+
    …WÝjK  ã                  ó   € R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIHt ^ RI	H
t
 ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ R	IHtHt ^ R
IHt ^ RIHtHt ] ! R R]4      4       t ! R R]4      t] ! R R]4      4       tR# )zHOptional security executables. Acquisition and publication belong to PM.)ÚannotationsN)ÚPath)Úurlparse)Úpaths)Únative)ÚLockfile)ÚInstallError)ÚBinaryPackageÚ_RUST_TRIPLE)Úregister)ÚMUSL_TARGETSÚflatten_single_dirc                  óV   a € ] tR t^tRtRtRRRR/tRR/tR R	 ltR
 V 3R llt	Rt
V ;t# )ÚBwsÚbwsTÚposixÚwin32zbws.exeúlinux-arm64-bionicú(upstream does not ship an Android binaryc               ó$   € V ^8„  d   QhRRRRRR/# ©é   ÚversionÚstrÚtargetÚreturn© )Úformats   "ÚHC:\Users\johnn\AppData\Local\hermes\hermes-agent\pm\security_packages.pyÚ__annotate__ÚBws.__annotate__   s&   € ÷ tñ t ð t¨cð t°cñ tó    c                	óŠ   € \         V,          P                  R R4      pVP                  R4      '       d   RMTpRV RV RV R2# )z	linux-gnuz
linux-muslÚdarwinzmacos-universalz;https://github.com/bitwarden/sdk-sm/releases/download/bws-vz/bws-Ú-z.zip)r
   ÚreplaceÚ
startswith)Úselfr   r   ÚtripleÚplatforms   &&&  r   Ú	fetch_urlÚBws.fetch_url   sU   € ô ˜fÕ%×-Ñ-¨k¸<ÓHˆØ(.×(9Ñ(9¸(×(CÒ(CÑ$ÈˆØLÈWÈIÐUZÐ[cÐZdÐdeÐfmÐenÐnrÐsÐsr!   c               ó(   € V ^8„  d   QhRRRRRRRR/# ©r   Ústagedr   r   r   r   r   ÚNoner   )r   s   "r   r   r    "   s(   € ÷  ñ   4ð  °#ð  ¸sð  Àtñ  r!   c                	ó¨   <€ \         SV `  WW44       V P                  W$4      pVe,   VP                  4       '       d   VP	                  R4       R # R # R # )Néí  )ÚsuperÚstageÚbinaryÚis_fileÚchmod)r'   Ústorer.   r   r   r4   Ú	__class__s   &&&&& €r   r3   Ú	Bws.stage"   sE   ø€ Ü‰‰�e WÔ5Ø—‘˜VÓ,ˆØÒ &§.¡.×"2Ò"2Ø�L‰L˜Öñ #3Ñr!   r   )Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__ÚnameÚoptionalÚ
binary_relÚgapsr*   r3   Ú__static_attributes__Ú__classcell__©r8   s   @r   r   r      s6   ø† à€DØ€HØ˜5 '¨9Ð5€JØ Ð"LÐM€Dõt÷ ö  r!   r   c                  ó^   a € ] tR t^)tRtRtRRRRRR/tR V 3R	 lltR
 R ltR R lt	Rt
V ;t# )Ú_SignedBinaryaÿ  The same PM artifact transaction also acquires pinned provenance files.

The consumer owns signature semantics, not a second downloader. Checksum
signatures must cover the *archive* pinned by PM, not an unrelated blob.
Every locked provenance artifact is required even without a verifier on
PATH. This intentionally strengthens cold-install availability: a missing
or corrupt signature/key/certificate cannot silently reduce the pinned
closure. Verifier execution remains optional; explicit rejection is fatal.
