error": {"Message": '', "Code": ''}, "ResponseMetadata": {}} headers = response['headers'] # Error responses can have slightly different structures for json. # The basic structure is: # # {"__type":"ConnectClientException", # "message":"The error message."} # The error message can either come in the 'message' or 'Message' key # so we need to check for both. error['Error']['Message'] = body.get( 'message', body.get('Message', '') ) # if the message did not contain an error code # include the response status code response_code = response.get('status_code') code = body.get('__type', response_code and str(response_code)) if code is not None: # code has a couple forms as well: # * "com.aws.dynamodb.vAPI#ProvisionedThroughputExceededException" # * "ResourceNotFoundException" if ':' in code: code = code.split(':', 1)[0] if '#' in code: code = code.rsplit('#', 1)[1] if 'x-amzn-query-error' in headers: code = self._do_query_compatible_error_parse( code, headers, error ) error['Error']['Code'] = code self._inject_response_metadata(error, response['headers']) return error def _inject_response_metadata(self, parsed, headers): if 'x-amzn-requestid' in headers: parsed.setdefault('ResponseMetadata', {})['RequestId'] = headers[ 'x-amzn-requestid' ] def _parse_body_as_json(self, body_contents): if not body_contents: return {} body = body_contents.decode(self.DEFAULT_ENCODING) try: original_parsed = json.loads(body) return original_parsed except ValueError: # if the body cannot be parsed, include # the literal string as the message return {'message': body} class BaseCBORParser(ResponseParser): INDEFINITE_ITEM_ADDITIONAL_INFO = 31 BREAK_CODE = 0xFF @CachedProperty def major_type_to_parsing_method_map(self): return { 0: self._parse_unsigned_integer, 1: self._parse_negative_integer, 2: self._parse_byte_string, 3: self._parse_text_string, 4: self._parse_array, 5: self._parse_map, 6: self._parse_tag, 7: self._parse_simple_and_float, } def get_peekable_stream_from_bytes(self, bytes): return io.BufferedReader(io.BytesIO(bytes)) def parse_data_item(self, stream): # CBOR data is divided into "data items", and each data item starts # with an initial byte that describes how the following bytes should be parsed initial_byte = self._read_bytes_as_int(stream, 1) # The highest order three bits of the initial byte describe the CBOR major type major_type = initial_byte >> 5 # The lowest order 5 bits of the initial byte tells us more information about # how the bytes should be parsed that will be used additional_info = initial_byte & 0b00011111 if major_type in self.major_type_to_parsing_method_map: method = self.major_type_to_parsing_method_map[major_type] return method(stream, additional_info) else: raise ResponseParserError( f"Unsupported inital byte found for data item- " f"Major type:{major_type}, Additional info: " f"{additional_info}" ) # Major type 0 - unsigned integers def _parse_unsigned_integer(self, stream, additional_info): additional_info_to_num_bytes = { 24: 1, 25: 2, 26: 4, 27: 8, } # Values under 24 don't need a full byte to be stored; their values are # instead stored as the "additional info" in the initial byte if additional_info < 24: return additional_info elif additional_info in additional_info_to_num_bytes: num_bytes = additional_info_to_num_bytes[additional_info] return self._read_bytes_as_int(stream, num_bytes) else: raise ResponseParserError( "Invalid CBOR integer returned from the service; unparsable " f"additional info found for major type 0 or 1: {additional_info}" ) # Major type 1 - negative integers def _parse_negative_integer(self, stream, additional_info): return -1 - self._parse_unsigned_integer(stream, additional_info) # Major type 2 - byte string def _parse_byte_string(self, stream, additional_info): if additional_info != self.INDEFINITE_ITEM_ADDITIONAL_INFO: length = self._parse_unsigned_integer(stream, additional_info) return self._read_from_stream(stream, length) else: chunks = [] while True: if self._handle_break_code(stream): break initial_byte = self._read_bytes_as_int(stream, 1) additional_info = initial_byte & 0b00011111 length = self._parse_unsigned_integer(stream, additional_info) chunks.append(self._read_from_stream(stream, length)) return b''.join(chunks) # Major type 3 - text string def _parse_text_string(self, stream, additional_info): return self._parse_byte_string(stream, additional_info).decode('utf-8') # Major type 4 - lists def _parse_array(self, stream, additional_info): if additional_info != self.INDEFINITE_ITEM_ADDITIONAL_INFO: length = self._parse_unsigned_integer(stream, additional_info) return [self.parse_data_item(stream) for _ in range(length)] else: items = [] while not self._handle_break_code(stream): items.append(self.parse_data_item(stream)) return items # Major type 5 - maps def _parse_map(self, stream, additional_info): items = {} if additional_info != self.INDEFINITE_ITEM_ADDITIONAL_INFO: length = self._parse_unsigned_integer(stream, additional_info) for _ in range(length): self._parse_key_value_pair(stream, items) return items else: while not self._handle_break_code(stream): self._parse_key_value_pair(stream, items) return items def _parse_key_value_pair(self, stream, items): key = self.parse_data_item(stream) value = self.parse_data_item(stream) if value is not None: items[key] = value # Major type 6 is tags. The only tag we currently support is tag 1 for unix # timestamps def _parse_tag(self, stream, additional_info): tag = self._parse_unsigned_integer(stream, additional_info) value = self.parse_data_item(stream) if tag == 1: # Epoch-based date/time in milliseconds return self._parse_datetime(value) else: raise ResponseParserError( f"Found CBOR tag not supported by botocore: {tag}" ) def _parse_datetime(self, value): if isinstance(value, (int, float)): return self._timestamp_parser(value) else: raise ResponseParserError( f"Unable to parse datetime value: {value}" ) # Major type 7 includes floats and "simple" types. Supported simple types are # currently boolean values, CBOR's null, and CBOR's undefined type. All other # values are either floats or invalid. def _parse_simple_and_float(self, stream, additional_info): # For major type 7, values 20-23 correspond to CBOR "simple" values additional_info_simple_values = { 20: False, # CBOR false 21: True, # CBOR true 22: None, # CBOR null 23: None, # CBOR undefined } # First we check if the additional info corresponds to a supported simple value if additional_info in additional_info_simple_values: return additional_info_simple_values[additional_info] # If it's not a simple value, we need to parse it into the correct format and # number fo bytes float_formats = { 25: ('>e', 2), 26: ('>f', 4), 27: ('>d', 8), } if additional_info in float_formats: float_format, num_bytes = float_formats[additional_info] return struct.unpack( float_format, self._read_from_stream(stream, num_bytes) )[0] raise ResponseParserError( f"Invalid additional info found for major type 7: {additional_info}. " f"This indicates an unsupported simple type or an indefinite float value" ) # This helper method is intended for use when parsing indefinite length items. # It does nothing if the next byte is not the break code. If the next byte is # the break code, it advances past that byte and returns True so the calling # method knows to stop parsing that data item. def _handle_break_code(self, stream): if int.from_bytes(stream.peek(1)[:1], 'big') == self.BREAK_CODE: stream.seek(1, os.SEEK_CUR) return True def _read_bytes_as_int(self, stream, num_bytes): byte = self._read_from_stream(stream, num_bytes) return int.from_bytes(byte, 'big') def _read_from_stream(self, stream, num_bytes): value = stream.read(num_bytes) if len(value) != num_bytes: raise ResponseParserError( "End of stream reached; this indicates a " "malformed CBOR response from the server or an " "issue in botocore" ) return value class BaseEventStreamParser(ResponseParser): def _do_parse(self, response, shape): final_parsed = {} if shape.serialization.get('eventstream'): event_type = response['headers'].get(':event-type') event_shape = shape.members.get(event_type) if event_shape: final_parsed[event_type] = self._do_parse( response, event_shape ) else: self._parse_non_payload_attrs( response, shape, shape.members, final_parsed ) self._parse_payload(response, shape, shape.members, final_parsed) return final_parsed def _do_error_parse(self, response, shape): exception_type = response['headers'].get(':exception-type') exception_shape = shape.members.get(exception_type) if exception_shape is not None: original_parsed = self._initial_body_parse(response['body']) body = self._parse_shape(exception_shape, original_parsed) error = { 'Error': { 'Code': exception_type, 'Message': body.get('Message', body.get('message', '')), } } else: error = { 'Error': { 'Code': response['headers'].get(':error-code', ''), 'Message': response['headers'].get(':error-message', ''), } } return error def _parse_payload(self, response, shape, member_shapes, final_parsed): if shape.serialization.get('event'): for name in member_shapes: member_shape = member_shapes[name] if member_shape.serialization.get('eventpayload'): body = response['body'] if member_shape.type_name == 'blob': parsed_body = body elif member_shape.type_name == 'string': parsed_body = body.decode(self.DEFAULT_ENCODING) else: raw_parse = self._initial_body_parse(body) parsed_body = self._parse_shape( member_shape, raw_parse ) final_parsed[name] = parsed_body return # If we didn't find an explicit payload, use the current shape original_parsed = self._initial_body_parse(response['body']) body_parsed = self._parse_shape(shape, original_parsed) final_parsed.update(body_parsed) def _parse_non_payload_attrs( self, response, shape, member_shapes, final_parsed ): headers = response['headers'] for name in member_shapes: member_shape = member_shapes[name] if member_shape.serialization.get('eventheader'): if name in headers: value = headers[name] if member_shape.type_name == 'timestamp': # Event stream timestamps are an in milleseconds so we # divide by 1000 to convert to seconds. value = self._timestamp_parser(value / 1000.0) final_parsed[name] = value def _initial_body_parse(self, body_contents): # This method should do the initial xml/json parsing of the # body. We still need to walk the parsed body in order # to convert types, but this method will do the first round # of parsing. raise NotImplementedError("_initial_body_parse") class EventStreamJSONParser(BaseEventStreamParser, BaseJSONParser): def _initial_body_parse(self, body_contents): return self._parse_body_as_json(body_contents) class EventStreamXMLParser(BaseEventStreamParser, BaseXMLResponseParser): def _initial_body_parse(self, xml_string): if not xml_string: return ETree.Element('') return self._parse_xml_string_to_dom(xml_string) class EventStreamCBORParser(BaseEventStreamParser, BaseCBORParser): def _initial_body_parse(self, body_contents): if body_contents == b'': return {} return self.parse_data_item( self.get_peekable_stream_from_bytes(body_contents) ) class JSONParser(BaseJSONParser): EVENT_STREAM_PARSER_CLS = EventStreamJSONParser """Response parser for the "json" protocol.""" def _do_parse(self, response, shape): parsed = {} if shape is not None: event_name = shape.event_stream_name if event_name: parsed = self._handle_event_stream(response, shape, event_name) else: parsed = self._handle_json_body(response['body'], shape) self._inject_response_metadata(parsed, response['headers']) return parsed def _do_modeled_error_parse(self, response, shape): return self._handle_json_body(response['body'], shape) def _handle_event_stream(self, response, shape, event_name): event_stream_shape = shape.members[event_name] event_stream = self._create_event_stream(response, event_stream_shape) try: event = event_stream.get_initial_response() except NoInitialResponseError: error_msg = 'First event was not of type initial-response' raise ResponseParserError(error_msg) parsed = self._handle_json_body(event.payload, shape) parsed[event_name] = event_stream return parsed def _handle_json_body(self, raw_body, shape): # The json.loads() gives us the primitive JSON types, # but we need to traverse the parsed JSON data to convert # to richer types (blobs, timestamps, etc. parsed_json = self._parse_body_as_json(raw_body) return self._parse_shape(shape, parsed_json) class BaseRestParser(ResponseParser): def _do_parse(self, response, shape): final_parsed = {} final_parsed['ResponseMetadata'] = self._populate_response_metadata( response ) self._add_modeled_parse(response, shape, final_parsed) return final_parsed def _add_modeled_parse(self, response, shape, final_parsed): if shape is None: return final_parsed member_shapes = shape.members self._parse_non_payload_attrs( response, shape, member_shapes, final_parsed ) self._parse_payload(response, shape, member_shapes, final_parsed) def _do_modeled_error_parse(self, response, shape): final_parsed = {} self._add_modeled_parse(response, shape, final_parsed) return final_parsed def _populate_response_metadata(self, response): metadata = {} headers = response['headers'] if 'x-amzn-requestid' in headers: metadata['RequestId'] = headers['x-amzn-requestid'] elif 'x-amz-request-id' in headers: metadata['RequestId'] = headers['x-amz-request-id'] # HostId is what it's called whenever this value is returned # in an XML response body, so to be consistent, we'll always # call is HostId. metadata['HostId'] = headers.get('x-amz-id-2', '') return metadata def _parse_payload(self, response, shape, member_shapes, final_parsed): if 'payload' in shape.serialization: # If a payload is specified in the output shape, then only that # shape is used for the body payload. payload_member_name = shape.serialization['payload'] body_shape = member_shapes[payload_member_name] if body_shape.serialization.get('eventstream'): body = self._create_event_stream(response, body_shape) final_parsed[payload_member_name] = body elif body_shape.type_name in ['string', 'blob']: # This is a stream body = response['body'] if isinstance(body, bytes): body = body.decode(self.DEFAULT_ENCODING) final_parsed[payload_member_name] = body else: original_parsed = self._initial_body_parse(response['body']) final_parsed[payload_member_name] = self._parse_shape( body_shape, original_parsed ) else: original_parsed = self._initial_body_parse(response['body']) body_parsed = self._parse_shape(shape, original_parsed) final_parsed.update(body_parsed) def _parse_non_payload_attrs( self, response, shape, member_shapes, final_parsed ): headers = response['headers'] for name in member_shapes: member_shape = member_shapes[name] location = member_shape.serialization.get('location') if location is None: continue elif location == 'statusCode': final_parsed[name] = self._parse_shape( member_shape, response['status_code'] ) elif location == 'headers': final_parsed[name] = self._parse_header_map( member_shape, headers ) elif location == 'header': header_name = member_shape.serialization.get('name', name) if header_name in headers: final_parsed[name] = self._parse_shape( member_shape, headers[header_name] ) def _parse_header_map(self, shape, headers): # Note that headers are case insensitive, so we .lower() # all header names and header prefixes. parsed = {} prefix = shape.serialization.get('name', '').lower() for header_name in headers: if header_name.lower().startswith(prefix): # The key name inserted into the parsed hash # strips off the prefix. name = header_name[len(prefix) :] parsed[name] = headers[header_name] return parsed def _initial_body_parse(self, body_contents): # This method should do the initial xml/json parsing of the # body. We still need to walk the parsed body in order # to convert types, but this method will do the first round # of parsing. raise NotImplementedError("_initial_body_parse") def _handle_string(self, shape, value): parsed = value if is_json_value_header(shape): decoded = base64.b64decode(value).decode(self.DEFAULT_ENCODING) parsed = json.loads(decoded) return parsed def _handle_list(self, shape, node): location = shape.serialization.get('location') if location == 'header' and not isinstance(node, list): # List in headers may be a comma separated string as per RFC7230 node = [e.strip() for e in node.split(',')] return super()._handle_list(shape, node) class BaseRpcV2Parser(ResponseParser): def _do_parse(self, response, shape): parsed = {} if shape is not None: event_stream_name = shape.event_stream_name if event_stream_name: parsed = self._handle_event_stream( response, shape, event_stream_name ) else: parsed = {} self._parse_payload(response, shape, parsed) parsed['ResponseMetadata'] = self._populate_response_metadata( response ) return parsed def _add_modeled_parse(self, response, shape, final_parsed): if shape is None: return final_parsed self._parse_payload(response, shape, final_parsed) def _do_modeled_error_parse(self, response, shape): final_parsed = {} self._add_modeled_parse(response, shape, final_parsed) return final_parsed def _populate_response_metadata(self, response): metadata = {} headers = response['headers'] if 'x-amzn-requestid' in headers: metadata['RequestId'] = headers['x-amzn-requestid'] return metadata def _handle_structure(self, shape, node): parsed = {} members = shape.members if shape.is_tagged_union: cleaned_value = node.copy() cleaned_value.pop("__type", None) cleaned_value = { k: v for k, v in cleaned_value.items() if v is not None } if len(cleaned_value) != 1: error_msg = ( "Invalid service response: %s must have one and only " "one member set." ) raise ResponseParserError(error_msg % shape.name) for member_name in members: member_shape = members[member_name] member_node = node.get(member_name) if member_node is not None: parsed[member_name] = self._parse_shape( member_shape, member_node ) return parsed def _parse_payload(self, response, shape, final_parsed): original_parsed = self._initial_body_parse(response['body']) body_parsed = self._parse_shape(shape, original_parsed) final_parsed.update(body_parsed) def _initial_body_parse(self, body_contents): # This method should do the initial parsing of the # body. We still need to walk the parsed body in order # to convert types, but this method will do the first round # of parsing. raise NotImplementedError("_initial_body_parse") class RestJSONParser(BaseRestParser, BaseJSONParser): EVENT_STREAM_PARSER_CLS = EventStreamJSONParser def _initial_body_parse(self, body_contents): return self._parse_body_as_json(body_contents) def _do_error_parse(self, response, shape): error = super()._do_error_parse(response, shape) self._inject_error_code(error, response) return error def _inject_error_code(self, error, response): # The "Code" value can come from either a response # header or a value in the JSON body. body = self._initial_body_parse(response['body']) code = None if 'x-amzn-errortype' in response['headers']: code = response['headers']['x-amzn-errortype'] elif 'code' in body or 'Code' in body: code = body.get('code', body.get('Code', '')) if code is None: return if isinstance(code, str): code = code.split(':', 1)[0].rsplit('#', 1)[-1] error['Error']['Code'] = code def _handle_boolean(self, shape, value): return ensure_boolean(value) def _handle_integer(self, shape, value): return int(value) def _handle_float(self, shape, value): return float(value) _handle_long = _handle_integer _handle_double = _handle_float class RpcV2CBORParser(BaseRpcV2Parser, BaseCBORParser): EVENT_STREAM_PARSER_CLS = EventStreamCBORParser def _initial_body_parse(self, body_contents): if body_contents == b'': return body_contents body_contents_stream = self.get_peekable_stream_from_bytes( body_contents ) return self.parse_data_item(body_contents_stream) def _do_error_parse(self, response, shape): body = self._initial_body_parse(response['body']) error = { "Error": { "Message": body.get('message', body.get('Message', '')), "Code": '', }, "ResponseMetadata": {}, } headers = response['headers'] code = body.get('__type') if code is None: response_code = response.get('status_code') if response_code is not None: code = str(response_code) if code is not None: if ':' in code: code = code.split(':', 1)[0] if '#' in code: code = code.rsplit('#', 1)[1] if 'x-amzn-query-error' in headers: code = self._do_query_compatible_error_parse( code, headers, error ) error['Error']['Code'] = code if 'x-amzn-requestid' in headers: error.setdefault('ResponseMetadata', {})['RequestId'] = headers[ 'x-amzn-requestid' ] return error def _handle_event_stream(self, response, shape, event_name): event_stream_shape = shape.members[event_name] event_stream = self._create_event_stream(response, event_stream_shape) try: event = event_stream.get_initial_response() except NoInitialResponseError: error_msg = 'First event was not of type initial-response' raise ResponseParserError(error_msg) parsed = self._initial_body_parse(event.payload) parsed[event_name] = event_stream return parsed class RestXMLParser(BaseRestParser, BaseXMLResponseParser): EVENT_STREAM_PARSER_CLS = EventStreamXMLParser def _initial_body_parse(self, xml_string): if not xml_string: return ETree.Element('') return self._parse_xml_string_to_dom(xml_string) def _do_error_parse(self, response, shape): # We're trying to be service agnostic here, but S3 does have a slightly # different response structure for its errors compared to other # rest-xml serivces (route53/cloudfront). We handle this by just # trying to parse both forms. # First: # <ErrorResponse xmlns="..."> # <Error> # <Type>Sender</Type> # <Code>InvalidInput</Code> # <Message>Invalid resource type: foo</Message> # </Error> # <RequestId>request-id</RequestId> # </ErrorResponse> if response['body']: # If the body ends up being invalid xml, the xml parser should not # blow up. It should at least try to pull information about the # the error response from other sources like the HTTP status code. try: return self._parse_error_from_body(response) except ResponseParserError: LOG.debug( 'Exception caught when parsing error response body:', exc_info=True, ) return self._parse_error_from_http_status(response) def _parse_error_from_http_status(self, response): return { 'Error': { 'Code': str(response['status_code']), 'Message': http.client.responses.get( response['status_code'], '' ), }, 'ResponseMetadata': { 'RequestId': response['headers'].get('x-amz-request-id', ''), 'HostId': response['headers'].get('x-amz-id-2', ''), }, } def _parse_error_from_body(self, response): xml_contents = response['body'] root = self._parse_xml_string_to_dom(xml_contents) parsed = self._build_name_to_xml_node(root) self._replace_nodes(parsed) if root.tag == 'Error': # This is an S3 error response. First we'll populate the # response metadata. metadata = self._populate_response_metadata(response) # The RequestId and the HostId are already in the # ResponseMetadata, but are also duplicated in the XML # body. We don't need these values in both places, # we'll just remove them from the parsed XML body. parsed.pop('RequestId', '') parsed.pop('HostId', '') return {'Error': parsed, 'ResponseMetadata': metadata} elif 'RequestId' in parsed: # Other rest-xml services: parsed['ResponseMetadata'] = {'RequestId': parsed.pop('RequestId')} default = {'Error': {'Message': '', 'Code': ''}} merge_dicts(default, parsed) return default @_text_content def _handle_string(self, shape, text): text = super()._handle_string(shape, text) return text PROTOCOL_PARSERS = { 'ec2': EC2QueryParser, 'query': QueryParser, 'json': JSONParser, 'rest-json': RestJSONParser, 'rest-xml': RestXMLParser, 'smithy-rpc-v2-cbor': RpcV2CBORParser, }	58.65 KB	2025-05-25 12:26
📄 regions.py # Copyright 2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Resolves regions and endpoints. This module implements endpoint resolution, including resolving endpoints for a given service and region and resolving the available endpoints for a service in a specific AWS partition. """ import copy import logging import re from enum import Enum import jmespath from botocore import UNSIGNED, xform_name from botocore.auth import AUTH_TYPE_MAPS, HAS_CRT from botocore.crt import CRT_SUPPORTED_AUTH_TYPES from botocore.endpoint_provider import EndpointProvider from botocore.exceptions import ( EndpointProviderError, EndpointVariantError, InvalidEndpointConfigurationError, InvalidHostLabelError, MissingDependencyException, NoRegionError, ParamValidationError, UnknownEndpointResolutionBuiltInName, UnknownRegionError, UnknownSignatureVersionError, UnsupportedS3AccesspointConfigurationError, UnsupportedS3ConfigurationError, UnsupportedS3ControlArnError, UnsupportedS3ControlConfigurationError, ) from botocore.useragent import register_feature_id from botocore.utils import ensure_boolean, instance_cache LOG = logging.getLogger(__name__) DEFAULT_URI_TEMPLATE = '{service}.{region}.{dnsSuffix}' # noqa DEFAULT_SERVICE_DATA = {'endpoints': {}} class BaseEndpointResolver: """Resolves regions and endpoints. Must be subclassed.""" def construct_endpoint(self, service_name, region_name=None): """Resolves an endpoint for a service and region combination. :type service_name: string :param service_name: Name of the service to resolve an endpoint for (e.g., s3) :type region_name: string :param region_name: Region/endpoint name to resolve (e.g., us-east-1) if no region is provided, the first found partition-wide endpoint will be used if available. :rtype: dict :return: Returns a dict containing the following keys: - partition: (string, required) Resolved partition name - endpointName: (string, required) Resolved endpoint name - hostname: (string, required) Hostname to use for this endpoint - sslCommonName: (string) sslCommonName to use for this endpoint. - credentialScope: (dict) Signature version 4 credential scope - region: (string) region name override when signing. - service: (string) service name override when signing. - signatureVersions: (list<string>) A list of possible signature versions, including s3, v4, v2, and s3v4 - protocols: (list<string>) A list of supported protocols (e.g., http, https) - ...: Other keys may be included as well based on the metadata """ raise NotImplementedError def get_available_partitions(self): """Lists the partitions available to the endpoint resolver. :return: Returns a list of partition names (e.g., ["aws", "aws-cn"]). """ raise NotImplementedError def get_available_endpoints( self, service_name, partition_name='aws', allow_non_regional=False ): """Lists the endpoint names of a particular partition. :type service_name: string :param service_name: Name of a service to list endpoint for (e.g., s3) :type partition_name: string :param partition_name: Name of the partition to limit endpoints to. (e.g., aws for the public AWS endpoints, aws-cn for AWS China endpoints, aws-us-gov for AWS GovCloud (US) Endpoints, etc. :type allow_non_regional: bool :param allow_non_regional: Set to True to include endpoints that are not regional endpoints (e.g., s3-external-1, fips-us-gov-west-1, etc). :return: Returns a list of endpoint names (e.g., ["us-east-1"]). """ raise NotImplementedError class EndpointResolver(BaseEndpointResolver): """Resolves endpoints based on partition endpoint metadata""" _UNSUPPORTED_DUALSTACK_PARTITIONS = ['aws-iso', 'aws-iso-b'] def __init__(self, endpoint_data, uses_builtin_data=False): """ :type endpoint_data: dict :param endpoint_data: A dict of partition data. :type uses_builtin_data: boolean :param uses_builtin_data: Whether the endpoint data originates in the package's data directory. """ if 'partitions' not in endpoint_data: raise ValueError('Missing "partitions" in endpoint data') self._endpoint_data = endpoint_data self.uses_builtin_data = uses_builtin_data def get_service_endpoints_data(self, service_name, partition_name='aws'): for partition in self._endpoint_data['partitions']: if partition['partition'] != partition_name: continue services = partition['services'] if service_name not in services: continue return services[service_name]['endpoints'] def get_available_partitions(self): result = [] for partition in self._endpoint_data['partitions']: result.append(partition['partition']) return result def get_available_endpoints( self, service_name, partition_name='aws', allow_non_regional=False, endpoint_variant_tags=None, ): result = [] for partition in self._endpoint_data['partitions']: if partition['partition'] != partition_name: continue services = partition['services'] if service_name not in services: continue service_endpoints = services[service_name]['endpoints'] for endpoint_name in service_endpoints: is_regional_endpoint = endpoint_name in partition['regions'] # Only regional endpoints can be modeled with variants if endpoint_variant_tags and is_regional_endpoint: variant_data = self._retrieve_variant_data( service_endpoints[endpoint_name], endpoint_variant_tags ) if variant_data: result.append(endpoint_name) elif allow_non_regional or is_regional_endpoint: result.append(endpoint_name) return result def get_partition_dns_suffix( self, partition_name, endpoint_variant_tags=None ): for partition in self._endpoint_data['partitions']: if partition['partition'] == partition_name: if endpoint_variant_tags: variant = self._retrieve_variant_data( partition.get('defaults'), endpoint_variant_tags ) if variant and 'dnsSuffix' in variant: return variant['dnsSuffix'] else: return partition['dnsSuffix'] return None def construct_endpoint( self, service_name, region_name=None, partition_name=None, use_dualstack_endpoint=False, use_fips_endpoint=False, ): if ( service_name == 's3' and use_dualstack_endpoint and region_name is None ): region_name = 'us-east-1' if partition_name is not None: valid_partition = None for partition in self._endpoint_data['partitions']: if partition['partition'] == partition_name: valid_partition = partition if valid_partition is not None: result = self._endpoint_for_partition( valid_partition, service_name, region_name, use_dualstack_endpoint, use_fips_endpoint, True, ) return result return None # Iterate over each partition until a match is found. for partition in self._endpoint_data['partitions']: if use_dualstack_endpoint and ( partition['partition'] in self._UNSUPPORTED_DUALSTACK_PARTITIONS ): continue result = self._endpoint_for_partition( partition, service_name, region_name, use_dualstack_endpoint, use_fips_endpoint, ) if result: return result def get_partition_for_region(self, region_name): for partition in self._endpoint_data['partitions']: if self._region_match(partition, region_name): return partition['partition'] raise UnknownRegionError( region_name=region_name, error_msg='No partition found for provided region_name.', ) def _endpoint_for_partition( self, partition, service_name, region_name, use_dualstack_endpoint, use_fips_endpoint, force_partition=False, ): partition_name = partition["partition"] if ( use_dualstack_endpoint and partition_name in self._UNSUPPORTED_DUALSTACK_PARTITIONS ): error_msg = ( "Dualstack endpoints are currently not supported" f" for {partition_name} partition" ) raise EndpointVariantError(tags=['dualstack'], error_msg=error_msg) # Get the service from the partition, or an empty template. service_data = partition['services'].get( service_name, DEFAULT_SERVICE_DATA ) # Use the partition endpoint if no region is supplied. if region_name is None: if 'partitionEndpoint' in service_data: region_name = service_data['partitionEndpoint'] else: raise NoRegionError() resolve_kwargs = { 'partition': partition, 'service_name': service_name, 'service_data': service_data, 'endpoint_name': region_name, 'use_dualstack_endpoint': use_dualstack_endpoint, 'use_fips_endpoint': use_fips_endpoint, } # Attempt to resolve the exact region for this partition. if region_name in service_data['endpoints']: return self._resolve(resolve_kwargs) # Check to see if the endpoint provided is valid for the partition. if self._region_match(partition, region_name) or force_partition: # Use the partition endpoint if set and not regionalized. partition_endpoint = service_data.get('partitionEndpoint') is_regionalized = service_data.get('isRegionalized', True) if partition_endpoint and not is_regionalized: LOG.debug( 'Using partition endpoint for %s, %s: %s', service_name, region_name, partition_endpoint, ) resolve_kwargs['endpoint_name'] = partition_endpoint return self._resolve(resolve_kwargs) LOG.debug( 'Creating a regex based endpoint for %s, %s', service_name, region_name, ) return self._resolve(resolve_kwargs) def _region_match(self, partition, region_name): if region_name in partition['regions']: return True if 'regionRegex' in partition: return re.compile(partition['regionRegex']).match(region_name) return False def _retrieve_variant_data(self, endpoint_data, tags): variants = endpoint_data.get('variants', []) for variant in variants: if set(variant['tags']) == set(tags): result = variant.copy() return result def _create_tag_list(self, use_dualstack_endpoint, use_fips_endpoint): tags = [] if use_dualstack_endpoint: tags.append('dualstack') if use_fips_endpoint: tags.append('fips') return tags def _resolve_variant( self, tags, endpoint_data, service_defaults, partition_defaults ): result = {} for variants in [endpoint_data, service_defaults, partition_defaults]: variant = self._retrieve_variant_data(variants, tags) if variant: self._merge_keys(variant, result) return result def _resolve( self, partition, service_name, service_data, endpoint_name, use_dualstack_endpoint, use_fips_endpoint, ): endpoint_data = service_data.get('endpoints', {}).get( endpoint_name, {} ) if endpoint_data.get('deprecated'): LOG.warning( f'Client is configured with the deprecated endpoint: {endpoint_name}' ) service_defaults = service_data.get('defaults', {}) partition_defaults = partition.get('defaults', {}) tags = self._create_tag_list(use_dualstack_endpoint, use_fips_endpoint) if tags: result = self._resolve_variant( tags, endpoint_data, service_defaults, partition_defaults ) if result == {}: error_msg = ( f"Endpoint does not exist for {service_name} " f"in region {endpoint_name}" ) raise EndpointVariantError(tags=tags, error_msg=error_msg) self._merge_keys(endpoint_data, result) else: result = endpoint_data # If dnsSuffix has not already been consumed from a variant definition if 'dnsSuffix' not in result: result['dnsSuffix'] = partition['dnsSuffix'] result['partition'] = partition['partition'] result['endpointName'] = endpoint_name # Merge in the service defaults then the partition defaults. self._merge_keys(service_defaults, result) self._merge_keys(partition_defaults, result) result['hostname'] = self._expand_template( partition, result['hostname'], service_name, endpoint_name, result['dnsSuffix'], ) if 'sslCommonName' in result: result['sslCommonName'] = self._expand_template( partition, result['sslCommonName'], service_name, endpoint_name, result['dnsSuffix'], ) return result def _merge_keys(self, from_data, result): for key in from_data: if key not in result: result[key] = from_data[key] def _expand_template( self, partition, template, service_name, endpoint_name, dnsSuffix ): return template.format( service=service_name, region=endpoint_name, dnsSuffix=dnsSuffix ) class EndpointResolverBuiltins(str, Enum): # The AWS Region configured for the SDK client (str) AWS_REGION = "AWS::Region" # Whether the UseFIPSEndpoint configuration option has been enabled for # the SDK client (bool) AWS_USE_FIPS = "AWS::UseFIPS" # Whether the UseDualStackEndpoint configuration option has been enabled # for the SDK client (bool) AWS_USE_DUALSTACK = "AWS::UseDualStack" # Whether the global endpoint should be used with STS, rather than the # regional endpoint for us-east-1 (bool) AWS_STS_USE_GLOBAL_ENDPOINT = "AWS::STS::UseGlobalEndpoint" # Whether the global endpoint should be used with S3, rather than the # regional endpoint for us-east-1 (bool) AWS_S3_USE_GLOBAL_ENDPOINT = "AWS::S3::UseGlobalEndpoint" # Whether S3 Transfer Acceleration has been requested (bool) AWS_S3_ACCELERATE = "AWS::S3::Accelerate" # Whether S3 Force Path Style has been enabled (bool) AWS_S3_FORCE_PATH_STYLE = "AWS::S3::ForcePathStyle" # Whether to use the ARN region or raise an error when ARN and client # region differ (for s3 service only, bool) AWS_S3_USE_ARN_REGION = "AWS::S3::UseArnRegion" # Whether to use the ARN region or raise an error when ARN and client # region differ (for s3-control service only, bool) AWS_S3CONTROL_USE_ARN_REGION = 'AWS::S3Control::UseArnRegion' # Whether multi-region access points (MRAP) should be disabled (bool) AWS_S3_DISABLE_MRAP = "AWS::S3::DisableMultiRegionAccessPoints" # Whether a custom endpoint has been configured (str) SDK_ENDPOINT = "SDK::Endpoint" # An AWS account ID that can be optionally configured for the SDK client (str) ACCOUNT_ID = "AWS::Auth::AccountId" # Whether an endpoint should include an account ID (str) ACCOUNT_ID_ENDPOINT_MODE = "AWS::Auth::AccountIdEndpointMode" class EndpointRulesetResolver: """Resolves endpoints using a service's endpoint ruleset""" def __init__( self, endpoint_ruleset_data, partition_data, service_model, builtins, client_context, event_emitter, use_ssl=True, requested_auth_scheme=None, ): self._provider = EndpointProvider( ruleset_data=endpoint_ruleset_data, partition_data=partition_data, ) self._param_definitions = self._provider.ruleset.parameters self._service_model = service_model self._builtins = builtins self._client_context = client_context self._event_emitter = event_emitter self._use_ssl = use_ssl self._requested_auth_scheme = requested_auth_scheme self._instance_cache = {} def construct_endpoint( self, operation_model, call_args, request_context, ): """Invokes the provider with params defined in the service's ruleset""" if call_args is None: call_args = {} if request_context is None: request_context = {} provider_params = self._get_provider_params( operation_model, call_args, request_context ) LOG.debug( f'Calling endpoint provider with parameters: {provider_params}' ) try: provider_result = self._provider.resolve_endpoint( provider_params ) except EndpointProviderError as ex: botocore_exception = self.ruleset_error_to_botocore_exception( ex, provider_params ) if botocore_exception is None: raise else: raise botocore_exception from ex LOG.debug(f'Endpoint provider result: {provider_result.url}') # The endpoint provider does not support non-secure transport. if not self._use_ssl and provider_result.url.startswith('https://'): provider_result = provider_result._replace( url=f'http://{provider_result.url[8:]}' ) # Multi-valued headers are not supported in botocore. Replace the list # of values returned for each header with just its first entry, # dropping any additionally entries. provider_result = provider_result._replace( headers={ key: val[0] for key, val in provider_result.headers.items() } ) return provider_result def _get_provider_params( self, operation_model, call_args, request_context ): """Resolve a value for each parameter defined in the service's ruleset The resolution order for parameter values is: 1. Operation-specific static context values from the service definition 2. Operation-specific dynamic context values from API parameters 3. Client-specific context parameters 4. Built-in values such as region, FIPS usage, ... """ provider_params = {} # Builtin values can be customized for each operation by hooks # subscribing to the ``before-endpoint-resolution.`` event. customized_builtins = self._get_customized_builtins( operation_model, call_args, request_context ) for param_name, param_def in self._param_definitions.items(): param_val = self._resolve_param_from_context( param_name=param_name, operation_model=operation_model, call_args=call_args, ) if param_val is None and param_def.builtin is not None: param_val = self._resolve_param_as_builtin( builtin_name=param_def.builtin, builtins=customized_builtins, ) if param_val is not None: provider_params[param_name] = param_val self._register_endpoint_feature_ids(param_name, param_val) return provider_params def _resolve_param_from_context( self, param_name, operation_model, call_args ): static = self._resolve_param_as_static_context_param( param_name, operation_model ) if static is not None: return static dynamic = self._resolve_param_as_dynamic_context_param( param_name, operation_model, call_args ) if dynamic is not None: return dynamic operation_context_params = ( self._resolve_param_as_operation_context_param( param_name, operation_model, call_args ) ) if operation_context_params is not None: return operation_context_params return self._resolve_param_as_client_context_param(param_name) def _resolve_param_as_static_context_param( self, param_name, operation_model ): static_ctx_params = self._get_static_context_params(operation_model) return static_ctx_params.get(param_name) def _resolve_param_as_dynamic_context_param( self, param_name, operation_model, call_args ): dynamic_ctx_params = self._get_dynamic_context_params(operation_model) if param_name in dynamic_ctx_params: member_name = dynamic_ctx_params[param_name] return call_args.get(member_name) def _resolve_param_as_client_context_param(self, param_name): client_ctx_params = self._get_client_context_params() if param_name in client_ctx_params: client_ctx_varname = client_ctx_params[param_name] return self._client_context.get(client_ctx_varname) def _resolve_param_as_operation_context_param( self, param_name, operation_model, call_args ): operation_ctx_params = operation_model.operation_context_parameters if param_name in operation_ctx_params: path = operation_ctx_params[param_name]['path'] return jmespath.search(path, call_args) def _resolve_param_as_builtin(self, builtin_name, builtins): if builtin_name not in EndpointResolverBuiltins.__members__.values(): raise UnknownEndpointResolutionBuiltInName(name=builtin_name) builtin = builtins.get(builtin_name) if callable(builtin): return builtin() return builtin @instance_cache def _get_static_context_params(self, operation_model): """Mapping of param names to static param value for an operation""" return { param.name: param.value for param in operation_model.static_context_parameters } @instance_cache def _get_dynamic_context_params(self, operation_model): """Mapping of param names to member names for an operation""" return { param.name: param.member_name for param in operation_model.context_parameters } @instance_cache def _get_client_context_params(self): """Mapping of param names to client configuration variable""" return { param.name: xform_name(param.name) for param in self._service_model.client_context_parameters } def _get_customized_builtins( self, operation_model, call_args, request_context ): service_id = self._service_model.service_id.hyphenize() customized_builtins = copy.copy(self._builtins) # Handlers are expected to modify the builtins dict in place. self._event_emitter.emit( f'before-endpoint-resolution.