+
    ˜qgjÌ  ã                   óÐ   € ^ RI t ^ RIt^ RIHtHt ^ RIHtHt ] P                  ! ]	4      t
]P                  ! R]P                  4      tR R ltR R ltR	 R
 ltR R ltR R ltR# )é    N)ÚListÚOptional)Ússh_utilÚsubpz7-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----c                ó0   € V ^8„  d   QhR\         R\         /# ©é   ÚkeyÚreturn©Ústr)Úformats   "Ú?/usr/lib/python3/dist-packages/cloudinit/sources/azure/certs.pyÚ__annotate__r      s   € ÷ ñ œcð ¤cñ ó    c                ó‚   € V P                  4       p RV 9   d(   \        P                  R4       V P                  RR4      p V # )a©  Sanitize an OpenSSH key by removing embedded CRLF sequences.

Azure-generated SSH keys may contain CRLF (\r\n) sequences embedded
in the base64 key data. This strips those sequences so the key can
be properly parsed and written to authorized_keys.

Note: Azure no longer generates keys with embedded CRLF sequences,
but previously provisioned keys may still be in use.

See https://bugs.launchpad.net/cloud-init/+bug/1910835
z
z5SSH key contains embedded CRLF sequences, sanitizing.Ú )ÚstripÚLOGÚdebugÚreplace)r
   s   &r   Úsanitize_openssh_keyr      s8   € ð �)‰)‹+€CØ�„}Ü�	‰	ÐIÔJØ�k‰k˜& "Ó%ˆØ€Jr   c                ó0   € V ^8„  d   QhR\         R\        /# r   ©r   Úbool)r   s   "r   r   r   &   s   € ÷ ñ œcð ¤dñ r   c                ó*  € V '       g   \         P                  R4       R# \        P                  ! 4       p VP	                  V 4      pTP                  f   \         P                  R4       R# R#   \
         d    \         P                  R4        R# i ; i)z®Validate whether or not the key is OpenSSH-formatted.

This checks if a given string is a valid OpenSSH public key format
(e.g., ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256).

zEmpty SSH key content provided.FzSSH key could not be parsed.zSSH key type is missing.T)r   r   r   ÚAuthKeyLineParserÚparseÚ	TypeErrorÚkeytype)r
   ÚparserÚakls   &  r   Úis_openssh_formattedr#   &   sx   € ÷ Ü�	‰	Ð3Ô4Ùä×'Ò'Ó)€FðØ�l‰l˜3Óˆð
 ‡{�{ÒÜ�	‰	Ð,Ô-Ùáøô ô Ü�	‰	Ð0Ô1Úðús   ¶A. Á. BÂBc                ó0   € V ^8„  d   QhR\         R\        /# )r	   Úcertr   r   )r   s   "r   r   r   ?   s   € ÷ ñ œcð ¤dñ r   c                ó†  € V '       g   \         P                  R4       R# V P                  4       p RV 9  d   \         P                  R4       R# RV 9  d   \         P                  R4       R#  . ROp\        P                  ! WR7       R#   \        P                   d"   p\         P                  R	T4        R
p?R# R
p?ii ; i)z©Check if the input string is an x509 certificate in PEM format.

