shell bypass 403
3
���e]R � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZyd dlmZ W n ek
r` d dl mZ Y nX ddl
m Z ddl m
Z
mZmZmZmZmZ ddlmZmZmZ eje�ZdZdZG d d
� d
e �Z dS ) � N)�Thread� )�DistlibException)�HTTPBasicAuthHandler�Request�HTTPPasswordMgr�urlparse� build_opener� string_types)�cached_property�zip_dir� ServerProxyz https://pypi.python.org/pypi�pypic @ s� e Zd ZdZdZd*dd�Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z d+dd�Z d,dd�Z
d-dd�Zd.dd�Zd d � Zd/d d �Zd0d d!�Zd1d"d#�Zd$d%� Zd&d'� Zd2d(d)�ZdS )3� PackageIndexzc
This class represents a package index compatible with PyPI, the Python
Package Index.
s. ----------ThIs_Is_tHe_distlib_index_bouNdaRY_$Nc C s� |pt | _| j� t| j�\}}}}}}|s<|s<|s<|d krJtd| j ��d| _d| _d| _d| _d| _ t
t j d��R}xJd D ]B} y(t
j| dg||d �}
|
d
kr�| | _P W q| tk
r� Y q|X q|W W dQ R X dS )
z�
Initialise an instance.
:param url: The URL of the index. If not specified, the URL for PyPI is
used.
�http�httpszinvalid repository: %sN�w�gpg�gpg2z --version)�stdout�stderrr )r r )r r )�
DEFAULT_INDEX�url�read_configurationr r �password_handler� ssl_verifierr �gpg_home� rpc_proxy�open�os�devnull�
subprocessZ
check_call�OSError) �selfr �scheme�netloc�pathZparamsZqueryZfragZsink�s�rc� r) �/usr/lib/python3.6/index.py�__init__$ s(
zPackageIndex.__init__c C s& ddl m} ddlm} |� }||�S )zs
Get the distutils command for interacting with PyPI configurations.
:return: the command.
r )� Distribution)�
PyPIRCCommand)Zdistutils.corer, Zdistutils.configr- )r# r, r- �dr) r) r* �_get_pypirc_commandB s z PackageIndex._get_pypirc_commandc C sR | j � }| j|_|j� }|jd�| _|jd�| _|jdd�| _|jd| j�| _dS )z�
Read the PyPI access configuration as supported by distutils, getting
PyPI to do the actual work. This populates ``username``, ``password``,
``realm`` and ``url`` attributes from the configuration.
�username�password�realmr �
repositoryN)r/ r r3 Z _read_pypirc�getr0 r1 r2 )r# �cZcfgr) r) r* r L s z PackageIndex.read_configurationc C s$ | j � | j� }|j| j| j� dS )z�
Save the PyPI access configuration. You must have set ``username`` and
``password`` attributes before calling this method.
Again, distutils is used to do the actual work.
N)�check_credentialsr/ Z
_store_pypircr0 r1 )r# r5 r) r) r* �save_configuration[ s z PackageIndex.save_configurationc C s\ | j dks| jdkr td��t� }t| j�\}}}}}}|j| j|| j | j� t|�| _ dS )zp
Check that ``username`` and ``password`` have been set, and raise an
exception if not.
Nz!username and password must be set)
r0 r1 r r r r Z add_passwordr2 r r )r# Zpm�_r% r) r) r* r6 g s z PackageIndex.check_credentialsc C s\ | j � |j� |j� }d|d< | j|j� g �}| j|�}d|d< | j|j� g �}| j|�S )aq
Register a distribution on PyPI, using the provided metadata.
:param metadata: A :class:`Metadata` instance defining at least a name
and version number for the distribution to be
registered.
:return: The HTTP response received from PyPI upon submission of the
request.
Zverifyz:actionZsubmit)r6 �validate�todict�encode_request�items� send_request)r# �metadatar. �requestZresponser) r) r* �registers s
zPackageIndex.registerc C sJ x<|j � }|sP |jd�j� }|j|� tjd||f � qW |j� dS )ar
Thread runner for reading lines of from a subprocess into a buffer.
:param name: The logical name of the stream (used for logging only).
:param stream: The stream to read from. This will typically a pipe
connected to the output stream of a subprocess.
:param outbuf: The list to append the read lines to.
zutf-8z%s: %sN)�readline�decode�rstrip�append�logger�debug�close)r# �name�streamZoutbufr' r) r) r* �_reader� s
zPackageIndex._readerc C s� | j dddg}|dkr | j}|r.|jd|g� |dk rF|jdddg� tj� }tjj|tjj|�d �}|jd
d d |d
||g� t j
ddj|�� ||fS )a�
Return a suitable command for signing a file.
:param filename: The pathname to the file to be signed.
:param signer: The identifier of the signer of the file.
:param sign_password: The passphrase for the signer's
private key used for signing.