{service_id}', builtins=customized_builtins, model=operation_model, params=call_args, context=request_context, ) return customized_builtins def auth_schemes_to_signing_ctx(self, auth_schemes): """Convert an Endpoint's authSchemes property to a signing_context dict :type auth_schemes: list :param auth_schemes: A list of dictionaries taken from the ``authSchemes`` property of an Endpoint object returned by ``EndpointProvider``. :rtype: str, dict :return: Tuple of auth type string (to be used in ``request_context['auth_type']``) and signing context dict (for use in ``request_context['signing']``). """ if not isinstance(auth_schemes, list) or len(auth_schemes) == 0: raise TypeError("auth_schemes must be a non-empty list.") LOG.debug( 'Selecting from endpoint provider\'s list of auth schemes: %s. ' 'User selected auth scheme is: "%s"', ', '.join([f'"{s.get("name")}"' for s in auth_schemes]), self._requested_auth_scheme, ) if self._requested_auth_scheme == UNSIGNED: return 'none', {} auth_schemes = [ {scheme, 'name': self._strip_sig_prefix(scheme['name'])} for scheme in auth_schemes ] if self._requested_auth_scheme is not None: try: # Use the first scheme that matches the requested scheme, # after accounting for naming differences between botocore and # endpoint rulesets. Keep the requested name. name, scheme = next( (self._requested_auth_scheme, s) for s in auth_schemes if self._does_botocore_authname_match_ruleset_authname( self._requested_auth_scheme, s['name'] ) ) except StopIteration: # For legacy signers, no match will be found. Do not raise an # exception, instead default to the logic in botocore # customizations. return None, {} else: try: name, scheme = next( (s['name'], s) for s in auth_schemes if s['name'] in AUTH_TYPE_MAPS ) except StopIteration: # If no auth scheme was specifically requested and an # authSchemes list is present in the Endpoint object but none # of the entries are supported, raise an exception. fixable_with_crt = False auth_type_options = [s['name'] for s in auth_schemes] if not HAS_CRT: fixable_with_crt = any( scheme in CRT_SUPPORTED_AUTH_TYPES for scheme in auth_type_options ) if fixable_with_crt: raise MissingDependencyException( msg='This operation requires an additional dependency.' ' Use pip install botocore[crt] before proceeding.' ) else: raise UnknownSignatureVersionError( signature_version=', '.join(auth_type_options) ) signing_context = {} if 'signingRegion' in scheme: signing_context['region'] = scheme['signingRegion'] elif 'signingRegionSet' in scheme: if len(scheme['signingRegionSet']) > 0: signing_context['region'] = ','.join( scheme['signingRegionSet'] ) if 'signingName' in scheme: signing_context.update(signing_name=scheme['signingName']) if 'disableDoubleEncoding' in scheme: signing_context['disableDoubleEncoding'] = ensure_boolean( scheme['disableDoubleEncoding'] ) LOG.debug( 'Selected auth type "%s" as "%s" with signing context params: %s', scheme['name'], # original name without "sig" name, # chosen name can differ when `signature_version` is set signing_context, ) return name, signing_context def _strip_sig_prefix(self, auth_name): """Normalize auth type names by removing any "sig" prefix""" return auth_name[3:] if auth_name.startswith('sig') else auth_name def _does_botocore_authname_match_ruleset_authname(self, botoname, rsname): """ Whether a valid string provided as signature_version parameter for client construction refers to the same auth methods as a string returned by the endpoint ruleset provider. This accounts for: The ruleset prefixes auth names with "sig" * The s3 and s3control rulesets don't distinguish between v4[a] and s3v4[a] signers * The v2, v3, and HMAC v1 based signers (s3, s3-) are botocore legacy features and do not exist in the rulesets Only characters up to the first dash are considered Example matches: * v4, sigv4 * v4, v4 * s3v4, sigv4 * s3v7, sigv7 (hypothetical example) * s3v4a, sigv4a * s3v4-query, sigv4 Example mismatches: * v4a, sigv4 * s3, sigv4 * s3-presign-post, sigv4 """ rsname = self._strip_sig_prefix(rsname) botoname = botoname.split('-')[0] if botoname != 's3' and botoname.startswith('s3'): botoname = botoname[2:] return rsname == botoname def ruleset_error_to_botocore_exception(self, ruleset_exception, params): """Attempts to translate ruleset errors to pre-existing botocore exception types by string matching exception strings. """ msg = ruleset_exception.kwargs.get('msg') if msg is None: return if msg.startswith('Invalid region in ARN: '): # Example message: # "Invalid region in ARN: `us-we$t-2` (invalid DNS name)" try: label = msg.split('`')[1] except IndexError: label = msg return InvalidHostLabelError(label=label) service_name = self._service_model.service_name if service_name == 's3': if ( msg == 'S3 Object Lambda does not support S3 Accelerate' or msg == 'Accelerate cannot be used with FIPS' ): return UnsupportedS3ConfigurationError(msg=msg) if ( msg.startswith('S3 Outposts does not support') or msg.startswith('S3 MRAP does not support') or msg.startswith('S3 Object Lambda does not support') or msg.startswith('Access Points do not support') or msg.startswith('Invalid configuration:') or msg.startswith('Client was configured for partition') ): return UnsupportedS3AccesspointConfigurationError(msg=msg) if msg.lower().startswith('invalid arn:'): return ParamValidationError(report=msg) if service_name == 's3control': if msg.startswith('Invalid ARN:'): arn = params.get('Bucket') return UnsupportedS3ControlArnError(arn=arn, msg=msg) if msg.startswith('Invalid configuration:') or msg.startswith( 'Client was configured for partition' ): return UnsupportedS3ControlConfigurationError(msg=msg) if msg == "AccountId is required but not set": return ParamValidationError(report=msg) if service_name == 'events': if msg.startswith( 'Invalid Configuration: FIPS is not supported with ' 'EventBridge multi-region endpoints.' ): return InvalidEndpointConfigurationError(msg=msg) if msg == 'EndpointId must be a valid host label.': return InvalidEndpointConfigurationError(msg=msg) return None def _register_endpoint_feature_ids(self, param_name, param_val): if param_name == 'AccountIdEndpointMode': register_feature_id(f'ACCOUNT_ID_MODE_{param_val.upper()}') elif param_name == 'AccountId': register_feature_id('RESOLVED_ACCOUNT_ID')	33.03 KB	2025-05-25 12:26
📄 response.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import logging from io import IOBase from urllib3.exceptions import ProtocolError as URLLib3ProtocolError from urllib3.exceptions import ReadTimeoutError as URLLib3ReadTimeoutError from botocore import parsers from botocore.compat import set_socket_timeout from botocore.exceptions import ( IncompleteReadError, ReadTimeoutError, ResponseStreamingError, ) # Keep these imported. There's pre-existing code that uses them. from botocore import ScalarTypes # noqa from botocore.compat import XMLParseError # noqa from botocore.hooks import first_non_none_response # noqa logger = logging.getLogger(__name__) class StreamingBody(IOBase): """Wrapper class for an http response body. This provides a few additional conveniences that do not exist in the urllib3 model: * Set the timeout on the socket (i.e read() timeouts) * Auto validation of content length, if the amount of bytes we read does not match the content length, an exception is raised. """ _DEFAULT_CHUNK_SIZE = 1024 def __init__(self, raw_stream, content_length): self._raw_stream = raw_stream self._content_length = content_length self._amount_read = 0 def __del__(self): # Extending destructor in order to preserve the underlying raw_stream. # The ability to add custom cleanup logic introduced in Python3.4+. # https://www.python.org/dev/peps/pep-0442/ pass def set_socket_timeout(self, timeout): """Set the timeout seconds on the socket.""" # The problem we're trying to solve is to prevent .read() calls from # hanging. This can happen in rare cases. What we'd like to ideally # do is set a timeout on the .read() call so that callers can retry # the request. # Unfortunately, this isn't currently possible in requests. # See: https://github.com/kennethreitz/requests/issues/1803 # So what we're going to do is reach into the guts of the stream and # grab the socket object, which we can set the timeout on. We're # putting in a check here so in case this interface goes away, we'll # know. try: set_socket_timeout(self._raw_stream, timeout) except AttributeError: logger.error( "Cannot access the socket object of " "a streaming response. It's possible " "the interface has changed.", exc_info=True, ) raise def readable(self): try: return self._raw_stream.readable() except AttributeError: return False def read(self, amt=None): """Read at most amt bytes from the stream. If the amt argument is omitted, read all data. """ try: chunk = self._raw_stream.read(amt) except URLLib3ReadTimeoutError as e: # TODO: the url will be None as urllib3 isn't setting it yet raise ReadTimeoutError(endpoint_url=e.url, error=e) except URLLib3ProtocolError as e: raise ResponseStreamingError(error=e) self._amount_read += len(chunk) if amt is None or (not chunk and amt > 0): # If the server sends empty contents or # we ask to read all of the contents, then we know # we need to verify the content length. self._verify_content_length() return chunk def readinto(self, b): """Read bytes into a pre-allocated, writable bytes-like object b, and return the number of bytes read.""" try: amount_read = self._raw_stream.readinto(b) except URLLib3ReadTimeoutError as e: # TODO: the url will be None as urllib3 isn't setting it yet raise ReadTimeoutError(endpoint_url=e.url, error=e) except URLLib3ProtocolError as e: raise ResponseStreamingError(error=e) self._amount_read += amount_read if amount_read == 0 and len(b) > 0: # If the server sends empty contents then we know we need to verify # the content length. self._verify_content_length() return amount_read def readlines(self): return self._raw_stream.readlines() def __iter__(self): """Return an iterator to yield 1k chunks from the raw stream.""" return self.iter_chunks(self._DEFAULT_CHUNK_SIZE) def __next__(self): """Return the next 1k chunk from the raw stream.""" current_chunk = self.read(self._DEFAULT_CHUNK_SIZE) if current_chunk: return current_chunk raise StopIteration() def __enter__(self): return self._raw_stream def __exit__(self, type, value, traceback): self._raw_stream.close() next = __next__ def iter_lines(self, chunk_size=_DEFAULT_CHUNK_SIZE, keepends=False): """Return an iterator to yield lines from the raw stream. This is achieved by reading chunk of bytes (of size chunk_size) at a time from the raw stream, and then yielding lines from there. """ pending = b'' for chunk in self.iter_chunks(chunk_size): lines = (pending + chunk).splitlines(True) for line in lines[:-1]: yield line.splitlines(keepends)[0] pending = lines[-1] if pending: yield pending.splitlines(keepends)[0] def iter_chunks(self, chunk_size=_DEFAULT_CHUNK_SIZE): """Return an iterator to yield chunks of chunk_size bytes from the raw stream. """ while True: current_chunk = self.read(chunk_size) if current_chunk == b"": break yield current_chunk def _verify_content_length(self): # See: https://github.com/kennethreitz/requests/issues/1855 # Basically, our http library doesn't do this for us, so we have # to do this ourself. if self._content_length is not None and self._amount_read != int( self._content_length ): raise IncompleteReadError( actual_bytes=self._amount_read, expected_bytes=int(self._content_length), ) def tell(self): return self._raw_stream.tell() def close(self): """Close the underlying http response stream.""" self._raw_stream.close() def get_response(operation_model, http_response): protocol = operation_model.metadata['protocol'] response_dict = { 'headers': http_response.headers, 'status_code': http_response.status_code, } # TODO: Unfortunately, we have to have error logic here. # If it looks like an error, in the streaming response case we # need to actually grab the contents. if response_dict['status_code'] >= 300: response_dict['body'] = http_response.content elif operation_model.has_streaming_output: response_dict['body'] = StreamingBody( http_response.raw, response_dict['headers'].get('content-length') ) else: response_dict['body'] = http_response.content parser = parsers.create_parser(protocol) return http_response, parser.parse( response_dict, operation_model.output_shape )	7.79 KB	2025-05-25 12:26
📁 retries	-	2025-05-25 12:26
📄 retryhandler.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import functools import logging import random from binascii import crc32 from botocore.exceptions import ( ChecksumError, ConnectionClosedError, ConnectionError, EndpointConnectionError, ReadTimeoutError, ) logger = logging.getLogger(__name__) # The only supported error for now is GENERAL_CONNECTION_ERROR # which maps to requests generic ConnectionError. If we're able # to get more specific exceptions from requests we can update # this mapping with more specific exceptions. EXCEPTION_MAP = { 'GENERAL_CONNECTION_ERROR': [ ConnectionError, ConnectionClosedError, ReadTimeoutError, EndpointConnectionError, ], } def delay_exponential(base, growth_factor, attempts): """Calculate time to sleep based on exponential function. The format is:: base * growth_factor ^ (attempts - 1) If ``base`` is set to 'rand' then a random number between 0 and 1 will be used as the base. Base must be greater than 0, otherwise a ValueError will be raised. """ if base == 'rand': base = random.random() elif base <= 0: raise ValueError( f"The 'base' param must be greater than 0, got: {base}" ) time_to_sleep = base * (growth_factor (attempts - 1)) return time_to_sleep def create_exponential_delay_function(base, growth_factor): """Create an exponential delay function based on the attempts. This is used so that you only have to pass it the attempts parameter to calculate the delay. """ return functools.partial( delay_exponential, base=base, growth_factor=growth_factor ) def create_retry_handler(config, operation_name=None): checker = create_checker_from_retry_config( config, operation_name=operation_name ) action = create_retry_action_from_config( config, operation_name=operation_name ) return RetryHandler(checker=checker, action=action) def create_retry_action_from_config(config, operation_name=None): # The spec has the possibility of supporting per policy # actions, but right now, we assume this comes from the # default section, which means that delay functions apply # for every policy in the retry config (per service). delay_config = config['__default__']['delay'] if delay_config['type'] == 'exponential': return create_exponential_delay_function( base=delay_config['base'], growth_factor=delay_config['growth_factor'], ) def create_checker_from_retry_config(config, operation_name=None): checkers = [] max_attempts = None retryable_exceptions = [] if '__default__' in config: policies = config['__default__'].get('policies', []) max_attempts = config['__default__']['max_attempts'] for key in policies: current_config = policies[key] checkers.append(_create_single_checker(current_config)) retry_exception = _extract_retryable_exception(current_config) if retry_exception is not None: retryable_exceptions.extend(retry_exception) if operation_name is not None and config.get(operation_name) is not None: operation_policies = config[operation_name]['policies'] for key in operation_policies: checkers.append(_create_single_checker(operation_policies[key])) retry_exception = _extract_retryable_exception( operation_policies[key] ) if retry_exception is not None: retryable_exceptions.extend(retry_exception) if len(checkers) == 1: # Don't need to use a MultiChecker return MaxAttemptsDecorator(checkers[0], max_attempts=max_attempts) else: multi_checker = MultiChecker(checkers) return MaxAttemptsDecorator( multi_checker, max_attempts=max_attempts, retryable_exceptions=tuple(retryable_exceptions), ) def _create_single_checker(config): if 'response' in config['applies_when']: return _create_single_response_checker( config['applies_when']['response'] ) elif 'socket_errors' in config['applies_when']: return ExceptionRaiser() def _create_single_response_checker(response): if 'service_error_code' in response: checker = ServiceErrorCodeChecker( status_code=response['http_status_code'], error_code=response['service_error_code'], ) elif 'http_status_code' in response: checker = HTTPStatusCodeChecker( status_code=response['http_status_code'] ) elif 'crc32body' in response: checker = CRC32Checker(header=response['crc32body']) else: # TODO: send a signal. raise ValueError("Unknown retry policy") return checker def _extract_retryable_exception(config): applies_when = config['applies_when'] if 'crc32body' in applies_when.get('response', {}): return [ChecksumError] elif 'socket_errors' in applies_when: exceptions = [] for name in applies_when['socket_errors']: exceptions.extend(EXCEPTION_MAP[name]) return exceptions class RetryHandler: """Retry handler. The retry handler takes two params, ``checker`` object and an ``action`` object. The ``checker`` object must be a callable object and based on a response and an attempt number, determines whether or not sufficient criteria for a retry has been met. If this is the case then the ``action`` object (which also is a callable) determines what needs to happen in the event of a retry. """ def __init__(self, checker, action): self._checker = checker self._action = action def __call__(self, attempts, response, caught_exception, kwargs): """Handler for a retry. Intended to be hooked up to an event handler (hence the kwargs), this will process retries appropriately. """ checker_kwargs = { 'attempt_number': attempts, 'response': response, 'caught_exception': caught_exception, } if isinstance(self._checker, MaxAttemptsDecorator): retries_context = kwargs['request_dict']['context'].get('retries') checker_kwargs.update({'retries_context': retries_context}) if self._checker(checker_kwargs): result = self._action(attempts=attempts) logger.debug("Retry needed, action of: %s", result) return result logger.debug("No retry needed.") class BaseChecker: """Base class for retry checkers. Each class is responsible for checking a single criteria that determines whether or not a retry should not happen. """ def __call__(self, attempt_number, response, caught_exception): """Determine if retry criteria matches. Note that either ``response`` is not None and ``caught_exception`` is None or ``response`` is None and ``caught_exception`` is not None. :type attempt_number: int :param attempt_number: The total number of times we've attempted to send the request. :param response: The HTTP response (if one was received). :type caught_exception: Exception :param caught_exception: Any exception that was caught while trying to send the HTTP response. :return: True, if the retry criteria matches (and therefore a retry should occur. False if the criteria does not match. """ # The default implementation allows subclasses to not have to check # whether or not response is None or not. if response is not None: return self._check_response(attempt_number, response) elif caught_exception is not None: return self._check_caught_exception( attempt_number, caught_exception ) else: raise ValueError("Both response and caught_exception are None.") def _check_response(self, attempt_number, response): pass def _check_caught_exception(self, attempt_number, caught_exception): pass class MaxAttemptsDecorator(BaseChecker): """Allow retries up to a maximum number of attempts. This will pass through calls to the decorated retry checker, provided that the number of attempts does not exceed max_attempts. It will also catch any retryable_exceptions passed in. Once max_attempts has been exceeded, then False will be returned or the retryable_exceptions that was previously being caught will be raised. """ def __init__(self, checker, max_attempts, retryable_exceptions=None): self._checker = checker self._max_attempts = max_attempts self._retryable_exceptions = retryable_exceptions def __call__( self, attempt_number, response, caught_exception, retries_context ): if retries_context: retries_context['max'] = max( retries_context.get('max', 0), self._max_attempts ) should_retry = self._should_retry( attempt_number, response, caught_exception ) if should_retry: if attempt_number >= self._max_attempts: # explicitly set MaxAttemptsReached if response is not None and 'ResponseMetadata' in response[1]: response[1]['ResponseMetadata']['MaxAttemptsReached'] = ( True ) logger.debug( "Reached the maximum number of retry attempts: %s", attempt_number, ) return False else: return should_retry else: return False def _should_retry(self, attempt_number, response, caught_exception): if self._retryable_exceptions and attempt_number < self._max_attempts: try: return self._checker( attempt_number, response, caught_exception ) except self._retryable_exceptions as e: logger.debug( "retry needed, retryable exception caught: %s", e, exc_info=True, ) return True else: # If we've exceeded the max attempts we just let the exception # propagate if one has occurred. return self._checker(attempt_number, response, caught_exception) class HTTPStatusCodeChecker(BaseChecker): def __init__(self, status_code): self._status_code = status_code def _check_response(self, attempt_number, response): if response[0].status_code == self._status_code: logger.debug( "retry needed: retryable HTTP status code received: %s", self._status_code, ) return True else: return False class ServiceErrorCodeChecker(BaseChecker): def __init__(self, status_code, error_code): self._status_code = status_code self._error_code = error_code def _check_response(self, attempt_number, response): if response[0].status_code == self._status_code: actual_error_code = response[1].get('Error', {}).get('Code') if actual_error_code == self._error_code: logger.debug( "retry needed: matching HTTP status and error code seen: " "%s, %s", self._status_code, self._error_code, ) return True return False class MultiChecker(BaseChecker): def __init__(self, checkers): self._checkers = checkers def __call__(self, attempt_number, response, caught_exception): for checker in self._checkers: checker_response = checker( attempt_number, response, caught_exception ) if checker_response: return checker_response return False class CRC32Checker(BaseChecker): def __init__(self, header): # The header where the expected crc32 is located. self._header_name = header def _check_response(self, attempt_number, response): http_response = response[0] expected_crc = http_response.headers.get(self._header_name) if expected_crc is None: logger.debug( "crc32 check skipped, the %s header is not " "in the http response.", self._header_name, ) else: actual_crc32 = crc32(response[0].content) & 0xFFFFFFFF if not actual_crc32 == int(expected_crc): logger.debug( "retry needed: crc32 check failed, expected != actual: " "%s != %s", int(expected_crc), actual_crc32, ) raise ChecksumError( checksum_type='crc32', expected_checksum=int(expected_crc), actual_checksum=actual_crc32, ) class ExceptionRaiser(BaseChecker): """Raise any caught exceptions. This class will raise any non None ``caught_exception``. """ def _check_caught_exception(self, attempt_number, caught_exception): # This is implementation specific, but this class is useful by # coordinating with the MaxAttemptsDecorator. # The MaxAttemptsDecorator has a list of exceptions it should catch # and retry, but something needs to come along and actually raise the # caught_exception. That's what this class is being used for. If # the MaxAttemptsDecorator is not interested in retrying the exception # then this exception just propagates out past the retry code. raise caught_exception	14.36 KB	2025-05-25 12:26
📄 serialize.py # Copyright 2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """Protocol input serializes. This module contains classes that implement input serialization for the various AWS protocol types. These classes essentially take user input, a model object that represents what the expected input should look like, and it returns a dictionary that contains the various parts of a request. A few high level design decisions: * Each protocol type maps to a separate class, all inherit from ``Serializer``. * The return value for ``serialize_to_request`` (the main entry point) returns a dictionary that represents a request. This will have keys like ``url_path``, ``query_string``, etc. This is done so that it's a) easy to test and b) not tied to a particular HTTP library. See the ``serialize_to_request`` docstring for more details. Unicode ------- The input to the serializers should be text (str/unicode), not bytes, with the exception of blob types. Those are assumed to be binary, and if a str/unicode type is passed in, it will be encoded as utf-8. """ import base64 import calendar import datetime import json import math import re import struct from xml.etree import ElementTree from botocore import validate from botocore.compat import formatdate from botocore.exceptions import ParamValidationError from botocore.useragent import register_feature_id from botocore.utils import ( has_header, is_json_value_header, parse_to_aware_datetime, percent_encode, ) # From the spec, the default timestamp format if not specified is iso8601. DEFAULT_TIMESTAMP_FORMAT = 'iso8601' ISO8601 = '%Y-%m-%dT%H:%M:%SZ' # Same as ISO8601, but with microsecond precision. ISO8601_MICRO = '%Y-%m-%dT%H:%M:%S.%fZ' HOST_PREFIX_RE = re.compile(r"^[A-Za-z0-9\.\-]+$") def create_serializer(protocol_name, include_validation=True): # TODO: Unknown protocols. serializer = SERIALIZERS[protocol_name]() if include_validation: validator = validate.ParamValidator() serializer = validate.ParamValidationDecorator(validator, serializer) return serializer class Serializer: DEFAULT_METHOD = 'POST' # Clients can change this to a different MutableMapping # (i.e OrderedDict) if they want. This is used in the # compliance test to match the hash ordering used in the # tests. MAP_TYPE = dict DEFAULT_ENCODING = 'utf-8' def serialize_to_request(self, parameters, operation_model): """Serialize parameters into an HTTP request. This method takes user provided parameters and a shape model and serializes the parameters to an HTTP request. More specifically, this method returns information about parts of the HTTP request, it does not enforce a particular interface or standard for an HTTP request. It instead returns a dictionary of: * 'url_path' * 'host_prefix' * 'query_string' * 'headers' * 'body' * 'method' It is then up to consumers to decide how to map this to a Request object of their HTTP library of choice. Below is an example return value:: {'body': {'Action': 'OperationName', 'Bar': 'val2', 'Foo': 'val1', 'Version': '2014-01-01'}, 'headers': {}, 'method': 'POST', 'query_string': '', 'host_prefix': 'value.', 'url_path': '/'} :param parameters: The dictionary input parameters for the operation (i.e the user input). :param operation_model: The OperationModel object that describes the operation. """ raise NotImplementedError("serialize_to_request") def _create_default_request(self): # Creates a boilerplate default request dict that subclasses # can use as a starting point. serialized = { 'url_path': '/', 'query_string': '', 'method': self.DEFAULT_METHOD, 'headers': {}, # An empty body is represented as an empty byte string. 'body': b'', } return serialized # Some extra utility methods subclasses can use. def _timestamp_iso8601(self, value): if value.microsecond > 0: timestamp_format = ISO8601_MICRO else: timestamp_format = ISO8601 return value.strftime(timestamp_format) def _timestamp_unixtimestamp(self, value): return int(calendar.timegm(value.timetuple())) def _timestamp_rfc822(self, value): if isinstance(value, datetime.datetime): value = self._timestamp_unixtimestamp(value) return formatdate(value, usegmt=True) def _convert_timestamp_to_str(self, value, timestamp_format=None): if timestamp_format is None: timestamp_format = self.TIMESTAMP_FORMAT timestamp_format = timestamp_format.lower() datetime_obj = parse_to_aware_datetime(value) converter = getattr(self, f'_timestamp_{timestamp_format}') final_value = converter(datetime_obj) return final_value def _get_serialized_name(self, shape, default_name): # Returns the serialized name for the shape if it exists. # Otherwise it will return the passed in default_name. return shape.serialization.get('name', default_name) def _get_base64(self, value): # Returns the base64-encoded version of value, handling # both strings and bytes. The returned value is a string # via the default encoding. if isinstance(value, str): value = value.encode(self.DEFAULT_ENCODING) return base64.b64encode(value).strip().decode(self.DEFAULT_ENCODING) def _expand_host_prefix(self, parameters, operation_model): operation_endpoint = operation_model.endpoint if ( operation_endpoint is None or 'hostPrefix' not in operation_endpoint ): return None host_prefix_expression = operation_endpoint['hostPrefix'] if operation_model.input_shape is None: return host_prefix_expression input_members = operation_model.input_shape.members host_labels = [ member for member, shape in input_members.items() if shape.serialization.get('hostLabel') ] format_kwargs = {} bad_labels = [] for name in host_labels: param = parameters[name] if not HOST_PREFIX_RE.match(param): bad_labels.append(name) format_kwargs[name] = param if bad_labels: raise ParamValidationError( report=( f"Invalid value for parameter(s): {', '.join(bad_labels)}. " "Must contain only alphanumeric characters, hyphen, " "or period." ) ) return host_prefix_expression.format(*format_kwargs) def _is_shape_flattened(self, shape): return shape.serialization.get('flattened') def _handle_float(self, value): if value == float("Infinity"): value = "Infinity" elif value == float("-Infinity"): value = "-Infinity" elif math.isnan(value): value = "NaN" return value class QuerySerializer(Serializer): TIMESTAMP_FORMAT = 'iso8601' def serialize_to_request(self, parameters, operation_model): shape = operation_model.input_shape serialized = self._create_default_request() serialized['method'] = operation_model.http.get( 'method', self.DEFAULT_METHOD ) serialized['headers'] = { 'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8' } # The query serializer only deals with body params so # that's what we hand off the _serialize_ methods. body_params = self.MAP_TYPE() body_params['Action'] = operation_model.name body_params['Version'] = operation_model.metadata['apiVersion'] if shape is not None: self._serialize(body_params, parameters, shape) serialized['body'] = body_params host_prefix = self._expand_host_prefix(parameters, operation_model) if host_prefix is not None: serialized['host_prefix'] = host_prefix return serialized def _serialize(self, serialized, value, shape, prefix=''): # serialized: The dict that is incrementally added to with the # final serialized parameters. # value: The current user input value. # shape: The shape object that describes the structure of the # input. # prefix: The incrementally built up prefix for the serialized # key (i.e Foo.bar.members.1). method = getattr( self, f'_serialize_type_{shape.type_name}', self._default_serialize, ) method(serialized, value, shape, prefix=prefix) def _serialize_type_structure(self, serialized, value, shape, prefix=''): members = shape.members for key, value in value.items(): member_shape = members[key] member_prefix = self._get_serialized_name(member_shape, key) if prefix: member_prefix = f'{prefix}.{member_prefix}' self._serialize(serialized, value, member_shape, member_prefix) def _serialize_type_list(self, serialized, value, shape, prefix=''): if not value: # The query protocol serializes empty lists. serialized[prefix] = '' return if self._is_shape_flattened(shape): list_prefix = prefix if shape.member.serialization.get('name'): name = self._get_serialized_name(shape.member, default_name='') # Replace '.Original' with '.{name}'. list_prefix = '.'.join(prefix.split('.')[:-1] + [name]) else: list_name = shape.member.serialization.get('name', 'member') list_prefix = f'{prefix}.{list_name}' for i, element in enumerate(value, 1): element_prefix = f'{list_prefix}.{i}' element_shape = shape.member self._serialize(serialized, element, element_shape, element_prefix) def _serialize_type_map(self, serialized, value, shape, prefix=''): if self._is_shape_flattened(shape): full_prefix = prefix else: full_prefix = f'{prefix}.entry' template = full_prefix + '.{i}.{suffix}' key_shape = shape.key value_shape = shape.value key_suffix = self._get_serialized_name(key_shape, default_name='key') value_suffix = self._get_serialized_name(value_shape, 'value') for i, key in enumerate(value, 1): key_prefix = template.format(i=i, suffix=key_suffix) value_prefix = template.format(i=i, suffix=value_suffix) self._serialize(serialized, key, key_shape, key_prefix) self._serialize(serialized, value[key], value_shape, value_prefix) def _serialize_type_blob(self, serialized, value, shape, prefix=''): # Blob args must be base64 encoded. serialized[prefix] = self._get_base64(value) def _serialize_type_timestamp(self, serialized, value, shape, prefix=''): serialized[prefix] = self._convert_timestamp_to_str( value, shape.serialization.get('timestampFormat') ) def _serialize_type_boolean(self, serialized, value, shape, prefix=''): if value: serialized[prefix] = 'true' else: serialized[prefix] = 'false' def _default_serialize(self, serialized, value, shape, prefix=''): serialized[prefix] = value def _serialize_type_float(self, serialized, value, shape, prefix=''): serialized[prefix] = self._handle_float(value) def _serialize_type_double(self, serialized, value, shape, prefix=''): self._serialize_type_float(serialized, value, shape, prefix) class EC2Serializer(QuerySerializer): """EC2 specific customizations to the query protocol serializers. The EC2 model is almost, but not exactly, similar to the query protocol serializer. This class encapsulates those differences. The model will have be marked with a ``protocol`` of ``ec2``, so you don't need to worry about wiring this class up correctly. """ def _get_serialized_name(self, shape, default_name): # Returns the serialized name for the shape if it exists. # Otherwise it will return the passed in capitalized default_name. if 'queryName' in shape.serialization: return shape.serialization['queryName'] elif 'name' in shape.serialization: # A locationName is always capitalized # on input for the ec2 protocol. name = shape.serialization['name'] return name[0].upper() + name[1:] else: return default_name def _serialize_type_list(self, serialized, value, shape, prefix=''): for i, element in enumerate(value, 1): element_prefix = f'{prefix}.{i}' element_shape = shape.member self._serialize(serialized, element, element_shape, element_prefix) class JSONSerializer(Serializer): TIMESTAMP_FORMAT = 'unixtimestamp' def serialize_to_request(self, parameters, operation_model): target = '{}.{}'.format( operation_model.metadata['targetPrefix'], operation_model.name, ) json_version = operation_model.metadata['jsonVersion'] serialized = self._create_default_request() serialized['method'] = operation_model.http.get( 'method', self.DEFAULT_METHOD ) serialized['headers'] = { 'X-Amz-Target': target, 'Content-Type': f'application/x-amz-json-{json_version}', } body = self.MAP_TYPE() input_shape = operation_model.input_shape if input_shape is not None: self._serialize(body, parameters, input_shape) serialized['body'] = json.dumps(body).encode(self.DEFAULT_ENCODING) host_prefix = self._expand_host_prefix(parameters, operation_model) if host_prefix is not None: serialized['host_prefix'] = host_prefix return serialized def _serialize(self, serialized, value, shape, key=None): method = getattr( self, f'_serialize_type_{shape.type_name}', self._default_serialize, ) method(serialized, value, shape, key) def _serialize_type_structure(self, serialized, value, shape, key): if shape.is_document_type: serialized[key] = value else: if key is not None: # If a key is provided, this is a result of a recursive # call so we need to add a new child dict as the value # of the passed in serialized dict. We'll then add # all the structure members as key/vals in the new serialized # dictionary we just created. new_serialized = self.MAP_TYPE() serialized[key] = new_serialized serialized = new_serialized members = shape.members for member_key, member_value in value.items(): member_shape = members[member_key] if 'name' in member_shape.serialization: member_key = member_shape.serialization['name'] self._serialize( serialized, member_value, member_shape, member_key ) def _serialize_type_map(self, serialized, value, shape, key): map_obj = self.MAP_TYPE() serialized[key] = map_obj for sub_key, sub_value in value.items(): self._serialize(map_obj, sub_value, shape.value, sub_key) def _serialize_type_list(self, serialized, value, shape, key): list_obj = [] serialized[key] = list_obj for list_item in value: wrapper = {} # The JSON list serialization is the only case where we aren't # setting a key on a dict. We handle this by using # a __current__ key on a wrapper dict to serialize each # list item before appending it to the serialized list. self._serialize(wrapper, list_item, shape.member, "__current__") list_obj.append(wrapper["__current__"]) def _default_serialize(self, serialized, value, shape, key): serialized[key] = value def _serialize_type_timestamp(self, serialized, value, shape, key): serialized[key] = self._convert_timestamp_to_str( value, shape.serialization.get('timestampFormat') ) def _serialize_type_blob(self, serialized, value, shape, key): serialized[key] = self._get_base64(value) def _serialize_type_float(self, serialized, value, shape, prefix=''): serialized[prefix] = self._handle_float(value) def _serialize_type_double(self, serialized, value, shape, prefix=''): self._serialize_type_float(serialized, value, shape, prefix) class CBORSerializer(Serializer): UNSIGNED_INT_MAJOR_TYPE = 0 NEGATIVE_INT_MAJOR_TYPE = 1 BLOB_MAJOR_TYPE = 2 STRING_MAJOR_TYPE = 3 LIST_MAJOR_TYPE = 4 MAP_MAJOR_TYPE = 5 TAG_MAJOR_TYPE = 6 FLOAT_AND_SIMPLE_MAJOR_TYPE = 7 def _serialize_data_item(self, serialized, value, shape, key=None): method = getattr(self, f'_serialize_type_{shape.type_name}') if method is None: raise ValueError( f"Unrecognized C2J type: {shape.type_name}, unable to " f"serialize request" ) method(serialized, value, shape, key) def _serialize_type_integer(self, serialized, value, shape, key): if value >= 0: major_type = self.UNSIGNED_INT_MAJOR_TYPE else: major_type = self.NEGATIVE_INT_MAJOR_TYPE # The only differences in serializing negative and positive integers is # that for negative, we set the major type to 1 and set the value to -1 # minus the value value = -1 - value additional_info, num_bytes = self._get_additional_info_and_num_bytes( value ) initial_byte = self._get_initial_byte(major_type, additional_info) if num_bytes == 0: serialized.extend(initial_byte) else: serialized.extend(initial_byte + value.to_bytes(num_bytes, "big")) def _serialize_type_long(self, serialized, value, shape, key): self._serialize_type_integer(serialized, value, shape, key) def _serialize_type_blob(self, serialized, value, shape, key): if isinstance(value, str): value = value.encode('utf-8') elif not isinstance(value, (bytes, bytearray)): # We support file-like objects for blobs; these already have been # validated to ensure they have a read method value = value.read() length = len(value) additional_info, num_bytes = self._get_additional_info_and_num_bytes( length ) initial_byte = self._get_initial_byte( self.BLOB_MAJOR_TYPE, additional_info ) if num_bytes == 0: serialized.extend(initial_byte) else: serialized.extend(initial_byte + length.to_bytes(num_bytes, "big")) serialized.extend(value) def _serialize_type_string(self, serialized, value, shape, key): encoded = value.encode('utf-8') length = len(encoded) additional_info, num_bytes = self._get_additional_info_and_num_bytes( length ) initial_byte = self._get_initial_byte( self.STRING_MAJOR_TYPE, additional_info ) if num_bytes == 0: serialized.extend(initial_byte + encoded) else: serialized.extend( initial_byte + length.to_bytes(num_bytes, "big") + encoded ) def _serialize_type_list(self, serialized, value, shape, key): length = len(value) additional_info, num_bytes = self._get_additional_info_and_num_bytes( length ) initial_byte = self._get_initial_byte( self.LIST_MAJOR_TYPE, additional_info ) if num_bytes == 0: serialized.extend(initial_byte) else: serialized.extend(initial_byte + length.to_bytes(num_bytes, "big")) for item in value: self._serialize_data_item(serialized, item, shape.member) def _serialize_type_map(self, serialized, value, shape, key): length = len(value) additional_info, num_bytes = self._get_additional_info_and_num_bytes( length ) initial_byte = self._get_initial_byte( self.MAP_MAJOR_TYPE, additional_info ) if num_bytes == 0: serialized.extend(initial_byte) else: serialized.extend(initial_byte + length.to_bytes(num_bytes, "big")) for key_item, item in value.items(): self._serialize_data_item(serialized, key_item, shape.key) self._serialize_data_item(serialized, item, shape.value) def _serialize_type_structure(self, serialized, value, shape, key): if key is not None: # For nested structures, we need to serialize the key first self._serialize_data_item(serialized, key, shape.key_shape) # Remove `None` values from the dictionary value = {k: v for k, v in value.items() if v is not None} map_length = len(value) additional_info, num_bytes = self._get_additional_info_and_num_bytes( map_length ) initial_byte = self._get_initial_byte( self.MAP_MAJOR_TYPE, additional_info ) if num_bytes == 0: serialized.extend(initial_byte) else: serialized.extend( initial_byte + map_length.to_bytes(num_bytes, "big") ) members = shape.members for member_key, member_value in value.items(): member_shape = members[member_key] if 'name' in member_shape.serialization: member_key = member_shape.serialization['name'] if member_value is not None: self._serialize_type_string(serialized, member_key, None, None) self._serialize_data_item( serialized, member_value, member_shape ) def _serialize_type_timestamp(self, serialized, value, shape, key): timestamp = self._convert_timestamp_to_str(value) tag = 1 # Use tag 1 for unix timestamp initial_byte = self._get_initial_byte(self.TAG_MAJOR_TYPE, tag) serialized.extend(initial_byte) # Tagging the timestamp additional_info, num_bytes = self._get_additional_info_and_num_bytes( timestamp ) if num_bytes == 0: initial_byte = self._get_initial_byte( self.UNSIGNED_INT_MAJOR_TYPE, timestamp ) serialized.extend(initial_byte) else: initial_byte = self._get_initial_byte( self.UNSIGNED_INT_MAJOR_TYPE, additional_info ) serialized.extend( initial_byte + timestamp.to_bytes(num_bytes, "big") ) def _serialize_type_float(self, serialized, value, shape, key): if self._is_special_number(value): serialized.extend( self._get_bytes_for_special_numbers(value) ) # Handle special values like NaN or Infinity else: initial_byte = self._get_initial_byte( self.FLOAT_AND_SIMPLE_MAJOR_TYPE, 26 ) serialized.extend(initial_byte + struct.pack(">f", value)) def _serialize_type_double(self, serialized, value, shape, key): if self._is_special_number(value): serialized.extend( self._get_bytes_for_special_numbers(value) ) # Handle special values like NaN or Infinity else: initial_byte = self._get_initial_byte( self.FLOAT_AND_SIMPLE_MAJOR_TYPE, 27 ) serialized.extend(initial_byte + struct.pack(">d", value)) def _serialize_type_boolean(self, serialized, value, shape, key): additional_info = 21 if value else 20 serialized.extend( self._get_initial_byte( self.FLOAT_AND_SIMPLE_MAJOR_TYPE, additional_info ) ) def _get_additional_info_and_num_bytes(self, value): # Values under 24 can be stored in the initial byte and don't need further # encoding if value < 24: return value, 0 # Values between 24 and 255 (inclusive) can be stored in 1 byte and # correspond to additional info 24 elif value < 256: return 24, 1 # Values up to 65535 can be stored in two bytes and correspond to additional # info 25 elif value < 65536: return 25, 2 # Values up to 4294967296 can be stored in four bytes and correspond to # additional info 26 elif value < 4294967296: return 26, 4 # The maximum number of bytes in a definite length data items is 8 which # to additional info 27 else: return 27, 8 def _get_initial_byte(self, major_type, additional_info): # The highest order three bits are the major type, so we need to bitshift the # major type by 5 major_type_bytes = major_type << 5 return (major_type_bytes \| additional_info).to_bytes(1, "big") def _is_special_number(self, value): return any( [ value == float('inf'), value == float('-inf'), math.isnan(value), ] ) def _get_bytes_for_special_numbers(self, value): additional_info = 25 initial_byte = self._get_initial_byte( self.FLOAT_AND_SIMPLE_MAJOR_TYPE, additional_info ) if value == float('inf'): return initial_byte + struct.pack(">H", 0x7C00) elif value == float('-inf'): return initial_byte + struct.pack(">H", 0xFC00) elif math.isnan(value): return initial_byte + struct.pack(">H", 0x7E00) class BaseRestSerializer(Serializer): """Base class for rest protocols. The only variance between the various rest protocols is the way that the body is serialized. All other aspects (headers, uri, etc.) are the same and logic for serializing those aspects lives here. Subclasses must implement the ``_serialize_body_params`` method. """ QUERY_STRING_TIMESTAMP_FORMAT = 'iso8601' HEADER_TIMESTAMP_FORMAT = 'rfc822' # This is a list of known values for the "location" key in the # serialization dict. The location key tells us where on the request # to put the serialized value. KNOWN_LOCATIONS = ['uri', 'querystring', 'header', 'headers'] def serialize_to_request(self, parameters, operation_model): serialized = self._create_default_request() serialized['method'] = operation_model.http.get( 'method', self.DEFAULT_METHOD ) shape = operation_model.input_shape host_prefix = self._expand_host_prefix(parameters, operation_model) if host_prefix is not None: serialized['host_prefix'] = host_prefix if shape is None: serialized['url_path'] = operation_model.http['requestUri'] return serialized shape_members = shape.members # While the ``serialized`` key holds the final serialized request # data, we need interim dicts for the various locations of the # request. We need this for the uri_path_kwargs and the # query_string_kwargs because they are templated, so we need # to gather all the needed data for the string template, # then we render the template. The body_kwargs is needed # because once we've collected them all, we run them through # _serialize_body_params, which for rest-json, creates JSON, # and for rest-xml, will create XML. This is what the # ``partitioned`` dict below is for. partitioned = { 'uri_path_kwargs': self.MAP_TYPE(), 'query_string_kwargs': self.MAP_TYPE(), 'body_kwargs': self.MAP_TYPE(), 'headers': self.MAP_TYPE(), } for param_name, param_value in parameters.items(): if param_value is None: # Don't serialize any parameter with a None value. continue self._partition_parameters( partitioned, param_name, param_value, shape_members ) serialized['url_path'] = self._render_uri_template( operation_model.http['requestUri'], partitioned['uri_path_kwargs'] ) if 'authPath' in operation_model.http: serialized['auth_path'] = self._render_uri_template( operation_model.http['authPath'], partitioned['uri_path_kwargs'], ) # Note that we lean on the http implementation to handle the case # where the requestUri path already has query parameters. # The bundled http client, requests, already supports this. serialized['query_string'] = partitioned['query_string_kwargs'] if partitioned['headers']: serialized['headers'] = partitioned['headers'] self._serialize_payload( partitioned, parameters, serialized, shape, shape_members ) self._serialize_content_type(serialized, shape, shape_members) return serialized def _render_uri_template(self, uri_template, params): # We need to handle two cases:: # # /{Bucket}/foo # /{Key+}/bar # A label ending with '+' is greedy. There can only # be one greedy key. encoded_params = {} for template_param in re.findall(r'{(.?)