Ë
    GKÕiùg  ã                   ó  — d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl	m
Z
mZmZmZmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZm Z  d dl!m"Z"m#Z#m$Z$  ejJ                  «       Z& e jN                   ejP                  e)«      «      Z*g d¢Z+ddgZ,e+e,z   e+e,z   e+dœZ-g d¢Z.g d¢Z/g d¢Z0e+e,z   e.z   e+e,z   e/z   e+e0z   dœZ1 G d„ dejd                  «      Z3 G d„ de3«      Z4 G d„ de3«      Z5 G d„ de4«      Z6y)é    N)Úgroupby)ÚListÚOptionalÚTuple)ÚapiÚaptÚevent_loggerÚ
exceptionsÚmessagesÚsystemÚutil)ÚNoCloudTypeReasonÚget_cloud_type)Úrepo)ÚEntitlementWithMessage)ÚApplicationStatus)Únotices)ÚNotice)ÚServicesOnceEnabledDataÚservices_once_enabled_file)ÚMessagingOperationsÚMessagingOperationsDictÚStaticAffordance)Ú
strongswanústrongswan-hmacúopenssh-clientúopenssh-serverúshim-signedúopenssh-client-hmacúopenssh-server-hmac)ÚxenialÚbionicÚfocal)Úopensslúlibssl1.0.0úlibssl1.0.0-hmac)r$   ú	libssl1.1úlibssl1.1-hmacÚlibgcrypt20úlibgcrypt20-hmacc            	       ón  ‡ — e Zd ZdZdZdZej                  ZdZ	dZ
ej                  j                  Zg d¢Zedefd„«       Zed„ «       Zd	edefd
„Zdej,                  fd„Zdefd„Zdej,                  fd„Z	 	 d#dej,                  deee      deddfˆ fd„Zdefd„Z	 d$dededdfd„Zdededefˆ fd„Z ede!e"df   fd„«       Z#edee   fˆ fd„«       Z$de!e%eejL                     f   fˆ fd„Z'd%d„Z(dej,                  defˆ fd„Z)dej,                  defˆ fd „Z*d!„ Z+dej,                  ddfˆ fd"„Z,ˆ xZ-S )&ÚFIPSCommonEntitlementié  zubuntu-pro-fips.gpgz/proc/sys/crypto/fips_enabledT)zfips-initramfszfips-initramfs-genericr)   r*   Úlibgmp10Úlibgnutls30Úlibhogweed6Ú
libnettle8r%   r&   r%   r&   r'   r(   Úlibssl3z
linux-fipsr   r   r   r    r$   úopenssl-fips-module-3r   r   r   úubuntu-fipszubuntu-aws-fipszubuntu-azure-fipsúubuntu-gcp-fipsÚreturnc                 óæ  — d }d }| j                   s�t        j                  «       rLt        j                  j                  | j                  ¬«      }| j                  «       st        j                  g}n| j                  }t        j                  d|ifg}d }| j                  sI| j                   s=t        j                  dt        j                  j                  | j                  ¬«      ifg}| j                   s| j                  i fgnd }||||dœ}t        | j                   «      dk(  rÌ| j                   d   }t#        j$                  d|«      }|r|j'                  d«      }	nd}	t        j(                  «       j*                  }
|	|
k7  rn|j-                  d«      xs g }t        j.                  j                  |	| j0                  |	|
xs d	¬
«      }|j3                  t        j                  d|if«       ||d<   |S )N©ÚtitleÚmsg)Ú
pre_enableÚpre_installÚpost_enableÚpre_disableé   r   zubuntu-([a-z]+)-fipsÚgenericr:   Úunknown)ÚvariantÚserviceÚbase_flavorÚcurrent_flavor)Úaccess_onlyr   Úis_containerr   Ú PROMPT_FIPS_CONTAINER_PRE_ENABLEÚformatr8   Úauto_upgrade_all_on_enableÚFIPS_RUN_APT_UPGRADEÚpre_enable_msgr   Úprompt_for_confirmationÚpurgeÚPROMPT_FIPS_PRE_DISABLEÚprompt_if_kernel_downgradeÚlenÚpackagesÚreÚmatchÚgroupÚget_kernel_infoÚflavorÚgetÚ#KERNEL_FLAVOR_CHANGE_WARNING_PROMPTÚnameÚappend)Úselfr:   r<   Úpre_enable_promptr=   r;   Ú	messagingÚubuntu_fips_package_nameÚ ubuntu_fips_package_flavor_matchÚubuntu_fips_package_flavorrD   r9   s               ú</usr/lib/python3/dist-packages/uaclient/entitlements/fips.pyr]   zFIPSCommonEntitlement.messaging„   s  € àˆ