Tz	win32-x64z5this integration requires a Linux/macOS host (or WSL)zwin32-arm64r   r   c               ó(   € V ^8„  d   QhRRRRRRRR/# )r   Úarchiver   r.   r   r   r   r/   r   )r   s   "r   r   Ú_SignedBinary.__annotate__:   s(   € ÷ 'ñ '˜dð '¨Dð '¸#ð 'À$ñ 'r!   c                	ó  <€ VP                   P                  R4      '       dE   VR,          pVP                  RR7       \        P                  ! WVP                   ,          4       R# \
        SV `  WV4       \        V4       R# )ú.txtú.provenanceT)ÚparentsN)rK   z.sigz.pemz.asc)r>   ÚendswithÚmkdirÚshutilÚcopyfiler2   Úunpackr   )r'   rH   r.   r   Ú	directoryr8   s   &&&& €r   rR   Ú_SignedBinary.unpack:   s\   ø€ Ø�<‰<× Ñ Ð!A×BÒBØ Õ.ˆIØ�O‰O DˆOÔ)Ü�OŠO˜G°·±Õ%=Ö>ä‰G‰N˜7¨FÔ3Ü˜vÖ&r!   c               ó(   € V ^8„  d   QhRRRRRRRR/# r-   r   )r   s   "r   r   rI   C   s(   € ÷ +ñ + 4ð +°#ð +¸sð +Àtñ +r!   c                	óº  a€ V P                  W$4      pVe-   VP                  4       '       d   VP                  4       '       d   \        V P                  R4      hVP                  R4       VR,          p\        \        P                  ! 4       4      P                  V P                  V4      pV^ ,          p\        \        VR,          4      P                  4      P                  oR VR,          P                  RR7      P                  4        4       p	\        V3R	 lV	 4       R 4      p
W¨R
,          8w  d   \        V P                  R4      hV P!                  V4       R # )Nz$archive binary is not a regular filer1   rL   Úurlc              3  ó@   "  € T F  qP                  4       x € K  	  R # 5i©N)Úsplit)Ú.0Úlines   & r   Ú	<genexpr>Ú&_SignedBinary.stage.<locals>.<genexpr>L   s   é € ÐuÑ)t —
‘
—�Ó)tùs   ‚úchecksums.txtz	utf-8-sig)Úencodingc              3  ó˜   <"  € T F?  p\        V4      ^8X  g   K  V^,          P                  R4      S8X  g   K4  V^ ,          x € KA  	  R# 5i)r   Ú*N)ÚlenÚlstrip)r[   ÚrowÚfilenames   & €r   r]   r^   M   s;   øé € Ðd©4 C´3°s³8¸q±=œÀSÈÅVÇ]Á]ÐSVÓEWÐ[cÑEcœ˜˜QŸš«4ùs   ƒA
šA
¹A
Úsha256z1release checksums do not cover the pinned archive)r4   r5   Ú
is_symlinkr   r>   r6   r   r   Úlockfile_pathÚ	artifactsr   r   ÚpathÚ	read_textÚ
splitlinesÚnextÚverify_provenance)r'   r7   r.   r   r   r4   Ú
provenancerj   rH   ÚrowsÚexpectedrf   s   &&&&&      @r   r3   Ú_SignedBinary.stageC   s	  ø€ Ø—‘˜VÓ,ˆØŠ> §¡×!1Ò!1°V×5FÑ5F×5HÒ5HÜ˜tŸy™yÐ*PÓQÐQØ�‰�UÔØ˜mÕ+ˆ
ÜœU×0Ò0Ó2Ó3×=Ñ=¸d¿i¹iÈÓPˆ	Ø˜A•,ˆÜœ ¨¥Ó0×5Ñ5Ó6×;Ñ;ˆÙu¨*°Õ*F×)QÑ)QÐ[fÐ)QÓ)g×)rÑ)rÔ)tÓuˆÜÔd©4ÓdÐfjÓkˆØ˜xÕ(Ô(Ü˜tŸy™yÐ*]Ó^Ð^Ø×Ñ˜zÖ*r!   c               ó    € V ^8„  d   QhRRRR/# ©r   rS   r   r   r/   r   )r   s   "r   r   rI   R   s   € ÷ "ñ "¨4ð "°Dñ "r!   c                	ó   € \         hrY   )ÚNotImplementedError)r'   rS   s   &&r   ro   Ú_SignedBinary.verify_provenanceR   s   € Ü!Ð!r!   r   )r:   r;   r<   r=   Ú__doc__r?   rA   rR   r3   ro   rB   rC   rD   s   @r   rF   rF   )   sA   ø† ñð €HàÐLØÐNØÐHð€D÷'ð 'õ+÷"ó "r!   rF   c                  óV   € ] tR t^VtRtRR/tRtR R ltR R ltR R	 lt	R
 R lt
RtR# )Ú	IronProxyz
iron-proxyr   zphttps://raw.githubusercontent.com/paradigmxyz/iron-proxy/be5f255d0d9d10d8573bd65f480dd48a07772bf1/public-key.ascc               ó   € V ^8„  d   QhRR/# )r   r   Údictr   )r   s   "r   r   ÚIronProxy.__annotate__]   s   € ÷ !ñ !˜Dñ !r!   c                	ó   € ^ RI Hp V! 4       # )é    )Úallowlisted_env)Úagent.proxy_sources.iron_proxyr�   )r'   r�   s   & r   Ú