}', uri_template): if template_param.endswith('+'): encoded_params[template_param] = percent_encode( params[template_param[:-1]], safe='/~' ) else: encoded_params[template_param] = percent_encode( params[template_param] ) return uri_template.format(encoded_params) def _serialize_payload( self, partitioned, parameters, serialized, shape, shape_members ): # partitioned - The user input params partitioned by location. # parameters - The user input params. # serialized - The final serialized request dict. # shape - Describes the expected input shape # shape_members - The members of the input struct shape payload_member = shape.serialization.get('payload') if self._has_streaming_payload(payload_member, shape_members): # If it's streaming, then the body is just the # value of the payload. body_payload = parameters.get(payload_member, b'') body_payload = self._encode_payload(body_payload) serialized['body'] = body_payload elif payload_member is not None: # If there's a payload member, we serialized that # member to they body. body_params = parameters.get(payload_member) if body_params is not None: serialized['body'] = self._serialize_body_params( body_params, shape_members[payload_member] ) else: serialized['body'] = self._serialize_empty_body() elif partitioned['body_kwargs']: serialized['body'] = self._serialize_body_params( partitioned['body_kwargs'], shape ) elif self._requires_empty_body(shape): serialized['body'] = self._serialize_empty_body() def _serialize_empty_body(self): return b'' def _serialize_content_type(self, serialized, shape, shape_members): """ Some protocols require varied Content-Type headers depending on user input. This allows subclasses to apply this conditionally. """ pass def _requires_empty_body(self, shape): """ Some protocols require a specific body to represent an empty payload. This allows subclasses to apply this conditionally. """ return False def _has_streaming_payload(self, payload, shape_members): """Determine if payload is streaming (a blob or string).""" return payload is not None and shape_members[payload].type_name in ( 'blob', 'string', ) def _encode_payload(self, body): if isinstance(body, str): return body.encode(self.DEFAULT_ENCODING) return body def _partition_parameters( self, partitioned, param_name, param_value, shape_members ): # This takes the user provided input parameter (``param``) # and figures out where they go in the request dict. # Some params are HTTP headers, some are used in the URI, some # are in the request body. This method deals with this. member = shape_members[param_name] location = member.serialization.get('location') key_name = member.serialization.get('name', param_name) if location == 'uri': uri_path_value = self._get_uri_and_query_string_value( param_value, member ) partitioned['uri_path_kwargs'][key_name] = uri_path_value elif location == 'querystring': if isinstance(param_value, dict): partitioned['query_string_kwargs'].update(param_value) elif member.type_name == 'list': new_param = [ self._get_uri_and_query_string_value(value, member.member) for value in param_value ] partitioned['query_string_kwargs'][key_name] = new_param else: new_param = self._get_uri_and_query_string_value( param_value, member ) partitioned['query_string_kwargs'][key_name] = new_param elif location == 'header': shape = shape_members[param_name] if not param_value and shape.type_name == 'list': # Empty lists should not be set on the headers return partitioned['headers'][key_name] = self._convert_header_value( shape, param_value ) elif location == 'headers': # 'headers' is a bit of an oddball. The ``key_name`` # is actually really a prefix for the header names: header_prefix = key_name # The value provided by the user is a dict so we'll be # creating multiple header key/val pairs. The key # name to use for each header is the header_prefix (``key_name``) # plus the key provided by the user. self._do_serialize_header_map( header_prefix, partitioned['headers'], param_value ) else: partitioned['body_kwargs'][param_name] = param_value def _get_uri_and_query_string_value(self, param_value, member): if member.type_name == 'boolean': return str(param_value).lower() elif member.type_name == 'timestamp': timestamp_format = member.serialization.get( 'timestampFormat', self.QUERY_STRING_TIMESTAMP_FORMAT ) return self._convert_timestamp_to_str( param_value, timestamp_format ) elif member.type_name in ['float', 'double']: return str(self._handle_float(param_value)) return param_value def _do_serialize_header_map(self, header_prefix, headers, user_input): for key, val in user_input.items(): full_key = header_prefix + key headers[full_key] = val def _serialize_body_params(self, params, shape): raise NotImplementedError('_serialize_body_params') def _convert_header_value(self, shape, value): if shape.type_name == 'timestamp': datetime_obj = parse_to_aware_datetime(value) timestamp = calendar.timegm(datetime_obj.utctimetuple()) timestamp_format = shape.serialization.get( 'timestampFormat', self.HEADER_TIMESTAMP_FORMAT ) return str( self._convert_timestamp_to_str(timestamp, timestamp_format) ) elif shape.type_name == 'list': if shape.member.type_name == "string": converted_value = [ self._escape_header_list_string(v) for v in value if v is not None ] else: converted_value = [ self._convert_header_value(shape.member, v) for v in value if v is not None ] return ",".join(converted_value) elif is_json_value_header(shape): # Serialize with no spaces after separators to save space in # the header. return self._get_base64(json.dumps(value, separators=(',', ':'))) elif shape.type_name == 'boolean': return str(value).lower() elif shape.type_name in ['float', 'double']: return str(self._handle_float(value)) else: return str(value) def _escape_header_list_string(self, value): # Escapes a header list string by wrapping it in double quotes if it contains # a comma or a double quote, and escapes any internal double quotes. if '"' in value or ',' in value: return '"' + value.replace('"', '\\"') + '"' else: return value class BaseRpcV2Serializer(Serializer): """Base class for RPCv2 protocols. The only variance between the various RPCv2 protocols is the way that the body is serialized. All other aspects (headers, uri, etc.) are the same and logic for serializing those aspects lives here. Subclasses must implement the ``_serialize_body_params`` and ``_serialize_headers`` methods. """ def serialize_to_request(self, parameters, operation_model): serialized = self._create_default_request() service_name = operation_model.service_model.metadata['targetPrefix'] operation_name = operation_model.name serialized['url_path'] = ( f'/service/{service_name}/operation/{operation_name}' ) input_shape = operation_model.input_shape if input_shape is not None: self._serialize_payload(parameters, serialized, input_shape) self._serialize_headers(serialized, operation_model) return serialized def _serialize_payload(self, parameters, serialized, shape): body_payload = self._serialize_body_params(parameters, shape) serialized['body'] = body_payload def _serialize_headers(self, serialized, operation_model): raise NotImplementedError("_serialize_headers") def _serialize_body_params(self, parameters, shape): raise NotImplementedError("_serialize_body_params") class RestJSONSerializer(BaseRestSerializer, JSONSerializer): def _serialize_empty_body(self): return b'{}' def _requires_empty_body(self, shape): """ Serialize an empty JSON object whenever the shape has members not targeting a location. """ for member, val in shape.members.items(): if 'location' not in val.serialization: return True return False def _serialize_content_type(self, serialized, shape, shape_members): """Set Content-Type to application/json for all structured bodies.""" payload = shape.serialization.get('payload') if self._has_streaming_payload(payload, shape_members): # Don't apply content-type to streaming bodies return has_body = serialized['body'] != b'' has_content_type = has_header('Content-Type', serialized['headers']) if has_body and not has_content_type: serialized['headers']['Content-Type'] = 'application/json' def _serialize_body_params(self, params, shape): serialized_body = self.MAP_TYPE() self._serialize(serialized_body, params, shape) return json.dumps(serialized_body).encode(self.DEFAULT_ENCODING) class RestXMLSerializer(BaseRestSerializer): TIMESTAMP_FORMAT = 'iso8601' def _serialize_body_params(self, params, shape): root_name = shape.serialization['name'] pseudo_root = ElementTree.Element('') self._serialize(shape, params, pseudo_root, root_name) real_root = list(pseudo_root)[0] return ElementTree.tostring(real_root, encoding=self.DEFAULT_ENCODING) def _serialize(self, shape, params, xmlnode, name): method = getattr( self, f'_serialize_type_{shape.type_name}', self._default_serialize, ) method(xmlnode, params, shape, name) def _serialize_type_structure(self, xmlnode, params, shape, name): structure_node = ElementTree.SubElement(xmlnode, name) self._add_xml_namespace(shape, structure_node) for key, value in params.items(): member_shape = shape.members[key] member_name = member_shape.serialization.get('name', key) # We need to special case member shapes that are marked as an # xmlAttribute. Rather than serializing into an XML child node, # we instead serialize the shape to an XML attribute of the # current* node. if value is None: # Don't serialize any param whose value is None. return if member_shape.serialization.get('xmlAttribute'): # xmlAttributes must have a serialization name. xml_attribute_name = member_shape.serialization['name'] structure_node.attrib[xml_attribute_name] = value continue self._serialize(member_shape, value, structure_node, member_name) def _serialize_type_list(self, xmlnode, params, shape, name): member_shape = shape.member if shape.serialization.get('flattened'): element_name = name list_node = xmlnode else: element_name = member_shape.serialization.get('name', 'member') list_node = ElementTree.SubElement(xmlnode, name) self._add_xml_namespace(shape, list_node) for item in params: self._serialize(member_shape, item, list_node, element_name) def _serialize_type_map(self, xmlnode, params, shape, name): # Given the ``name`` of MyMap, and input of {"key1": "val1"} # we serialize this as: # <MyMap> # <entry> # <key>key1</key> # <value>val1</value> # </entry> # </MyMap> if not self._is_shape_flattened(shape): node = ElementTree.SubElement(xmlnode, name) self._add_xml_namespace(shape, node) for key, value in params.items(): sub_node = ( ElementTree.SubElement(xmlnode, name) if self._is_shape_flattened(shape) else ElementTree.SubElement(node, 'entry') ) key_name = self._get_serialized_name(shape.key, default_name='key') val_name = self._get_serialized_name( shape.value, default_name='value' ) self._serialize(shape.key, key, sub_node, key_name) self._serialize(shape.value, value, sub_node, val_name) def _serialize_type_boolean(self, xmlnode, params, shape, name): # For scalar types, the 'params' attr is actually just a scalar # value representing the data we need to serialize as a boolean. # It will either be 'true' or 'false' node = ElementTree.SubElement(xmlnode, name) if params: str_value = 'true' else: str_value = 'false' node.text = str_value self._add_xml_namespace(shape, node) def _serialize_type_blob(self, xmlnode, params, shape, name): node = ElementTree.SubElement(xmlnode, name) node.text = self._get_base64(params) self._add_xml_namespace(shape, node) def _serialize_type_timestamp(self, xmlnode, params, shape, name): node = ElementTree.SubElement(xmlnode, name) node.text = str( self._convert_timestamp_to_str( params, shape.serialization.get('timestampFormat') ) ) self._add_xml_namespace(shape, node) def _serialize_type_float(self, xmlnode, params, shape, name): node = ElementTree.SubElement(xmlnode, name) node.text = str(self._handle_float(params)) self._add_xml_namespace(shape, node) def _serialize_type_double(self, xmlnode, params, shape, name): self._serialize_type_float(xmlnode, params, shape, name) def _default_serialize(self, xmlnode, params, shape, name): node = ElementTree.SubElement(xmlnode, name) node.text = str(params) self._add_xml_namespace(shape, node) def _add_xml_namespace(self, shape, structure_node): if 'xmlNamespace' in shape.serialization: namespace_metadata = shape.serialization['xmlNamespace'] attribute_name = 'xmlns' if isinstance(namespace_metadata, dict): if namespace_metadata.get('prefix'): attribute_name += f":{namespace_metadata['prefix']}" structure_node.attrib[attribute_name] = namespace_metadata[ 'uri' ] elif isinstance(namespace_metadata, str): structure_node.attrib[attribute_name] = namespace_metadata class RpcV2CBORSerializer(BaseRpcV2Serializer, CBORSerializer): TIMESTAMP_FORMAT = 'unixtimestamp' def serialize_to_request(self, parameters, operation_model): register_feature_id('PROTOCOL_RPC_V2_CBOR') return super().serialize_to_request(parameters, operation_model) def _serialize_body_params(self, parameters, input_shape): body = bytearray() self._serialize_data_item(body, parameters, input_shape) return bytes(body) def _serialize_headers(self, serialized, operation_model): serialized['headers']['smithy-protocol'] = 'rpc-v2-cbor' if operation_model.has_event_stream_output: header_val = 'application/vnd.amazon.eventstream' else: header_val = 'application/cbor' has_body = serialized['body'] != b'' has_content_type = has_header('Content-Type', serialized['headers']) serialized['headers']['Accept'] = header_val if not has_content_type and has_body: serialized['headers']['Content-Type'] = header_val SERIALIZERS = { 'ec2': EC2Serializer, 'query': QuerySerializer, 'json': JSONSerializer, 'rest-json': RestJSONSerializer, 'rest-xml': RestXMLSerializer, 'smithy-rpc-v2-cbor': RpcV2CBORSerializer, }	47.43 KB	2025-05-25 12:26
📄 session.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """ This module contains the main interface to the botocore package, the Session object. """ import copy import logging import os import platform import socket import warnings import botocore.client import botocore.configloader import botocore.credentials import botocore.tokens from botocore import ( UNSIGNED, __version__, handlers, invoke_initializers, monitoring, paginate, retryhandler, translate, waiter, ) from botocore.compat import HAS_CRT, MutableMapping from botocore.configprovider import ( BOTOCORE_DEFAUT_SESSION_VARIABLES, ConfigChainFactory, ConfiguredEndpointProvider, ConfigValueStore, DefaultConfigResolver, SmartDefaultsConfigStoreFactory, create_botocore_default_config_mapping, ) from botocore.context import get_context, with_current_context from botocore.errorfactory import ClientExceptionsFactory from botocore.exceptions import ( ConfigNotFound, InvalidDefaultsMode, PartialCredentialsError, ProfileNotFound, UnknownServiceError, ) from botocore.hooks import ( EventAliaser, HierarchicalEmitter, first_non_none_response, ) from botocore.loaders import create_loader from botocore.model import ServiceModel from botocore.parsers import ResponseParserFactory from botocore.regions import EndpointResolver from botocore.useragent import UserAgentString from botocore.utils import ( EVENT_ALIASES, IMDSRegionProvider, validate_region_name, ) from botocore.compat import HAS_CRT # noqa logger = logging.getLogger(__name__) class Session: """ The Session object collects together useful functionality from `botocore` as well as important data such as configuration information and credentials into a single, easy-to-use object. :ivar available_profiles: A list of profiles defined in the config file associated with this session. :ivar profile: The current profile. """ SESSION_VARIABLES = copy.copy(BOTOCORE_DEFAUT_SESSION_VARIABLES) #: The default format string to use when configuring the botocore logger. LOG_FORMAT = '%(asctime)s - %(name)s - %(levelname)s - %(message)s' def __init__( self, session_vars=None, event_hooks=None, include_builtin_handlers=True, profile=None, ): """ Create a new Session object. :type session_vars: dict :param session_vars: A dictionary that is used to override some or all of the environment variables associated with this session. The key/value pairs defined in this dictionary will override the corresponding variables defined in ``SESSION_VARIABLES``. :type event_hooks: BaseEventHooks :param event_hooks: The event hooks object to use. If one is not provided, an event hooks object will be automatically created for you. :type include_builtin_handlers: bool :param include_builtin_handlers: Indicates whether or not to automatically register builtin handlers. :type profile: str :param profile: The name of the profile to use for this session. Note that the profile can only be set when the session is created. """ if event_hooks is None: self._original_handler = HierarchicalEmitter() else: self._original_handler = event_hooks self._events = EventAliaser(self._original_handler) if include_builtin_handlers: self._register_builtin_handlers(self._events) self.user_agent_name = 'Botocore' self.user_agent_version = __version__ self.user_agent_extra = '' # The _profile attribute is just used to cache the value # of the current profile to avoid going through the normal # config lookup process each access time. self._profile = None self._config = None self._credentials = None self._auth_token = None self._profile_map = None # This is a dict that stores per session specific config variable # overrides via set_config_variable(). self._session_instance_vars = {} if profile is not None: self._session_instance_vars['profile'] = profile self._client_config = None self._last_client_region_used = None self._components = ComponentLocator() self._internal_components = ComponentLocator() self._register_components() self.session_var_map = SessionVarDict(self, self.SESSION_VARIABLES) if session_vars is not None: self.session_var_map.update(session_vars) invoke_initializers(self) def _register_components(self): self._register_credential_provider() self._register_token_provider() self._register_data_loader() self._register_endpoint_resolver() self._register_event_emitter() self._register_response_parser_factory() self._register_exceptions_factory() self._register_config_store() self._register_monitor() self._register_default_config_resolver() self._register_smart_defaults_factory() self._register_user_agent_creator() def _register_event_emitter(self): self._components.register_component('event_emitter', self._events) def _register_token_provider(self): self._components.lazy_register_component( 'token_provider', self._create_token_resolver ) def _create_token_resolver(self): return botocore.tokens.create_token_resolver(self) def _register_credential_provider(self): self._components.lazy_register_component( 'credential_provider', self._create_credential_resolver ) def _create_credential_resolver(self): return botocore.credentials.create_credential_resolver( self, region_name=self._last_client_region_used ) def _register_data_loader(self): self._components.lazy_register_component( 'data_loader', lambda: create_loader(self.get_config_variable('data_path')), ) def _register_endpoint_resolver(self): def create_default_resolver(): loader = self.get_component('data_loader') endpoints, path = loader.load_data_with_path('endpoints') uses_builtin = loader.is_builtin_path(path) return EndpointResolver(endpoints, uses_builtin_data=uses_builtin) self._internal_components.lazy_register_component( 'endpoint_resolver', create_default_resolver ) def _register_default_config_resolver(self): def create_default_config_resolver(): loader = self.get_component('data_loader') defaults = loader.load_data('sdk-default-configuration') return DefaultConfigResolver(defaults) self._internal_components.lazy_register_component( 'default_config_resolver', create_default_config_resolver ) def _register_smart_defaults_factory(self): def create_smart_defaults_factory(): default_config_resolver = self._get_internal_component( 'default_config_resolver' ) imds_region_provider = IMDSRegionProvider(session=self) return SmartDefaultsConfigStoreFactory( default_config_resolver, imds_region_provider ) self._internal_components.lazy_register_component( 'smart_defaults_factory', create_smart_defaults_factory ) def _register_response_parser_factory(self): self._components.register_component( 'response_parser_factory', ResponseParserFactory() ) def _register_exceptions_factory(self): self._internal_components.register_component( 'exceptions_factory', ClientExceptionsFactory() ) def _register_builtin_handlers(self, events): for spec in handlers.BUILTIN_HANDLERS: if len(spec) == 2: event_name, handler = spec self.register(event_name, handler) else: event_name, handler, register_type = spec if register_type is handlers.REGISTER_FIRST: self._events.register_first(event_name, handler) elif register_type is handlers.REGISTER_LAST: self._events.register_last(event_name, handler) def _register_config_store(self): config_store_component = ConfigValueStore( mapping=create_botocore_default_config_mapping(self) ) self._components.register_component( 'config_store', config_store_component ) def _register_monitor(self): self._internal_components.lazy_register_component( 'monitor', self._create_csm_monitor ) def _register_user_agent_creator(self): uas = UserAgentString.from_environment() self._components.register_component('user_agent_creator', uas) def _create_csm_monitor(self): if self.get_config_variable('csm_enabled'): client_id = self.get_config_variable('csm_client_id') host = self.get_config_variable('csm_host') port = self.get_config_variable('csm_port') handler = monitoring.Monitor( adapter=monitoring.MonitorEventAdapter(), publisher=monitoring.SocketPublisher( socket=socket.socket(socket.AF_INET, socket.SOCK_DGRAM), host=host, port=port, serializer=monitoring.CSMSerializer( csm_client_id=client_id ), ), ) return handler return None def _get_crt_version(self): user_agent_creator = self.get_component('user_agent_creator') return user_agent_creator._crt_version or 'Unknown' @property def available_profiles(self): return list(self._build_profile_map().keys()) def _build_profile_map(self): # This will build the profile map if it has not been created, # otherwise it will return the cached value. The profile map # is a list of profile names, to the config values for the profile. if self._profile_map is None: self._profile_map = self.full_config['profiles'] return self._profile_map @property def profile(self): if self._profile is None: profile = self.get_config_variable('profile') self._profile = profile return self._profile def get_config_variable(self, logical_name, methods=None): if methods is not None: return self._get_config_variable_with_custom_methods( logical_name, methods ) return self.get_component('config_store').get_config_variable( logical_name ) def _get_config_variable_with_custom_methods(self, logical_name, methods): # If a custom list of methods was supplied we need to perserve the # behavior with the new system. To do so a new chain that is a copy of # the old one will be constructed, but only with the supplied methods # being added to the chain. This chain will be consulted for a value # and then thrown out. This is not efficient, nor is the methods arg # used in botocore, this is just for backwards compatibility. chain_builder = SubsetChainConfigFactory(session=self, methods=methods) mapping = create_botocore_default_config_mapping(self) for name, config_options in self.session_var_map.items(): config_name, env_vars, default, typecast = config_options build_chain_config_args = { 'conversion_func': typecast, 'default': default, } if 'instance' in methods: build_chain_config_args['instance_name'] = name if 'env' in methods: build_chain_config_args['env_var_names'] = env_vars if 'config' in methods: build_chain_config_args['config_property_name'] = config_name mapping[name] = chain_builder.create_config_chain( build_chain_config_args ) config_store_component = ConfigValueStore(mapping=mapping) value = config_store_component.get_config_variable(logical_name) return value def set_config_variable(self, logical_name, value): """Set a configuration variable to a specific value. By using this method, you can override the normal lookup process used in ``get_config_variable`` by explicitly setting a value. Subsequent calls to ``get_config_variable`` will use the ``value``. This gives you per-session specific configuration values. :: >>> # Assume logical name 'foo' maps to env var 'FOO' >>> os.environ['FOO'] = 'myvalue' >>> s.get_config_variable('foo') 'myvalue' >>> s.set_config_variable('foo', 'othervalue') >>> s.get_config_variable('foo') 'othervalue' :type logical_name: str :param logical_name: The logical name of the session variable you want to set. These are the keys in ``SESSION_VARIABLES``. :param value: The value to associate with the config variable. """ logger.debug( "Setting config variable for %s to %r", logical_name, value, ) self._session_instance_vars[logical_name] = value def instance_variables(self): return copy.copy(self._session_instance_vars) def get_scoped_config(self): """ Returns the config values from the config file scoped to the current profile. The configuration data is loaded only from the config file. It does not resolve variables based on different locations (e.g. first from the session instance, then from environment variables, then from the config file). If you want this lookup behavior, use the ``get_config_variable`` method instead. Note that this configuration is specific to a single profile (the ``profile`` session variable). If the ``profile`` session variable is set and the profile does not exist in the config file, a ``ProfileNotFound`` exception will be raised. :raises: ConfigNotFound, ConfigParseError, ProfileNotFound :rtype: dict """ profile_name = self.get_config_variable('profile') profile_map = self._build_profile_map() # If a profile is not explicitly set return the default # profile config or an empty config dict if we don't have # a default profile. if profile_name is None: return profile_map.get('default', {}) elif profile_name not in profile_map: # Otherwise if they specified a profile, it has to # exist (even if it's the default profile) otherwise # we complain. raise ProfileNotFound(profile=profile_name) else: return profile_map[profile_name] @property def full_config(self): """Return the parsed config file. The ``get_config`` method returns the config associated with the specified profile. This property returns the contents of the entire config file. :rtype: dict """ if self._config is None: try: config_file = self.get_config_variable('config_file') self._config = botocore.configloader.load_config(config_file) except ConfigNotFound: self._config = {'profiles': {}} try: # Now we need to inject the profiles from the # credentials file. We don't actually need the values # in the creds file, only the profile names so that we # can validate the user is not referring to a nonexistent # profile. cred_file = self.get_config_variable('credentials_file') cred_profiles = botocore.configloader.raw_config_parse( cred_file ) for profile in cred_profiles: cred_vars = cred_profiles[profile] if profile not in self._config['profiles']: self._config['profiles'][profile] = cred_vars else: self._config['profiles'][profile].update(cred_vars) except ConfigNotFound: pass return self._config def get_default_client_config(self): """Retrieves the default config for creating clients :rtype: botocore.client.Config :returns: The default client config object when creating clients. If the value is ``None`` then there is no default config object attached to the session. """ return self._client_config def set_default_client_config(self, client_config): """Sets the default config for creating clients :type client_config: botocore.client.Config :param client_config: The default client config object when creating clients. If the value is ``None`` then there is no default config object attached to the session. """ self._client_config = client_config def set_credentials( self, access_key, secret_key, token=None, account_id=None ): """ Manually create credentials for this session. If you would prefer to use botocore without a config file, environment variables, or IAM roles, you can pass explicit credentials into this method to establish credentials for this session. :type access_key: str :param access_key: The access key part of the credentials. :type secret_key: str :param secret_key: The secret key part of the credentials. :type token: str :param token: An option session token used by STS session credentials. :type account_id: str :param account_id: An optional account ID part of the credentials. """ self._credentials = botocore.credentials.Credentials( access_key, secret_key, token, account_id=account_id ) def get_credentials(self): """ Return the :class:`botocore.credential.Credential` object associated with this session. If the credentials have not yet been loaded, this will attempt to load them. If they have already been loaded, this will return the cached credentials. """ if self._credentials is None: self._credentials = self._components.get_component( 'credential_provider' ).load_credentials() return self._credentials def get_auth_token(self): """ Return the :class:`botocore.tokens.AuthToken` object associated with this session. If the authorization token has not yet been loaded, this will attempt to load it. If it has already been loaded, this will return the cached authorization token. """ if self._auth_token is None: provider = self._components.get_component('token_provider') self._auth_token = provider.load_token() return self._auth_token def user_agent(self): """ Return a string suitable for use as a User-Agent header. The string will be of the form: <agent_name>/<agent_version> Python/<py_ver> <plat_name>/<plat_ver> <exec_env> Where: - agent_name is the value of the `user_agent_name` attribute of the session object (`Botocore` by default). - agent_version is the value of the `user_agent_version` attribute of the session object (the botocore version by default). by default. - py_ver is the version of the Python interpreter beng used. - plat_name is the name of the platform (e.g. Darwin) - plat_ver is the version of the platform - exec_env is exec-env/$AWS_EXECUTION_ENV If ``user_agent_extra`` is not empty, then this value will be appended to the end of the user agent string. """ base = ( f'{self.user_agent_name}/{self.user_agent_version} ' f'Python/{platform.python_version()} ' f'{platform.system()}/{platform.release()}' ) if HAS_CRT: base += f' awscrt/{self._get_crt_version()}' if os.environ.get('AWS_EXECUTION_ENV') is not None: base += ' exec-env/{}'.format(os.environ.get('AWS_EXECUTION_ENV')) if self.user_agent_extra: base += f' {self.user_agent_extra}' return base def get_data(self, data_path): """ Retrieve the data associated with `data_path`. :type data_path: str :param data_path: The path to the data you wish to retrieve. """ return self.get_component('data_loader').load_data(data_path) def get_service_model(self, service_name, api_version=None): """Get the service model object. :type service_name: string :param service_name: The service name :type api_version: string :param api_version: The API version of the service. If none is provided, then the latest API version will be used. :rtype: L{botocore.model.ServiceModel} :return: The botocore service model for the service. """ service_description = self.get_service_data(service_name, api_version) return ServiceModel(service_description, service_name=service_name) def get_waiter_model(self, service_name, api_version=None): loader = self.get_component('data_loader') waiter_config = loader.load_service_model( service_name, 'waiters-2', api_version ) return waiter.WaiterModel(waiter_config) def get_paginator_model(self, service_name, api_version=None): loader = self.get_component('data_loader') paginator_config = loader.load_service_model( service_name, 'paginators-1', api_version ) return paginate.PaginatorModel(paginator_config) def get_service_data(self, service_name, api_version=None): """ Retrieve the fully merged data associated with a service. """ data_path = service_name service_data = self.get_component('data_loader').load_service_model( data_path, type_name='service-2', api_version=api_version ) service_id = EVENT_ALIASES.get(service_name, service_name) self._events.emit( f'service-data-loaded.