:param keystore: The path to a directory which contains the keys
used in verification. If not specified, the
instance's ``gpg_home`` attribute is used instead.
:return: The signing command as a list suitable to be
passed to :class:`subprocess.Popen`.
z --status-fd�2z--no-ttyNz --homedirz--batchz--passphrase-fd�0z.ascz
--detach-signz--armorz --local-userz--outputz invoking: %s� ) r r �extend�tempfileZmkdtempr r& �join�basenamerE rF )r# �filename�signer�
sign_password�keystore�cmdZtdZsfr) r) r* �get_sign_command� s
z PackageIndex.get_sign_commandc C s� t jt jd�}|dk r t j|d< g }g }t j|f|�}t| jd|j|fd�}|j� t| jd|j|fd�}|j� |dk r�|jj |� |jj
� |j � |j � |j � |j
||fS )a�
Run a command in a child process , passing it any input data specified.
:param cmd: The command to run.
:param input_data: If specified, this must be a byte string containing
data to be sent to the child process.
:return: A tuple consisting of the subprocess' exit code, a list of
lines read from the subprocess' ``stdout``, and a list of
lines read from the subprocess' ``stderr``.
)r r N�stdinr )�target�argsr )r! �PIPE�Popenr rJ r �startr rX �writerG �waitrP �
returncode) r# rV Z
input_data�kwargsr r �pZt1Zt2r) r) r* � run_command� s$
zPackageIndex.run_commandc
C sD | j ||||�\}}| j||jd��\}}} |dkr@td| ��|S )aR
Sign a file.
:param filename: The pathname to the file to be signed.
:param signer: The identifier of the signer of the file.
:param sign_password: The passphrase for the signer's
private key used for signing.
:param keystore: The path to a directory which contains the keys
used in signing. If not specified, the instance's
``gpg_home`` attribute is used instead.
:return: The absolute pathname of the file where the signature is
stored.
zutf-8r z&sign command failed with error code %s)rW rc �encoder )
r# rR rS rT rU rV �sig_filer( r r r) r) r* � sign_file� s
zPackageIndex.sign_file�sdist�sourcec C s( | j � tjj|�s td| ��|j� |j� }d} |rZ| jsJtj d� n| j
||||�} t |d��}
|
j � } W dQ R X t
j| �j� } t
j| �j� }
|jdd||| |
d�� dtjj|�| fg}| �rt | d��}
|
j � }W dQ R X |jd tjj| �|f� tjtjj| �� | j|j� |�}| j|�S )
a�
Upload a release file to the index.
:param metadata: A :class:`Metadata` instance defining at least a name
and version number for the file to be uploaded.
:param filename: The pathname of the file to be uploaded.
:param signer: The identifier of the signer of the file.
:param sign_password: The passphrase for the signer's
private key used for signing.
:param filetype: The type of the file being uploaded. This is the
distutils command which produced that file, e.g.
``sdist`` or ``bdist_wheel``.
:param pyversion: The version of Python which the release relates
to. For code compatible with any Python, this would
be ``source``, otherwise it would be e.g. ``3.2``.
:param keystore: The path to a directory which contains the keys
used in signing. If not specified, the instance's
``gpg_home`` attribute is used instead.
:return: The HTTP response received from PyPI upon submission of the
request.
z
not found: %sNz)no signing program available - not signed�rbZ file_upload�1)z:actionZprotocol_version�filetype� pyversion�
md5_digest�
sha256_digest�contentZ
gpg_signature)r6 r r& �existsr r9 r: r rE Zwarningrf r �read�hashlib�md5� hexdigestZsha256�updaterQ rD �shutilZrmtree�dirnamer; r< r= )r# r> rR rS rT rk rl rU r. re �fZ file_datarm rn �filesZsig_datar? r) r) r* � upload_file� s>
zPackageIndex.upload_filec
C s� | j � tjj|�s td| ��tjj|d�}tjj|�sFtd| ��|j� |j|j }}t
|�j � }d d|fd|fg}d||fg}| j ||�} | j
| �S )
a2
Upload documentation to the index.
:param metadata: A :class:`Metadata` instance defining at least a name
and version number for the documentation to be
uploaded.
:param doc_dir: The pathname of the directory which contains the
documentation. This should be the directory that
contains the ``index.html`` for the documentation.
:return: The HTTP response received from PyPI upon submission of the
request.
znot a directory: %rz
index.htmlz
not found: %r�:action�
doc_uploadrH �versionro )r{ r| )r6 r r& �isdirr rP rp r9 rH r} r �getvaluer; r= )
r# r> Zdoc_dir�fnrH r} Zzip_data�fieldsry r? r) r) r* �upload_documentation) s
z!PackageIndex.upload_documentationc C sT | j dddg}|dkr | j}|r.|jd|g� |jd||g� tjddj|�� |S ) a|
Return a suitable command for verifying a file.
:param signature_filename: The pathname to the file containing the
signature.
:param data_filename: The pathname to the file containing the
signed data.