_probe_envÚIronProxy._probe_env]   s   € ÝBáÓ Ð r!   c               ó$   € V ^8„  d   QhRRRRRR/# r   r   )r   s   "r   r   r~   b   s&   € ÷ Gñ G ð G¨cð G°cñ Gr!   c           	     	ó˜   € V\         9   d   VP                  R 4      MTpVP                  R4      w  rEVR8X  d   RMTpRV RV RV RV R2	# )z-muslr$   Úx64Úamd64z=https://github.com/paradigmxyz/iron-proxy/releases/download/vz/iron-proxy_Ú_z.tar.gz)r   ÚremovesuffixrZ   )r'   r   r   Úlookup_targetr)   Úarchs   &&&   r   r*   ÚIronProxy.fetch_urlb   sr   € ð 9?Ä,Ô8N˜×+Ñ+¨GÔ4ÐTZˆØ&×,Ñ,¨SÓ1‰ˆØ %œ-‰w¨TˆØNÈwÈiÐWcÐdkÐclÐlmÐnvÐmwÐwxÐy}Ðx~ð  Fð  Gð  	Gr!   c               ó$   € V ^8„  d   QhRRRRRR/# )r   r   r   r   r   z	list[str]r   )r   s   "r   r   r~   j   s&   € ÷ eñ e #ð e¨sð e°yñ er!   c                	ó€   € V P                  W4      pVP                  R ^4      ^ ,          pW4 R2V R2V P                  .# )Ú/z/checksums.txtz/checksums.txt.asc)r*   ÚrsplitÚsigning_key_url)r'   r   r   rH   Úbases   &&&  r   Ú
fetch_urlsÚIronProxy.fetch_urlsj   sG   € Ø—.‘. Ó1ˆØ�~‰~˜c 1Ó% aÕ(ˆØ˜6 Ð0°T°FÐ:LÐ2MÈt×OcÑOcÐdÐdr!   c               ó    € V ^8„  d   QhRRRR/# ru   r   )r   s   "r   r   r~   o   s   € ÷ Sñ S¨4ð S°Dñ Sr!   c           
     	ó¨  € \         P                  ! R 4      pV'       g,   \        P                  ! \        4      P                  R4       R# \        P                  ! RR7      ;_uu_ 4       pVRVRR.pVR,          pVR	,          pVP                  4       '       d   VP                  4       '       g   \        V P                  R
4      h\        P                  ! . VORN\        V4      N\        P                  R^<RR7      pVP                  '       d5   \        P                  ! \        4      P                  R4        RRR4       R# \        P                  ! . VORN\        V4      N\        VR,          4      N\        P                  R^<RR7      pVP                  '       d   \        V P                  R4      h RRR4       R#   + '       g   i     R# ; i)Úgpgz=gpg unavailable; iron-proxy archive checksum remains enforcedNzhermes-iron-signature-)Úprefixz	--homedirz--batchz--no-ttyzchecksums.txt.asczpublic-key.asczpinned signature assets missingz--importTF)ÚstdinÚcapture_outputÚtimeoutÚcheckzJCould not import iron-proxy signing key; archive checksum remains enforcedz--verifyr_   z!GPG signature verification failed)rP   ÚwhichÚloggingÚ	getLoggerr:   ÚwarningÚtempfileÚTemporaryDirectoryr5   r   r>   Ú
subprocessÚrunr   ÚDEVNULLÚ
returncode)	r'   rS   r˜   ÚhomeÚargsÚ	signatureÚkeyÚimportedÚverifieds	   &&       r   ro   ÚIronProxy.verify_provenanceo   s€  € ô �lŠl˜5Ó!ˆßÜ×ÒœhÓ'×/Ñ/Ð0oÔpÙÜ×(Ò(Ð0H×IÕIÈTØ˜ d¨I°zÐBˆDØ!Ð$7Õ7ˆIØÐ.Õ.ˆCØ×$Ñ$×&Ò&¨c¯k©k¯mªmÜ" 4§9¡9Ð.OÓPÐPÜ!—~’~Ð&F¨Ð&F¨jÐ&F¼&À»+Ð&FÌj×N`ÑN`Ø59À2ÈUôTˆHà×"×"Ð"Ü×!Ò!¤(Ó+×3Ñ3ð  5Aô  BØ÷ JÑIô "—~’~Ð&q¨Ð&q¨jÐ&q¼&ÀÓ:KÐ&qÌVÐT]Ð`oÕToÓMpÐ&qÜ,6×,>Ñ,>ÈtÐ]_ÐglônˆHà×"×"Ð"Ü" 4§9¡9Ð.QÓRÐRð #÷ J×I×IÒIús   Á)AG Â/B
G ÅA2G Ç G	r   N)r:   r;   r<   r=   r>   r@   r’   rƒ   r*   r”   ro   rB   r   r!   r   r{   r{   V   s6   † à€DØ˜<Ð(€Jð I€Oõ!õ
Gõe÷
Sñ Sr!   r{   )ry   Ú
__future__r   rŸ   rP   r¤   r¢   Úpathlibr   Úurllib.parser   Úpmr   Úpm.filesystemr   Úpm.lockr   Ú
pm.packager   Úpm.packagesr	   r
   Úpm.registryr   Úpm.storer   r   r   rF   r{   r   r!   r   Ú<module>r¹      sx   ðÙ NÝ "ã Û Û Û Ý Ý !å Ý  Ý Ý #ß 3Ý  ß 5ð 
ô ˆ-ó  ó 
ð ô(*"�Mô *"ðZ 
ô-S�ó -Só 
ò-Sr!   