{service_id}', service_data=service_data, service_name=service_name, session=self, ) return service_data def get_available_services(self): """ Return a list of names of available services. """ return self.get_component('data_loader').list_available_services( type_name='service-2' ) def set_debug_logger(self, logger_name='botocore'): """ Convenience function to quickly configure full debug output to go to the console. """ self.set_stream_logger(logger_name, logging.DEBUG) def set_stream_logger( self, logger_name, log_level, stream=None, format_string=None ): """ Convenience method to configure a stream logger. :type logger_name: str :param logger_name: The name of the logger to configure :type log_level: str :param log_level: The log level to set for the logger. This is any param supported by the ``.setLevel()`` method of a ``Log`` object. :type stream: file :param stream: A file like object to log to. If none is provided then sys.stderr will be used. :type format_string: str :param format_string: The format string to use for the log formatter. If none is provided this will default to ``self.LOG_FORMAT``. """ log = logging.getLogger(logger_name) log.setLevel(logging.DEBUG) ch = logging.StreamHandler(stream) ch.setLevel(log_level) # create formatter if format_string is None: format_string = self.LOG_FORMAT formatter = logging.Formatter(format_string) # add formatter to ch ch.setFormatter(formatter) # add ch to logger log.addHandler(ch) def set_file_logger(self, log_level, path, logger_name='botocore'): """ Convenience function to quickly configure any level of logging to a file. :type log_level: int :param log_level: A log level as specified in the `logging` module :type path: string :param path: Path to the log file. The file will be created if it doesn't already exist. """ log = logging.getLogger(logger_name) log.setLevel(logging.DEBUG) # create console handler and set level to debug ch = logging.FileHandler(path) ch.setLevel(log_level) # create formatter formatter = logging.Formatter(self.LOG_FORMAT) # add formatter to ch ch.setFormatter(formatter) # add ch to logger log.addHandler(ch) def register( self, event_name, handler, unique_id=None, unique_id_uses_count=False ): """Register a handler with an event. :type event_name: str :param event_name: The name of the event. :type handler: callable :param handler: The callback to invoke when the event is emitted. This object must be callable, and must accept ``kwargs``. If either of these preconditions are not met, a ``ValueError`` will be raised. :type unique_id: str :param unique_id: An optional identifier to associate with the registration. A unique_id can only be used once for the entire session registration (unless it is unregistered). This can be used to prevent an event handler from being registered twice. :param unique_id_uses_count: boolean :param unique_id_uses_count: Specifies if the event should maintain a count when a ``unique_id`` is registered and unregisted. The event can only be completely unregistered once every register call using the unique id has been matched by an ``unregister`` call. If ``unique_id`` is specified, subsequent ``register`` calls must use the same value for ``unique_id_uses_count`` as the ``register`` call that first registered the event. :raises ValueError: If the call to ``register`` uses ``unique_id`` but the value for ``unique_id_uses_count`` differs from the ``unique_id_uses_count`` value declared by the very first ``register`` call for that ``unique_id``. """ self._events.register( event_name, handler, unique_id, unique_id_uses_count=unique_id_uses_count, ) def unregister( self, event_name, handler=None, unique_id=None, unique_id_uses_count=False, ): """Unregister a handler with an event. :type event_name: str :param event_name: The name of the event. :type handler: callable :param handler: The callback to unregister. :type unique_id: str :param unique_id: A unique identifier identifying the callback to unregister. You can provide either the handler or the unique_id, you do not have to provide both. :param unique_id_uses_count: boolean :param unique_id_uses_count: Specifies if the event should maintain a count when a ``unique_id`` is registered and unregisted. The event can only be completely unregistered once every ``register`` call using the ``unique_id`` has been matched by an ``unregister`` call. If the ``unique_id`` is specified, subsequent ``unregister`` calls must use the same value for ``unique_id_uses_count`` as the ``register`` call that first registered the event. :raises ValueError: If the call to ``unregister`` uses ``unique_id`` but the value for ``unique_id_uses_count`` differs from the ``unique_id_uses_count`` value declared by the very first ``register`` call for that ``unique_id``. """ self._events.unregister( event_name, handler=handler, unique_id=unique_id, unique_id_uses_count=unique_id_uses_count, ) def emit(self, event_name, kwargs): return self._events.emit(event_name, kwargs) def emit_first_non_none_response(self, event_name, kwargs): responses = self._events.emit(event_name, kwargs) return first_non_none_response(responses) def get_component(self, name): try: return self._components.get_component(name) except ValueError: if name in ['endpoint_resolver', 'exceptions_factory']: warnings.warn( f'Fetching the {name} component with the get_component() ' 'method is deprecated as the component has always been ' 'considered an internal interface of botocore', DeprecationWarning, ) return self._internal_components.get_component(name) raise def _get_internal_component(self, name): # While this method may be called by botocore classes outside of the # Session, this method should never be used by a class that lives # outside of botocore. return self._internal_components.get_component(name) def _register_internal_component(self, name, component): # While this method may be called by botocore classes outside of the # Session, this method should never be used by a class that lives # outside of botocore. return self._internal_components.register_component(name, component) def register_component(self, name, component): self._components.register_component(name, component) def lazy_register_component(self, name, component): self._components.lazy_register_component(name, component) @with_current_context() def create_client( self, service_name, region_name=None, api_version=None, use_ssl=True, verify=None, endpoint_url=None, aws_access_key_id=None, aws_secret_access_key=None, aws_session_token=None, config=None, aws_account_id=None, ): """Create a botocore client. :type service_name: string :param service_name: The name of the service for which a client will be created. You can use the ``Session.get_available_services()`` method to get a list of all available service names. :type region_name: string :param region_name: The name of the region associated with the client. A client is associated with a single region. :type api_version: string :param api_version: The API version to use. By default, botocore will use the latest API version when creating a client. You only need to specify this parameter if you want to use a previous API version of the client. :type use_ssl: boolean :param use_ssl: Whether or not to use SSL. By default, SSL is used. Note that not all services support non-ssl connections. :type verify: boolean/string :param verify: Whether or not to verify SSL certificates. By default SSL certificates are verified. You can provide the following values: * False - do not validate SSL certificates. SSL will still be used (unless use_ssl is False), but SSL certificates will not be verified. * path/to/cert/bundle.pem - A filename of the CA cert bundle to uses. You can specify this argument if you want to use a different CA cert bundle than the one used by botocore. :type endpoint_url: string :param endpoint_url: The complete URL to use for the constructed client. Normally, botocore will automatically construct the appropriate URL to use when communicating with a service. You can specify a complete URL (including the "http/https" scheme) to override this behavior. If this value is provided, then ``use_ssl`` is ignored. :type aws_access_key_id: string :param aws_access_key_id: The access key to use when creating the client. This is entirely optional, and if not provided, the credentials configured for the session will automatically be used. You only need to provide this argument if you want to override the credentials used for this specific client. :type aws_secret_access_key: string :param aws_secret_access_key: The secret key to use when creating the client. Same semantics as aws_access_key_id above. :type aws_session_token: string :param aws_session_token: The session token to use when creating the client. Same semantics as aws_access_key_id above. :type config: botocore.client.Config :param config: Advanced client configuration options. If a value is specified in the client config, its value will take precedence over environment variables and configuration values, but not over a value passed explicitly to the method. If a default config object is set on the session, the config object used when creating the client will be the result of calling ``merge()`` on the default config with the config provided to this call. :type aws_account_id: string :param aws_account_id: The account id to use when creating the client. Same semantics as aws_access_key_id above. :rtype: botocore.client.BaseClient :return: A botocore client instance """ default_client_config = self.get_default_client_config() # If a config is provided and a default config is set, then # use the config resulting from merging the two. if config is not None and default_client_config is not None: config = default_client_config.merge(config) # If a config was not provided then use the default # client config from the session elif default_client_config is not None: config = default_client_config region_name = self._resolve_region_name(region_name, config) # Figure out the verify value base on the various # configuration options. if verify is None: verify = self.get_config_variable('ca_bundle') if api_version is None: api_version = self.get_config_variable('api_versions').get( service_name, None ) loader = self.get_component('data_loader') event_emitter = self.get_component('event_emitter') response_parser_factory = self.get_component('response_parser_factory') if config is not None and config.signature_version is UNSIGNED: credentials = None elif ( aws_access_key_id is not None and aws_secret_access_key is not None ): credentials = botocore.credentials.Credentials( access_key=aws_access_key_id, secret_key=aws_secret_access_key, token=aws_session_token, account_id=aws_account_id, ) elif self._missing_cred_vars(aws_access_key_id, aws_secret_access_key): raise PartialCredentialsError( provider='explicit', cred_var=self._missing_cred_vars( aws_access_key_id, aws_secret_access_key ), ) else: if ignored_credentials := self._get_ignored_credentials( aws_session_token, aws_account_id ): logger.debug( f"Ignoring the following credential-related values which were set without " f"an access key id and secret key on the session or client: {ignored_credentials}" ) credentials = self.get_credentials() auth_token = self.get_auth_token() endpoint_resolver = self._get_internal_component('endpoint_resolver') exceptions_factory = self._get_internal_component('exceptions_factory') config_store = copy.copy(self.get_component('config_store')) user_agent_creator = self.get_component('user_agent_creator') # Session configuration values for the user agent string are applied # just before each client creation because they may have been modified # at any time between session creation and client creation. user_agent_creator.set_session_config( session_user_agent_name=self.user_agent_name, session_user_agent_version=self.user_agent_version, session_user_agent_extra=self.user_agent_extra, ) defaults_mode = self._resolve_defaults_mode(config, config_store) if defaults_mode != 'legacy': smart_defaults_factory = self._get_internal_component( 'smart_defaults_factory' ) smart_defaults_factory.merge_smart_defaults( config_store, defaults_mode, region_name ) self._add_configured_endpoint_provider( client_name=service_name, config_store=config_store, ) user_agent_creator.set_client_features(get_context().features) client_creator = botocore.client.ClientCreator( loader, endpoint_resolver, self.user_agent(), event_emitter, retryhandler, translate, response_parser_factory, exceptions_factory, config_store, user_agent_creator=user_agent_creator, ) client = client_creator.create_client( service_name=service_name, region_name=region_name, is_secure=use_ssl, endpoint_url=endpoint_url, verify=verify, credentials=credentials, scoped_config=self.get_scoped_config(), client_config=config, api_version=api_version, auth_token=auth_token, ) monitor = self._get_internal_component('monitor') if monitor is not None: monitor.register(client.meta.events) return client def _resolve_region_name(self, region_name, config): # Figure out the user-provided region based on the various # configuration options. if region_name is None: if config and config.region_name is not None: region_name = config.region_name else: region_name = self.get_config_variable('region') validate_region_name(region_name) # For any client that we create in retrieving credentials # we want to create it using the same region as specified in # creating this client. It is important to note though that the # credentials client is only created once per session. So if a new # client is created with a different region, its credential resolver # will use the region of the first client. However, that is not an # issue as of now because the credential resolver uses only STS and # the credentials returned at regional endpoints are valid across # all regions in the partition. self._last_client_region_used = region_name return region_name def _resolve_defaults_mode(self, client_config, config_store): mode = config_store.get_config_variable('defaults_mode') if client_config and client_config.defaults_mode: mode = client_config.defaults_mode default_config_resolver = self._get_internal_component( 'default_config_resolver' ) default_modes = default_config_resolver.get_default_modes() lmode = mode.lower() if lmode not in default_modes: raise InvalidDefaultsMode( mode=mode, valid_modes=', '.join(default_modes) ) return lmode def _add_configured_endpoint_provider(self, client_name, config_store): chain = ConfiguredEndpointProvider( full_config=self.full_config, scoped_config=self.get_scoped_config(), client_name=client_name, ) config_store.set_config_provider( logical_name='endpoint_url', provider=chain, ) def _missing_cred_vars(self, access_key, secret_key): if access_key is not None and secret_key is None: return 'aws_secret_access_key' if secret_key is not None and access_key is None: return 'aws_access_key_id' return None def get_available_partitions(self): """Lists the available partitions found on disk :rtype: list :return: Returns a list of partition names (e.g., ["aws", "aws-cn"]) """ resolver = self._get_internal_component('endpoint_resolver') return resolver.get_available_partitions() def get_partition_for_region(self, region_name): """Lists the partition name of a particular region. :type region_name: string :param region_name: Name of the region to list partition for (e.g., us-east-1). :rtype: string :return: Returns the respective partition name (e.g., aws). """ resolver = self._get_internal_component('endpoint_resolver') return resolver.get_partition_for_region(region_name) def get_available_regions( self, service_name, partition_name='aws', allow_non_regional=False ): """Lists the region and endpoint names of a particular partition. :type service_name: string :param service_name: Name of a service to list endpoint for (e.g., s3). This parameter accepts a service name (e.g., "elb") or endpoint prefix (e.g., "elasticloadbalancing"). :type partition_name: string :param partition_name: Name of the partition to limit endpoints to. (e.g., aws for the public AWS endpoints, aws-cn for AWS China endpoints, aws-us-gov for AWS GovCloud (US) Endpoints, etc. :type allow_non_regional: bool :param allow_non_regional: Set to True to include endpoints that are not regional endpoints (e.g., s3-external-1, fips-us-gov-west-1, etc). :return: Returns a list of endpoint names (e.g., ["us-east-1"]). """ resolver = self._get_internal_component('endpoint_resolver') results = [] try: service_data = self.get_service_data(service_name) endpoint_prefix = service_data['metadata'].get( 'endpointPrefix', service_name ) results = resolver.get_available_endpoints( endpoint_prefix, partition_name, allow_non_regional ) except UnknownServiceError: pass return results def _get_ignored_credentials(self, aws_session_token, aws_account_id): credential_inputs = [] if aws_session_token: credential_inputs.append('aws_session_token') if aws_account_id: credential_inputs.append('aws_account_id') return ', '.join(credential_inputs) if credential_inputs else None class ComponentLocator: """Service locator for session components.""" def __init__(self): self._components = {} self._deferred = {} def get_component(self, name): if name in self._deferred: factory = self._deferred[name] self._components[name] = factory() # Only delete the component from the deferred dict after # successfully creating the object from the factory as well as # injecting the instantiated value into the _components dict. try: del self._deferred[name] except KeyError: # If we get here, it's likely that get_component was called # concurrently from multiple threads, and another thread # already deleted the entry. This means the factory was # probably called twice, but cleaning up the deferred entry # should not crash outright. pass try: return self._components[name] except KeyError: raise ValueError(f"Unknown component: {name}") def register_component(self, name, component): self._components[name] = component try: del self._deferred[name] except KeyError: pass def lazy_register_component(self, name, no_arg_factory): self._deferred[name] = no_arg_factory try: del self._components[name] except KeyError: pass class SessionVarDict(MutableMapping): def __init__(self, session, session_vars): self._session = session self._store = copy.copy(session_vars) def __getitem__(self, key): return self._store[key] def __setitem__(self, key, value): self._store[key] = value self._update_config_store_from_session_vars(key, value) def __delitem__(self, key): del self._store[key] def __iter__(self): return iter(self._store) def __len__(self): return len(self._store) def _update_config_store_from_session_vars( self, logical_name, config_options ): # This is for backwards compatibility. The new preferred way to # modify configuration logic is to use the component system to get # the config_store component from the session, and then update # a key with a custom config provider(s). # This backwards compatibility method takes the old session_vars # list of tuples and and transforms that into a set of updates to # the config_store component. config_chain_builder = ConfigChainFactory(session=self._session) config_name, env_vars, default, typecast = config_options config_store = self._session.get_component('config_store') config_store.set_config_provider( logical_name, config_chain_builder.create_config_chain( instance_name=logical_name, env_var_names=env_vars, config_property_names=config_name, default=default, conversion_func=typecast, ), ) class SubsetChainConfigFactory: """A class for creating backwards compatible configuration chains. This class can be used instead of :class:`botocore.configprovider.ConfigChainFactory` to make it honor the methods argument to get_config_variable. This class can be used to filter out providers that are not in the methods tuple when creating a new config chain. """ def __init__(self, session, methods, environ=None): self._factory = ConfigChainFactory(session, environ) self._supported_methods = methods def create_config_chain( self, instance_name=None, env_var_names=None, config_property_name=None, default=None, conversion_func=None, ): """Build a config chain following the standard botocore pattern. This config chain factory will omit any providers not in the methods tuple provided at initialization. For example if given the tuple ('instance', 'config',) it will not inject the environment provider into the standard config chain. This lets the botocore session support the custom ``methods`` argument for all the default botocore config variables when calling ``get_config_variable``. """ if 'instance' not in self._supported_methods: instance_name = None if 'env' not in self._supported_methods: env_var_names = None if 'config' not in self._supported_methods: config_property_name = None return self._factory.create_config_chain( instance_name=instance_name, env_var_names=env_var_names, config_property_names=config_property_name, default=default, conversion_func=conversion_func, ) def get_session(env_vars=None): """ Return a new session object. """ return Session(env_vars)	49.3 KB	2025-05-25 12:26
📄 signers.py # Copyright 2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import base64 import datetime import json import weakref import botocore import botocore.auth from botocore.awsrequest import create_request_object, prepare_request_dict from botocore.compat import OrderedDict from botocore.exceptions import ( ParamValidationError, UnknownClientMethodError, UnknownSignatureVersionError, UnsupportedSignatureVersionError, ) from botocore.utils import ArnParser, datetime2timestamp # Keep these imported. There's pre-existing code that uses them. from botocore.utils import fix_s3_host # noqa class RequestSigner: """ An object to sign requests before they go out over the wire using one of the authentication mechanisms defined in ``auth.py``. This class fires two events scoped to a service and operation name: * choose-signer: Allows overriding the auth signer name. * before-sign: Allows mutating the request before signing. Together these events allow for customization of the request signing pipeline, including overrides, request path manipulation, and disabling signing per operation. :type service_id: botocore.model.ServiceId :param service_id: The service id for the service, e.g. ``S3`` :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type signature_version: string :param signature_version: Signature name like ``v4``. :type credentials: :py:class:`~botocore.credentials.Credentials` :param credentials: User credentials with which to sign requests. :type event_emitter: :py:class:`~botocore.hooks.BaseEventHooks` :param event_emitter: Extension mechanism to fire events. """ def __init__( self, service_id, region_name, signing_name, signature_version, credentials, event_emitter, auth_token=None, ): self._region_name = region_name self._signing_name = signing_name self._signature_version = signature_version self._credentials = credentials self._auth_token = auth_token self._service_id = service_id # We need weakref to prevent leaking memory in Python 2.6 on Linux 2.6 self._event_emitter = weakref.proxy(event_emitter) @property def region_name(self): return self._region_name @property def signature_version(self): return self._signature_version @property def signing_name(self): return self._signing_name def handler(self, operation_name=None, request=None, *kwargs): # This is typically hooked up to the "request-created" event # from a client's event emitter. When a new request is created # this method is invoked to sign the request. # Don't call this method directly. return self.sign(operation_name, request) def sign( self, operation_name, request, region_name=None, signing_type='standard', expires_in=None, signing_name=None, ): """Sign a request before it goes out over the wire. :type operation_name: string :param operation_name: The name of the current operation, e.g. ``ListBuckets``. :type request: AWSRequest :param request: The request object to be sent over the wire. :type region_name: str :param region_name: The region to sign the request for. :type signing_type: str :param signing_type: The type of signing to perform. This can be one of three possible values: 'standard' - This should be used for most requests. * 'presign-url' - This should be used when pre-signing a request. * 'presign-post' - This should be used when pre-signing an S3 post. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. This parameter is only valid for signing type 'presign-url'. :type signing_name: str :param signing_name: The name to use for the service when signing. """ explicit_region_name = region_name if region_name is None: region_name = self._region_name if signing_name is None: signing_name = self._signing_name signature_version = self._choose_signer( operation_name, signing_type, request.context ) # Allow mutating request before signing self._event_emitter.emit( f'before-sign.{self._service_id.hyphenize()}.{operation_name}', request=request, signing_name=signing_name, region_name=self._region_name, signature_version=signature_version, request_signer=self, operation_name=operation_name, ) if signature_version != botocore.UNSIGNED: kwargs = { 'signing_name': signing_name, 'region_name': region_name, 'signature_version': signature_version, } if expires_in is not None: kwargs['expires'] = expires_in signing_context = request.context.get('signing', {}) if not explicit_region_name and signing_context.get('region'): kwargs['region_name'] = signing_context['region'] if signing_context.get('signing_name'): kwargs['signing_name'] = signing_context['signing_name'] if signing_context.get('request_credentials'): kwargs['request_credentials'] = signing_context[ 'request_credentials' ] if signing_context.get('identity_cache') is not None: self._resolve_identity_cache( kwargs, signing_context['identity_cache'], signing_context['cache_key'], ) try: auth = self.get_auth_instance(kwargs) except UnknownSignatureVersionError as e: if signing_type != 'standard': raise UnsupportedSignatureVersionError( signature_version=signature_version ) else: raise e auth.add_auth(request) def _resolve_identity_cache(self, kwargs, cache, cache_key): kwargs['identity_cache'] = cache kwargs['cache_key'] = cache_key def _choose_signer(self, operation_name, signing_type, context): """ Allow setting the signature version via the choose-signer event. A value of `botocore.UNSIGNED` means no signing will be performed. :param operation_name: The operation to sign. :param signing_type: The type of signing that the signer is to be used for. :return: The signature version to sign with. """ signing_type_suffix_map = { 'presign-post': '-presign-post', 'presign-url': '-query', } suffix = signing_type_suffix_map.get(signing_type, '') # operation specific signing context takes precedent over client-level # defaults signature_version = context.get('auth_type') or self._signature_version signing = context.get('signing', {}) signing_name = signing.get('signing_name', self._signing_name) region_name = signing.get('region', self._region_name) if ( signature_version is not botocore.UNSIGNED and not signature_version.endswith(suffix) ): signature_version += suffix handler, response = self._event_emitter.emit_until_response( f'choose-signer.{self._service_id.hyphenize()}.{operation_name}', signing_name=signing_name, region_name=region_name, signature_version=signature_version, context=context, ) if response is not None: signature_version = response # The suffix needs to be checked again in case we get an improper # signature version from choose-signer. if ( signature_version is not botocore.UNSIGNED and not signature_version.endswith(suffix) ): signature_version += suffix return signature_version def get_auth_instance( self, signing_name, region_name, signature_version=None, request_credentials=None, kwargs, ): """ Get an auth instance which can be used to sign a request using the given signature version. :type signing_name: string :param signing_name: Service signing name. This is usually the same as the service name, but can differ. E.g. ``emr`` vs. ``elasticmapreduce``. :type region_name: string :param region_name: Name of the service region, e.g. ``us-east-1`` :type signature_version: string :param signature_version: Signature name like ``v4``. :rtype: :py:class:`~botocore.auth.BaseSigner` :return: Auth instance to sign a request. """ if signature_version is None: signature_version = self._signature_version cls = botocore.auth.AUTH_TYPE_MAPS.get(signature_version) if cls is None: raise UnknownSignatureVersionError( signature_version=signature_version ) if cls.REQUIRES_TOKEN is True: frozen_token = None if self._auth_token is not None: frozen_token = self._auth_token.get_frozen_token() auth = cls(frozen_token) return auth credentials = request_credentials or self._credentials if getattr(cls, "REQUIRES_IDENTITY_CACHE", None) is True: cache = kwargs["identity_cache"] key = kwargs["cache_key"] credentials = cache.get_credentials(key) del kwargs["cache_key"] # If there's no credentials provided (i.e credentials is None), # then we'll pass a value of "None" over to the auth classes, # which already handle the cases where no credentials have # been provided. frozen_credentials = None if credentials is not None: frozen_credentials = credentials.get_frozen_credentials() kwargs['credentials'] = frozen_credentials if cls.REQUIRES_REGION: if self._region_name is None: raise botocore.exceptions.NoRegionError() kwargs['region_name'] = region_name kwargs['service_name'] = signing_name auth = cls(kwargs) return auth # Alias get_auth for backwards compatibility. get_auth = get_auth_instance def generate_presigned_url( self, request_dict, operation_name, expires_in=3600, region_name=None, signing_name=None, ): """Generates a presigned url :type request_dict: dict :param request_dict: The prepared request dictionary returned by ``botocore.awsrequest.prepare_request_dict()`` :type operation_name: str :param operation_name: The operation being signed. :type expires_in: int :param expires_in: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type region_name: string :param region_name: The region name to sign the presigned url. :type signing_name: str :param signing_name: The name to use for the service when signing. :returns: The presigned url """ request = create_request_object(request_dict) self.sign( operation_name, request, region_name, 'presign-url', expires_in, signing_name, ) request.prepare() return request.url class CloudFrontSigner: '''A signer to create a signed CloudFront URL. First you create a cloudfront signer based on a normalized RSA signer:: import rsa def rsa_signer(message): private_key = open('private_key.pem', 'r').read() return rsa.sign( message, rsa.PrivateKey.load_pkcs1(private_key.encode('utf8')), 'SHA-1') # CloudFront requires SHA-1 hash cf_signer = CloudFrontSigner(key_id, rsa_signer) To sign with a canned policy:: signed_url = cf_signer.generate_signed_url( url, date_less_than=datetime(2015, 12, 1)) To sign with a custom policy:: signed_url = cf_signer.generate_signed_url(url, policy=my_policy) ''' def __init__(self, key_id, rsa_signer): """Create a CloudFrontSigner. :type key_id: str :param key_id: The CloudFront Key Pair ID :type rsa_signer: callable :param rsa_signer: An RSA signer. Its only input parameter will be the message to be signed, and its output will be the signed content as a binary string. The hash algorithm needed by CloudFront is SHA-1. """ self.key_id = key_id self.rsa_signer = rsa_signer def generate_presigned_url(self, url, date_less_than=None, policy=None): """Creates a signed CloudFront URL based on given parameters. :type url: str :param url: The URL of the protected object :type date_less_than: datetime :param date_less_than: The URL will expire after that date and time :type policy: str :param policy: The custom policy, possibly built by self.build_policy() :rtype: str :return: The signed URL. """ both_args_supplied = date_less_than is not None and policy is not None neither_arg_supplied = date_less_than is None and policy is None if both_args_supplied or neither_arg_supplied: e = 'Need to provide either date_less_than or policy, but not both' raise ValueError(e) if date_less_than is not None: # We still need to build a canned policy for signing purpose policy = self.build_policy(url, date_less_than) if isinstance(policy, str): policy = policy.encode('utf8') if date_less_than is not None: params = [f'Expires={int(datetime2timestamp(date_less_than))}'] else: params = [f"Policy={self._url_b64encode(policy).decode('utf8')}"] signature = self.rsa_signer(policy) params.extend( [ f"Signature={self._url_b64encode(signature).decode('utf8')}", f"Key-Pair-Id={self.key_id}", ] ) return self._build_url(url, params) def _build_url(self, base_url, extra_params): separator = '&' if '?' in base_url else '?' return base_url + separator + '&'.join(extra_params) def build_policy( self, resource, date_less_than, date_greater_than=None, ip_address=None ): """A helper to build policy. :type resource: str :param resource: The URL or the stream filename of the protected object :type date_less_than: datetime :param date_less_than: The URL will expire after the time has passed :type date_greater_than: datetime :param date_greater_than: The URL will not be valid until this time :type ip_address: str :param ip_address: Use 'x.x.x.x' for an IP, or 'x.x.x.x/x' for a subnet :rtype: str :return: The policy in a compact string. """ # Note: # 1. Order in canned policy is significant. Special care has been taken # to ensure the output will match the order defined by the document. # There is also a test case to ensure that order. # SEE: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-canned-policy.html#private-content-canned-policy-creating-policy-statement # 2. Albeit the order in custom policy is not required by CloudFront, # we still use OrderedDict internally to ensure the result is stable # and also matches canned policy requirement. # SEE: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html moment = int(datetime2timestamp(date_less_than)) condition = OrderedDict({"DateLessThan": {"AWS:EpochTime": moment}}) if ip_address: if '/' not in ip_address: ip_address += '/32' condition["IpAddress"] = {"AWS:SourceIp": ip_address} if date_greater_than: moment = int(datetime2timestamp(date_greater_than)) condition["DateGreaterThan"] = {"AWS:EpochTime": moment} ordered_payload = [('Resource', resource), ('Condition', condition)] custom_policy = {"Statement": [OrderedDict(ordered_payload)]} return json.dumps(custom_policy, separators=(',', ':')) def _url_b64encode(self, data): # Required by CloudFront. See also: # http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-linux-openssl.html return ( base64.b64encode(data) .replace(b'+', b'-') .replace(b'=', b'_') .replace(b'/', b'~') ) def add_generate_db_auth_token(class_attributes, kwargs): class_attributes['generate_db_auth_token'] = generate_db_auth_token def add_dsql_generate_db_auth_token_methods(class_attributes, kwargs): class_attributes['generate_db_connect_auth_token'] = ( dsql_generate_db_connect_auth_token ) class_attributes['generate_db_connect_admin_auth_token'] = ( dsql_generate_db_connect_admin_auth_token ) def generate_db_auth_token(self, DBHostname, Port, DBUsername, Region=None): """Generates an auth token used to connect to a db with IAM credentials. :type DBHostname: str :param DBHostname: The hostname of the database to connect to. :type Port: int :param Port: The port number the database is listening on. :type DBUsername: str :param DBUsername: The username to log in as. :type Region: str :param Region: The region the database is in. If None, the client region will be used. :return: A presigned url which can be used as an auth token. """ region = Region if region is None: region = self.meta.region_name params = { 'Action': 'connect', 'DBUser': DBUsername, } request_dict = { 'url_path': '/', 'query_string': '', 'headers': {}, 'body': params, 'method': 'GET', } # RDS requires that the scheme not be set when sent over. This can cause # issues when signing because the Python url parsing libraries follow # RFC 1808 closely, which states that a netloc must be introduced by `//`. # Otherwise the url is presumed to be relative, and thus the whole # netloc would be treated as a path component. To work around this we # introduce https here and remove it once we're done processing it. scheme = 'https://' endpoint_url = f'{scheme}{DBHostname}:{Port}' prepare_request_dict(request_dict, endpoint_url) presigned_url = self._request_signer.generate_presigned_url( operation_name='connect', request_dict=request_dict, region_name=region, expires_in=900, signing_name='rds-db', ) return presigned_url[len(scheme) :] def _dsql_generate_db_auth_token( self, Hostname, Action, Region=None, ExpiresIn=900 ): """Generate a DSQL database token for an arbitrary action. :type Hostname: str :param Hostname: The DSQL endpoint host name. :type Action: str :param Action: Action to perform on the cluster (DbConnectAdmin or DbConnect). :type Region: str :param Region: The AWS region where the DSQL Cluster is hosted. If None, the client region will be used. :type ExpiresIn: int :param ExpiresIn: The token expiry duration in seconds (default is 900 seconds). :return: A presigned url which can be used as an auth token. """ possible_actions = ("DbConnect", "DbConnectAdmin") if Action not in possible_actions: raise ParamValidationError( report=f"Received {Action} for action but expected one of: {', '.join(possible_actions)}" ) if Region is None: Region = self.meta.region_name request_dict = { 'url_path': '/', 'query_string': '', 'headers': {}, 'body': { 'Action': Action, }, 'method': 'GET', } scheme = 'https://' endpoint_url = f'{scheme}{Hostname}' prepare_request_dict(request_dict, endpoint_url) presigned_url = self._request_signer.generate_presigned_url( operation_name=Action, request_dict=request_dict, region_name=Region, expires_in=ExpiresIn, signing_name='dsql', ) return presigned_url[len(scheme) :] def dsql_generate_db_connect_auth_token( self, Hostname, Region=None, ExpiresIn=900 ): """Generate a DSQL database token for the "DbConnect" action. :type Hostname: str :param Hostname: The DSQL endpoint host name. :type Region: str :param Region: The AWS region where the DSQL Cluster is hosted. If None, the client region will be used. :type ExpiresIn: int :param ExpiresIn: The token expiry duration in seconds (default is 900 seconds). :return: A presigned url which can be used as an auth token. """ return _dsql_generate_db_auth_token( self, Hostname, "DbConnect", Region, ExpiresIn ) def dsql_generate_db_connect_admin_auth_token( self, Hostname, Region=None, ExpiresIn=900 ): """Generate a DSQL database token for the "DbConnectAdmin" action. :type Hostname: str :param Hostname: The DSQL endpoint host name. :type Region: str :param Region: The AWS region where the DSQL Cluster is hosted. If None, the client region will be used. :type ExpiresIn: int :param ExpiresIn: The token expiry duration in seconds (default is 900 seconds). :return: A presigned url which can be used as an auth token. """ return _dsql_generate_db_auth_token( self, Hostname, "DbConnectAdmin", Region, ExpiresIn ) class S3PostPresigner: def __init__(self, request_signer): self._request_signer = request_signer def generate_presigned_post( self, request_dict, fields=None, conditions=None, expires_in=3600, region_name=None, ): """Generates the url and the form fields used for a presigned s3 post :type request_dict: dict :param request_dict: The prepared request dictionary returned by ``botocore.awsrequest.prepare_request_dict()`` :type fields: dict :param fields: A dictionary of prefilled form fields to build on top of. :type conditions: list :param conditions: A list of conditions to include in the policy. Each element can be either a list or a structure. For example: .. code:: python [ {"acl": "public-read"}, {"bucket": "amzn-s3-demo-bucket"}, ["starts-with", "$key", "mykey"] ] :type expires_in: int :param expires_in: The number of seconds the presigned post is valid for. :type region_name: string :param region_name: The region name to sign the presigned post to. :rtype: dict :returns: A dictionary with two elements: ``url`` and ``fields``. Url is the url to post to. Fields is a dictionary filled with the form fields and respective values to use when submitting the post. For example: .. code:: python { 'url': 'https://amzn-s3-demo-bucket.s3.amazonaws.com', 'fields': { 'acl': 'public-read', 'key': 'mykey', 'signature': 'mysignature', 'policy': 'mybase64 encoded policy' } } """ if fields is None: fields = {} if conditions is None: conditions = [] # Create the policy for the post. policy = {} # Create an expiration date for the policy datetime_now = datetime.datetime.utcnow() expire_date = datetime_now + datetime.timedelta(seconds=expires_in) policy['expiration'] = expire_date.strftime(botocore.auth.ISO8601) # Append all of the conditions that the user supplied. policy['conditions'] = [] for condition in conditions: policy['conditions'].append(condition) # Store the policy and the fields in the request for signing request = create_request_object(request_dict) request.context['s3-presign-post-fields'] = fields request.context['s3-presign-post-policy'] = policy self._request_signer.sign( 'PutObject', request, region_name, 'presign-post' ) # Return the url and the fields for th form to post. return {'url': request.url, 'fields': fields} def add_generate_presigned_url(class_attributes, kwargs): class_attributes['generate_presigned_url'] = generate_presigned_url def generate_presigned_url( self, ClientMethod, Params=None, ExpiresIn=3600, HttpMethod=None ): """Generate a presigned url given a client, its method, and arguments :type ClientMethod: string :param ClientMethod: The client method to presign for :type Params: dict :param Params: The parameters normally passed to ``ClientMethod``. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds) :type HttpMethod: string :param HttpMethod: The http method to use on the generated url. By default, the http method is whatever is used in the method's model. :returns: The presigned url """ client_method = ClientMethod params = Params if params is None: params = {} expires_in = ExpiresIn http_method = HttpMethod context = { 'is_presign_request': True, 'use_global_endpoint': _should_use_global_endpoint(self), } request_signer = self._request_signer try: operation_name = self._PY_TO_OP_NAME[client_method] except KeyError: raise UnknownClientMethodError(method_name=client_method) operation_model = self.meta.service_model.operation_model(operation_name) params = self._emit_api_params( api_params=params, operation_model=operation_model, context=context, ) bucket_is_arn = ArnParser.is_arn(params.get('Bucket', '')) ( endpoint_url, additional_headers, properties, ) = self._resolve_endpoint_ruleset( operation_model, params, context, ignore_signing_region=(not bucket_is_arn), ) request_dict = self._convert_to_request_dict( api_params=params, operation_model=operation_model, endpoint_url=endpoint_url, context=context, headers=additional_headers, set_user_agent_header=False, ) # Switch out the http method if user specified it. if http_method is not None: request_dict['method'] = http_method # Generate the presigned url. return request_signer.generate_presigned_url( request_dict=request_dict, expires_in=expires_in, operation_name=operation_name, ) def add_generate_presigned_post(class_attributes, **kwargs): class_attributes['generate_presigned_post'] = generate_presigned_post def generate_presigned_post( self, Bucket, Key, Fields=None, Conditions=None, ExpiresIn=3600 ): """Builds the url and the form fields used for a presigned s3 post :type Bucket: string :param Bucket: The name of the bucket to presign the post to. Note that bucket related conditions should not be included in the ``conditions`` parameter. :type Key: string :param Key: Key name, optionally add ${filename} to the end to attach the submitted filename. Note that key related conditions and fields are filled out for you and should not be included in the ``Fields`` or ``Conditions`` parameter. :type Fields: dict :param Fields: A dictionary of prefilled form fields to build on top of. Elements that may be included are acl, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and x-amz-meta-. Note that if a particular element is included in the fields dictionary it will not be automatically added to the conditions list. You must specify a condition for the element as well. :type Conditions: list :param Conditions: A list of conditions to include in the policy. Each element can be either a list or a structure. For example: .. code:: python [ {"acl": "public-read"}, ["content-length-range", 2, 5], ["starts-with", "$success_action_redirect", ""] ] Conditions that are included may pertain to acl, content-length-range, Cache-Control, Content-Type, Content-Disposition, Content-Encoding, Expires, success_action_redirect, redirect, success_action_status, and/or x-amz-meta-. Note that if you include a condition, you must specify a valid value in the fields dictionary as well. A value will not be added automatically to the fields dictionary based on the conditions. :type ExpiresIn: int :param ExpiresIn: The number of seconds the presigned post is valid for. :rtype: dict :returns: A dictionary with two elements: ``url`` and ``fields``. Url is the url to post to. Fields is a dictionary filled with the form fields and respective values to use when submitting the post. For example: .. code:: python { 'url': 'https://amzn-s3-demo-bucket.s3.amazonaws.com', 'fields': { 'acl': 'public-read', 'key': 'mykey', 'signature': 'mysignature', 'policy': 'mybase64 encoded policy' } } """ bucket = Bucket key = Key fields = Fields conditions = Conditions expires_in = ExpiresIn if fields is None: fields = {} else: fields = fields.copy() if conditions is None: conditions = [] context = { 'is_presign_request': True, 'use_global_endpoint': _should_use_global_endpoint(self), } post_presigner = S3PostPresigner(self._request_signer) # We choose the CreateBucket operation model because its url gets # serialized to what a presign post requires. operation_model = self.meta.service_model.operation_model('CreateBucket') params = self._emit_api_params( api_params={'Bucket': bucket}, operation_model=operation_model, context=context, ) bucket_is_arn = ArnParser.is_arn(params.get('Bucket', '')) ( endpoint_url, additional_headers, properties, ) = self._resolve_endpoint_ruleset( operation_model, params, context, ignore_signing_region=(not bucket_is_arn), ) request_dict = self._convert_to_request_dict( api_params=params, operation_model=operation_model, endpoint_url=endpoint_url, context=context, headers=additional_headers, set_user_agent_header=False, ) # Append that the bucket name to the list of conditions. conditions.append({'bucket': bucket}) # If the key ends with filename, the only constraint that can be # imposed is if it starts with the specified prefix. if key.endswith('${filename}'): conditions.append(["starts-with", '$key', key[: -len('${filename}')]]) else: conditions.append({'key': key}) # Add the key to the fields. fields['key'] = key return post_presigner.generate_presigned_post( request_dict=request_dict, fields=fields, conditions=conditions, expires_in=expires_in, ) def _should_use_global_endpoint(client): if client.meta.partition != 'aws': return False s3_config = client.meta.config.s3 if s3_config: if s3_config.get('use_dualstack_endpoint', False): return False if ( s3_config.get('us_east_1_regional_endpoint') == 'regional' and client.meta.config.region_name == 'us-east-1' ): return False if s3_config.get('addressing_style') == 'virtual': return False return True	33.61 KB	2025-05-25 12:26
