+
    ˜qgjY"  ã                   óÖ  a € R; t!0 t R t^ RIt^ RIt^ RIHtHtHt ^ RIH	t	 ^ RI
Ht ^ RIHt ^ RIHt ]P                   ! ]4      tRRRR	R
RRRRR./tRRRRRR
RRRRR./RRRRRR
RRRRR./RRRRRR
RRRRR./RRRRRR
RRRRR.//tR RR!RR"RR#RR$RR%RR&RR'RR(RR)RR*RR+R/t]! ]P/                  4       4      . R<O,           tR,R-R.]R/]R0R1R2./t] ^ k R3 tR4 tR5 tR6 tR7 tR8 tR9 R: lt R# )=zCA Certs: Add ca certificates.N)Ú	lifecycleÚsubpÚutil)ÚCloud)ÚConfig)Ú
MetaSchema)ÚPER_INSTANCEÚca_cert_pathÚca_cert_local_pathz!/usr/local/share/ca-certificates/Úca_cert_filenamez#cloud-init-ca-cert-{cert_index}.crtÚca_cert_configz/etc/ca-certificates.confÚca_cert_update_cmdzupdate-ca-certificatesÚaoscz/etc/ssl/certs/z#cloud-init-ca-cert-{cert_index}.pemz+/etc/ca-certificates/conf.d/cloud-init.confzupdate-ca-bundleÚrhelz/etc/pki/ca-trust/z/usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trustÚopensusez/etc/pki/trust/z/usr/share/pki/trust/Úphotonz/etc/pki/tls/certs/zrehash_ca_certificates.shÚ	almalinuxÚamazonÚcentosÚ
cloudlinuxÚfedorazopensuse-microoszopensuse-tumbleweedzopensuse-leapÚrockyÚsle_hpcz	sle-microÚslesÚidÚcc_ca_certsÚdistrosÚ	frequencyÚactivate_by_schema_keysÚca_certsúca-certsc                óÌ   € V \         9   d   \         V ,          p \        P                  V \        4      p\        P
                  P                  VR,          VR,          4      VR&   V# )z¦Return a distro-specific ca_certs config dictionary

@param distro_name: String providing the distro class name.
@returns: Dict of distro configurations for ca_cert.
r
   r   Úca_cert_full_path)ÚDISTRO_FAMILYÚDISTRO_OVERRIDESÚgetÚDEFAULT_CONFIGÚosÚpathÚjoin)Údistro_nameÚcfgs   & Ú>/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.pyÚ_distro_ca_certs_configsr-   Z   sX   € ð ”mÔ#Ü# KÕ0ˆÜ
×
Ñ
˜{¬NÓ
;€CÜ!Ÿw™wŸ|™|ØÐ Õ! 3Ð'9Õ#:ó €CÐÑð €Jó    c                óD   € \         P                   ! V R,          RR7       R# )z‚
Updates the CA certificate cache on the current machine.

@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r   F)ÚcaptureN)r   ©Ú
distro_cfgs   &r,   Úupdate_ca_certsr3   i   s   € ô 	‡I‚IˆjÐ-Õ.¸×>r.   c                ó¼   € V'       g   R# \        V^4       FA  w  r#\        V4      pV R,          P                  VR7      p\        P                  ! WTRR7       KC  	  R# )a  
Adds certificates to the system. To actually apply the new certificates
you must also call the appropriate distro-specific utility such as
L{update_ca_certs}.

@param distro_cfg: A hash providing _distro_ca_certs_configs function.
@param certs: A list of certificate strings.
Nr"   )Ú
cert_indexi¤  )Úmode)Ú	enumerateÚstrÚformatr   Ú
write_file)r2   Úcertsr5   ÚcÚcert_file_contentsÚcert_file_names   &&    r,   Úadd_ca_certsr?   r   sV   € ÷ Ùä" 5¨!Ö,‰ˆ
ä  ›VÐØ#Ð$7Õ8×?Ñ?Ø!ð @ó 
ˆô 	�Š˜À×Gó -r.   c                óœ   € V R9   d   \        V4       R# V R9   d1   \        V4       V R9   d   Rp\        P                  ! RVR7       R# R# R# )a  
Disables all default trusted CA certificates. For Alpine, Debian and
Ubuntu to actually apply the changes you must also call
L{update_ca_certs}.