:param keystore: The path to a directory which contains the keys
used in verification. If not specified, the
instance's ``gpg_home`` attribute is used instead.
:return: The verifying command as a list suitable to be
passed to :class:`subprocess.Popen`.
z --status-fdrK z--no-ttyNz --homedirz--verifyz invoking: %srM )r r rN rE rF rP )r# �signature_filename�
data_filenamerU rV r) r) r* �get_verify_commandE s z PackageIndex.get_verify_commandc C sH | j std��| j|||�}| j|�\}}}|dkr@td| ��|dkS )a6
Verify a signature for a file.
:param signature_filename: The pathname to the file containing the
signature.
:param data_filename: The pathname to the file containing the
signed data.
:param keystore: The path to a directory which contains the keys
used in verification. If not specified, the
instance's ``gpg_home`` attribute is used instead.
:return: True if the signature was verified, else False.
z0verification unavailable because gpg unavailabler r z(verify command failed with error code %s)r r )r r r� rc )r# r� r� rU rV r( r r r) r) r* �verify_signature] s z PackageIndex.verify_signaturec C sp |dkrd}t jd� n6t|ttf�r0|\}}nd}tt|�� }t jd| � t|d���}| jt |��}z�|j
� } d}
d} d} d}
d | kr�t | d
�} |r�||
|
| � xP|j |
�}|s�P | t
|�7 } |j|� |r�|j|� |
d7 }
|r�||
|
| � q�W W d|j� X W dQ R X | dk�r4| | k �r4td | | f ��|�rl|j� }||k�r`td ||||f ��t jd
|� dS )a
This is a convenience method for downloading a file from an URL.
Normally, this will be a file from the index, though currently
no check is made for this (i.e. a file can be downloaded from
anywhere).
The method is just like the :func:`urlretrieve` function in the
standard library, except that it allows digest computation to be
done during download and checking that the downloaded data
matched any expected value.
:param url: The URL of the file to be downloaded (assumed to be
available via an HTTP GET request).
:param destfile: The pathname where the downloaded file is to be
saved.
:param digest: If specified, this must be a (hasher, value)
tuple, where hasher is the algorithm used (e.g.
``'md5'``) and ``value`` is the expected value.
:param reporthook: The same as for :func:`urlretrieve` in the
standard library.
NzNo digest specifiedrs zDigest specified: %s�wbi r r zcontent-lengthzContent-Lengthz1retrieval incomplete: got only %d out of %d bytesz.%s digest mismatch for %s: expected %s, got %szDigest verified: %s���)rE rF �
isinstance�list�tuple�getattrrr r r= r �info�intrq �lenr^ ru rG r rt )r# r �destfileZdigestZ
reporthookZdigesterZhasherZdfpZsfp�headersZ blocksize�sizerq Zblocknum�block�actualr) r) r* �
download_filev sV
zPackageIndex.download_filec C s: g }| j r|j| j � | jr(|j| j� t|� }|j|�S )z�
Send a standard library :class:`Request` to PyPI and return its
response.
:param req: The request to send.
:return: The HTTP response from PyPI (a standard library HTTPResponse).
)r rD r r r )r# ZreqZhandlers�openerr) r) r* r= � s zPackageIndex.send_requestc C s� g }| j }xX|D ]P\}}t|ttf�s,|g}x2|D ]*}|jd| d| jd�d|jd�f� q2W qW x6|D ].\}} }
|jd| d|| f jd�d|
f� qjW |jd| d df� dj|�} d| } | tt| ��d�}
t | j
| |
�S ) a&
Encode fields and files for posting to an HTTP server.
:param fields: The fields to send as a list of (fieldname, value)
tuples.
:param files: The files to send as a list of (fieldname, filename,
file_bytes) tuple.
s --z)Content-Disposition: form-data; name="%s"zutf-8� z8Content-Disposition: form-data; name="%s"; filename="%s"s
s multipart/form-data; boundary=)z Content-typezContent-length) �boundaryr� r� r� rN rd rP �strr� r r )r# r� ry �partsr� �k�values�v�keyrR �valueZbodyZctr� r) r) r* r; � s2
zPackageIndex.encode_requestc C s> t |t�rd|i}| jd kr,t| jdd�| _| jj||p:d�S )NrH g @)Ztimeout�and)r� r
r r
r �search)r# Zterms�operatorr) r) r* r� � s
zPackageIndex.search)N)N)N)N)NNrg rh N)N)N)NN)N)�__name__�
__module__� __qualname__�__doc__r� r+ r/ r r7 r6 r@ rJ rW rc rf rz r� r� r� r� r= r; r� r) r) r) r* r s*
#
8
M+r ) rr Zloggingr rv r! rO Z threadingr � ImportErrorZdummy_threading� r �compatr r r r r r
�utilr r r
Z getLoggerr� rE r Z
DEFAULT_REALM�objectr r) r) r) r* �<module> s