📄 stub.py # Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import copy from collections import deque from pprint import pformat from botocore.awsrequest import AWSResponse from botocore.exceptions import ( ParamValidationError, StubAssertionError, StubResponseError, UnStubbedResponseError, ) from botocore.validate import validate_parameters class _ANY: """ A helper object that compares equal to everything. Copied from unittest.mock """ def __eq__(self, other): return True def __ne__(self, other): return False def __repr__(self): return '<ANY>' ANY = _ANY() class Stubber: """ This class will allow you to stub out requests so you don't have to hit an endpoint to write tests. Responses are returned first in, first out. If operations are called out of order, or are called with no remaining queued responses, an error will be raised. Example: :: import datetime import botocore.session from botocore.stub import Stubber s3 = botocore.session.get_session().create_client('s3') stubber = Stubber(s3) response = { 'IsTruncated': False, 'Name': 'test-bucket', 'MaxKeys': 1000, 'Prefix': '', 'Contents': [{ 'Key': 'test.txt', 'ETag': '"abc123"', 'StorageClass': 'STANDARD', 'LastModified': datetime.datetime(2016, 1, 20, 22, 9), 'Owner': {'ID': 'abc123', 'DisplayName': 'myname'}, 'Size': 14814 }], 'EncodingType': 'url', 'ResponseMetadata': { 'RequestId': 'abc123', 'HTTPStatusCode': 200, 'HostId': 'abc123' }, 'Marker': '' } expected_params = {'Bucket': 'test-bucket'} stubber.add_response('list_objects', response, expected_params) stubber.activate() service_response = s3.list_objects(Bucket='test-bucket') assert service_response == response This class can also be called as a context manager, which will handle activation / deactivation for you. Example: :: import datetime import botocore.session from botocore.stub import Stubber s3 = botocore.session.get_session().create_client('s3') response = { "Owner": { "ID": "foo", "DisplayName": "bar" }, "Buckets": [{ "CreationDate": datetime.datetime(2016, 1, 20, 22, 9), "Name": "baz" }] } with Stubber(s3) as stubber: stubber.add_response('list_buckets', response, {}) service_response = s3.list_buckets() assert service_response == response If you have an input parameter that is a randomly generated value, or you otherwise don't care about its value, you can use ``stub.ANY`` to ignore it in validation. Example: :: import datetime import botocore.session from botocore.stub import Stubber, ANY s3 = botocore.session.get_session().create_client('s3') stubber = Stubber(s3) response = { 'IsTruncated': False, 'Name': 'test-bucket', 'MaxKeys': 1000, 'Prefix': '', 'Contents': [{ 'Key': 'test.txt', 'ETag': '"abc123"', 'StorageClass': 'STANDARD', 'LastModified': datetime.datetime(2016, 1, 20, 22, 9), 'Owner': {'ID': 'abc123', 'DisplayName': 'myname'}, 'Size': 14814 }], 'EncodingType': 'url', 'ResponseMetadata': { 'RequestId': 'abc123', 'HTTPStatusCode': 200, 'HostId': 'abc123' }, 'Marker': '' } expected_params = {'Bucket': ANY} stubber.add_response('list_objects', response, expected_params) with stubber: service_response = s3.list_objects(Bucket='test-bucket') assert service_response == response """ def __init__(self, client): """ :param client: The client to add your stubs to. """ self.client = client self._event_id = 'boto_stubber' self._expected_params_event_id = 'boto_stubber_expected_params' self._queue = deque() def __enter__(self): self.activate() return self def __exit__(self, exception_type, exception_value, traceback): self.deactivate() def activate(self): """ Activates the stubber on the client """ self.client.meta.events.register_first( 'before-parameter-build..', self._assert_expected_params, unique_id=self._expected_params_event_id, ) self.client.meta.events.register( 'before-call..', self._get_response_handler, unique_id=self._event_id, ) def deactivate(self): """ Deactivates the stubber on the client """ self.client.meta.events.unregister( 'before-parameter-build..', self._assert_expected_params, unique_id=self._expected_params_event_id, ) self.client.meta.events.unregister( 'before-call..', self._get_response_handler, unique_id=self._event_id, ) def add_response(self, method, service_response, expected_params=None): """ Adds a service response to the response queue. This will be validated against the service model to ensure correctness. It should be noted, however, that while missing attributes are often considered correct, your code may not function properly if you leave them out. Therefore you should always fill in every value you see in a typical response for your particular request. :param method: The name of the client method to stub. :type method: str :param service_response: A dict response stub. Provided parameters will be validated against the service model. :type service_response: dict :param expected_params: A dictionary of the expected parameters to be called for the provided service response. The parameters match the names of keyword arguments passed to that client call. If any of the parameters differ a ``StubResponseError`` is thrown. You can use stub.ANY to indicate a particular parameter to ignore in validation. stub.ANY is only valid for top level params. """ self._add_response(method, service_response, expected_params) def _add_response(self, method, service_response, expected_params): if not hasattr(self.client, method): raise ValueError( f"Client {self.client.meta.service_model.service_name} " f"does not have method: {method}" ) # Create a successful http response http_response = AWSResponse(None, 200, {}, None) operation_name = self.client.meta.method_to_api_mapping.get(method) self._validate_operation_response(operation_name, service_response) # Add the service_response to the queue for returning responses response = { 'operation_name': operation_name, 'response': (http_response, service_response), 'expected_params': expected_params, } self._queue.append(response) def add_client_error( self, method, service_error_code='', service_message='', http_status_code=400, service_error_meta=None, expected_params=None, response_meta=None, modeled_fields=None, ): """ Adds a ``ClientError`` to the response queue. :param method: The name of the service method to return the error on. :type method: str :param service_error_code: The service error code to return, e.g. ``NoSuchBucket`` :type service_error_code: str :param service_message: The service message to return, e.g. 'The specified bucket does not exist.' :type service_message: str :param http_status_code: The HTTP status code to return, e.g. 404, etc :type http_status_code: int :param service_error_meta: Additional keys to be added to the service Error :type service_error_meta: dict :param expected_params: A dictionary of the expected parameters to be called for the provided service response. The parameters match the names of keyword arguments passed to that client call. If any of the parameters differ a ``StubResponseError`` is thrown. You can use stub.ANY to indicate a particular parameter to ignore in validation. :param response_meta: Additional keys to be added to the response's ResponseMetadata :type response_meta: dict :param modeled_fields: Additional keys to be added to the response based on fields that are modeled for the particular error code. These keys will be validated against the particular error shape designated by the error code. :type modeled_fields: dict """ http_response = AWSResponse(None, http_status_code, {}, None) # We don't look to the model to build this because the caller would # need to know the details of what the HTTP body would need to # look like. parsed_response = { 'ResponseMetadata': {'HTTPStatusCode': http_status_code}, 'Error': {'Message': service_message, 'Code': service_error_code}, } if service_error_meta is not None: parsed_response['Error'].update(service_error_meta) if response_meta is not None: parsed_response['ResponseMetadata'].update(response_meta) if modeled_fields is not None: service_model = self.client.meta.service_model shape = service_model.shape_for_error_code(service_error_code) self._validate_response(shape, modeled_fields) parsed_response.update(modeled_fields) operation_name = self.client.meta.method_to_api_mapping.get(method) # Note that we do not allow for expected_params while # adding errors into the queue yet. response = { 'operation_name': operation_name, 'response': (http_response, parsed_response), 'expected_params': expected_params, } self._queue.append(response) def assert_no_pending_responses(self): """ Asserts that all expected calls were made. """ remaining = len(self._queue) if remaining != 0: raise AssertionError(f"{remaining} responses remaining in queue.") def _assert_expected_call_order(self, model, params): if not self._queue: raise UnStubbedResponseError( operation_name=model.name, reason=( 'Unexpected API Call: A call was made but no additional ' 'calls expected. Either the API Call was not stubbed or ' 'it was called multiple times.' ), ) name = self._queue[0]['operation_name'] if name != model.name: raise StubResponseError( operation_name=model.name, reason=f'Operation mismatch: found response for {name}.', ) def _get_response_handler(self, model, params, context, kwargs): self._assert_expected_call_order(model, params) # Pop off the entire response once everything has been validated return self._queue.popleft()['response'] def _assert_expected_params(self, model, params, context, kwargs): if self._should_not_stub(context): return self._assert_expected_call_order(model, params) expected_params = self._queue[0]['expected_params'] if expected_params is None: return # Validate the parameters are equal for param, value in expected_params.items(): if param not in params or expected_params[param] != params[param]: raise StubAssertionError( operation_name=model.name, reason=( f'Expected parameters:\n{pformat(expected_params)},\n' f'but received:\n{pformat(params)}' ), ) # Ensure there are no extra params hanging around if sorted(expected_params.keys()) != sorted(params.keys()): raise StubAssertionError( operation_name=model.name, reason=( f'Expected parameters:\n{pformat(expected_params)},\n' f'but received:\n{pformat(params)}' ), ) def _should_not_stub(self, context): # Do not include presign requests when processing stubbed client calls # as a presign request will never have an HTTP request sent over the # wire for it and therefore not receive a response back. if context and context.get('is_presign_request'): return True def _validate_operation_response(self, operation_name, service_response): service_model = self.client.meta.service_model operation_model = service_model.operation_model(operation_name) output_shape = operation_model.output_shape # Remove ResponseMetadata so that the validator doesn't attempt to # perform validation on it. response = service_response if 'ResponseMetadata' in response: response = copy.copy(service_response) del response['ResponseMetadata'] self._validate_response(output_shape, response) def _validate_response(self, shape, response): if shape is not None: validate_parameters(response, shape) elif response: # If the output shape is None, that means the response should be # empty apart from ResponseMetadata raise ParamValidationError( report=( "Service response should only contain ResponseMetadata." ) )	14.88 KB	2025-05-25 12:26
📄 tokens.py # Copyright 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import json import logging import os import threading from datetime import datetime, timedelta from typing import NamedTuple, Optional import dateutil.parser from dateutil.tz import tzutc from botocore import UNSIGNED from botocore.compat import total_seconds from botocore.config import Config from botocore.exceptions import ( ClientError, InvalidConfigError, TokenRetrievalError, ) from botocore.utils import CachedProperty, JSONFileCache, SSOTokenLoader logger = logging.getLogger(__name__) def _utc_now(): return datetime.now(tzutc()) def create_token_resolver(session): providers = [ SSOTokenProvider(session), ] return TokenProviderChain(providers=providers) def _serialize_utc_timestamp(obj): if isinstance(obj, datetime): return obj.strftime("%Y-%m-%dT%H:%M:%SZ") return obj def _sso_json_dumps(obj): return json.dumps(obj, default=_serialize_utc_timestamp) class FrozenAuthToken(NamedTuple): token: str expiration: Optional[datetime] = None class DeferredRefreshableToken: # The time at which we'll attempt to refresh, but not block if someone else # is refreshing. _advisory_refresh_timeout = 15 * 60 # The time at which all threads will block waiting for a refreshed token _mandatory_refresh_timeout = 10 * 60 # Refresh at most once every minute to avoid blocking every request _attempt_timeout = 60 def __init__(self, method, refresh_using, time_fetcher=_utc_now): self._time_fetcher = time_fetcher self._refresh_using = refresh_using self.method = method # The frozen token is protected by this lock self._refresh_lock = threading.Lock() self._frozen_token = None self._next_refresh = None def get_frozen_token(self): self._refresh() return self._frozen_token def _refresh(self): # If we don't need to refresh just return refresh_type = self._should_refresh() if not refresh_type: return None # Block for refresh if we're in the mandatory refresh window block_for_refresh = refresh_type == "mandatory" if self._refresh_lock.acquire(block_for_refresh): try: self._protected_refresh() finally: self._refresh_lock.release() def _protected_refresh(self): # This should only be called after acquiring the refresh lock # Another thread may have already refreshed, double check refresh refresh_type = self._should_refresh() if not refresh_type: return None try: now = self._time_fetcher() self._next_refresh = now + timedelta(seconds=self._attempt_timeout) self._frozen_token = self._refresh_using() except Exception: logger.warning( "Refreshing token failed during the %s refresh period.", refresh_type, exc_info=True, ) if refresh_type == "mandatory": # This refresh was mandatory, error must be propagated back raise if self._is_expired(): # Fresh credentials should never be expired raise TokenRetrievalError( provider=self.method, error_msg="Token has expired and refresh failed", ) def _is_expired(self): if self._frozen_token is None: return False expiration = self._frozen_token.expiration remaining = total_seconds(expiration - self._time_fetcher()) return remaining <= 0 def _should_refresh(self): if self._frozen_token is None: # We don't have a token yet, mandatory refresh return "mandatory" expiration = self._frozen_token.expiration if expiration is None: # No expiration, so assume we don't need to refresh. return None now = self._time_fetcher() if now < self._next_refresh: return None remaining = total_seconds(expiration - now) if remaining < self._mandatory_refresh_timeout: return "mandatory" elif remaining < self._advisory_refresh_timeout: return "advisory" return None class TokenProviderChain: def __init__(self, providers=None): if providers is None: providers = [] self._providers = providers def load_token(self): for provider in self._providers: token = provider.load_token() if token is not None: return token return None class SSOTokenProvider: METHOD = "sso" _REFRESH_WINDOW = 15 * 60 _SSO_TOKEN_CACHE_DIR = os.path.expanduser( os.path.join("~", ".aws", "sso", "cache") ) _SSO_CONFIG_VARS = [ "sso_start_url", "sso_region", ] _GRANT_TYPE = "refresh_token" DEFAULT_CACHE_CLS = JSONFileCache def __init__( self, session, cache=None, time_fetcher=_utc_now, profile_name=None ): self._session = session if cache is None: cache = self.DEFAULT_CACHE_CLS( self._SSO_TOKEN_CACHE_DIR, dumps_func=_sso_json_dumps, ) self._now = time_fetcher self._cache = cache self._token_loader = SSOTokenLoader(cache=self._cache) self._profile_name = ( profile_name or self._session.get_config_variable("profile") or 'default' ) def _load_sso_config(self): loaded_config = self._session.full_config profiles = loaded_config.get("profiles", {}) sso_sessions = loaded_config.get("sso_sessions", {}) profile_config = profiles.get(self._profile_name, {}) if "sso_session" not in profile_config: return sso_session_name = profile_config["sso_session"] sso_config = sso_sessions.get(sso_session_name, None) if not sso_config: error_msg = ( f'The profile "{self._profile_name}" is configured to use the SSO ' f'token provider but the "{sso_session_name}" sso_session ' f"configuration does not exist." ) raise InvalidConfigError(error_msg=error_msg) missing_configs = [] for var in self._SSO_CONFIG_VARS: if var not in sso_config: missing_configs.append(var) if missing_configs: error_msg = ( f'The profile "{self._profile_name}" is configured to use the SSO ' f"token provider but is missing the following configuration: " f"{missing_configs}." ) raise InvalidConfigError(error_msg=error_msg) return { "session_name": sso_session_name, "sso_region": sso_config["sso_region"], "sso_start_url": sso_config["sso_start_url"], } @CachedProperty def _sso_config(self): return self._load_sso_config() @CachedProperty def _client(self): config = Config( region_name=self._sso_config["sso_region"], signature_version=UNSIGNED, ) return self._session.create_client("sso-oidc", config=config) def _attempt_create_token(self, token): response = self._client.create_token( grantType=self._GRANT_TYPE, clientId=token["clientId"], clientSecret=token["clientSecret"], refreshToken=token["refreshToken"], ) expires_in = timedelta(seconds=response["expiresIn"]) new_token = { "startUrl": self._sso_config["sso_start_url"], "region": self._sso_config["sso_region"], "accessToken": response["accessToken"], "expiresAt": self._now() + expires_in, # Cache the registration alongside the token "clientId": token["clientId"], "clientSecret": token["clientSecret"], "registrationExpiresAt": token["registrationExpiresAt"], } if "refreshToken" in response: new_token["refreshToken"] = response["refreshToken"] logger.info("SSO Token refresh succeeded") return new_token def _refresh_access_token(self, token): keys = ( "refreshToken", "clientId", "clientSecret", "registrationExpiresAt", ) missing_keys = [k for k in keys if k not in token] if missing_keys: msg = f"Unable to refresh SSO token: missing keys: {missing_keys}" logger.info(msg) return None expiry = dateutil.parser.parse(token["registrationExpiresAt"]) if total_seconds(expiry - self._now()) <= 0: logger.info(f"SSO token registration expired at {expiry}") return None try: return self._attempt_create_token(token) except ClientError: logger.warning("SSO token refresh attempt failed", exc_info=True) return None def _refresher(self): start_url = self._sso_config["sso_start_url"] session_name = self._sso_config["session_name"] logger.info(f"Loading cached SSO token for {session_name}") token_dict = self._token_loader(start_url, session_name=session_name) expiration = dateutil.parser.parse(token_dict["expiresAt"]) logger.debug(f"Cached SSO token expires at {expiration}") remaining = total_seconds(expiration - self._now()) if remaining < self._REFRESH_WINDOW: new_token_dict = self._refresh_access_token(token_dict) if new_token_dict is not None: token_dict = new_token_dict expiration = token_dict["expiresAt"] self._token_loader.save_token( start_url, token_dict, session_name=session_name ) return FrozenAuthToken( token_dict["accessToken"], expiration=expiration ) def load_token(self): if self._sso_config is None: return None return DeferredRefreshableToken( self.METHOD, self._refresher, time_fetcher=self._now )	10.65 KB	2025-05-25 12:26
📄 translate.py # Copyright (c) 2012-2013 Mitch Garnaat http://garnaat.org/ # Copyright 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import copy from botocore.utils import merge_dicts def build_retry_config( endpoint_prefix, retry_model, definitions, client_retry_config=None ): service_config = retry_model.get(endpoint_prefix, {}) resolve_references(service_config, definitions) # We want to merge the global defaults with the service specific # defaults, with the service specific defaults taking precedence. # So we use the global defaults as the base. # # A deepcopy is done on the retry defaults because it ensures the # retry model has no chance of getting mutated when the service specific # configuration or client retry config is merged in. final_retry_config = { '__default__': copy.deepcopy(retry_model.get('__default__', {})) } resolve_references(final_retry_config, definitions) # The merge the service specific config on top. merge_dicts(final_retry_config, service_config) if client_retry_config is not None: _merge_client_retry_config(final_retry_config, client_retry_config) return final_retry_config def _merge_client_retry_config(retry_config, client_retry_config): max_retry_attempts_override = client_retry_config.get('max_attempts') if max_retry_attempts_override is not None: # In the retry config, the max_attempts refers to the maximum number # of requests in general will be made. However, for the client's # retry config it refers to how many retry attempts will be made at # most. So to translate this number from the client config, one is # added to convert it to the maximum number request that will be made # by including the initial request. # # It is also important to note that if we ever support per operation # configuration in the retry model via the client, we will need to # revisit this logic to make sure max_attempts gets applied # per operation. retry_config['__default__']['max_attempts'] = ( max_retry_attempts_override + 1 ) def resolve_references(config, definitions): """Recursively replace $ref keys. To cut down on duplication, common definitions can be declared (and passed in via the ``definitions`` attribute) and then references as {"$ref": "name"}, when this happens the reference dict is placed with the value from the ``definition`` dict. This is recursively done. """ for key, value in config.items(): if isinstance(value, dict): if len(value) == 1 and list(value.keys())[0] == '$ref': # Then we need to resolve this reference. config[key] = definitions[list(value.values())[0]] else: resolve_references(value, definitions)	3.33 KB	2025-05-25 12:26
📄 useragent.py # Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. """ NOTE: All classes and functions in this module are considered private and are subject to abrupt breaking changes. Please do not use them directly. To modify the User-Agent header sent by botocore, use one of these configuration options: * The ``AWS_SDK_UA_APP_ID`` environment variable. * The ``sdk_ua_app_id`` setting in the shared AWS config file. * The ``user_agent_appid`` field in the :py:class:`botocore.config.Config`. * The ``user_agent_extra`` field in the :py:class:`botocore.config.Config`. """ import logging import os import platform from copy import copy from string import ascii_letters, digits from typing import NamedTuple, Optional from botocore import __version__ as botocore_version from botocore.compat import HAS_CRT from botocore.context import get_context logger = logging.getLogger(__name__) _USERAGENT_ALLOWED_CHARACTERS = ascii_letters + digits + "!$%&'+-.^_`\|~," _USERAGENT_ALLOWED_OS_NAMES = ( 'windows', 'linux', 'macos', 'android', 'ios', 'watchos', 'tvos', 'other', ) _USERAGENT_PLATFORM_NAME_MAPPINGS = {'darwin': 'macos'} # The name by which botocore is identified in the User-Agent header. While most # AWS SDKs follow a naming pattern of "aws-sdk-", botocore and boto3 continue # using their existing values. Uses uppercase "B" with all other characters # lowercase. _USERAGENT_SDK_NAME = 'Botocore' _USERAGENT_FEATURE_MAPPINGS = { 'WAITER': 'B', 'PAGINATOR': 'C', 'S3_TRANSFER': 'G', 'PROTOCOL_RPC_V2_CBOR': 'M', 'ENDPOINT_OVERRIDE': 'N', 'ACCOUNT_ID_MODE_PREFERRED': 'P', 'ACCOUNT_ID_MODE_DISABLED': 'Q', 'ACCOUNT_ID_MODE_REQUIRED': 'R', 'SIGV4A_SIGNING': 'S', 'FLEXIBLE_CHECKSUMS_REQ_CRC32': 'U', 'FLEXIBLE_CHECKSUMS_REQ_CRC32C': 'V', 'FLEXIBLE_CHECKSUMS_REQ_CRC64': 'W', 'FLEXIBLE_CHECKSUMS_REQ_SHA1': 'X', 'FLEXIBLE_CHECKSUMS_REQ_SHA256': 'Y', 'FLEXIBLE_CHECKSUMS_REQ_WHEN_SUPPORTED': 'Z', 'FLEXIBLE_CHECKSUMS_REQ_WHEN_REQUIRED': 'a', 'FLEXIBLE_CHECKSUMS_RES_WHEN_SUPPORTED': 'b', 'FLEXIBLE_CHECKSUMS_RES_WHEN_REQUIRED': 'c', 'RESOLVED_ACCOUNT_ID': 'T', } def register_feature_id(feature_id): """Adds metric value to the current context object's ``features`` set. :type feature_id: str :param feature_id: The name of the feature to register. Value must be a key in the ``_USERAGENT_FEATURE_MAPPINGS`` dict. """ ctx = get_context() if ctx is None: # Never register features outside the scope of a # ``botocore.context.start_as_current_context`` context manager. # Otherwise, the context variable won't be reset and features will # bleed into all subsequent requests. Return instead of raising an # exception since this function could be invoked in a public interface. return if val := _USERAGENT_FEATURE_MAPPINGS.get(feature_id): ctx.features.add(val) def sanitize_user_agent_string_component(raw_str, allow_hash): """Replaces all not allowed characters in the string with a dash ("-"). Allowed characters are ASCII alphanumerics and ``!$%&'+-.^_`\|~,``. If ``allow_hash`` is ``True``, "#"``" is also allowed. :type raw_str: str :param raw_str: The input string to be sanitized. :type allow_hash: bool :param allow_hash: Whether "#" is considered an allowed character. """ return ''.join( c if c in _USERAGENT_ALLOWED_CHARACTERS or (allow_hash and c == '#') else '-' for c in raw_str ) class UserAgentComponentSizeConfig: """ Configures the max size of a built user agent string component and the delimiter used to truncate the string if the size is above the max. """ def __init__(self, max_size_in_bytes: int, delimiter: str): self.max_size_in_bytes = max_size_in_bytes self.delimiter = delimiter self._validate_input() def _validate_input(self): if self.max_size_in_bytes < 1: raise ValueError( f'Invalid `max_size_in_bytes`: {self.max_size_in_bytes}. ' 'Value must be a positive integer.' ) class UserAgentComponent(NamedTuple): """ Component of a Botocore User-Agent header string in the standard format. Each component consists of a prefix, a name, a value, and a size_config. In the string representation these are combined in the format ``prefix/name#value``. ``size_config`` configures the max size and truncation strategy for the built user agent string component. This class is considered private and is subject to abrupt breaking changes. """ prefix: str name: str value: Optional[str] = None size_config: Optional[UserAgentComponentSizeConfig] = None def to_string(self): """Create string like 'prefix/name#value' from a UserAgentComponent.""" clean_prefix = sanitize_user_agent_string_component( self.prefix, allow_hash=True ) clean_name = sanitize_user_agent_string_component( self.name, allow_hash=False ) if self.value is None or self.value == '': clean_string = f'{clean_prefix}/{clean_name}' else: clean_value = sanitize_user_agent_string_component( self.value, allow_hash=True ) clean_string = f'{clean_prefix}/{clean_name}#{clean_value}' if self.size_config is not None: clean_string = self._truncate_string( clean_string, self.size_config.max_size_in_bytes, self.size_config.delimiter, ) return clean_string def _truncate_string(self, string, max_size, delimiter): """ Pop ``delimiter``-separated values until encoded string is less than or equal to ``max_size``. """ orig = string while len(string.encode('utf-8')) > max_size: parts = string.split(delimiter) parts.pop() string = delimiter.join(parts) if string == '': logger.debug( f"User agent component `{orig}` could not be truncated to " f"`{max_size}` bytes with delimiter " f"`{delimiter}` without losing all contents. " f"Value will be omitted from user agent string." ) return string class RawStringUserAgentComponent: """ UserAgentComponent interface wrapper around ``str``. Use for User-Agent header components that are not constructed from prefix+name+value but instead are provided as strings. No sanitization is performed. """ def __init__(self, value): self._value = value def to_string(self): return self._value # This is not a public interface and is subject to abrupt breaking changes. # Any usage is not advised or supported in external code bases. try: from botocore.customizations.useragent import modify_components except ImportError: # Default implementation that returns unmodified User-Agent components. def modify_components(components): return components class UserAgentString: """ Generator for AWS SDK User-Agent header strings. The User-Agent header format contains information from session, client, and request context. ``UserAgentString`` provides methods for collecting the information and ``to_string`` for assembling it into the standardized string format. Example usage: ua_session = UserAgentString.from_environment() ua_session.set_session_config(...) ua_client = ua_session.with_client_config(Config(...)) ua_string = ua_request.to_string() For testing or when information from all sources is available at the same time, the methods can be chained: ua_string = ( UserAgentString .from_environment() .set_session_config(...) .with_client_config(Config(...)) .to_string() ) """ def __init__( self, platform_name, platform_version, platform_machine, python_version, python_implementation, execution_env, crt_version=None, ): """ :type platform_name: str :param platform_name: Name of the operating system or equivalent platform name. Should be sourced from :py:meth:`platform.system`. :type platform_version: str :param platform_version: Version of the operating system or equivalent platform name. Should be sourced from :py:meth:`platform.version`. :type platform_machine: str :param platform_version: Processor architecture or machine type. For example "x86_64". Should be sourced from :py:meth:`platform.machine`. :type python_version: str :param python_version: Version of the python implementation as str. Should be sourced from :py:meth:`platform.python_version`. :type python_implementation: str :param python_implementation: Name of the python implementation. Should be sourced from :py:meth:`platform.python_implementation`. :type execution_env: str :param execution_env: The value of the AWS execution environment. Should be sourced from the ``AWS_EXECUTION_ENV` environment variable. :type crt_version: str :param crt_version: Version string of awscrt package, if installed. """ self._platform_name = platform_name self._platform_version = platform_version self._platform_machine = platform_machine self._python_version = python_version self._python_implementation = python_implementation self._execution_env = execution_env self._crt_version = crt_version # Components that can be added with ``set_session_config()`` self._session_user_agent_name = None self._session_user_agent_version = None self._session_user_agent_extra = None self._client_config = None # Component that can be set with ``set_client_features()`` self._client_features = None @classmethod def from_environment(cls): crt_version = None if HAS_CRT: crt_version = _get_crt_version() or 'Unknown' return cls( platform_name=platform.system(), platform_version=platform.release(), platform_machine=platform.machine(), python_version=platform.python_version(), python_implementation=platform.python_implementation(), execution_env=os.environ.get('AWS_EXECUTION_ENV'), crt_version=crt_version, ) def set_session_config( self, session_user_agent_name, session_user_agent_version, session_user_agent_extra, ): """ Set the user agent configuration values that apply at session level. :param user_agent_name: The user agent name configured in the :py:class:`botocore.session.Session` object. For backwards compatibility, this will always be at the beginning of the User-Agent string, together with ``user_agent_version``. :param user_agent_version: The user agent version configured in the :py:class:`botocore.session.Session` object. :param user_agent_extra: The user agent "extra" configured in the :py:class:`botocore.session.Session` object. """ self._session_user_agent_name = session_user_agent_name self._session_user_agent_version = session_user_agent_version self._session_user_agent_extra = session_user_agent_extra return self def set_client_features(self, features): """ Persist client-specific features registered before or during client creation. :type features: Set[str] :param features: A set of client-specific features. """ self._client_features = features def with_client_config(self, client_config): """ Create a copy with all original values and client-specific values. :type client_config: botocore.config.Config :param client_config: The client configuration object. """ cp = copy(self) cp._client_config = client_config return cp def to_string(self): """ Build User-Agent header string from the object's properties. """ config_ua_override = None if self._client_config: if hasattr(self._client_config, '_supplied_user_agent'): config_ua_override = self._client_config._supplied_user_agent else: config_ua_override = self._client_config.user_agent if config_ua_override is not None: return self._build_legacy_ua_string(config_ua_override) components = [ self._build_sdk_metadata(), RawStringUserAgentComponent('ua/2.1'), self._build_os_metadata(), self._build_architecture_metadata(), self._build_language_metadata(), self._build_execution_env_metadata(), self._build_feature_metadata(), self._build_config_metadata(), self._build_app_id(), self._build_extra(), ] components = modify_components(components) return ' '.join( [comp.to_string() for comp in components if comp.to_string()] ) def _build_sdk_metadata(self): """ Build the SDK name and version component of the User-Agent header. For backwards-compatibility both session-level and client-level config of custom tool names are honored. If this removes the Botocore information from the start of the string, Botocore's name and version are included as a separate field with "md" prefix. """ sdk_md = [] if ( self._session_user_agent_name and self._session_user_agent_version and ( self._session_user_agent_name != _USERAGENT_SDK_NAME or self._session_user_agent_version != botocore_version ) ): sdk_md.extend( [ UserAgentComponent( self._session_user_agent_name, self._session_user_agent_version, ), UserAgentComponent( 'md', _USERAGENT_SDK_NAME, botocore_version ), ] ) else: sdk_md.append( UserAgentComponent(_USERAGENT_SDK_NAME, botocore_version) ) if self._crt_version is not None: sdk_md.append( UserAgentComponent('md', 'awscrt', self._crt_version) ) return sdk_md def _build_os_metadata(self): """ Build the OS/platform components of the User-Agent header string. For recognized platform names that match or map to an entry in the list of standardized OS names, a single component with prefix "os" is returned. Otherwise, one component "os/other" is returned and a second with prefix "md" and the raw platform name. String representations of example return values: * ``os/macos#10.13.6`` * ``os/linux`` * ``os/other`` * ``os/other md/foobar#1.2.3`` """ if self._platform_name is None: return [UserAgentComponent('os', 'other')] plt_name_lower = self._platform_name.lower() if plt_name_lower in _USERAGENT_ALLOWED_OS_NAMES: os_family = plt_name_lower elif plt_name_lower in _USERAGENT_PLATFORM_NAME_MAPPINGS: os_family = _USERAGENT_PLATFORM_NAME_MAPPINGS[plt_name_lower] else: os_family = None if os_family is not None: return [ UserAgentComponent('os', os_family, self._platform_version) ] else: return [ UserAgentComponent('os', 'other'), UserAgentComponent( 'md', self._platform_name, self._platform_version ), ] def _build_architecture_metadata(self): """ Build architecture component of the User-Agent header string. Returns the machine type with prefix "md" and name "arch", if one is available. Common values include "x86_64", "arm64", "i386". """ if self._platform_machine: return [ UserAgentComponent( 'md', 'arch', self._platform_machine.lower() ) ] return [] def _build_language_metadata(self): """ Build the language components of the User-Agent header string. Returns the Python version in a component with prefix "lang" and name "python". The Python implementation (e.g. CPython, PyPy) is returned as separate metadata component with prefix "md" and name "pyimpl". String representation of an example return value: ``lang/python#3.10.4 md/pyimpl#CPython`` """ lang_md = [ UserAgentComponent('lang', 'python', self._python_version), ] if self._python_implementation: lang_md.append( UserAgentComponent('md', 'pyimpl', self._python_implementation) ) return lang_md def _build_execution_env_metadata(self): """ Build the execution environment component of the User-Agent header. Returns a single component prefixed with "exec-env", usually sourced from the environment variable AWS_EXECUTION_ENV. """ if self._execution_env: return [UserAgentComponent('exec-env', self._execution_env)] else: return [] def _build_feature_metadata(self): """ Build the features component of the User-Agent header string. Returns a single component with prefix "m" followed by a list of comma-separated metric values. """ ctx = get_context() context_features = set() if ctx is None else ctx.features client_features = self._client_features or set() features = client_features.union(context_features) if not features: return [] size_config = UserAgentComponentSizeConfig(1024, ',') return [ UserAgentComponent( 'm', ','.join(features), size_config=size_config ) ] def _build_config_metadata(self): """ Build the configuration components of the User-Agent header string. Returns a list of components with prefix "cfg" followed by the config setting name and its value. Tracked configuration settings may be added or removed in future versions. """ if not self._client_config or not self._client_config.retries: return [] retry_mode = self._client_config.retries.get('mode') cfg_md = [UserAgentComponent('cfg', 'retry-mode', retry_mode)] if self._client_config.endpoint_discovery_enabled: cfg_md.append(UserAgentComponent('cfg', 'endpoint-discovery')) return cfg_md def _build_app_id(self): """ Build app component of the User-Agent header string. Returns a single component with prefix "app" and value sourced from the ``user_agent_appid`` field in :py:class:`botocore.config.Config` or the ``sdk_ua_app_id`` setting in the shared configuration file, or the ``AWS_SDK_UA_APP_ID`` environment variable. These are the recommended ways for apps built with Botocore to insert their identifer into the User-Agent header. """ if self._client_config and self._client_config.user_agent_appid: return [ UserAgentComponent('app', self._client_config.user_agent_appid) ] else: return [] def _build_extra(self): """User agent string components based on legacy "extra" settings. Creates components from the session-level and client-level ``user_agent_extra`` setting, if present. Both are passed through verbatim and should be appended at the end of the string. Preferred ways to inject application-specific information into botocore's User-Agent header string are the ``user_agent_appid` field in :py:class:`botocore.config.Config`. The ``AWS_SDK_UA_APP_ID`` environment variable and the ``sdk_ua_app_id`` configuration file setting are alternative ways to set the ``user_agent_appid`` config. """ extra = [] if self._session_user_agent_extra: extra.append( RawStringUserAgentComponent(self._session_user_agent_extra) ) if self._client_config and self._client_config.user_agent_extra: extra.append( RawStringUserAgentComponent( self._client_config.user_agent_extra ) ) return extra def _build_legacy_ua_string(self, config_ua_override): components = [config_ua_override] if self._session_user_agent_extra: components.append(self._session_user_agent_extra) if self._client_config.user_agent_extra: components.append(self._client_config.user_agent_extra) return ' '.join(components) def rebuild_and_replace_user_agent_handler( self, operation_name, request, **kwargs ): ua_string = self.to_string() if request.headers.get('User-Agent'): request.headers.replace_header('User-Agent', ua_string) def _get_crt_version(): """ This function is considered private and is subject to abrupt breaking changes. """ try: import awscrt return awscrt.__version__ except AttributeError: return None	22.3 KB	2025-05-25 12:26