@param distro_name: String providing the distro class name.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
)ÚdataN)r   r   r   )Úalpiner   Údebianúraspberry-pi-osÚubuntu)rC   rD   rE   z8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selectionsÚ-)Úremove_default_ca_certsÚdisable_system_ca_certsr   )r*   r2   Údebconf_sels   && r,   Údisable_default_ca_certsrJ   ‡   sY   € ð Ð2Ô2Ü 
Ö+Ø	ð ô 
ô 	  
Ô+àÐAÔAàOð ô �IŠIÐ5¸K×Hñ	 Bñ
r.   c                óv  € V R,          pV'       d&   \         P                  P                  V4      '       g   R# RpRp\         P                  ! V4      P                  '       d×   \
        P                  ! V4      p. pVP                  4        Fy  pWb8X  d   RpVP                  V4       K  VR8X  g   V^ ,          R9   d   VP                  V4       KF  V'       g   VP                  V4       RpVP                  RV,           4       K{  	  \
        P                  ! VRP                  V4      R,           R	R
7       R# R# )z¨
For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
in order to disable it.

@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r   Nz;# Modified by cloud-init to deselect certs due to user-dataFTÚ Ú!Ú
Úwb)Úomode)Ú#rM   )r'   r(   ÚexistsÚstatÚst_sizer   Úload_text_fileÚ
splitlinesÚappendr:   r)   )r2   Úca_cert_cfg_fnÚheader_commentÚadded_headerÚorigÚ	out_linesÚlines   &      r,   rH   rH   ¢   sý   € ð  Ð 0Õ1€Nç¤§¡§¡°×!?Ò!?Ùð 	Fð ð €Lä	‡w‚wˆ~Ó×&×&Ð&Ü×"Ò" >Ó2ˆØˆ	Ø—O‘OÖ%ˆDØÔ%Ø#�Ø× Ñ  Ö&Ø˜”˜t A�w¨*Ô4Ø× Ñ  Ö&ç#Ø×$Ñ$ ^Ô4Ø#'�LØ× Ñ   t¥Ö,ñ &ô 	�ŠØ˜DŸI™I iÓ0°4Õ7¸t÷	
ñ 'r.   c                ó¾   € V R,          f   R# \         P                  R4       \        P                  ! V R,          4       \        P                  ! V R,          4       R# )z†
Removes all default trusted CA certificates from the system.

@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r	   NzDeleting system CA certificatesr
   )ÚLOGÚdebugr   Údelete_dir_contentsr1   s   &r,   rG   rG   É   sF   € ð �.Õ!Ò)Ùä‡I�IÐ/Ô0Ü×Ò˜Z¨Õ7Ô8Ü×Ò˜ZÐ(<Õ=Ö>r.   c          
      óL   € V ^8„  d   QhR\         R\        R\        R\        RR/# )é   Únamer+   ÚcloudÚargsÚreturnN)r8   r   r   Úlist)r9   s   "r,   Ú__annotate__ri   ×   s/   € ÷ 8 ñ 8 ”ð 8 œ6ð 8 ¬%ð 8 ´tð 8 Àñ 8 r.   c                óh  € RV9   d   \         P                  ! RRRR7       MRV9  d   \        P                  RV 4       R# RV9   d   RV9   d   \        P	                  R	4       VP                  RVP                  R4      4      p\        V\        4      '       g   \        R
4      h\        VP                  P                  4      pRV9   d   \         P                  ! RRRR7       VP                  RVP                  RR4      4      '       d6   \        P                  R4       \        VP                  P                  V4       RV9   dJ   \        P                  ! VR4      pV'       d+   \        P                  R\        V4      4       \!        WV4       \        P                  R4       \#        V4       R# )aY  
Call to handle ca_cert sections in cloud-config file.