Øˆà×ÒÜ×"Ñ"Ô$ä×=Ñ=×DÑDØ"Ÿj™jð Eó ð "ð
 ×6Ñ6Ô8Ü#+×#@Ñ#@Ð"A‘Kà$(×$7Ñ$7Ð!ô ×0Ñ0ØÐ-Ð.ððˆJð ˆØ�zŠz $×"2Ò"2ô ×0Ñ0àœx×?Ñ?×FÑFØ"&§*¡*ð  Gó  ððð	ˆKð$ ×#Ò#ð	 ×3Ñ3Øðñð ð 	ð %Ø&Ø&Ø&ñ	
ˆ	ô ˆt�}‰}Ó Ò"à'+§}¡}°QÑ'7Ð$Ü/1¯x©xØ&Ð(@ó0Ð,ñ 0à4×:Ñ:¸1Ó=ñ +ð .7Ð*Ü#×3Ñ3Ó5×<Ñ<ˆNØ)¨^Ò;Ø&Ÿ]™]¨<Ó8Ò>¸B�
Ü×BÑB×IÑIØ6Ø ŸI™IØ :Ø#1Ò#>°Yð	 Jó �ð ×!Ñ!ä×4Ñ4Ø ˜ðôð +5�	˜,Ñ'àÐó    c                 ó¾   — t        j                  «       j                  }t        j                  «       rt        j                  |g «      S t        j                  |g «      S )a…  
        Dictionary of conditional packages to be installed when
        enabling FIPS services. For example, if we are enabling
        FIPS services in a machine that has openssh-client installed,
        we will perform two actions:

        1. Upgrade the package to the FIPS version
        2. Install the corresponding hmac version of that package
           when available.
        )r   Úget_release_infoÚseriesrF   Ú#FIPS_CONTAINER_CONDITIONAL_PACKAGESrW   ÚFIPS_CONDITIONAL_PACKAGES)r[   re   s     ra   Úconditional_packagesz*FIPSCommonEntitlement.conditional_packagesÙ   sJ   € ô ×(Ñ(Ó*×1Ñ1ˆä×ÑÔ Ü6×:Ñ:¸6À2ÓFÐFä(×,Ñ,¨V°RÓ8Ð8rb   Ú
assume_yesc                ó¤  — t        j                  «       j                  }|€t        j	                  d«       yt        j                  d|«      }d}t        | j                  «      dk(  r| j                  d   }t        j                  |j                  dd«      «      }|��|�›|j                  d	«      }t        j                  d
||«       t        j                  ||«      dk  rYt        j!                  t"        j$                  j'                  ||¬«      «       t)        j*                  t"        j,                  |¬«      S yt        j	                  d||«       y)ztCheck if installing a FIPS kernel will downgrade the kernel
        and prompt for confirmation if it will.
        z Cannot gather kernel informationFz!(?P<kernel_version>\d+\.\d+\.\d+)r3   r>   r   ÚubuntuÚlinuxÚkernel_versionz*Kernel information: cur='%s' and fips='%s')Úcurrent_versionÚnew_version)r9   ri   z2Cannot gather kernel information for '%s' and '%s'T)r   rU   Úproc_version_signature_versionÚLOGÚwarningrR   ÚsearchrP   rQ   r   Úget_pkg_candidate_versionÚreplacerT   ÚdebugÚversion_compareÚeventÚinfor   ÚKERNEL_DOWNGRADE_WARNINGrH   r   rL   ÚPROMPT_YES_NO)r[   ri   Úour_full_kernel_strÚour_mÚfips_packageÚfips_kernel_version_strÚour_kernel_version_strs          ra   rO   z0FIPSCommonEntitlement.prompt_if_kernel_downgradeì   sQ  € ô ×"Ñ"Ó$×CÑCð 	ð Ð&Ü�K‰KÐ:Ô;ØÜ—	‘	Ø0Ð2Eó
ˆð %ˆÜˆt�}‰}Ó Ò"ØŸ=™=¨Ñ+ˆLô #&×"?Ñ"?Ø× Ñ  ¨7Ó3ó#
Ðð ÐÐ!8Ð!DØ%*§[¡[Ð1AÓ%BÐ"Ü�I‰IØ<Ø#Ø'ôô ×#Ñ#Ø+Ð-Cóð òô
 —
‘
Ü×5Ñ5×<Ñ<Ø(>Ø$;ð =ó ôô ×3Ñ3Ü ×.Ñ.¸:ôð ð ô �K‰KØDØ#Ø'ôð
 rb   Úprogressc           	      óŒ  — g }t        j                  «       }t        t        | j                  «      d„ ¬«      }|D ]  \  }}||v sŒ||z  }Œ |D ]   }	 t        j