📄 utils.py # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import base64 import binascii import datetime import email.message import functools import hashlib import io import logging import os import random import re import socket import time import warnings import weakref from datetime import datetime as _DatetimeClass from ipaddress import ip_address from pathlib import Path from urllib.request import getproxies, proxy_bypass import dateutil.parser from dateutil.tz import tzutc from urllib3.exceptions import LocationParseError import botocore import botocore.awsrequest import botocore.httpsession # IP Regexes retained for backwards compatibility from botocore.compat import HEX_PAT # noqa: F401 from botocore.compat import IPV4_PAT # noqa: F401 from botocore.compat import IPV6_ADDRZ_PAT # noqa: F401 from botocore.compat import IPV6_PAT # noqa: F401 from botocore.compat import LS32_PAT # noqa: F401 from botocore.compat import UNRESERVED_PAT # noqa: F401 from botocore.compat import ZONE_ID_PAT # noqa: F401 from botocore.compat import ( HAS_CRT, IPV4_RE, IPV6_ADDRZ_RE, MD5_AVAILABLE, UNSAFE_URL_CHARS, OrderedDict, get_md5, get_tzinfo_options, json, quote, urlparse, urlsplit, urlunsplit, zip_longest, ) from botocore.exceptions import ( ClientError, ConfigNotFound, ConnectionClosedError, ConnectTimeoutError, EndpointConnectionError, HTTPClientError, InvalidDNSNameError, InvalidEndpointConfigurationError, InvalidExpressionError, InvalidHostLabelError, InvalidIMDSEndpointError, InvalidIMDSEndpointModeError, InvalidRegionError, MetadataRetrievalError, MissingDependencyException, ReadTimeoutError, SSOTokenLoadError, UnsupportedOutpostResourceError, UnsupportedS3AccesspointConfigurationError, UnsupportedS3ArnError, UnsupportedS3ConfigurationError, UnsupportedS3ControlArnError, UnsupportedS3ControlConfigurationError, ) logger = logging.getLogger(__name__) DEFAULT_METADATA_SERVICE_TIMEOUT = 1 METADATA_BASE_URL = 'http://169.254.169.254/' METADATA_BASE_URL_IPv6 = 'http://[fd00:ec2::254]/' METADATA_ENDPOINT_MODES = ('ipv4', 'ipv6') # These are chars that do not need to be urlencoded. # Based on rfc2986, section 2.3 SAFE_CHARS = '-._~' LABEL_RE = re.compile(r'[a-z0-9][a-z0-9\-][a-z0-9]') RETRYABLE_HTTP_ERRORS = ( ReadTimeoutError, EndpointConnectionError, ConnectionClosedError, ConnectTimeoutError, ) S3_ACCELERATE_WHITELIST = ['dualstack'] # In switching events from using service name / endpoint prefix to service # id, we have to preserve compatibility. This maps the instances where either # is different than the transformed service id. EVENT_ALIASES = { "api.mediatailor": "mediatailor", "api.pricing": "pricing", "api.sagemaker": "sagemaker", "apigateway": "api-gateway", "application-autoscaling": "application-auto-scaling", "appstream2": "appstream", "autoscaling": "auto-scaling", "autoscaling-plans": "auto-scaling-plans", "ce": "cost-explorer", "cloudhsmv2": "cloudhsm-v2", "cloudsearchdomain": "cloudsearch-domain", "cognito-idp": "cognito-identity-provider", "config": "config-service", "cur": "cost-and-usage-report-service", "data.iot": "iot-data-plane", "data.jobs.iot": "iot-jobs-data-plane", "data.mediastore": "mediastore-data", "datapipeline": "data-pipeline", "devicefarm": "device-farm", "directconnect": "direct-connect", "discovery": "application-discovery-service", "dms": "database-migration-service", "ds": "directory-service", "dynamodbstreams": "dynamodb-streams", "elasticbeanstalk": "elastic-beanstalk", "elasticfilesystem": "efs", "elasticloadbalancing": "elastic-load-balancing", "elasticmapreduce": "emr", "elastictranscoder": "elastic-transcoder", "elb": "elastic-load-balancing", "elbv2": "elastic-load-balancing-v2", "email": "ses", "entitlement.marketplace": "marketplace-entitlement-service", "es": "elasticsearch-service", "events": "eventbridge", "cloudwatch-events": "eventbridge", "iot-data": "iot-data-plane", "iot-jobs-data": "iot-jobs-data-plane", "kinesisanalytics": "kinesis-analytics", "kinesisvideo": "kinesis-video", "lex-models": "lex-model-building-service", "lex-runtime": "lex-runtime-service", "logs": "cloudwatch-logs", "machinelearning": "machine-learning", "marketplace-entitlement": "marketplace-entitlement-service", "marketplacecommerceanalytics": "marketplace-commerce-analytics", "metering.marketplace": "marketplace-metering", "meteringmarketplace": "marketplace-metering", "mgh": "migration-hub", "models.lex": "lex-model-building-service", "monitoring": "cloudwatch", "mturk-requester": "mturk", "opsworks-cm": "opsworkscm", "resourcegroupstaggingapi": "resource-groups-tagging-api", "route53": "route-53", "route53domains": "route-53-domains", "runtime.lex": "lex-runtime-service", "runtime.sagemaker": "sagemaker-runtime", "sdb": "simpledb", "secretsmanager": "secrets-manager", "serverlessrepo": "serverlessapplicationrepository", "servicecatalog": "service-catalog", "states": "sfn", "stepfunctions": "sfn", "storagegateway": "storage-gateway", "streams.dynamodb": "dynamodb-streams", "tagging": "resource-groups-tagging-api", } # This pattern can be used to detect if a header is a flexible checksum header CHECKSUM_HEADER_PATTERN = re.compile( r'^X-Amz-Checksum-([a-z0-9])$', flags=re.IGNORECASE, ) def ensure_boolean(val): """Ensures a boolean value if a string or boolean is provided For strings, the value for True/False is case insensitive """ if isinstance(val, bool): return val elif isinstance(val, str): return val.lower() == 'true' else: return False def resolve_imds_endpoint_mode(session): """Resolving IMDS endpoint mode to either IPv6 or IPv4. ec2_metadata_service_endpoint_mode takes precedence over imds_use_ipv6. """ endpoint_mode = session.get_config_variable( 'ec2_metadata_service_endpoint_mode' ) if endpoint_mode is not None: lendpoint_mode = endpoint_mode.lower() if lendpoint_mode not in METADATA_ENDPOINT_MODES: error_msg_kwargs = { 'mode': endpoint_mode, 'valid_modes': METADATA_ENDPOINT_MODES, } raise InvalidIMDSEndpointModeError(*error_msg_kwargs) return lendpoint_mode elif session.get_config_variable('imds_use_ipv6'): return 'ipv6' return 'ipv4' def is_json_value_header(shape): """Determines if the provided shape is the special header type jsonvalue. :type shape: botocore.shape :param shape: Shape to be inspected for the jsonvalue trait. :return: True if this type is a jsonvalue, False otherwise :rtype: Bool """ return ( hasattr(shape, 'serialization') and shape.serialization.get('jsonvalue', False) and shape.serialization.get('location') == 'header' and shape.type_name == 'string' ) def has_header(header_name, headers): """Case-insensitive check for header key.""" if header_name is None: return False elif isinstance(headers, botocore.awsrequest.HeadersDict): return header_name in headers else: return header_name.lower() in [key.lower() for key in headers.keys()] def get_service_module_name(service_model): """Returns the module name for a service This is the value used in both the documentation and client class name """ name = service_model.metadata.get( 'serviceAbbreviation', service_model.metadata.get( 'serviceFullName', service_model.service_name ), ) name = name.replace('Amazon', '') name = name.replace('AWS', '') name = re.sub(r'\W+', '', name) return name def normalize_url_path(path): if not path: return '/' return remove_dot_segments(path) def normalize_boolean(val): """Returns None if val is None, otherwise ensure value converted to boolean""" if val is None: return val else: return ensure_boolean(val) def remove_dot_segments(url): # RFC 3986, section 5.2.4 "Remove Dot Segments" # Also, AWS services require consecutive slashes to be removed, # so that's done here as well if not url: return '' input_url = url.split('/') output_list = [] for x in input_url: if x and x != '.': if x == '..': if output_list: output_list.pop() else: output_list.append(x) if url[0] == '/': first = '/' else: first = '' if url[-1] == '/' and output_list: last = '/' else: last = '' return first + '/'.join(output_list) + last def validate_jmespath_for_set(expression): # Validates a limited jmespath expression to determine if we can set a # value based on it. Only works with dotted paths. if not expression or expression == '.': raise InvalidExpressionError(expression=expression) for invalid in ['[', ']', '']: if invalid in expression: raise InvalidExpressionError(expression=expression) def set_value_from_jmespath(source, expression, value, is_first=True): # This takes a (limited) jmespath-like expression & can set a value based # on it. # Limitations: # * Only handles dotted lookups # * No offsets/wildcards/slices/etc. if is_first: validate_jmespath_for_set(expression) bits = expression.split('.', 1) current_key, remainder = bits[0], bits[1] if len(bits) > 1 else '' if not current_key: raise InvalidExpressionError(expression=expression) if remainder: if current_key not in source: # We've got something in the expression that's not present in the # source (new key). If there's any more bits, we'll set the key # with an empty dictionary. source[current_key] = {} return set_value_from_jmespath( source[current_key], remainder, value, is_first=False ) # If we're down to a single key, set it. source[current_key] = value def is_global_accesspoint(context): """Determine if request is intended for an MRAP accesspoint.""" s3_accesspoint = context.get('s3_accesspoint', {}) is_global = s3_accesspoint.get('region') == '' return is_global class _RetriesExceededError(Exception): """Internal exception used when the number of retries are exceeded.""" pass class BadIMDSRequestError(Exception): def __init__(self, request): self.request = request class IMDSFetcher: _RETRIES_EXCEEDED_ERROR_CLS = _RetriesExceededError _TOKEN_PATH = 'latest/api/token' _TOKEN_TTL = '21600' def __init__( self, timeout=DEFAULT_METADATA_SERVICE_TIMEOUT, num_attempts=1, base_url=METADATA_BASE_URL, env=None, user_agent=None, config=None, ): self._timeout = timeout self._num_attempts = num_attempts if config is None: config = {} self._base_url = self._select_base_url(base_url, config) self._config = config if env is None: env = os.environ.copy() self._disabled = ( env.get('AWS_EC2_METADATA_DISABLED', 'false').lower() == 'true' ) self._imds_v1_disabled = config.get('ec2_metadata_v1_disabled') self._user_agent = user_agent self._session = botocore.httpsession.URLLib3Session( timeout=self._timeout, proxies=get_environ_proxies(self._base_url), ) def get_base_url(self): return self._base_url def _select_base_url(self, base_url, config): if config is None: config = {} requires_ipv6 = ( config.get('ec2_metadata_service_endpoint_mode') == 'ipv6' ) custom_metadata_endpoint = config.get('ec2_metadata_service_endpoint') if requires_ipv6 and custom_metadata_endpoint: logger.warning( "Custom endpoint and IMDS_USE_IPV6 are both set. Using custom endpoint." ) chosen_base_url = None if base_url != METADATA_BASE_URL: chosen_base_url = base_url elif custom_metadata_endpoint: chosen_base_url = custom_metadata_endpoint elif requires_ipv6: chosen_base_url = METADATA_BASE_URL_IPv6 else: chosen_base_url = METADATA_BASE_URL logger.debug(f"IMDS ENDPOINT: {chosen_base_url}") if not is_valid_uri(chosen_base_url): raise InvalidIMDSEndpointError(endpoint=chosen_base_url) return chosen_base_url def _construct_url(self, path): sep = '' if self._base_url and not self._base_url.endswith('/'): sep = '/' return f'{self._base_url}{sep}{path}' def _fetch_metadata_token(self): self._assert_enabled() url = self._construct_url(self._TOKEN_PATH) headers = { 'x-aws-ec2-metadata-token-ttl-seconds': self._TOKEN_TTL, } self._add_user_agent(headers) request = botocore.awsrequest.AWSRequest( method='PUT', url=url, headers=headers ) for i in range(self._num_attempts): try: response = self._session.send(request.prepare()) if response.status_code == 200: return response.text elif response.status_code in (404, 403, 405): return None elif response.status_code in (400,): raise BadIMDSRequestError(request) except ReadTimeoutError: return None except RETRYABLE_HTTP_ERRORS as e: logger.debug( "Caught retryable HTTP exception while making metadata " "service request to %s: %s", url, e, exc_info=True, ) except HTTPClientError as e: if isinstance(e.kwargs.get('error'), LocationParseError): raise InvalidIMDSEndpointError(endpoint=url, error=e) else: raise return None def _get_request(self, url_path, retry_func, token=None): """Make a get request to the Instance Metadata Service. :type url_path: str :param url_path: The path component of the URL to make a get request. This arg is appended to the base_url that was provided in the initializer. :type retry_func: callable :param retry_func: A function that takes the response as an argument and determines if it needs to retry. By default empty and non 200 OK responses are retried. :type token: str :param token: Metadata token to send along with GET requests to IMDS. """ self._assert_enabled() if not token: self._assert_v1_enabled() if retry_func is None: retry_func = self._default_retry url = self._construct_url(url_path) headers = {} if token is not None: headers['x-aws-ec2-metadata-token'] = token self._add_user_agent(headers) for i in range(self._num_attempts): try: request = botocore.awsrequest.AWSRequest( method='GET', url=url, headers=headers ) response = self._session.send(request.prepare()) if not retry_func(response): return response except RETRYABLE_HTTP_ERRORS as e: logger.debug( "Caught retryable HTTP exception while making metadata " "service request to %s: %s", url, e, exc_info=True, ) raise self._RETRIES_EXCEEDED_ERROR_CLS() def _add_user_agent(self, headers): if self._user_agent is not None: headers['User-Agent'] = self._user_agent def _assert_enabled(self): if self._disabled: logger.debug("Access to EC2 metadata has been disabled.") raise self._RETRIES_EXCEEDED_ERROR_CLS() def _assert_v1_enabled(self): if self._imds_v1_disabled: raise MetadataRetrievalError( error_msg="Unable to retrieve token for use in IMDSv2 call and IMDSv1 has been disabled" ) def _default_retry(self, response): return self._is_non_ok_response(response) or self._is_empty(response) def _is_non_ok_response(self, response): if response.status_code != 200: self._log_imds_response(response, 'non-200', log_body=True) return True return False def _is_empty(self, response): if not response.content: self._log_imds_response(response, 'no body', log_body=True) return True return False def _log_imds_response(self, response, reason_to_log, log_body=False): statement = ( "Metadata service returned %s response " "with status code of %s for url: %s" ) logger_args = [reason_to_log, response.status_code, response.url] if log_body: statement += ", content body: %s" logger_args.append(response.content) logger.debug(statement, logger_args) class InstanceMetadataFetcher(IMDSFetcher): _URL_PATH = 'latest/meta-data/iam/security-credentials/' _REQUIRED_CREDENTIAL_FIELDS = [ 'AccessKeyId', 'SecretAccessKey', 'Token', 'Expiration', ] def retrieve_iam_role_credentials(self): try: token = self._fetch_metadata_token() role_name = self._get_iam_role(token) credentials = self._get_credentials(role_name, token) if self._contains_all_credential_fields(credentials): credentials = { 'role_name': role_name, 'access_key': credentials['AccessKeyId'], 'secret_key': credentials['SecretAccessKey'], 'token': credentials['Token'], 'expiry_time': credentials['Expiration'], } self._evaluate_expiration(credentials) return credentials else: # IMDS can return a 200 response that has a JSON formatted # error message (i.e. if ec2 is not trusted entity for the # attached role). We do not necessarily want to retry for # these and we also do not necessarily want to raise a key # error. So at least log the problematic response and return # an empty dictionary to signal that it was not able to # retrieve credentials. These error will contain both a # Code and Message key. if 'Code' in credentials and 'Message' in credentials: logger.debug( 'Error response received when retrieving' 'credentials: %s.', credentials, ) return {} except self._RETRIES_EXCEEDED_ERROR_CLS: logger.debug( "Max number of attempts exceeded (%s) when " "attempting to retrieve data from metadata service.", self._num_attempts, ) except BadIMDSRequestError as e: logger.debug("Bad IMDS request: %s", e.request) return {} def _get_iam_role(self, token=None): return self._get_request( url_path=self._URL_PATH, retry_func=self._needs_retry_for_role_name, token=token, ).text def _get_credentials(self, role_name, token=None): r = self._get_request( url_path=self._URL_PATH + role_name, retry_func=self._needs_retry_for_credentials, token=token, ) return json.loads(r.text) def _is_invalid_json(self, response): try: json.loads(response.text) return False except ValueError: self._log_imds_response(response, 'invalid json') return True def _needs_retry_for_role_name(self, response): return self._is_non_ok_response(response) or self._is_empty(response) def _needs_retry_for_credentials(self, response): return ( self._is_non_ok_response(response) or self._is_empty(response) or self._is_invalid_json(response) ) def _contains_all_credential_fields(self, credentials): for field in self._REQUIRED_CREDENTIAL_FIELDS: if field not in credentials: logger.debug( 'Retrieved credentials is missing required field: %s', field, ) return False return True def _evaluate_expiration(self, credentials): expiration = credentials.get("expiry_time") if expiration is None: return try: expiration = datetime.datetime.strptime( expiration, "%Y-%m-%dT%H:%M:%SZ" ) refresh_interval = self._config.get( "ec2_credential_refresh_window", 60 10 ) jitter = random.randint(120, 600) # Between 2 to 10 minutes refresh_interval_with_jitter = refresh_interval + jitter current_time = datetime.datetime.utcnow() refresh_offset = datetime.timedelta( seconds=refresh_interval_with_jitter ) extension_time = expiration - refresh_offset if current_time >= extension_time: new_time = current_time + refresh_offset credentials["expiry_time"] = new_time.strftime( "%Y-%m-%dT%H:%M:%SZ" ) logger.info( f"Attempting credential expiration extension due to a " f"credential service availability issue. A refresh of " f"these credentials will be attempted again within " f"the next {refresh_interval_with_jitter/60:.0f} minutes." ) except ValueError: logger.debug( f"Unable to parse expiry_time in {credentials['expiry_time']}" ) class IMDSRegionProvider: def __init__(self, session, environ=None, fetcher=None): """Initialize IMDSRegionProvider. :type session: :class:`botocore.session.Session` :param session: The session is needed to look up configuration for how to contact the instance metadata service. Specifically the whether or not it should use the IMDS region at all, and if so how to configure the timeout and number of attempts to reach the service. :type environ: None or dict :param environ: A dictionary of environment variables to use. If ``None`` is the argument then ``os.environ`` will be used by default. :type fecther: :class:`botocore.utils.InstanceMetadataRegionFetcher` :param fetcher: The class to actually handle the fetching of the region from the IMDS. If not provided a default one will be created. """ self._session = session if environ is None: environ = os.environ self._environ = environ self._fetcher = fetcher def provide(self): """Provide the region value from IMDS.""" instance_region = self._get_instance_metadata_region() return instance_region def _get_instance_metadata_region(self): fetcher = self._get_fetcher() region = fetcher.retrieve_region() return region def _get_fetcher(self): if self._fetcher is None: self._fetcher = self._create_fetcher() return self._fetcher def _create_fetcher(self): metadata_timeout = self._session.get_config_variable( 'metadata_service_timeout' ) metadata_num_attempts = self._session.get_config_variable( 'metadata_service_num_attempts' ) imds_config = { 'ec2_metadata_service_endpoint': self._session.get_config_variable( 'ec2_metadata_service_endpoint' ), 'ec2_metadata_service_endpoint_mode': resolve_imds_endpoint_mode( self._session ), 'ec2_metadata_v1_disabled': self._session.get_config_variable( 'ec2_metadata_v1_disabled' ), } fetcher = InstanceMetadataRegionFetcher( timeout=metadata_timeout, num_attempts=metadata_num_attempts, env=self._environ, user_agent=self._session.user_agent(), config=imds_config, ) return fetcher class InstanceMetadataRegionFetcher(IMDSFetcher): _URL_PATH = 'latest/meta-data/placement/availability-zone/' def retrieve_region(self): """Get the current region from the instance metadata service. :rvalue: str :returns: The region the current instance is running in or None if the instance metadata service cannot be contacted or does not give a valid response. :rtype: None or str :returns: Returns the region as a string if it is configured to use IMDS as a region source. Otherwise returns ``None``. It will also return ``None`` if it fails to get the region from IMDS due to exhausting its retries or not being able to connect. """ try: region = self._get_region() return region except self._RETRIES_EXCEEDED_ERROR_CLS: logger.debug( "Max number of attempts exceeded (%s) when " "attempting to retrieve data from metadata service.", self._num_attempts, ) return None def _get_region(self): token = self._fetch_metadata_token() response = self._get_request( url_path=self._URL_PATH, retry_func=self._default_retry, token=token, ) availability_zone = response.text region = availability_zone[:-1] return region def merge_dicts(dict1, dict2, append_lists=False): """Given two dict, merge the second dict into the first. The dicts can have arbitrary nesting. :param append_lists: If true, instead of clobbering a list with the new value, append all of the new values onto the original list. """ for key in dict2: if isinstance(dict2[key], dict): if key in dict1 and key in dict2: merge_dicts(dict1[key], dict2[key]) else: dict1[key] = dict2[key] # If the value is a list and the ``append_lists`` flag is set, # append the new values onto the original list elif isinstance(dict2[key], list) and append_lists: # The value in dict1 must be a list in order to append new # values onto it. if key in dict1 and isinstance(dict1[key], list): dict1[key].extend(dict2[key]) else: dict1[key] = dict2[key] else: # At scalar types, we iterate and merge the # current dict that we're on. dict1[key] = dict2[key] def lowercase_dict(original): """Copies the given dictionary ensuring all keys are lowercase strings.""" copy = {} for key in original: copy[key.lower()] = original[key] return copy def parse_key_val_file(filename, _open=open): try: with _open(filename) as f: contents = f.read() return parse_key_val_file_contents(contents) except OSError: raise ConfigNotFound(path=filename) def parse_key_val_file_contents(contents): # This was originally extracted from the EC2 credential provider, which was # fairly lenient in its parsing. We only try to parse key/val pairs if # there's a '=' in the line. final = {} for line in contents.splitlines(): if '=' not in line: continue key, val = line.split('=', 1) key = key.strip() val = val.strip() final[key] = val return final def percent_encode_sequence(mapping, safe=SAFE_CHARS): """Urlencode a dict or list into a string. This is similar to urllib.urlencode except that: * It uses quote, and not quote_plus * It has a default list of safe chars that don't need to be encoded, which matches what AWS services expect. If any value in the input ``mapping`` is a list type, then each list element wil be serialized. This is the equivalent to ``urlencode``'s ``doseq=True`` argument. This function should be preferred over the stdlib ``urlencode()`` function. :param mapping: Either a dict to urlencode or a list of ``(key, value)`` pairs. """ encoded_pairs = [] if hasattr(mapping, 'items'): pairs = mapping.items() else: pairs = mapping for key, value in pairs: if isinstance(value, list): for element in value: encoded_pairs.append( f'{percent_encode(key)}={percent_encode(element)}' ) else: encoded_pairs.append( f'{percent_encode(key)}={percent_encode(value)}' ) return '&'.join(encoded_pairs) def percent_encode(input_str, safe=SAFE_CHARS): """Urlencodes a string. Whereas percent_encode_sequence handles taking a dict/sequence and producing a percent encoded string, this function deals only with taking a string (not a dict/sequence) and percent encoding it. If given the binary type, will simply URL encode it. If given the text type, will produce the binary type by UTF-8 encoding the text. If given something else, will convert it to the text type first. """ # If its not a binary or text string, make it a text string. if not isinstance(input_str, (bytes, str)): input_str = str(input_str) # If it's not bytes, make it bytes by UTF-8 encoding it. if not isinstance(input_str, bytes): input_str = input_str.encode('utf-8') return quote(input_str, safe=safe) def _epoch_seconds_to_datetime(value, tzinfo): """Parse numerical epoch timestamps (seconds since 1970) into a ``datetime.datetime`` in UTC using ``datetime.timedelta``. This is intended as fallback when ``fromtimestamp`` raises ``OverflowError`` or ``OSError``. :type value: float or int :param value: The Unix timestamps as number. :type tzinfo: callable :param tzinfo: A ``datetime.tzinfo`` class or compatible callable. """ epoch_zero = datetime.datetime(1970, 1, 1, 0, 0, 0, tzinfo=tzutc()) epoch_zero_localized = epoch_zero.astimezone(tzinfo()) return epoch_zero_localized + datetime.timedelta(seconds=value) def _parse_timestamp_with_tzinfo(value, tzinfo): """Parse timestamp with pluggable tzinfo options.""" if isinstance(value, (int, float)): # Possibly an epoch time. return datetime.datetime.fromtimestamp(value, tzinfo()) else: try: return datetime.datetime.fromtimestamp(float(value), tzinfo()) except (TypeError, ValueError): pass try: # In certain cases, a timestamp marked with GMT can be parsed into a # different time zone, so here we provide a context which will # enforce that GMT == UTC. return dateutil.parser.parse(value, tzinfos={'GMT': tzutc()}) except (TypeError, ValueError) as e: raise ValueError(f'Invalid timestamp "{value}": {e}') def parse_timestamp(value): """Parse a timestamp into a datetime object. Supported formats: * iso8601 * rfc822 * epoch (value is an integer) This will return a ``datetime.datetime`` object. """ tzinfo_options = get_tzinfo_options() for tzinfo in tzinfo_options: try: return _parse_timestamp_with_tzinfo(value, tzinfo) except (OSError, OverflowError) as e: logger.debug( 'Unable to parse timestamp with "%s" timezone info.', tzinfo.__name__, exc_info=e, ) # For numeric values attempt fallback to using fromtimestamp-free method. # From Python's ``datetime.datetime.fromtimestamp`` documentation: "This # may raise ``OverflowError``, if the timestamp is out of the range of # values supported by the platform C localtime() function, and ``OSError`` # on localtime() failure. It's common for this to be restricted to years # from 1970 through 2038." try: numeric_value = float(value) except (TypeError, ValueError): pass else: try: for tzinfo in tzinfo_options: return _epoch_seconds_to_datetime(numeric_value, tzinfo=tzinfo) except (OSError, OverflowError) as e: logger.debug( 'Unable to parse timestamp using fallback method with "%s" ' 'timezone info.', tzinfo.__name__, exc_info=e, ) raise RuntimeError( f'Unable to calculate correct timezone offset for "{value}"' ) def parse_to_aware_datetime(value): """Converted the passed in value to a datetime object with tzinfo. This function can be used to normalize all timestamp inputs. This function accepts a number of different types of inputs, but will always return a datetime.datetime object with time zone information. The input param ``value`` can be one of several types: * A datetime object (both naive and aware) * An integer representing the epoch time (can also be a string of the integer, i.e '0', instead of 0). The epoch time is considered to be UTC. * An iso8601 formatted timestamp. This does not need to be a complete timestamp, it can contain just the date portion without the time component. The returned value will be a datetime object that will have tzinfo. If no timezone info was provided in the input value, then UTC is assumed, not local time. """ # This is a general purpose method that handles several cases of # converting the provided value to a string timestamp suitable to be # serialized to an http request. It can handle: # 1) A datetime.datetime object. if isinstance(value, _DatetimeClass): datetime_obj = value else: # 2) A string object that's formatted as a timestamp. # We document this as being an iso8601 timestamp, although # parse_timestamp is a bit more flexible. datetime_obj = parse_timestamp(value) if datetime_obj.tzinfo is None: # I think a case would be made that if no time zone is provided, # we should use the local time. However, to restore backwards # compat, the previous behavior was to assume UTC, which is # what we're going to do here. datetime_obj = datetime_obj.replace(tzinfo=tzutc()) else: datetime_obj = datetime_obj.astimezone(tzutc()) return datetime_obj def datetime2timestamp(dt, default_timezone=None): """Calculate the timestamp based on the given datetime instance. :type dt: datetime :param dt: A datetime object to be converted into timestamp :type default_timezone: tzinfo :param default_timezone: If it is provided as None, we treat it as tzutc(). But it is only used when dt is a naive datetime. :returns: The timestamp """ epoch = datetime.datetime(1970, 1, 1) if dt.tzinfo is None: if default_timezone is None: default_timezone = tzutc() dt = dt.replace(tzinfo=default_timezone) d = dt.replace(tzinfo=None) - dt.utcoffset() - epoch return d.total_seconds() def calculate_sha256(body, as_hex=False): """Calculate a sha256 checksum. This method will calculate the sha256 checksum of a file like object. Note that this method will iterate through the entire file contents. The caller is responsible for ensuring the proper starting position of the file and ``seek()``'ing the file back to its starting location if other consumers need to read from the file like object. :param body: Any file like object. The file must be opened in binary mode such that a ``.read()`` call returns bytes. :param as_hex: If True, then the hex digest is returned. If False, then the digest (as binary bytes) is returned. :returns: The sha256 checksum """ checksum = hashlib.sha256() for chunk in iter(lambda: body.read(1024 * 1024), b''): checksum.update(chunk) if as_hex: return checksum.hexdigest() else: return checksum.digest() def calculate_tree_hash(body): """Calculate a tree hash checksum. For more information see: http://docs.aws.amazon.com/amazonglacier/latest/dev/checksum-calculations.html :param body: Any file like object. This has the same constraints as the ``body`` param in calculate_sha256 :rtype: str :returns: The hex version of the calculated tree hash """ chunks = [] required_chunk_size = 1024 * 1024 sha256 = hashlib.sha256 for chunk in iter(lambda: body.read(required_chunk_size), b''): chunks.append(sha256(chunk).digest()) if not chunks: return sha256(b'').hexdigest() while len(chunks) > 1: new_chunks = [] for first, second in _in_pairs(chunks): if second is not None: new_chunks.append(sha256(first + second).digest()) else: # We're at the end of the list and there's no pair left. new_chunks.append(first) chunks = new_chunks return binascii.hexlify(chunks[0]).decode('ascii') def _in_pairs(iterable): # Creates iterator that iterates over the list in pairs: # for a, b in _in_pairs([0, 1, 2, 3, 4]): # print(a, b) # # will print: # 0, 1 # 2, 3 # 4, None shared_iter = iter(iterable) # Note that zip_longest is a compat import that uses # the itertools izip_longest. This creates an iterator, # this call below does _not_ immediately create the list # of pairs. return zip_longest(shared_iter, shared_iter) class CachedProperty: """A read only property that caches the initially computed value. This descriptor will only call the provided ``fget`` function once. Subsequent access to this property will return the cached value. """ def __init__(self, fget): self._fget = fget def __get__(self, obj, cls): if obj is None: return self else: computed_value = self._fget(obj) obj.__dict__[self._fget.__name__] = computed_value return computed_value class ArgumentGenerator: """Generate sample input based on a shape model. This class contains a ``generate_skeleton`` method that will take an input/output shape (created from ``botocore.model``) and generate a sample dictionary corresponding to the input/output shape. The specific values used are place holder values. For strings either an empty string or the member name can be used, for numbers 0 or 0.0 is used. The intended usage of this class is to generate the shape of the input structure. This can be useful for operations that have complex input shapes. This allows a user to just fill in the necessary data instead of worrying about the specific structure of the input arguments. Example usage:: s = botocore.session.get_session() ddb = s.get_service_model('dynamodb') arg_gen = ArgumentGenerator() sample_input = arg_gen.generate_skeleton( ddb.operation_model('CreateTable').input_shape) print("Sample input for dynamodb.CreateTable: %s" % sample_input) """ def __init__(self, use_member_names=False): self._use_member_names = use_member_names def generate_skeleton(self, shape): """Generate a sample input. :type shape: ``botocore.model.Shape`` :param shape: The input shape. :return: The generated skeleton input corresponding to the provided input shape. """ stack = [] return self._generate_skeleton(shape, stack) def _generate_skeleton(self, shape, stack, name=''): stack.append(shape.name) try: if shape.type_name == 'structure': return self._generate_type_structure(shape, stack) elif shape.type_name == 'list': return self._generate_type_list(shape, stack) elif shape.type_name == 'map': return self._generate_type_map(shape, stack) elif shape.type_name == 'string': if self._use_member_names: return name if shape.enum: return random.choice(shape.enum) return '' elif shape.type_name in ['integer', 'long']: return 0 elif shape.type_name in ['float', 'double']: return 0.0 elif shape.type_name == 'boolean': return True elif shape.type_name == 'timestamp': return datetime.datetime(1970, 1, 1, 0, 0, 0) finally: stack.pop() def _generate_type_structure(self, shape, stack): if stack.count(shape.name) > 1: return {} skeleton = OrderedDict() for member_name, member_shape in shape.members.items(): skeleton[member_name] = self._generate_skeleton( member_shape, stack, name=member_name ) return skeleton def _generate_type_list(self, shape, stack): # For list elements we've arbitrarily decided to # return two elements for the skeleton list. name = '' if self._use_member_names: name = shape.member.name return [ self._generate_skeleton(shape.member, stack, name), ] def _generate_type_map(self, shape, stack): key_shape = shape.key value_shape = shape.value assert key_shape.type_name == 'string' return OrderedDict( [ ('KeyName', self._generate_skeleton(value_shape, stack)), ] ) def is_valid_ipv6_endpoint_url(endpoint_url): if UNSAFE_URL_CHARS.intersection(endpoint_url): return False hostname = f'[{urlparse(endpoint_url).hostname}]' return IPV6_ADDRZ_RE.match(hostname) is not None def is_valid_ipv4_endpoint_url(endpoint_url): hostname = urlparse(endpoint_url).hostname return IPV4_RE.match(hostname) is not None def is_valid_endpoint_url(endpoint_url): """Verify the endpoint_url is valid. :type endpoint_url: string :param endpoint_url: An endpoint_url. Must have at least a scheme and a hostname. :return: True if the endpoint url is valid. False otherwise. """ # post-bpo-43882 urlsplit() strips unsafe characters from URL, causing # it to pass hostname validation below. Detect them early to fix that. if UNSAFE_URL_CHARS.intersection(endpoint_url): return False parts = urlsplit(endpoint_url) hostname = parts.hostname if hostname is None: return False if len(hostname) > 255: return False if hostname[-1] == ".": hostname = hostname[:-1] allowed = re.compile( r"^((?!-)[A-Z\d-]{1,63}(?<!-)\.)((?!-)[A-Z\d-]{1,63}(?<!-))$", re.IGNORECASE, ) return allowed.match(hostname) def is_valid_uri(endpoint_url): return is_valid_endpoint_url(endpoint_url) or is_valid_ipv6_endpoint_url( endpoint_url ) def validate_region_name(region_name): """Provided region_name must be a valid host label.""" if region_name is None: return valid_host_label = re.compile(r'^(?![0-9]+$)(?!-)[a-zA-Z0-9-]{,63}(?<!-)$') valid = valid_host_label.match(region_name) if not valid: raise InvalidRegionError(region_name=region_name) def check_dns_name(bucket_name): """ Check to see if the ``bucket_name`` complies with the restricted DNS naming conventions necessary to allow access via virtual-hosting style. Even though "." characters are perfectly valid in this DNS naming scheme, we are going to punt on any name containing a "." character because these will cause SSL cert validation problems if we try to use virtual-hosting style addressing. """ if '.' in bucket_name: return False n = len(bucket_name) if n < 3 or n > 63: # Wrong length return False match = LABEL_RE.match(bucket_name) if match is None or match.end() != len(bucket_name): return False return True def fix_s3_host( request, signature_version, region_name, default_endpoint_url=None, kwargs, ): """ This handler looks at S3 requests just before they are signed. If there is a bucket name on the path (true for everything except ListAllBuckets) it checks to see if that bucket name conforms to the DNS naming conventions. If it does, it alters the request to use ``virtual hosting`` style addressing rather than ``path-style`` addressing. """ if request.context.get('use_global_endpoint', False): default_endpoint_url = 's3.amazonaws.com' try: switch_to_virtual_host_style( request, signature_version, default_endpoint_url ) except InvalidDNSNameError as e: bucket_name = e.kwargs['bucket_name'] logger.debug( 'Not changing URI, bucket is not DNS compatible: %s', bucket_name ) def switch_to_virtual_host_style( request, signature_version, default_endpoint_url=None, kwargs ): """ This is a handler to force virtual host style s3 addressing no matter the signature version (which is taken in consideration for the default case). If the bucket is not DNS compatible an InvalidDNSName is thrown. :param request: A AWSRequest object that is about to be sent. :param signature_version: The signature version to sign with :param default_endpoint_url: The endpoint to use when switching to a virtual style. If None is supplied, the virtual host will be constructed from the url of the request. """ if request.auth_path is not None: # The auth_path has already been applied (this may be a # retried request). We don't need to perform this # customization again. return elif _is_get_bucket_location_request(request): # For the GetBucketLocation response, we should not be using # the virtual host style addressing so we can avoid any sigv4 # issues. logger.debug( "Request is GetBucketLocation operation, not checking " "for DNS compatibility." ) return parts = urlsplit(request.url) request.auth_path = parts.path path_parts = parts.path.split('/') # Retrieve what the endpoint we will be prepending the bucket name to. if default_endpoint_url is None: default_endpoint_url = parts.netloc if len(path_parts) > 1: bucket_name = path_parts[1] if not bucket_name: # If the bucket name is empty we should not be checking for # dns compatibility. return logger.debug('Checking for DNS compatible bucket for: %s', request.url) if check_dns_name(bucket_name): # If the operation is on a bucket, the auth_path must be # terminated with a '/' character. if len(path_parts) == 2: if request.auth_path[-1] != '/': request.auth_path += '/' path_parts.remove(bucket_name) # At the very least the path must be a '/', such as with the # CreateBucket operation when DNS style is being used. If this # is not used you will get an empty path which is incorrect. path = '/'.join(path_parts) or '/' global_endpoint = default_endpoint_url host = bucket_name + '.' + global_endpoint new_tuple = (parts.scheme, host, path, parts.query, '') new_uri = urlunsplit(new_tuple) request.url = new_uri logger.debug('URI updated to: %s', new_uri) else: raise InvalidDNSNameError(bucket_name=bucket_name) def _is_get_bucket_location_request(request): return request.url.endswith('?location') def instance_cache(func): """Method decorator for caching method calls to a single instance. This is not a general purpose caching decorator.* In order to use this, you must provide an ``_instance_cache`` attribute on the instance. This decorator is used to cache method calls. The cache is only scoped to a single instance though such that multiple instances will maintain their own cache. In order to keep things simple, this decorator requires that you provide an ``_instance_cache`` attribute on your instance. """ func_name = func.__name__ @functools.wraps(func) def _cache_guard(self, args, kwargs): cache_key = (func_name, args) if kwargs: kwarg_items = tuple(sorted(kwargs.items())) cache_key = (func_name, args, kwarg_items) result = self._instance_cache.get(cache_key) if result is not None: return result result = func(self, args, *kwargs) self._instance_cache[cache_key] = result return result return _cache_guard def lru_cache_weakref(cache_args, *cache_kwargs): """ Version of functools.lru_cache that stores a weak reference to ``self``. Serves the same purpose as :py:func:`instance_cache` but uses Python's functools implementation which offers ``max_size`` and ``typed`` properties. lru_cache is a global cache even when used on a method. The cache's reference to ``self`` will prevent garbage collection of the object. This wrapper around functools.lru_cache replaces the reference to ``self`` with a weak reference to not interfere with garbage collection. """ def wrapper(func): @functools.lru_cache(cache_args, *cache_kwargs) def func_with_weakref(weakref_to_self, args, *kwargs): return func(weakref_to_self(), args, *kwargs) @functools.wraps(func) def inner(self, args, *kwargs): for kwarg_key, kwarg_value in kwargs.items(): if isinstance(kwarg_value, list): kwargs[kwarg_key] = tuple(kwarg_value) return func_with_weakref(weakref.ref(self), args, kwargs) inner.cache_info = func_with_weakref.cache_info return inner return wrapper def switch_host_s3_accelerate(request, operation_name, kwargs): """Switches the current s3 endpoint with an S3 Accelerate endpoint""" # Note that when registered the switching of the s3 host happens # before it gets changed to virtual. So we are not concerned with ensuring # that the bucket name is translated to the virtual style here and we # can hard code the Accelerate endpoint. parts = urlsplit(request.url).netloc.split('.') parts = [p for p in parts if p in S3_ACCELERATE_WHITELIST] endpoint = 'https://s3-accelerate.' if len(parts) > 0: endpoint += '.'