@param name: The module name "ca_cert" from cloud.cfg
@param cfg: A nested dict containing the entire cloud config contents.
@param cloud: The L{CloudInit} object in use.
@param log: Pre-initialized Python logger object to use for logging.
@param args: Any module arguments from cloud.cfg
r    zKey 'ca-certs'z22.1zUse 'ca_certs' instead.)Ú
deprecatedÚdeprecated_versionÚextra_messager   z<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zunexpected type: {ca_cert_cfg}zremove-defaultszKey 'remove-defaults'zUse 'remove_defaults' instead.Úremove_defaultsFz'Disabling/removing default certificatesÚtrustedzAdding %d certificateszUpdating certificates)r   Ú	deprecater_   r`   Úwarningr%   Ú
isinstanceÚdictÚ	TypeErrorr-   Údistrord   rJ   r   Úget_cfg_option_listÚlenr?   r3   )rd   r+   re   rf   Úca_cert_cfgr2   Útrusted_certss   &&&&   r,   Úhandlerz   ×   sf  € ð �SÔÜ×ÒØ'Ø%Ø3ö	
ð
 
˜3Ô	Ü�	‰	ØJØô	
ñ 	à�SÔ˜Z¨3Ô.Ü�‰ð"ô	
ð —'‘'˜* c§g¡g¨jÓ&9Ó:€KÜ�k¤4×(Ò(ÜÐ8Ó9Ð9Ü)¨%¯,©,×*;Ñ*;Ó<€Jð ˜KÔ'Ü×ÒØ.Ø%Ø:õ	
ð
 ‡�Ø˜;Ÿ?™?Ð+<¸eÓD÷ò ô 	�	‰	Ð;Ô<Ü  §¡×!2Ñ!2°JÔ?ð �KÔÜ×0Ò0°¸iÓHˆßÜ�I‰IÐ.´°MÓ0BÔCÜ˜Ô3ô ‡I�IÐ%Ô&Ü�JÖr.   c                ó@   € V ^8„  d   Qh/ ^ \         9   d
   \        ;R&   # )rc   Úmeta)Ú__conditional_annotations__r   )r9   s   "r,   ri   ri      s    € × $Ñ $÷Zò „jñ ò[ %r.   )r   rB   rC   rD   r   r   rE   r   )"r}   Ú__doc__Úloggingr'   Ú	cloudinitr   r   r   Úcloudinit.cloudr   Úcloudinit.configr   Úcloudinit.config.schemar   Úcloudinit.settingsr   Ú	getLoggerÚ__name__r_   r&   r$   r#   rh   Úkeysr   r|   r-   r3   r?   rJ   rH   rG   rz   ri   )r}   s   @r,   Ú<module>rˆ      s¿  øðö
 %ã Û 	ç +Ñ +Ý !Ý #Ý .Ý +à×Ò˜Ó!€ð �DØÐ=ØÐ=ØÐ1ØÐ3Ð4ð€ð ØÐ)ØÐ/ØÐAØÐGØÐ1Ð2ðð ØÐ,ØÐ?ØÐIØ˜$ØÐ0Ð1ðð ØÐ)ØÐ5ØÐIØ˜$ØÐ7Ð8ðð ØÐ-ØÐ/ØÐAØ˜$ØÐ:Ð;ðð-Ð ð@ �ØˆfØˆfØ�&ØˆfØ˜
Ø˜:Ø�ZØˆVØˆzØ�Ø
ˆJð€ñ ˆ}×!Ñ!Ó#Ó
$ò 	(õ 	€ð 	ˆ-ØˆwØ�Ø 
¨JÐ7ð	€ó òò?òHò*Iò6$
òN?÷8 r.   