File: //usr/lib/python3/dist-packages/cloudinit/config/__pycache__/cc_ca_certs.cpython-38.pyc
U
Ӈg�" � @ s� U d Z ddlZddlZddlmZmZmZ ddlmZ ddl m
Z
ddl m Z ddl
mZ e�e�Zddd d
d gd �Zd
d
dddgd �dddddgd �dddddgd �ddddd gd �dd
dddgd �d�ZdD ]Zed ee< q�d D ]Zed ee< q�d d d d!d"d#d dd$d%d&d'd(d)d*d+gZd,eed-d.gd/�Ze ed0< d1d2� Zd3d4� Zd5d6� Zd7d8� Zd9d:� Z d;d<� Z e e
ee dd=�d>d?�Z dS )@z CA Certs: Add ca certificates.� N)� lifecycle�subp�util)�Cloud)�Config)�
MetaSchema)� PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)� ca_cert_path�ca_cert_local_path�ca_cert_filename�ca_cert_config�ca_cert_update_cmdz/etc/ssl/certs/z#cloud-init-ca-cert-{cert_index}.pemz+/etc/ca-certificates/conf.d/cloud-init.confzupdate-ca-bundlez/etc/pki/ca-trust/z /usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trustz/etc/pki/trust/z/usr/share/pki/trust/z/etc/pki/tls/certs/zrehash_ca_certificates.sh)�aosc�fedora�rhel�opensuse�photon)�opensuse-microos�opensuse-tumbleweed�
opensuse-leap�sle_hpc� sle-micro�slesr )� almalinux�
cloudlinuxr r r r �alpine�debianr r r r r r r �ubuntur Z cc_ca_certs�ca_certs�ca-certs)�id�distrosZ frequencyZactivate_by_schema_keys�metac C s* t �| t�}tj�|d |d �|d< |S )z�Return a distro-specific ca_certs config dictionary
@param distro_name: String providing the distro class name.
@returns: Dict of distro configurations for ca_cert.
r
r �ca_cert_full_path)�DISTRO_OVERRIDES�get�DEFAULT_CONFIG�os�path�join)� distro_name�cfg� r, �>/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.py�_distro_ca_certs_configsj s �r. c C s t j | d dd� dS )z�
Updates the CA certificate cache on the current machine.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r
F)ZcaptureN)r ��
distro_cfgr, r, r- �update_ca_certsw s r1 c C sH |sdS t |d�D ]0\}}t|�}| d j|d�}tj||dd� qdS )a-
Adds certificates to the system. To actually apply the new certificates
you must also call the appropriate distro-specific utility such as
L{update_ca_certs}.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
@param certs: A list of certificate strings.
N� r# )�
cert_indexi� )�mode)� enumerate�str�formatr �
write_file)r0 Zcertsr3 �cZcert_file_contentsZcert_file_namer, r, r- � add_ca_certs� s �r: c C s@ | dkrt |� n*| dkr<t|� | dkr<d}tjd|d� dS )a.
Disables all default trusted CA certificates. For Alpine, Debian and
Ubuntu to actually apply the changes you must also call
L{update_ca_certs}.
@param distro_name: String providing the distro class name.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
)r r )r r r r )r r z8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selections�-)�dataN)�remove_default_ca_certs�disable_system_ca_certsr )r* r0 Z debconf_selr, r, r- �disable_default_ca_certs� s
�r? c C s� | d }|rt j�|�s dS d}d}t �|�jr�t�|�}g }|�� D ]\}||krbd}|�|� qF|dksv|d dkr�|�|� qF|s�|�|� d}|�d | � qFtj |d
�
|�d
d d � dS )
z�
For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
in order to disable it.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r Nz;# Modified by cloud-init to deselect certs due to user-dataFT� r )�#�!rB �
�wb)Zomode) r' r( �exists�stat�st_sizer Zload_text_file�
splitlines�appendr8 r) )r0 Zca_cert_cfg_fnZheader_commentZ added_headerZorigZ out_lines�liner, r, r- r> � s0 �
�r> c C s: | d dkrdS t �d� t�| d � t�| d � dS )z�
Removes all default trusted CA certificates from the system.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r Nz Deleting system CA certificatesr
)�LOG�debugr Zdelete_dir_contentsr/ r, r, r- r= � s
r= )�namer+ �cloud�args�returnc C s� d|krt jdddd� nd|kr2t�d| � dS d|krLd|krLt�d � |�d|�d��}t|jj�}d
|kr�t jd dd d� |�d
|�d
d��r�t�d� t |jj|� d|kr�t
� |d�}|r�t�dt |�� t
||� t�d� t|� dS )au
Call to handle ca_cert sections in cloud-config file.
@param name: The module name "ca_cert" from cloud.cfg
@param cfg: A nested dict containing the entire cloud config contents.
@param cloud: The L{CloudInit} object in use.
@param log: Pre-initialized Python logger object to use for logging.
@param args: Any module arguments from cloud.cfg
r zKey 'ca-certs'z22.1zUse 'ca_certs' instead.)Z
deprecatedZdeprecated_versionZ
extra_messager z<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszKey 'remove-defaults'z Use 'remove_defaults' instead.Zremove_defaultsFz'Disabling/removing default certificatesZtrustedzAdding %d certificateszUpdating certificates)r Z deprecaterK rL Zwarningr% r. �distrorM r? r Zget_cfg_option_list�lenr: r1 )rM r+ rN rO Z ca_cert_cfgr0 Z
trusted_certsr, r, r- �handle� sJ
��� �
�
rS )!�__doc__Zloggingr' Z cloudinitr r r Zcloudinit.cloudr Zcloudinit.configr Zcloudinit.config.schemar Zcloudinit.settingsr Z getLogger�__name__rK r& r$ rQ r! r" �__annotations__r. r1 r: r? r> r= r6 �listrS r, r, r, r- �<module> s�
� ������&��
'