.join(parts) + '.' endpoint += 'amazonaws.com' if operation_name in ['ListBuckets', 'CreateBucket', 'DeleteBucket']: return _switch_hosts(request, endpoint, use_new_scheme=False) def switch_host_with_param(request, param_name): """Switches the host using a parameter value from a JSON request body""" request_json = json.loads(request.data.decode('utf-8')) if request_json.get(param_name): new_endpoint = request_json[param_name] _switch_hosts(request, new_endpoint) def _switch_hosts(request, new_endpoint, use_new_scheme=True): final_endpoint = _get_new_endpoint( request.url, new_endpoint, use_new_scheme ) request.url = final_endpoint def _get_new_endpoint(original_endpoint, new_endpoint, use_new_scheme=True): new_endpoint_components = urlsplit(new_endpoint) original_endpoint_components = urlsplit(original_endpoint) scheme = original_endpoint_components.scheme if use_new_scheme: scheme = new_endpoint_components.scheme final_endpoint_components = ( scheme, new_endpoint_components.netloc, original_endpoint_components.path, original_endpoint_components.query, '', ) final_endpoint = urlunsplit(final_endpoint_components) logger.debug(f'Updating URI from {original_endpoint} to {final_endpoint}') return final_endpoint def deep_merge(base, extra): """Deeply two dictionaries, overriding existing keys in the base. :param base: The base dictionary which will be merged into. :param extra: The dictionary to merge into the base. Keys from this dictionary will take precedence. """ for key in extra: # If the key represents a dict on both given dicts, merge the sub-dicts if ( key in base and isinstance(base[key], dict) and isinstance(extra[key], dict) ): deep_merge(base[key], extra[key]) continue # Otherwise, set the key on the base to be the value of the extra. base[key] = extra[key] def hyphenize_service_id(service_id): """Translate the form used for event emitters. :param service_id: The service_id to convert. """ return service_id.replace(' ', '-').lower() class IdentityCache: """Base IdentityCache implementation for storing and retrieving highly accessed credentials. This class is not intended to be instantiated in user code. """ METHOD = "base_identity_cache" def __init__(self, client, credential_cls): self._client = client self._credential_cls = credential_cls def get_credentials(self, kwargs): callback = self.build_refresh_callback(kwargs) metadata = callback() credential_entry = self._credential_cls.create_from_metadata( metadata=metadata, refresh_using=callback, method=self.METHOD, advisory_timeout=45, mandatory_timeout=10, ) return credential_entry def build_refresh_callback(kwargs): """Callback to be implemented by subclasses. Returns a set of metadata to be converted into a new credential instance. """ raise NotImplementedError() class S3ExpressIdentityCache(IdentityCache): """S3Express IdentityCache for retrieving and storing credentials from CreateSession calls. This class is not intended to be instantiated in user code. """ METHOD = "s3express" def __init__(self, client, credential_cls): self._client = client self._credential_cls = credential_cls @functools.lru_cache(maxsize=100) def get_credentials(self, bucket): return super().get_credentials(bucket=bucket) def build_refresh_callback(self, bucket): def refresher(): response = self._client.create_session(Bucket=bucket) creds = response['Credentials'] expiration = self._serialize_if_needed( creds['Expiration'], iso=True ) return { "access_key": creds['AccessKeyId'], "secret_key": creds['SecretAccessKey'], "token": creds['SessionToken'], "expiry_time": expiration, } return refresher def _serialize_if_needed(self, value, iso=False): if isinstance(value, _DatetimeClass): if iso: return value.isoformat() return value.strftime('%Y-%m-%dT%H:%M:%S%Z') return value class S3ExpressIdentityResolver: def __init__(self, client, credential_cls, cache=None): self._client = weakref.proxy(client) if cache is None: cache = S3ExpressIdentityCache(self._client, credential_cls) self._cache = cache def register(self, event_emitter=None): logger.debug('Registering S3Express Identity Resolver') emitter = event_emitter or self._client.meta.events emitter.register('before-call.s3', self.apply_signing_cache_key) emitter.register('before-sign.s3', self.resolve_s3express_identity) def apply_signing_cache_key(self, params, context, kwargs): endpoint_properties = context.get('endpoint_properties', {}) backend = endpoint_properties.get('backend', None) # Add cache key if Bucket supplied for s3express request bucket_name = context.get('input_params', {}).get('Bucket') if backend == 'S3Express' and bucket_name is not None: context.setdefault('signing', {}) context['signing']['cache_key'] = bucket_name def resolve_s3express_identity( self, request, signing_name, region_name, signature_version, request_signer, operation_name, kwargs, ): signing_context = request.context.get('signing', {}) signing_name = signing_context.get('signing_name') if signing_name == 's3express' and signature_version.startswith( 'v4-s3express' ): signing_context['identity_cache'] = self._cache if 'cache_key' not in signing_context: signing_context['cache_key'] = ( request.context.get('s3_redirect', {}) .get('params', {}) .get('Bucket') ) class S3RegionRedirectorv2: """Updated version of S3RegionRedirector for use when EndpointRulesetResolver is in use for endpoint resolution. This class is considered private and subject to abrupt breaking changes or removal without prior announcement. Please do not use it directly. """ def __init__(self, endpoint_bridge, client, cache=None): self._cache = cache or {} self._client = weakref.proxy(client) def register(self, event_emitter=None): logger.debug('Registering S3 region redirector handler') emitter = event_emitter or self._client.meta.events emitter.register('needs-retry.s3', self.redirect_from_error) emitter.register( 'before-parameter-build.s3', self.annotate_request_context ) emitter.register( 'before-endpoint-resolution.s3', self.redirect_from_cache ) def redirect_from_error(self, request_dict, response, operation, kwargs): """ An S3 request sent to the wrong region will return an error that contains the endpoint the request should be sent to. This handler will add the redirect information to the signing context and then redirect the request. """ if response is None: # This could be none if there was a ConnectionError or other # transport error. return redirect_ctx = request_dict.get('context', {}).get('s3_redirect', {}) if ArnParser.is_arn(redirect_ctx.get('bucket')): logger.debug( 'S3 request was previously for an Accesspoint ARN, not ' 'redirecting.' ) return if redirect_ctx.get('redirected'): logger.debug( 'S3 request was previously redirected, not redirecting.' ) return error = response[1].get('Error', {}) error_code = error.get('Code') response_metadata = response[1].get('ResponseMetadata', {}) # We have to account for 400 responses because # if we sign a Head* request with the wrong region, # we'll get a 400 Bad Request but we won't get a # body saying it's an "AuthorizationHeaderMalformed". is_special_head_object = ( error_code in ('301', '400') and operation.name == 'HeadObject' ) is_special_head_bucket = ( error_code in ('301', '400') and operation.name == 'HeadBucket' and 'x-amz-bucket-region' in response_metadata.get('HTTPHeaders', {}) ) is_wrong_signing_region = ( error_code == 'AuthorizationHeaderMalformed' and 'Region' in error ) is_redirect_status = response[0] is not None and response[ 0 ].status_code in (301, 302, 307) is_permanent_redirect = error_code == 'PermanentRedirect' is_opt_in_region_redirect = ( error_code == 'IllegalLocationConstraintException' and operation.name != 'CreateBucket' ) if not any( [ is_special_head_object, is_wrong_signing_region, is_permanent_redirect, is_special_head_bucket, is_redirect_status, is_opt_in_region_redirect, ] ): return bucket = request_dict['context']['s3_redirect']['bucket'] client_region = request_dict['context'].get('client_region') new_region = self.get_bucket_region(bucket, response) if new_region is None: logger.debug( f"S3 client configured for region {client_region} but the " f"bucket {bucket} is not in that region and the proper region " "could not be automatically determined." ) return logger.debug( f"S3 client configured for region {client_region} but the bucket {bucket} " f"is in region {new_region}; Please configure the proper region to " f"avoid multiple unnecessary redirects and signing attempts." ) # Adding the new region to _cache will make construct_endpoint() to # use the new region as value for the AWS::Region builtin parameter. self._cache[bucket] = new_region # Re-resolve endpoint with new region and modify request_dict with # the new URL, auth scheme, and signing context. ep_resolver = self._client._ruleset_resolver ep_info = ep_resolver.construct_endpoint( operation_model=operation, call_args=request_dict['context']['s3_redirect']['params'], request_context=request_dict['context'], ) request_dict['url'] = self.set_request_url( request_dict['url'], ep_info.url ) request_dict['context']['s3_redirect']['redirected'] = True auth_schemes = ep_info.properties.get('authSchemes') if auth_schemes is not None: auth_info = ep_resolver.auth_schemes_to_signing_ctx(auth_schemes) auth_type, signing_context = auth_info request_dict['context']['auth_type'] = auth_type request_dict['context']['signing'] = { request_dict['context'].get('signing', {}), signing_context, } # Return 0 so it doesn't wait to retry return 0 def get_bucket_region(self, bucket, response): """ There are multiple potential sources for the new region to redirect to, but they aren't all universally available for use. This will try to find region from response elements, but will fall back to calling HEAD on the bucket if all else fails. :param bucket: The bucket to find the region for. This is necessary if the region is not available in the error response. :param response: A response representing a service request that failed due to incorrect region configuration. """ # First try to source the region from the headers. service_response = response[1] response_headers = service_response['ResponseMetadata']['HTTPHeaders'] if 'x-amz-bucket-region' in response_headers: return response_headers['x-amz-bucket-region'] # Next, check the error body region = service_response.get('Error', {}).get('Region', None) if region is not None: return region # Finally, HEAD the bucket. No other choice sadly. try: response = self._client.head_bucket(Bucket=bucket) headers = response['ResponseMetadata']['HTTPHeaders'] except ClientError as e: headers = e.response['ResponseMetadata']['HTTPHeaders'] region = headers.get('x-amz-bucket-region', None) return region def set_request_url(self, old_url, new_endpoint, kwargs): """ Splice a new endpoint into an existing URL. Note that some endpoints from the the endpoint provider have a path component which will be discarded by this function. """ return _get_new_endpoint(old_url, new_endpoint, False) def redirect_from_cache(self, builtins, params, kwargs): """ If a bucket name has been redirected before, it is in the cache. This handler will update the AWS::Region endpoint resolver builtin param to use the region from cache instead of the client region to avoid the redirect. """ bucket = params.get('Bucket') if bucket is not None and bucket in self._cache: new_region = self._cache.get(bucket) builtins['AWS::Region'] = new_region def annotate_request_context(self, params, context, kwargs): """Store the bucket name in context for later use when redirecting. The bucket name may be an access point ARN or alias. """ bucket = params.get('Bucket') context['s3_redirect'] = { 'redirected': False, 'bucket': bucket, 'params': params, } class S3RegionRedirector: """This handler has been replaced by S3RegionRedirectorv2. The original version remains in place for any third-party libraries that import it. """ def __init__(self, endpoint_bridge, client, cache=None): self._endpoint_resolver = endpoint_bridge self._cache = cache if self._cache is None: self._cache = {} # This needs to be a weak ref in order to prevent memory leaks on # python 2.6 self._client = weakref.proxy(client) warnings.warn( 'The S3RegionRedirector class has been deprecated for a new ' 'internal replacement. A future version of botocore may remove ' 'this class.', category=FutureWarning, ) def register(self, event_emitter=None): emitter = event_emitter or self._client.meta.events emitter.register('needs-retry.s3', self.redirect_from_error) emitter.register('before-call.s3', self.set_request_url) emitter.register('before-parameter-build.s3', self.redirect_from_cache) def redirect_from_error(self, request_dict, response, operation, kwargs): """ An S3 request sent to the wrong region will return an error that contains the endpoint the request should be sent to. This handler will add the redirect information to the signing context and then redirect the request. """ if response is None: # This could be none if there was a ConnectionError or other # transport error. return if self._is_s3_accesspoint(request_dict.get('context', {})): logger.debug( 'S3 request was previously to an accesspoint, not redirecting.' ) return if request_dict.get('context', {}).get('s3_redirected'): logger.debug( 'S3 request was previously redirected, not redirecting.' ) return error = response[1].get('Error', {}) error_code = error.get('Code') response_metadata = response[1].get('ResponseMetadata', {}) # We have to account for 400 responses because # if we sign a Head* request with the wrong region, # we'll get a 400 Bad Request but we won't get a # body saying it's an "AuthorizationHeaderMalformed". is_special_head_object = ( error_code in ('301', '400') and operation.name == 'HeadObject' ) is_special_head_bucket = ( error_code in ('301', '400') and operation.name == 'HeadBucket' and 'x-amz-bucket-region' in response_metadata.get('HTTPHeaders', {}) ) is_wrong_signing_region = ( error_code == 'AuthorizationHeaderMalformed' and 'Region' in error ) is_redirect_status = response[0] is not None and response[ 0 ].status_code in (301, 302, 307) is_permanent_redirect = error_code == 'PermanentRedirect' if not any( [ is_special_head_object, is_wrong_signing_region, is_permanent_redirect, is_special_head_bucket, is_redirect_status, ] ): return bucket = request_dict['context']['signing']['bucket'] client_region = request_dict['context'].get('client_region') new_region = self.get_bucket_region(bucket, response) if new_region is None: logger.debug( f"S3 client configured for region {client_region} but the bucket {bucket} is not " "in that region and the proper region could not be " "automatically determined." ) return logger.debug( f"S3 client configured for region {client_region} but the bucket {bucket} is in region" f" {new_region}; Please configure the proper region to avoid multiple " "unnecessary redirects and signing attempts." ) endpoint = self._endpoint_resolver.resolve('s3', new_region) endpoint = endpoint['endpoint_url'] signing_context = { 'region': new_region, 'bucket': bucket, 'endpoint': endpoint, } request_dict['context']['signing'] = signing_context self._cache[bucket] = signing_context self.set_request_url(request_dict, request_dict['context']) request_dict['context']['s3_redirected'] = True # Return 0 so it doesn't wait to retry return 0 def get_bucket_region(self, bucket, response): """ There are multiple potential sources for the new region to redirect to, but they aren't all universally available for use. This will try to find region from response elements, but will fall back to calling HEAD on the bucket if all else fails. :param bucket: The bucket to find the region for. This is necessary if the region is not available in the error response. :param response: A response representing a service request that failed due to incorrect region configuration. """ # First try to source the region from the headers. service_response = response[1] response_headers = service_response['ResponseMetadata']['HTTPHeaders'] if 'x-amz-bucket-region' in response_headers: return response_headers['x-amz-bucket-region'] # Next, check the error body region = service_response.get('Error', {}).get('Region', None) if region is not None: return region # Finally, HEAD the bucket. No other choice sadly. try: response = self._client.head_bucket(Bucket=bucket) headers = response['ResponseMetadata']['HTTPHeaders'] except ClientError as e: headers = e.response['ResponseMetadata']['HTTPHeaders'] region = headers.get('x-amz-bucket-region', None) return region def set_request_url(self, params, context, kwargs): endpoint = context.get('signing', {}).get('endpoint', None) if endpoint is not None: params['url'] = _get_new_endpoint(params['url'], endpoint, False) def redirect_from_cache(self, params, context, kwargs): """ This handler retrieves a given bucket's signing context from the cache and adds it into the request context. """ if self._is_s3_accesspoint(context): return bucket = params.get('Bucket') signing_context = self._cache.get(bucket) if signing_context is not None: context['signing'] = signing_context else: context['signing'] = {'bucket': bucket} def _is_s3_accesspoint(self, context): return 's3_accesspoint' in context class InvalidArnException(ValueError): pass class ArnParser: def parse_arn(self, arn): arn_parts = arn.split(':', 5) if len(arn_parts) < 6: raise InvalidArnException( f'Provided ARN: {arn} must be of the format: ' 'arn:partition:service:region:account:resource' ) return { 'partition': arn_parts[1], 'service': arn_parts[2], 'region': arn_parts[3], 'account': arn_parts[4], 'resource': arn_parts[5], } @staticmethod def is_arn(value): if not isinstance(value, str) or not value.startswith('arn:'): return False arn_parser = ArnParser() try: arn_parser.parse_arn(value) return True except InvalidArnException: return False class S3ArnParamHandler: _RESOURCE_REGEX = re.compile( r'^(?P<resource_type>accesspoint\|outpost)[/:](?P<resource_name>.+)$' ) _OUTPOST_RESOURCE_REGEX = re.compile( r'^(?P<outpost_name>[a-zA-Z0-9\-]{1,63})[/:]accesspoint[/:]' r'(?P<accesspoint_name>[a-zA-Z0-9\-]{1,63}$)' ) _BLACKLISTED_OPERATIONS = ['CreateBucket'] def __init__(self, arn_parser=None): self._arn_parser = arn_parser if arn_parser is None: self._arn_parser = ArnParser() def register(self, event_emitter): event_emitter.register('before-parameter-build.s3', self.handle_arn) def handle_arn(self, params, model, context, kwargs): if model.name in self._BLACKLISTED_OPERATIONS: return arn_details = self._get_arn_details_from_bucket_param(params) if arn_details is None: return if arn_details['resource_type'] == 'accesspoint': self._store_accesspoint(params, context, arn_details) elif arn_details['resource_type'] == 'outpost': self._store_outpost(params, context, arn_details) def _get_arn_details_from_bucket_param(self, params): if 'Bucket' in params: try: arn = params['Bucket'] arn_details = self._arn_parser.parse_arn(arn) self._add_resource_type_and_name(arn, arn_details) return arn_details except InvalidArnException: pass return None def _add_resource_type_and_name(self, arn, arn_details): match = self._RESOURCE_REGEX.match(arn_details['resource']) if match: arn_details['resource_type'] = match.group('resource_type') arn_details['resource_name'] = match.group('resource_name') else: raise UnsupportedS3ArnError(arn=arn) def _store_accesspoint(self, params, context, arn_details): # Ideally the access-point would be stored as a parameter in the # request where the serializer would then know how to serialize it, # but access-points are not modeled in S3 operations so it would fail # validation. Instead, we set the access-point to the bucket parameter # to have some value set when serializing the request and additional # information on the context from the arn to use in forming the # access-point endpoint. params['Bucket'] = arn_details['resource_name'] context['s3_accesspoint'] = { 'name': arn_details['resource_name'], 'account': arn_details['account'], 'partition': arn_details['partition'], 'region': arn_details['region'], 'service': arn_details['service'], } def _store_outpost(self, params, context, arn_details): resource_name = arn_details['resource_name'] match = self._OUTPOST_RESOURCE_REGEX.match(resource_name) if not match: raise UnsupportedOutpostResourceError(resource_name=resource_name) # Because we need to set the bucket name to something to pass # validation we're going to use the access point name to be consistent # with normal access point arns. accesspoint_name = match.group('accesspoint_name') params['Bucket'] = accesspoint_name context['s3_accesspoint'] = { 'outpost_name': match.group('outpost_name'), 'name': accesspoint_name, 'account': arn_details['account'], 'partition': arn_details['partition'], 'region': arn_details['region'], 'service': arn_details['service'], } class S3EndpointSetter: _DEFAULT_PARTITION = 'aws' _DEFAULT_DNS_SUFFIX = 'amazonaws.com' def __init__( self, endpoint_resolver, region=None, s3_config=None, endpoint_url=None, partition=None, use_fips_endpoint=False, ): # This is calling the endpoint_resolver in regions.py self._endpoint_resolver = endpoint_resolver self._region = region self._s3_config = s3_config self._use_fips_endpoint = use_fips_endpoint if s3_config is None: self._s3_config = {} self._endpoint_url = endpoint_url self._partition = partition if partition is None: self._partition = self._DEFAULT_PARTITION def register(self, event_emitter): event_emitter.register('before-sign.s3', self.set_endpoint) event_emitter.register('choose-signer.s3', self.set_signer) event_emitter.register( 'before-call.s3.WriteGetObjectResponse', self.update_endpoint_to_s3_object_lambda, ) def update_endpoint_to_s3_object_lambda(self, params, context, kwargs): if self._use_accelerate_endpoint: raise UnsupportedS3ConfigurationError( msg='S3 client does not support accelerate endpoints for S3 Object Lambda operations', ) self._override_signing_name(context, 's3-object-lambda') if self._endpoint_url: # Only update the url if an explicit url was not provided return resolver = self._endpoint_resolver # Constructing endpoints as s3-object-lambda as region resolved = resolver.construct_endpoint( 's3-object-lambda', self._region ) # Ideally we would be able to replace the endpoint before # serialization but there's no event to do that currently # host_prefix is all the arn/bucket specs new_endpoint = 'https://{host_prefix}{hostname}'.format( host_prefix=params['host_prefix'], hostname=resolved['hostname'], ) params['url'] = _get_new_endpoint(params['url'], new_endpoint, False) def set_endpoint(self, request, kwargs): if self._use_accesspoint_endpoint(request): self._validate_accesspoint_supported(request) self._validate_fips_supported(request) self._validate_global_regions(request) region_name = self._resolve_region_for_accesspoint_endpoint( request ) self._resolve_signing_name_for_accesspoint_endpoint(request) self._switch_to_accesspoint_endpoint(request, region_name) return if self._use_accelerate_endpoint: if self._use_fips_endpoint: raise UnsupportedS3ConfigurationError( msg=( 'Client is configured to use the FIPS psuedo region ' f'for "{self._region}", but S3 Accelerate does not have any FIPS ' 'compatible endpoints.' ) ) switch_host_s3_accelerate(request=request, kwargs) if self._s3_addressing_handler: self._s3_addressing_handler(request=request, *kwargs) def _use_accesspoint_endpoint(self, request): return 's3_accesspoint' in request.context def _validate_fips_supported(self, request): if not self._use_fips_endpoint: return if 'fips' in request.context['s3_accesspoint']['region']: raise UnsupportedS3AccesspointConfigurationError( msg={'Invalid ARN, FIPS region not allowed in ARN.'} ) if 'outpost_name' in request.context['s3_accesspoint']: raise UnsupportedS3AccesspointConfigurationError( msg=( f'Client is configured to use the FIPS psuedo-region "{self._region}", ' 'but outpost ARNs do not support FIPS endpoints.' ) ) # Transforming psuedo region to actual region accesspoint_region = request.context['s3_accesspoint']['region'] if accesspoint_region != self._region: if not self._s3_config.get('use_arn_region', True): # TODO: Update message to reflect use_arn_region # is not set raise UnsupportedS3AccesspointConfigurationError( msg=( 'Client is configured to use the FIPS psuedo-region ' f'for "{self._region}", but the access-point ARN provided is for ' f'the "{accesspoint_region}" region. For clients using a FIPS ' 'psuedo-region calls to access-point ARNs in another ' 'region are not allowed.' ) ) def _validate_global_regions(self, request): if self._s3_config.get('use_arn_region', True): return if self._region in ['aws-global', 's3-external-1']: raise UnsupportedS3AccesspointConfigurationError( msg=( 'Client is configured to use the global psuedo-region ' f'"{self._region}". When providing access-point ARNs a regional ' 'endpoint must be specified.' ) ) def _validate_accesspoint_supported(self, request): if self._use_accelerate_endpoint: raise UnsupportedS3AccesspointConfigurationError( msg=( 'Client does not support s3 accelerate configuration ' 'when an access-point ARN is specified.' ) ) request_partition = request.context['s3_accesspoint']['partition'] if request_partition != self._partition: raise UnsupportedS3AccesspointConfigurationError( msg=( f'Client is configured for "{self._partition}" partition, but access-point' f' ARN provided is for "{request_partition}" partition. The client and ' ' access-point partition must be the same.' ) ) s3_service = request.context['s3_accesspoint'].get('service') if s3_service == 's3-object-lambda' and self._s3_config.get( 'use_dualstack_endpoint' ): raise UnsupportedS3AccesspointConfigurationError( msg=( 'Client does not support s3 dualstack configuration ' 'when an S3 Object Lambda access point ARN is specified.' ) ) outpost_name = request.context['s3_accesspoint'].get('outpost_name') if outpost_name and self._s3_config.get('use_dualstack_endpoint'): raise UnsupportedS3AccesspointConfigurationError( msg=( 'Client does not support s3 dualstack configuration ' 'when an outpost ARN is specified.' ) ) self._validate_mrap_s3_config(request) def _validate_mrap_s3_config(self, request): if not is_global_accesspoint(request.context): return if self._s3_config.get('s3_disable_multiregion_access_points'): raise UnsupportedS3AccesspointConfigurationError( msg=( 'Invalid configuration, Multi-Region Access Point ' 'ARNs are disabled.' ) ) elif self._s3_config.get('use_dualstack_endpoint'): raise UnsupportedS3AccesspointConfigurationError( msg=( 'Client does not support s3 dualstack configuration ' 'when a Multi-Region Access Point ARN is specified.' ) ) def _resolve_region_for_accesspoint_endpoint(self, request): if is_global_accesspoint(request.context): # Requests going to MRAP endpoints MUST be set to any () region. self._override_signing_region(request, '') elif self._s3_config.get('use_arn_region', True): accesspoint_region = request.context['s3_accesspoint']['region'] # If we are using the region from the access point, # we will also want to make sure that we set it as the # signing region as well self._override_signing_region(request, accesspoint_region) return accesspoint_region return self._region def set_signer(self, context, kwargs): if is_global_accesspoint(context): if HAS_CRT: return 's3v4a' else: raise MissingDependencyException( msg="Using S3 with an MRAP arn requires an additional " "dependency. You will need to pip install " "botocore[crt] before proceeding." ) def _resolve_signing_name_for_accesspoint_endpoint(self, request): accesspoint_service = request.context['s3_accesspoint']['service'] self._override_signing_name(request.context, accesspoint_service) def _switch_to_accesspoint_endpoint(self, request, region_name): original_components = urlsplit(request.url) accesspoint_endpoint = urlunsplit( ( original_components.scheme, self._get_netloc(request.context, region_name), self._get_accesspoint_path( original_components.path, request.context ), original_components.query, '', ) ) logger.debug( f'Updating URI from {request.url} to {accesspoint_endpoint}' ) request.url = accesspoint_endpoint def _get_netloc(self, request_context, region_name): if is_global_accesspoint(request_context): return self._get_mrap_netloc(request_context) else: return self._get_accesspoint_netloc(request_context, region_name) def _get_mrap_netloc(self, request_context): s3_accesspoint = request_context['s3_accesspoint'] region_name = 's3-global' mrap_netloc_components = [s3_accesspoint['name']] if self._endpoint_url: endpoint_url_netloc = urlsplit(self._endpoint_url).netloc mrap_netloc_components.append(endpoint_url_netloc) else: partition = s3_accesspoint['partition'] mrap_netloc_components.extend( [ 'accesspoint', region_name, self._get_partition_dns_suffix(partition), ] ) return '.'.join(mrap_netloc_components) def _get_accesspoint_netloc(self, request_context, region_name): s3_accesspoint = request_context['s3_accesspoint'] accesspoint_netloc_components = [ '{}-{}'.format(s3_accesspoint['name'], s3_accesspoint['account']), ] outpost_name = s3_accesspoint.get('outpost_name') if self._endpoint_url: if outpost_name: accesspoint_netloc_components.append(outpost_name) endpoint_url_netloc = urlsplit(self._endpoint_url).netloc accesspoint_netloc_components.append(endpoint_url_netloc) else: if outpost_name: outpost_host = [outpost_name, 's3-outposts'] accesspoint_netloc_components.extend(outpost_host) elif s3_accesspoint['service'] == 's3-object-lambda': component = self._inject_fips_if_needed( 's3-object-lambda', request_context ) accesspoint_netloc_components.append(component) else: component = self._inject_fips_if_needed( 's3-accesspoint', request_context ) accesspoint_netloc_components.append(component) if self._s3_config.get('use_dualstack_endpoint'): accesspoint_netloc_components.append('dualstack') accesspoint_netloc_components.extend( [region_name, self._get_dns_suffix(region_name)] ) return '.'.join(accesspoint_netloc_components) def _inject_fips_if_needed(self, component, request_context): if self._use_fips_endpoint: return f'{component}-fips' return component def _get_accesspoint_path(self, original_path, request_context): # The Bucket parameter was substituted with the access-point name as # some value was required in serializing the bucket name. Now that # we are making the request directly to the access point, we will # want to remove that access-point name from the path. name = request_context['s3_accesspoint']['name'] # All S3 operations require at least a / in their path. return original_path.replace('/' + name, '', 1) or '/' def _get_partition_dns_suffix(self, partition_name): dns_suffix = self._endpoint_resolver.get_partition_dns_suffix( partition_name ) if dns_suffix is None: dns_suffix = self._DEFAULT_DNS_SUFFIX return dns_suffix def _get_dns_suffix(self, region_name): resolved = self._endpoint_resolver.construct_endpoint( 's3', region_name ) dns_suffix = self._DEFAULT_DNS_SUFFIX if resolved and 'dnsSuffix' in resolved: dns_suffix = resolved['dnsSuffix'] return dns_suffix def _override_signing_region(self, request, region_name): signing_context = request.context.get('signing', {}) # S3SigV4Auth will use the context['signing']['region'] value to # sign with if present. This is used by the Bucket redirector # as well but we should be fine because the redirector is never # used in combination with the accesspoint setting logic. signing_context['region'] = region_name request.context['signing'] = signing_context def _override_signing_name(self, context, signing_name): signing_context = context.get('signing', {}) # S3SigV4Auth will use the context['signing']['signing_name'] value to # sign with if present. This is used by the Bucket redirector # as well but we should be fine because the redirector is never # used in combination with the accesspoint setting logic. signing_context['signing_name'] = signing_name context['signing'] = signing_context @CachedProperty def _use_accelerate_endpoint(self): # Enable accelerate if the configuration is set to to true or the # endpoint being used matches one of the accelerate endpoints. # Accelerate has been explicitly configured. if self._s3_config.get('use_accelerate_endpoint'): return True # Accelerate mode is turned on automatically if an endpoint url is # provided that matches the accelerate scheme. if self._endpoint_url is None: return False # Accelerate is only valid for Amazon endpoints. netloc = urlsplit(self._endpoint_url).netloc if not netloc.endswith('amazonaws.com'): return False # The first part of the url should always be s3-accelerate. parts = netloc.split('.') if parts[0] != 's3-accelerate': return False # Url parts between 's3-accelerate' and 'amazonaws.com' which # represent different url features. feature_parts = parts[1:-2] # There should be no duplicate url parts. if len(feature_parts) != len(set(feature_parts)): return False # Remaining parts must all be in the whitelist. return all(p in S3_ACCELERATE_WHITELIST for p in feature_parts) @CachedProperty def _addressing_style(self): # Use virtual host style addressing if accelerate is enabled or if # the given endpoint url is an accelerate endpoint. if self._use_accelerate_endpoint: return 'virtual' # If a particular addressing style is configured, use it. configured_addressing_style = self._s3_config.get('addressing_style') if configured_addressing_style: return configured_addressing_style @CachedProperty def _s3_addressing_handler(self): # If virtual host style was configured, use it regardless of whether # or not the bucket looks dns compatible. if self._addressing_style == 'virtual': logger.debug("Using S3 virtual host style addressing.") return switch_to_virtual_host_style # If path style is configured, no additional steps are needed. If # endpoint_url was specified, don't default to virtual. We could # potentially default provided endpoint urls to virtual hosted # style, but for now it is avoided. if self._addressing_style == 'path' or self._endpoint_url is not None: logger.debug("Using S3 path style addressing.") return None logger.debug( "Defaulting to S3 virtual host style addressing with " "path style addressing fallback." ) # By default, try to use virtual style with path fallback. return fix_s3_host class S3ControlEndpointSetter: _DEFAULT_PARTITION = 'aws' _DEFAULT_DNS_SUFFIX = 'amazonaws.com' _HOST_LABEL_REGEX = re.compile(r'^[a-zA-Z0-9\-]{1,63}$') def __init__( self, endpoint_resolver, region=None, s3_config=None, endpoint_url=None, partition=None, use_fips_endpoint=False, ): self._endpoint_resolver = endpoint_resolver self._region = region self._s3_config = s3_config self._use_fips_endpoint = use_fips_endpoint if s3_config is None: self._s3_config = {} self._endpoint_url = endpoint_url self._partition = partition if partition is None: self._partition = self._DEFAULT_PARTITION def register(self, event_emitter): event_emitter.register('before-sign.s3-control', self.set_endpoint) def set_endpoint(self, request, kwargs): if self._use_endpoint_from_arn_details(request): self._validate_endpoint_from_arn_details_supported(request) region_name = self._resolve_region_from_arn_details(request) self._resolve_signing_name_from_arn_details(request) self._resolve_endpoint_from_arn_details(request, region_name) self._add_headers_from_arn_details(request) elif self._use_endpoint_from_outpost_id(request): self._validate_outpost_redirection_valid(request) self._override_signing_name(request, 's3-outposts') new_netloc = self._construct_outpost_endpoint(self._region) self._update_request_netloc(request, new_netloc) def _use_endpoint_from_arn_details(self, request): return 'arn_details' in request.context def _use_endpoint_from_outpost_id(self, request): return 'outpost_id' in request.context def _validate_endpoint_from_arn_details_supported(self, request): if 'fips' in request.context['arn_details']['region']: raise UnsupportedS3ControlArnError( arn=request.context['arn_details']['original'], msg='Invalid ARN, FIPS region not allowed in ARN.', ) if not self._s3_config.get('use_arn_region', False): arn_region = request.context['arn_details']['region'] if arn_region != self._region: error_msg = ( 'The use_arn_region configuration is disabled but ' f'received arn for "{arn_region}" when the client is configured ' f'to use "{self._region}"' ) raise UnsupportedS3ControlConfigurationError(msg=error_msg) request_partion = request.context['arn_details']['partition'] if request_partion != self._partition: raise UnsupportedS3ControlConfigurationError( msg=( f'Client is configured for "{self._partition}" partition, but arn ' f'provided is for "{request_partion}" partition. The client and ' 'arn partition must be the same.' ) ) if self._s3_config.get('use_accelerate_endpoint'): raise UnsupportedS3ControlConfigurationError( msg='S3 control client does not support accelerate endpoints', ) if 'outpost_name' in request.context['arn_details']: self._validate_outpost_redirection_valid(request) def _validate_outpost_redirection_valid(self, request): if self._s3_config.get('use_dualstack_endpoint'): raise UnsupportedS3ControlConfigurationError( msg=( 'Client does not support s3 dualstack configuration ' 'when an outpost is specified.' ) ) def _resolve_region_from_arn_details(self, request): if self._s3_config.get('use_arn_region', False): arn_region = request.context['arn_details']['region'] # If we are using the region from the expanded arn, we will also # want to make sure that we set it as the signing region as well self._override_signing_region(request, arn_region) return arn_region return self._region def _resolve_signing_name_from_arn_details(self, request): arn_service = request.context['arn_details']['service'] self._override_signing_name(request, arn_service) return arn_service def _resolve_endpoint_from_arn_details(self, request, region_name): new_netloc = self._resolve_netloc_from_arn_details( request, region_name ) self._update_request_netloc(request, new_netloc) def _update_request_netloc(self, request, new_netloc): original_components = urlsplit(request.url) arn_details_endpoint = urlunsplit( ( original_components.scheme, new_netloc, original_components.path, original_components.query, '', ) ) logger.debug( f'Updating URI from {request.url} to {arn_details_endpoint}' ) request.url = arn_details_endpoint def _resolve_netloc_from_arn_details(self, request, region_name): arn_details = request.context['arn_details'] if 'outpost_name' in arn_details: return self._construct_outpost_endpoint(region_name) account = arn_details['account'] return self._construct_s3_control_endpoint(region_name, account) def _is_valid_host_label(self, label): return self._HOST_LABEL_REGEX.match(label) def _validate_host_labels(self, labels): for label in labels: if not self._is_valid_host_label(label): raise InvalidHostLabelError(label=label) def _construct_s3_control_endpoint(self, region_name, account): self._validate_host_labels(region_name, account) if self._endpoint_url: endpoint_url_netloc = urlsplit(self._endpoint_url).netloc netloc = [account, endpoint_url_netloc] else: netloc = [ account, 's3-control', ] self._add_dualstack(netloc) dns_suffix = self._get_dns_suffix(region_name) netloc.extend([region_name, dns_suffix]) return self._construct_netloc(netloc) def _construct_outpost_endpoint(self, region_name): self._validate_host_labels(region_name) if self._endpoint_url: return urlsplit(self._endpoint_url).netloc else: netloc = [ 's3-outposts', region_name, self._get_dns_suffix(region_name), ] self._add_fips(netloc) return self._construct_netloc(netloc) def _construct_netloc(self, netloc): return '.'