This validates that the certificate is a valid x509 certificate by
attempting to parse it with openssl.
zEmpty certificate provided.Fz-----BEGIN CERTIFICATE-----zNo BEGIN CERTIFICATE marker.z-----END CERTIFICATE-----zNo END CERTIFICATE marker.©ÚdataTz#Certificate could not be parsed: %sN)ÚopensslÚx509ú-nooutz-text)r   r   r   r   ÚProcessExecutionError)r%   ÚcmdÚes   &  r   Úis_x509_certificater/   ?   s“   € ÷ Ü�	‰	Ð/Ô0Ùà�:‰:‹<€Dà$¨DÔ0Ü�	‰	Ð0Ô1Ùà"¨$Ô.Ü�	‰	Ð.Ô/ÙðÚ4ˆÜ�	Š	�#Õ!ÙøÜ×%Ñ%ô Ü�	‰	Ð7¸Ô;Ýûðús   Á-B
 Â
C ÂB;Â;C c                ó\   € V ^8„  d   QhR\         \        ,          R\        \        ,          /# )r	   r(   r   )r   r   r   )r   s   "r   r   r   ]   s"   € ÷ ñ ¤H¬S¥Mð ´d¼3µiñ r   c                óx  € V '       g   \         P                  R4       . # . p\        P                  V 4       Fb  pVP	                  ^ 4      p\        V4      '       d)   \         P                  R4       VP                  V4       KM  \         P                  R4       Kd  	  V'       g   \         P                  R4       V# )a’  Extract and validate all x509 certificates from a data bundle.

The data may contain a mix of certificates and private keys. This function
finds all valid x509 certificates and returns them.

Args:
    data: String containing certificate data, potentially mixed with
          private keys or other content. May be None.

Returns:
    A list of valid x509 certificate strings. Empty if none are found.
z,No data provided for certificate extraction.z4Successfully extracted x509 certificate from bundle.z8Found certificate block but validation failed, skipping.z0No valid x509 certificates found in data bundle.)r   r   Ú_CERTIFICATE_BLOCK_REÚfinditerÚgroupr/   Úappend)r(   ÚcertificatesÚmatchÚcertificates   &   r   Úextract_x509_certificatesr9   ]   s�   € ÷ Ü�	‰	Ð@ÔAØˆ	à€LÜ&×/Ñ/°Ö5ˆØ—k‘k !“nˆÜ˜{×+Ò+Ü�I‰IÐLÔMØ×Ñ Ö,ä�I‰IØJöñ 6÷ Ü�	‰	ÐDÔEàÐr   c                ó0   € V ^8„  d   QhR\         R\         /# )r	   r8   r   r   )r   s   "r   r   r      s   € ÷ ñ ¬ð ´ñ r   c                ó¢  € \         P                  R4       . ROp \        P                  ! WR7      w  r#. ROp \        P                  ! YRR7      w  rc\         P                  R4       T#   \        P                   d   p\         P	                  RT4       h Rp?ii ; i  \        P                   d   p\         P	                  RT4       h Rp?ii ; i)	z9Convert an x509 certificate to OpenSSH public key format.z9Converting x509 certificate to OpenSSH public key format.r'   z1Failed to extract public key from certificate: %sNz2Failed to convert public key to OpenSSH format: %sz:Successfully converted x509 certificate to OpenSSH format.)r)   r*   r+   z-pubkey)z
ssh-keygenz-iz-mÚPKCS8z-fz
/dev/stdin)r   r   r   r,   Úwarning)r8   Úopenssl_cmdÚpub_keyÚ_r.   Ú
keygen_cmdÚssh_keys   &      r   Úconvert_x509_to_opensshrC      s­   € ä‡I�IÐIÔJÚ:€KðÜ—Y’Y˜{Ô=‰
ˆò
 I€JðÜ—Y’Y˜zÔ8‰
ˆô
 ‡I�IÐJÔKØ€Nøô ×%Ñ%ô Ü�‰ÐGÈÔKØûðûô ×%Ñ%ô Ü�‰ÐHÈ!ÔLØûðús.   ›A) ¹B Á)BÁ>BÂBÂCÂ2C	Ã	C)ÚloggingÚreÚtypingr   r   Ú	cloudinitr   r   Ú	getLoggerÚ__name__r   ÚcompileÚDOTALLr2   r   r#   r/   r9   rC   © r   r   Ú<module>rM      sV   ðó
 Û 	ß !ç $à×Ò˜Ó!€àŸ
š
Ø>Ø‡I�IóÐ õõ&õ2õ<÷Dr   