.join(netloc) def _add_fips(self, netloc): if self._use_fips_endpoint: netloc[0] = netloc[0] + '-fips' def _add_dualstack(self, netloc): if self._s3_config.get('use_dualstack_endpoint'): netloc.append('dualstack') def _get_dns_suffix(self, region_name): resolved = self._endpoint_resolver.construct_endpoint( 's3', region_name ) dns_suffix = self._DEFAULT_DNS_SUFFIX if resolved and 'dnsSuffix' in resolved: dns_suffix = resolved['dnsSuffix'] return dns_suffix def _override_signing_region(self, request, region_name): signing_context = request.context.get('signing', {}) # S3SigV4Auth will use the context['signing']['region'] value to # sign with if present. This is used by the Bucket redirector # as well but we should be fine because the redirector is never # used in combination with the accesspoint setting logic. signing_context['region'] = region_name request.context['signing'] = signing_context def _override_signing_name(self, request, signing_name): signing_context = request.context.get('signing', {}) # S3SigV4Auth will use the context['signing']['signing_name'] value to # sign with if present. This is used by the Bucket redirector # as well but we should be fine because the redirector is never # used in combination with the accesspoint setting logic. signing_context['signing_name'] = signing_name request.context['signing'] = signing_context def _add_headers_from_arn_details(self, request): arn_details = request.context['arn_details'] outpost_name = arn_details.get('outpost_name') if outpost_name: self._add_outpost_id_header(request, outpost_name) def _add_outpost_id_header(self, request, outpost_name): request.headers['x-amz-outpost-id'] = outpost_name class S3ControlArnParamHandler: """This handler has been replaced by S3ControlArnParamHandlerv2. The original version remains in place for any third-party importers. """ _RESOURCE_SPLIT_REGEX = re.compile(r'[/:]') def __init__(self, arn_parser=None): self._arn_parser = arn_parser if arn_parser is None: self._arn_parser = ArnParser() warnings.warn( 'The S3ControlArnParamHandler class has been deprecated for a new ' 'internal replacement. A future version of botocore may remove ' 'this class.', category=FutureWarning, ) def register(self, event_emitter): event_emitter.register( 'before-parameter-build.s3-control', self.handle_arn, ) def handle_arn(self, params, model, context, kwargs): if model.name in ('CreateBucket', 'ListRegionalBuckets'): # CreateBucket and ListRegionalBuckets are special cases that do # not obey ARN based redirection but will redirect based off of the # presence of the OutpostId parameter self._handle_outpost_id_param(params, model, context) else: self._handle_name_param(params, model, context) self._handle_bucket_param(params, model, context) def _get_arn_details_from_param(self, params, param_name): if param_name not in params: return None try: arn = params[param_name] arn_details = self._arn_parser.parse_arn(arn) arn_details['original'] = arn arn_details['resources'] = self._split_resource(arn_details) return arn_details except InvalidArnException: return None def _split_resource(self, arn_details): return self._RESOURCE_SPLIT_REGEX.split(arn_details['resource']) def _override_account_id_param(self, params, arn_details): account_id = arn_details['account'] if 'AccountId' in params and params['AccountId'] != account_id: error_msg = ( 'Account ID in arn does not match the AccountId parameter ' 'provided: "{}"' ).format(params['AccountId']) raise UnsupportedS3ControlArnError( arn=arn_details['original'], msg=error_msg, ) params['AccountId'] = account_id def _handle_outpost_id_param(self, params, model, context): if 'OutpostId' not in params: return context['outpost_id'] = params['OutpostId'] def _handle_name_param(self, params, model, context): # CreateAccessPoint is a special case that does not expand Name if model.name == 'CreateAccessPoint': return arn_details = self._get_arn_details_from_param(params, 'Name') if arn_details is None: return if self._is_outpost_accesspoint(arn_details): self._store_outpost_accesspoint(params, context, arn_details) else: error_msg = 'The Name parameter does not support the provided ARN' raise UnsupportedS3ControlArnError( arn=arn_details['original'], msg=error_msg, ) def _is_outpost_accesspoint(self, arn_details): if arn_details['service'] != 's3-outposts': return False resources = arn_details['resources'] if len(resources) != 4: return False # Resource must be of the form outpost/op-123/accesspoint/name return resources[0] == 'outpost' and resources[2] == 'accesspoint' def _store_outpost_accesspoint(self, params, context, arn_details): self._override_account_id_param(params, arn_details) accesspoint_name = arn_details['resources'][3] params['Name'] = accesspoint_name arn_details['accesspoint_name'] = accesspoint_name arn_details['outpost_name'] = arn_details['resources'][1] context['arn_details'] = arn_details def _handle_bucket_param(self, params, model, context): arn_details = self._get_arn_details_from_param(params, 'Bucket') if arn_details is None: return if self._is_outpost_bucket(arn_details): self._store_outpost_bucket(params, context, arn_details) else: error_msg = ( 'The Bucket parameter does not support the provided ARN' ) raise UnsupportedS3ControlArnError( arn=arn_details['original'], msg=error_msg, ) def _is_outpost_bucket(self, arn_details): if arn_details['service'] != 's3-outposts': return False resources = arn_details['resources'] if len(resources) != 4: return False # Resource must be of the form outpost/op-123/bucket/name return resources[0] == 'outpost' and resources[2] == 'bucket' def _store_outpost_bucket(self, params, context, arn_details): self._override_account_id_param(params, arn_details) bucket_name = arn_details['resources'][3] params['Bucket'] = bucket_name arn_details['bucket_name'] = bucket_name arn_details['outpost_name'] = arn_details['resources'][1] context['arn_details'] = arn_details class S3ControlArnParamHandlerv2(S3ControlArnParamHandler): """Updated version of S3ControlArnParamHandler for use when EndpointRulesetResolver is in use for endpoint resolution. This class is considered private and subject to abrupt breaking changes or removal without prior announcement. Please do not use it directly. """ def __init__(self, arn_parser=None): self._arn_parser = arn_parser if arn_parser is None: self._arn_parser = ArnParser() def register(self, event_emitter): event_emitter.register( 'before-endpoint-resolution.s3-control', self.handle_arn, ) def _handle_name_param(self, params, model, context): # CreateAccessPoint is a special case that does not expand Name if model.name == 'CreateAccessPoint': return arn_details = self._get_arn_details_from_param(params, 'Name') if arn_details is None: return self._raise_for_fips_pseudo_region(arn_details) self._raise_for_accelerate_endpoint(context) if self._is_outpost_accesspoint(arn_details): self._store_outpost_accesspoint(params, context, arn_details) else: error_msg = 'The Name parameter does not support the provided ARN' raise UnsupportedS3ControlArnError( arn=arn_details['original'], msg=error_msg, ) def _store_outpost_accesspoint(self, params, context, arn_details): self._override_account_id_param(params, arn_details) def _handle_bucket_param(self, params, model, context): arn_details = self._get_arn_details_from_param(params, 'Bucket') if arn_details is None: return self._raise_for_fips_pseudo_region(arn_details) self._raise_for_accelerate_endpoint(context) if self._is_outpost_bucket(arn_details): self._store_outpost_bucket(params, context, arn_details) else: error_msg = ( 'The Bucket parameter does not support the provided ARN' ) raise UnsupportedS3ControlArnError( arn=arn_details['original'], msg=error_msg, ) def _store_outpost_bucket(self, params, context, arn_details): self._override_account_id_param(params, arn_details) def _raise_for_fips_pseudo_region(self, arn_details): # FIPS pseudo region names cannot be used in ARNs arn_region = arn_details['region'] if arn_region.startswith('fips-') or arn_region.endswith('fips-'): raise UnsupportedS3ControlArnError( arn=arn_details['original'], msg='Invalid ARN, FIPS region not allowed in ARN.', ) def _raise_for_accelerate_endpoint(self, context): s3_config = context['client_config'].s3 or {} if s3_config.get('use_accelerate_endpoint'): raise UnsupportedS3ControlConfigurationError( msg='S3 control client does not support accelerate endpoints', ) class ContainerMetadataFetcher: TIMEOUT_SECONDS = 2 RETRY_ATTEMPTS = 3 SLEEP_TIME = 1 IP_ADDRESS = '169.254.170.2' _ALLOWED_HOSTS = [ IP_ADDRESS, '169.254.170.23', 'fd00:ec2::23', 'localhost', ] def __init__(self, session=None, sleep=time.sleep): if session is None: session = botocore.httpsession.URLLib3Session( timeout=self.TIMEOUT_SECONDS ) self._session = session self._sleep = sleep def retrieve_full_uri(self, full_url, headers=None): """Retrieve JSON metadata from container metadata. :type full_url: str :param full_url: The full URL of the metadata service. This should include the scheme as well, e.g "http://localhost:123/foo" """ self._validate_allowed_url(full_url) return self._retrieve_credentials(full_url, headers) def _validate_allowed_url(self, full_url): parsed = botocore.compat.urlparse(full_url) if self._is_loopback_address(parsed.hostname): return is_whitelisted_host = self._check_if_whitelisted_host(parsed.hostname) if not is_whitelisted_host: raise ValueError( f"Unsupported host '{parsed.hostname}'. Can only retrieve metadata " f"from a loopback address or one of these hosts: {', '.join(self._ALLOWED_HOSTS)}" ) def _is_loopback_address(self, hostname): try: ip = ip_address(hostname) return ip.is_loopback except ValueError: return False def _check_if_whitelisted_host(self, host): if host in self._ALLOWED_HOSTS: return True return False def retrieve_uri(self, relative_uri): """Retrieve JSON metadata from container metadata. :type relative_uri: str :param relative_uri: A relative URI, e.g "/foo/bar?id=123" :return: The parsed JSON response. """ full_url = self.full_url(relative_uri) return self._retrieve_credentials(full_url) def _retrieve_credentials(self, full_url, extra_headers=None): headers = {'Accept': 'application/json'} if extra_headers is not None: headers.update(extra_headers) attempts = 0 while True: try: return self._get_response( full_url, headers, self.TIMEOUT_SECONDS ) except MetadataRetrievalError as e: logger.debug( "Received error when attempting to retrieve " "container metadata: %s", e, exc_info=True, ) self._sleep(self.SLEEP_TIME) attempts += 1 if attempts >= self.RETRY_ATTEMPTS: raise def _get_response(self, full_url, headers, timeout): try: AWSRequest = botocore.awsrequest.AWSRequest request = AWSRequest(method='GET', url=full_url, headers=headers) response = self._session.send(request.prepare()) response_text = response.content.decode('utf-8') if response.status_code != 200: raise MetadataRetrievalError( error_msg=( f"Received non 200 response {response.status_code} " f"from container metadata: {response_text}" ) ) try: return json.loads(response_text) except ValueError: error_msg = "Unable to parse JSON returned from container metadata services" logger.debug('%s:%s', error_msg, response_text) raise MetadataRetrievalError(error_msg=error_msg) except RETRYABLE_HTTP_ERRORS as e: error_msg = ( "Received error when attempting to retrieve " f"container metadata: {e}" ) raise MetadataRetrievalError(error_msg=error_msg) def full_url(self, relative_uri): return f'http://{self.IP_ADDRESS}{relative_uri}' def get_environ_proxies(url): if should_bypass_proxies(url): return {} else: return getproxies() def should_bypass_proxies(url): """ Returns whether we should bypass proxies or not. """ # NOTE: requests allowed for ip/cidr entries in no_proxy env that we don't # support current as urllib only checks DNS suffix # If the system proxy settings indicate that this URL should be bypassed, # don't proxy. # The proxy_bypass function is incredibly buggy on OS X in early versions # of Python 2.6, so allow this call to fail. Only catch the specific # exceptions we've seen, though: this call failing in other ways can reveal # legitimate problems. try: if proxy_bypass(urlparse(url).netloc): return True except (TypeError, socket.gaierror): pass return False def determine_content_length(body): # No body, content length of 0 if not body: return 0 # Try asking the body for it's length try: return len(body) except (AttributeError, TypeError): pass # Try getting the length from a seekable stream if hasattr(body, 'seek') and hasattr(body, 'tell'): try: orig_pos = body.tell() body.seek(0, 2) end_file_pos = body.tell() body.seek(orig_pos) return end_file_pos - orig_pos except io.UnsupportedOperation: # in case when body is, for example, io.BufferedIOBase object # it has "seek" method which throws "UnsupportedOperation" # exception in such case we want to fall back to "chunked" # encoding pass # Failed to determine the length return None def get_encoding_from_headers(headers, default='ISO-8859-1'): """Returns encodings from given HTTP Header Dict. :param headers: dictionary to extract encoding from. :param default: default encoding if the content-type is text """ content_type = headers.get('content-type') if not content_type: return None message = email.message.Message() message['content-type'] = content_type charset = message.get_param("charset") if charset is not None: return charset if 'text' in content_type: return default def calculate_md5(body, kwargs): """This function has been deprecated, but is kept for backwards compatibility.""" if isinstance(body, (bytes, bytearray)): binary_md5 = _calculate_md5_from_bytes(body) else: binary_md5 = _calculate_md5_from_file(body) return base64.b64encode(binary_md5).decode('ascii') def _calculate_md5_from_bytes(body_bytes): """This function has been deprecated, but is kept for backwards compatibility.""" md5 = get_md5(body_bytes) return md5.digest() def _calculate_md5_from_file(fileobj): """This function has been deprecated, but is kept for backwards compatibility.""" start_position = fileobj.tell() md5 = get_md5() for chunk in iter(lambda: fileobj.read(1024 * 1024), b''): md5.update(chunk) fileobj.seek(start_position) return md5.digest() def _is_s3express_request(params): endpoint_properties = params.get('context', {}).get( 'endpoint_properties', {} ) return endpoint_properties.get('backend') == 'S3Express' def has_checksum_header(params): """ Checks if a header starting with "x-amz-checksum-" is provided in a request. This function is considered private and subject to abrupt breaking changes or removal without prior announcement. Please do not use it directly. """ headers = params['headers'] # If a header matching the x-amz-checksum-* pattern is present, we # assume a checksum has already been provided by the user. for header in headers: if CHECKSUM_HEADER_PATTERN.match(header): return True return False def conditionally_calculate_checksum(params, kwargs): """This function has been deprecated, but is kept for backwards compatibility.""" if not has_checksum_header(params): conditionally_calculate_md5(params, kwargs) conditionally_enable_crc32(params, kwargs) def conditionally_enable_crc32(params, kwargs): """This function has been deprecated, but is kept for backwards compatibility.""" checksum_context = params.get('context', {}).get('checksum', {}) checksum_algorithm = checksum_context.get('request_algorithm') if ( _is_s3express_request(params) and params['body'] is not None and checksum_algorithm in (None, "conditional-md5") ): params['context']['checksum'] = { 'request_algorithm': { 'algorithm': 'crc32', 'in': 'header', 'name': 'x-amz-checksum-crc32', } } def conditionally_calculate_md5(params, kwargs): """Only add a Content-MD5 if the system supports it. This function has been deprecated, but is kept for backwards compatibility. """ body = params['body'] checksum_context = params.get('context', {}).get('checksum', {}) checksum_algorithm = checksum_context.get('request_algorithm') if checksum_algorithm and checksum_algorithm != 'conditional-md5': # Skip for requests that will have a flexible checksum applied return if has_checksum_header(params): # Don't add a new header if one is already available. return if _is_s3express_request(params): # S3Express doesn't support MD5 return if MD5_AVAILABLE and body is not None: md5_digest = calculate_md5(body, kwargs) params['headers']['Content-MD5'] = md5_digest class FileWebIdentityTokenLoader: def __init__(self, web_identity_token_path, _open=open): self._web_identity_token_path = web_identity_token_path self._open = _open def __call__(self): with self._open(self._web_identity_token_path) as token_file: return token_file.read() class SSOTokenLoader: def __init__(self, cache=None): if cache is None: cache = {} self._cache = cache def _generate_cache_key(self, start_url, session_name): input_str = start_url if session_name is not None: input_str = session_name return hashlib.sha1(input_str.encode('utf-8')).hexdigest() def save_token(self, start_url, token, session_name=None): cache_key = self._generate_cache_key(start_url, session_name) self._cache[cache_key] = token def __call__(self, start_url, session_name=None): cache_key = self._generate_cache_key(start_url, session_name) logger.debug(f'Checking for cached token at: {cache_key}') if cache_key not in self._cache: name = start_url if session_name is not None: name = session_name error_msg = f'Token for {name} does not exist' raise SSOTokenLoadError(error_msg=error_msg) token = self._cache[cache_key] if 'accessToken' not in token or 'expiresAt' not in token: error_msg = f'Token for {start_url} is invalid' raise SSOTokenLoadError(error_msg=error_msg) return token class EventbridgeSignerSetter: _DEFAULT_PARTITION = 'aws' _DEFAULT_DNS_SUFFIX = 'amazonaws.com' def __init__(self, endpoint_resolver, region=None, endpoint_url=None): self._endpoint_resolver = endpoint_resolver self._region = region self._endpoint_url = endpoint_url def register(self, event_emitter): event_emitter.register( 'before-parameter-build.events.PutEvents', self.check_for_global_endpoint, ) event_emitter.register( 'before-call.events.PutEvents', self.set_endpoint_url ) def set_endpoint_url(self, params, context, kwargs): if 'eventbridge_endpoint' in context: endpoint = context['eventbridge_endpoint'] logger.debug(f"Rewriting URL from {params['url']} to {endpoint}") params['url'] = endpoint def check_for_global_endpoint(self, params, context, kwargs): endpoint = params.get('EndpointId') if endpoint is None: return if len(endpoint) == 0: raise InvalidEndpointConfigurationError( msg='EndpointId must not be a zero length string' ) if not HAS_CRT: raise MissingDependencyException( msg="Using EndpointId requires an additional " "dependency. You will need to pip install " "botocore[crt] before proceeding." ) config = context.get('client_config') endpoint_variant_tags = None if config is not None: if config.use_fips_endpoint: raise InvalidEndpointConfigurationError( msg="FIPS is not supported with EventBridge " "multi-region endpoints." ) if config.use_dualstack_endpoint: endpoint_variant_tags = ['dualstack'] if self._endpoint_url is None: # Validate endpoint is a valid hostname component parts = urlparse(f'https://{endpoint}') if parts.hostname != endpoint: raise InvalidEndpointConfigurationError( msg='EndpointId is not a valid hostname component.' ) resolved_endpoint = self._get_global_endpoint( endpoint, endpoint_variant_tags=endpoint_variant_tags ) else: resolved_endpoint = self._endpoint_url context['eventbridge_endpoint'] = resolved_endpoint context['auth_type'] = 'v4a' def _get_global_endpoint(self, endpoint, endpoint_variant_tags=None): resolver = self._endpoint_resolver partition = resolver.get_partition_for_region(self._region) if partition is None: partition = self._DEFAULT_PARTITION dns_suffix = resolver.get_partition_dns_suffix( partition, endpoint_variant_tags=endpoint_variant_tags ) if dns_suffix is None: dns_suffix = self._DEFAULT_DNS_SUFFIX return f"https://{endpoint}.endpoint.events.{dns_suffix}/" def is_s3_accelerate_url(url): """Does the URL match the S3 Accelerate endpoint scheme? Virtual host naming style with bucket names in the netloc part of the URL are not allowed by this function. """ if url is None: return False # Accelerate is only valid for Amazon endpoints. url_parts = urlsplit(url) if not url_parts.netloc.endswith( 'amazonaws.com' ) or url_parts.scheme not in ['https', 'http']: return False # The first part of the URL must be s3-accelerate. parts = url_parts.netloc.split('.') if parts[0] != 's3-accelerate': return False # Url parts between 's3-accelerate' and 'amazonaws.com' which # represent different url features. feature_parts = parts[1:-2] # There should be no duplicate URL parts. if len(feature_parts) != len(set(feature_parts)): return False # Remaining parts must all be in the whitelist. return all(p in S3_ACCELERATE_WHITELIST for p in feature_parts) class JSONFileCache: """JSON file cache. This provides a dict like interface that stores JSON serializable objects. The objects are serialized to JSON and stored in a file. These values can be retrieved at a later time. """ CACHE_DIR = os.path.expanduser(os.path.join('~', '.aws', 'boto', 'cache')) def __init__(self, working_dir=CACHE_DIR, dumps_func=None): self._working_dir = working_dir if dumps_func is None: dumps_func = self._default_dumps self._dumps = dumps_func def _default_dumps(self, obj): return json.dumps(obj, default=self._serialize_if_needed) def __contains__(self, cache_key): actual_key = self._convert_cache_key(cache_key) return os.path.isfile(actual_key) def __getitem__(self, cache_key): """Retrieve value from a cache key.""" actual_key = self._convert_cache_key(cache_key) try: with open(actual_key) as f: return json.load(f) except (OSError, ValueError): raise KeyError(cache_key) def __delitem__(self, cache_key): actual_key = self._convert_cache_key(cache_key) try: key_path = Path(actual_key) key_path.unlink() except FileNotFoundError: raise KeyError(cache_key) def __setitem__(self, cache_key, value): full_key = self._convert_cache_key(cache_key) try: file_content = self._dumps(value) except (TypeError, ValueError): raise ValueError( f"Value cannot be cached, must be " f"JSON serializable: {value}" ) if not os.path.isdir(self._working_dir): os.makedirs(self._working_dir) with os.fdopen( os.open(full_key, os.O_WRONLY \| os.O_CREAT, 0o600), 'w' ) as f: f.truncate() f.write(file_content) def _convert_cache_key(self, cache_key): full_path = os.path.join(self._working_dir, cache_key + '.json') return full_path def _serialize_if_needed(self, value, iso=False): if isinstance(value, _DatetimeClass): if iso: return value.isoformat() return value.strftime('%Y-%m-%dT%H:%M:%S%Z') return value def is_s3express_bucket(bucket): if bucket is None: return False return bucket.endswith('--x-s3') # This parameter is not part of the public interface and is subject to abrupt # breaking changes or removal without prior announcement. # Mapping of services that have been renamed for backwards compatibility reasons. # Keys are the previous name that should be allowed, values are the documented # and preferred client name. SERVICE_NAME_ALIASES = {'runtime.sagemaker': 'sagemaker-runtime'} # This parameter is not part of the public interface and is subject to abrupt # breaking changes or removal without prior announcement. # Mapping to determine the service ID for services that do not use it as the # model data directory name. The keys are the data directory name and the # values are the transformed service IDs (lower case and hyphenated). CLIENT_NAME_TO_HYPHENIZED_SERVICE_ID_OVERRIDES = { # Actual service name we use -> Allowed computed service name. 'apigateway': 'api-gateway', 'application-autoscaling': 'application-auto-scaling', 'appmesh': 'app-mesh', 'autoscaling': 'auto-scaling', 'autoscaling-plans': 'auto-scaling-plans', 'ce': 'cost-explorer', 'cloudhsmv2': 'cloudhsm-v2', 'cloudsearchdomain': 'cloudsearch-domain', 'cognito-idp': 'cognito-identity-provider', 'config': 'config-service', 'cur': 'cost-and-usage-report-service', 'datapipeline': 'data-pipeline', 'directconnect': 'direct-connect', 'devicefarm': 'device-farm', 'discovery': 'application-discovery-service', 'dms': 'database-migration-service', 'ds': 'directory-service', 'ds-data': 'directory-service-data', 'dynamodbstreams': 'dynamodb-streams', 'elasticbeanstalk': 'elastic-beanstalk', 'elastictranscoder': 'elastic-transcoder', 'elb': 'elastic-load-balancing', 'elbv2': 'elastic-load-balancing-v2', 'es': 'elasticsearch-service', 'events': 'eventbridge', 'globalaccelerator': 'global-accelerator', 'iot-data': 'iot-data-plane', 'iot-jobs-data': 'iot-jobs-data-plane', 'iotevents-data': 'iot-events-data', 'iotevents': 'iot-events', 'iotwireless': 'iot-wireless', 'kinesisanalytics': 'kinesis-analytics', 'kinesisanalyticsv2': 'kinesis-analytics-v2', 'kinesisvideo': 'kinesis-video', 'lex-models': 'lex-model-building-service', 'lexv2-models': 'lex-models-v2', 'lex-runtime': 'lex-runtime-service', 'lexv2-runtime': 'lex-runtime-v2', 'logs': 'cloudwatch-logs', 'machinelearning': 'machine-learning', 'marketplacecommerceanalytics': 'marketplace-commerce-analytics', 'marketplace-entitlement': 'marketplace-entitlement-service', 'meteringmarketplace': 'marketplace-metering', 'mgh': 'migration-hub', 'sms-voice': 'pinpoint-sms-voice', 'resourcegroupstaggingapi': 'resource-groups-tagging-api', 'route53': 'route-53', 'route53domains': 'route-53-domains', 's3control': 's3-control', 'sdb': 'simpledb', 'secretsmanager': 'secrets-manager', 'serverlessrepo': 'serverlessapplicationrepository', 'servicecatalog': 'service-catalog', 'servicecatalog-appregistry': 'service-catalog-appregistry', 'stepfunctions': 'sfn', 'storagegateway': 'storage-gateway', }	132.31 KB	2025-05-25 12:26
📄 validate.py """User input parameter validation. This module handles user input parameter validation against a provided input model. Note that the objects in this module do not mutate any arguments. No type version happens here. It is up to another layer to properly convert arguments to any required types. Validation Errors ----------------- """ import decimal import json from datetime import datetime from botocore.exceptions import ParamValidationError from botocore.utils import is_json_value_header, parse_to_aware_datetime def validate_parameters(params, shape): """Validates input parameters against a schema. This is a convenience function that validates parameters against a schema. You can also instantiate and use the ParamValidator class directly if you want more control. If there are any validation errors then a ParamValidationError will be raised. If there are no validation errors than no exception is raised and a value of None is returned. :param params: The user provided input parameters. :type shape: botocore.model.Shape :param shape: The schema which the input parameters should adhere to. :raise: ParamValidationError """ validator = ParamValidator() report = validator.validate(params, shape) if report.has_errors(): raise ParamValidationError(report=report.generate_report()) def type_check(valid_types): def _create_type_check_guard(func): def _on_passes_type_check(self, param, shape, errors, name): if _type_check(param, errors, name): return func(self, param, shape, errors, name) def _type_check(param, errors, name): if not isinstance(param, valid_types): valid_type_names = [str(t) for t in valid_types] errors.report( name, 'invalid type', param=param, valid_types=valid_type_names, ) return False return True return _on_passes_type_check return _create_type_check_guard def range_check(name, value, shape, error_type, errors): failed = False min_allowed = float('-inf') if 'min' in shape.metadata: min_allowed = shape.metadata['min'] if value < min_allowed: failed = True elif hasattr(shape, 'serialization'): # Members that can be bound to the host have an implicit min of 1 if shape.serialization.get('hostLabel'): min_allowed = 1 if value < min_allowed: failed = True if failed: errors.report(name, error_type, param=value, min_allowed=min_allowed) class ValidationErrors: def __init__(self): self._errors = [] def has_errors(self): if self._errors: return True return False def generate_report(self): error_messages = [] for error in self._errors: error_messages.append(self._format_error(error)) return '\n'.join(error_messages) def _format_error(self, error): error_type, name, additional = error name = self._get_name(name) if error_type == 'missing required field': return ( f"Missing required parameter in {name}: " f"\"{additional['required_name']}\"" ) elif error_type == 'unknown field': unknown_param = additional['unknown_param'] valid_names = ', '.join(additional['valid_names']) return ( f'Unknown parameter in {name}: "{unknown_param}", ' f'must be one of: {valid_names}' ) elif error_type == 'invalid type': param = additional['param'] param_type = type(param) valid_types = ', '.join(additional['valid_types']) return ( f'Invalid type for parameter {name}, value: {param}, ' f'type: {param_type}, valid types: {valid_types}' ) elif error_type == 'invalid range': param = additional['param'] min_allowed = additional['min_allowed'] return ( f'Invalid value for parameter {name}, value: {param}, ' f'valid min value: {min_allowed}' ) elif error_type == 'invalid length': param = additional['param'] min_allowed = additional['min_allowed'] return ( f'Invalid length for parameter {name}, value: {param}, ' f'valid min length: {min_allowed}' ) elif error_type == 'unable to encode to json': return 'Invalid parameter {} must be json serializable: {}'.format( name, additional['type_error'], ) elif error_type == 'invalid type for document': param = additional['param'] param_type = type(param) valid_types = ', '.join(additional['valid_types']) return ( f'Invalid type for document parameter {name}, value: {param}, ' f'type: {param_type}, valid types: {valid_types}' ) elif error_type == 'more than one input': members = ', '.join(additional['members']) return ( f'Invalid number of parameters set for tagged union structure ' f'{name}. Can only set one of the following keys: ' f'{members}.' ) elif error_type == 'empty input': members = ', '.join(additional['members']) return ( f'Must set one of the following keys for tagged union' f'structure {name}: {members}.' ) def _get_name(self, name): if not name: return 'input' elif name.startswith('.'): return name[1:] else: return name def report(self, name, reason, **kwargs): self._errors.append((reason, name, kwargs)) class ParamValidator: """Validates parameters against a shape model.""" def validate(self, params, shape): """Validate parameters against a shape model. This method will validate the parameters against a provided shape model. All errors will be collected before returning to the caller. This means that this method will not stop at the first error, it will return all possible errors. :param params: User provided dict of parameters :param shape: A shape model describing the expected input. :return: A list of errors. """ errors = ValidationErrors() self._validate(params, shape, errors, name='') return errors def _check_special_validation_cases(self, shape): if is_json_value_header(shape): return self._validate_jsonvalue_string if shape.type_name == 'structure' and shape.is_document_type: return self._validate_document def _validate(self, params, shape, errors, name): special_validator = self._check_special_validation_cases(shape) if special_validator: special_validator(params, shape, errors, name) else: getattr(self, f'_validate_{shape.type_name}')( params, shape, errors, name ) def _validate_jsonvalue_string(self, params, shape, errors, name): # Check to see if a value marked as a jsonvalue can be dumped to # a json string. try: json.dumps(params) except (ValueError, TypeError) as e: errors.report(name, 'unable to encode to json', type_error=e) def _validate_document(self, params, shape, errors, name): if params is None: return if isinstance(params, dict): for key in params: self._validate_document(params[key], shape, errors, key) elif isinstance(params, list): for index, entity in enumerate(params): self._validate_document( entity, shape, errors, '%s[%d]' % (name, index) ) elif not isinstance(params, ((str,), int, bool, float)): valid_types = (str, int, bool, float, list, dict) valid_type_names = [str(t) for t in valid_types] errors.report( name, 'invalid type for document', param=params, param_type=type(params), valid_types=valid_type_names, ) @type_check(valid_types=(dict,)) def _validate_structure(self, params, shape, errors, name): if shape.is_tagged_union: if len(params) == 0: errors.report(name, 'empty input', members=shape.members) elif len(params) > 1: errors.report( name, 'more than one input', members=shape.members ) # Validate required fields. for required_member in shape.metadata.get('required', []): if required_member not in params: errors.report( name, 'missing required field', required_name=required_member, user_params=params, ) members = shape.members known_params = [] # Validate known params. for param in params: if param not in members: errors.report( name, 'unknown field', unknown_param=param, valid_names=list(members), ) else: known_params.append(param) # Validate structure members. for param in known_params: self._validate( params[param], shape.members[param], errors, f'{name}.{param}', ) @type_check(valid_types=(str,)) def _validate_string(self, param, shape, errors, name): # Validate range. For a string, the min/max constraints # are of the string length. # Looks like: # "WorkflowId":{ # "type":"string", # "min":1, # "max":256 # } range_check(name, len(param), shape, 'invalid length', errors) @type_check(valid_types=(list, tuple)) def _validate_list(self, param, shape, errors, name): member_shape = shape.member range_check(name, len(param), shape, 'invalid length', errors) for i, item in enumerate(param): self._validate(item, member_shape, errors, f'{name}[{i}]') @type_check(valid_types=(dict,)) def _validate_map(self, param, shape, errors, name): key_shape = shape.key value_shape = shape.value for key, value in param.items(): self._validate(key, key_shape, errors, f"{name} (key: {key})") self._validate(value, value_shape, errors, f'{name}.{key}') @type_check(valid_types=(int,)) def _validate_integer(self, param, shape, errors, name): range_check(name, param, shape, 'invalid range', errors) def _validate_blob(self, param, shape, errors, name): if isinstance(param, (bytes, bytearray, str)): return elif hasattr(param, 'read'): # File like objects are also allowed for blob types. return else: errors.report( name, 'invalid type', param=param, valid_types=[str(bytes), str(bytearray), 'file-like object'], ) @type_check(valid_types=(bool,)) def _validate_boolean(self, param, shape, errors, name): pass @type_check(valid_types=(float, decimal.Decimal) + (int,)) def _validate_double(self, param, shape, errors, name): range_check(name, param, shape, 'invalid range', errors) _validate_float = _validate_double @type_check(valid_types=(int,)) def _validate_long(self, param, shape, errors, name): range_check(name, param, shape, 'invalid range', errors) def _validate_timestamp(self, param, shape, errors, name): # We don't use @type_check because datetimes are a bit # more flexible. You can either provide a datetime # object, or a string that parses to a datetime. is_valid_type = self._type_check_datetime(param) if not is_valid_type: valid_type_names = [str(datetime), 'timestamp-string'] errors.report( name, 'invalid type', param=param, valid_types=valid_type_names ) def _type_check_datetime(self, value): try: parse_to_aware_datetime(value) return True except (TypeError, ValueError, AttributeError): # Yes, dateutil can sometimes raise an AttributeError # when parsing timestamps. return False class ParamValidationDecorator: def __init__(self, param_validator, serializer): self._param_validator = param_validator self._serializer = serializer def serialize_to_request(self, parameters, operation_model): input_shape = operation_model.input_shape if input_shape is not None: report = self._param_validator.validate( parameters, operation_model.input_shape ) if report.has_errors(): raise ParamValidationError(report=report.generate_report()) return self._serializer.serialize_to_request( parameters, operation_model )	13.44 KB	2025-05-25 12:26
📁 vendored	-	2025-05-25 12:26
📄 waiter.py # Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"). You # may not use this file except in compliance with the License. A copy of # the License is located at # # http://aws.amazon.com/apache2.0/ # # or in the "license" file accompanying this file. This file is # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF # ANY KIND, either express or implied. See the License for the specific # language governing permissions and limitations under the License. import logging import time from functools import partial import jmespath from botocore.context import with_current_context from botocore.docs.docstring import WaiterDocstring from botocore.useragent import register_feature_id from botocore.utils import get_service_module_name from . import xform_name from .exceptions import ClientError, WaiterConfigError, WaiterError logger = logging.getLogger(__name__) def create_waiter_with_client(waiter_name, waiter_model, client): """ :type waiter_name: str :param waiter_name: The name of the waiter. The name should match the name (including the casing) of the key name in the waiter model file (typically this is CamelCasing). :type waiter_model: botocore.waiter.WaiterModel :param waiter_model: The model for the waiter configuration. :type client: botocore.client.BaseClient :param client: The botocore client associated with the service. :rtype: botocore.waiter.Waiter :return: The waiter object. """ single_waiter_config = waiter_model.get_waiter(waiter_name) operation_name = xform_name(single_waiter_config.operation) operation_method = NormalizedOperationMethod( getattr(client, operation_name) ) # Create a new wait method that will serve as a proxy to the underlying # Waiter.wait method. This is needed to attach a docstring to the # method. def wait(self, kwargs): Waiter.wait(self, kwargs) wait.__doc__ = WaiterDocstring( waiter_name=waiter_name, event_emitter=client.meta.events, service_model=client.meta.service_model, service_waiter_model=waiter_model, include_signature=False, ) # Rename the waiter class based on the type of waiter. waiter_class_name = str( f'{get_service_module_name(client.meta.service_model)}.Waiter.{waiter_name}' ) # Create the new waiter class documented_waiter_cls = type(waiter_class_name, (Waiter,), {'wait': wait}) # Return an instance of the new waiter class. return documented_waiter_cls( waiter_name, single_waiter_config, operation_method ) def is_valid_waiter_error(response): error = response.get('Error') if isinstance(error, dict) and 'Code' in error: return True return False class NormalizedOperationMethod: def __init__(self, client_method): self._client_method = client_method def __call__(self, kwargs): try: return self._client_method(kwargs) except ClientError as e: return e.response class WaiterModel: SUPPORTED_VERSION = 2 def __init__(self, waiter_config): """ Note that the WaiterModel takes ownership of the waiter_config. It may or may not mutate the waiter_config. If this is a concern, it is best to make a copy of the waiter config before passing it to the WaiterModel. :type waiter_config: dict :param waiter_config: The loaded waiter config from the <service>.waiters.json file. This can be obtained from a botocore Loader object as well. """ self._waiter_config = waiter_config['waiters'] # These are part of the public API. Changing these # will result in having to update the consuming code, # so don't change unless you really need to. version = waiter_config.get('version', 'unknown') self._verify_supported_version(version) self.version = version self.waiter_names = list(sorted(waiter_config['waiters'].keys())) def _verify_supported_version(self, version): if version != self.SUPPORTED_VERSION: raise WaiterConfigError( error_msg=( "Unsupported waiter version, supported version " f"must be: {self.SUPPORTED_VERSION}, but version " f"of waiter config is: {version}" ) ) def get_waiter(self, waiter_name): try: single_waiter_config = self._waiter_config[waiter_name] except KeyError: raise ValueError(f"Waiter does not exist: {waiter_name}") return SingleWaiterConfig(single_waiter_config) class SingleWaiterConfig: """Represents the waiter configuration for a single waiter. A single waiter is considered the configuration for a single value associated with a named waiter (i.e TableExists). """ def __init__(self, single_waiter_config): self._config = single_waiter_config # These attributes are part of the public API. self.description = single_waiter_config.get('description', '') # Per the spec, these three fields are required. self.operation = single_waiter_config['operation'] self.delay = single_waiter_config['delay'] self.max_attempts = single_waiter_config['maxAttempts'] @property def acceptors(self): acceptors = [] for acceptor_config in self._config['acceptors']: acceptor = AcceptorConfig(acceptor_config) acceptors.append(acceptor) return acceptors class AcceptorConfig: def __init__(self, config): self.state = config['state'] self.matcher = config['matcher'] self.expected = config['expected'] self.argument = config.get('argument') self.matcher_func = self._create_matcher_func() @property def explanation(self): if self.matcher == 'path': return f'For expression "{self.argument}" we matched expected path: "{self.expected}"' elif self.matcher == 'pathAll': return ( f'For expression "{self.argument}" all members matched ' f'expected path: "{self.expected}"' ) elif self.matcher == 'pathAny': return ( f'For expression "{self.argument}" we matched expected ' f'path: "{self.expected}" at least once' ) elif self.matcher == 'status': return f'Matched expected HTTP status code: {self.expected}' elif self.matcher == 'error': return f'Matched expected service error code: {self.expected}' else: return f'No explanation for unknown waiter type: "{self.matcher}"' def _create_matcher_func(self): # An acceptor function is a callable that takes a single value. The # parsed AWS response. Note that the parsed error response is also # provided in the case of errors, so it's entirely possible to # handle all the available matcher capabilities in the future. # There's only three supported matchers, so for now, this is all # contained to a single method. If this grows, we can expand this # out to separate methods or even objects. if self.matcher == 'path': return self._create_path_matcher() elif self.matcher == 'pathAll': return self._create_path_all_matcher() elif self.matcher == 'pathAny': return self._create_path_any_matcher() elif self.matcher == 'status': return self._create_status_matcher() elif self.matcher == 'error': return self._create_error_matcher() else: raise WaiterConfigError( error_msg=f"Unknown acceptor: {self.matcher}" ) def _create_path_matcher(self): expression = jmespath.compile(self.argument) expected = self.expected def acceptor_matches(response): if is_valid_waiter_error(response): return return expression.search(response) == expected return acceptor_matches def _create_path_all_matcher(self): expression = jmespath.compile(self.argument) expected = self.expected def acceptor_matches(response): if is_valid_waiter_error(response): return result = expression.search(response) if not isinstance(result, list) or not result: # pathAll matcher must result in a list. # Also we require at least one element in the list, # that is, an empty list should not result in this # acceptor match. return False for element in result: if element != expected: return False return True return acceptor_matches def _create_path_any_matcher(self): expression = jmespath.compile(self.argument) expected = self.expected def acceptor_matches(response): if is_valid_waiter_error(response): return result = expression.search(response) if not isinstance(result, list) or not result: # pathAny matcher must result in a list. # Also we require at least one element in the list, # that is, an empty list should not result in this # acceptor match. return False for element in result: if element == expected: return True return False return acceptor_matches def _create_status_matcher(self): expected = self.expected def acceptor_matches(response): # We don't have any requirements on the expected incoming data # other than it is a dict, so we don't assume there's # a ResponseMetadata.HTTPStatusCode. status_code = response.get('ResponseMetadata', {}).get( 'HTTPStatusCode' ) return status_code == expected return acceptor_matches def _create_error_matcher(self): expected = self.expected def acceptor_matches(response): # When the client encounters an error, it will normally raise # an exception. However, the waiter implementation will catch # this exception, and instead send us the parsed error # response. So response is still a dictionary, and in the case # of an error response will contain the "Error" and # "ResponseMetadata" key. # When expected is True, accept any error code. # When expected is False, check if any errors were encountered. # Otherwise, check for a specific AWS error code. if expected is True: return "Error" in response and "Code" in response["Error"] elif expected is False: return "Error" not in response else: return response.get("Error", {}).get("Code", "") == expected return acceptor_matches class Waiter: def __init__(self, name, config, operation_method): """ :type name: string :param name: The name of the waiter :type config: botocore.waiter.SingleWaiterConfig :param config: The configuration for the waiter. :type operation_method: callable :param operation_method: A callable that accepts kwargs and returns a response. For example, this can be a method from a botocore client. """ self._operation_method = operation_method # The two attributes are exposed to allow for introspection # and documentation. self.name = name self.config = config @with_current_context(partial(register_feature_id, 'WAITER')) def wait(self, kwargs): acceptors = list(self.config.acceptors) current_state = 'waiting' # pop the invocation specific config config = kwargs.pop('WaiterConfig', {}) sleep_amount = config.get('Delay', self.config.delay) max_attempts = config.get('MaxAttempts', self.config.max_attempts) last_matched_acceptor = None num_attempts = 0 while True: response = self._operation_method(*kwargs) num_attempts += 1 for acceptor in acceptors: if acceptor.matcher_func(response): last_matched_acceptor = acceptor current_state = acceptor.state break else: # If none of the acceptors matched, we should # transition to the failure state if an error # response was received. if is_valid_waiter_error(response): # Transition to a failure state, which we # can just handle here by raising an exception. raise WaiterError( name=self.name, reason='An error occurred ({}): {}'.format( response['Error'].get('Code', 'Unknown'), response['Error'].get('Message', 'Unknown'), ), last_response=response, ) if current_state == 'success': logger.debug( "Waiting complete, waiter matched the " "success state." ) return if current_state == 'failure': reason = f'Waiter encountered a terminal failure state: {acceptor.explanation}' raise WaiterError( name=self.name, reason=reason, last_response=response, ) if num_attempts >= max_attempts: if last_matched_acceptor is None: reason = 'Max attempts exceeded' else: reason = ( f'Max attempts exceeded. Previously accepted state: ' f'{acceptor.explanation}' ) raise WaiterError( name=self.name, reason=reason, last_response=response, ) time.sleep(sleep_amount)	14.37 KB	2025-05-25 12:26

Edit File:

Terminal