                  |gddig d¢¬«       Œ" y # t        j                  $ r> |j                  dt        j                  j                  | j                  |¬«      «       Y Œtw xY w)	Nc                 ó&   — | j                  dd«      S )Nz-hmacÚ )ru   )Úpkg_names    ra   ú<lambda>zNFIPSCommonEntitlement.hardcoded_install_conditional_packages.<locals>.<lambda>-  s   €  ×!1Ñ!1°'¸2Ó!>€ rb   )ÚkeyÚDEBIAN_FRONTENDÚnoninteractive©z--allow-downgradesz$-o Dpkg::Options::="--force-confdef"z$-o Dpkg::Options::="--force-confold"©rQ   Úoverride_env_varsÚapt_optionsry   )rB   Úpkg)r   Úget_installed_packages_namesr   Úsortedrh   Úrun_apt_install_commandr
   ÚUbuntuProErrorÚemitr   ÚFIPS_PACKAGE_NOT_AVAILABLErH   r8   )r[   r�   Údesired_packagesÚinstalled_packagesÚ
pkg_groupsr…   Úpkg_listrŽ   s           ra   Ú&hardcoded_install_conditional_packagesz<FIPSCommonEntitlement.hardcoded_install_conditional_packages$  sÝ   € ð
 ÐÜ ×=Ñ=Ó?ÐÜÜ�4×,Ñ,Ó-Ù>ô
ˆ
ð
 #-ò 	-ÑˆH�hØÐ-Ò-Ø  HÑ,Ñ ð	-ð $ò 	ˆCðÜ×+Ñ+Ø!˜UØ'8Ð:JÐ&Kò!öñ	øô ×,Ñ,ò Ø—‘ØÜ×7Ñ7×>Ñ>Ø $§
¡
°ð ?ó öðús   ÁA2Á2ACÃCc                 ó¦   — t        j                  | j                  j                  d¬«      }t        j                  «       j
                  dv }|xs | S )Nzfeatures.fips_auto_upgrade_all©ÚconfigÚpath_to_value>   r#   r"   r!   )r   Úis_config_value_trueÚcfgr   rd   re   )r[   Úinstall_all_updates_overrideÚhardcoded_releases      ra   rI   z0FIPSCommonEntitlement.auto_upgrade_all_on_enableG  sT   € Ü'+×'@Ñ'@Ø—8‘8—<‘<Ð/Oô(
Ð$ô #×3Ñ3Ó5×<Ñ<ð A
ð 
Ðð
 ,ÒDÐ3DÐ/DÐDrb   c                 óh  — t        j                  | j                  «      D �cg c]  }|j                  ‘Œ }}t	        j
                  «       j                  dk(  r|j                  d«       |j                  «        t        |«      dkD  rn	 |j                  dt        j                  j                  dj                  |«      ¬«      «       | j                  |«       t        j                   |ddig d	¢¬
«       y y c c}w # t"        j$                  $ r# |j                  dt        j&                  «       Y y w xY w)NÚjammyr2   r   ry   ú )rQ   rˆ   r‰   rŠ   r‹   )r   Ú;get_installed_packages_with_uninstalled_candidate_in_originÚoriginrY   r   rd   re   rZ   ÚsortrP   r“   r   ÚINSTALLING_PACKAGESrH   ÚjoinÚunhold_packagesr‘   r
   r’   ÚFIPS_PACKAGES_UPGRADE_FAILURE)r[   r�   ÚpackageÚ
to_upgrades       ra   Ú#install_all_available_fips_upgradesz9FIPSCommonEntitlement.install_all_available_fips_upgradesS  s  € ô
 ×ZÑZØ—‘óö
àð �L‹Lð
ˆ
ð 
ô ×"Ñ"Ó$×+Ñ+¨wÒ6Ø×ÑÐ5Ô6à�‰ÔÜˆz‹?˜QÒðNØ—‘ØÜ×0Ñ0×7Ñ7Ø!$§¡¨*Ó!5ð 8ó ôð ×$Ñ$ ZÔ0Ü×+Ñ+Ø'Ø'8Ð:JÐ&Kò!öð ùò
øô< ×,Ñ,ò NØ—‘˜f¤h×&LÑ&LÖMðNús   ¢C6ÂA,C; Ã;3D1Ä0D1NÚpackage_listÚcleanup_on_failurec                 ó†  •— | j                   }|rt        ‰| �	  ||¬«       n9|j                  t        j
                  j                  | j                  ¬«      «       | j                  «       r| j                  |«       n| j                  |«       | j                  «       r$t        j                  t        j                  «       yy)zïInstall contract recommended packages for the entitlement.

        :param package_list: Optional package list to use instead of
            self.packages.
        :param cleanup_on_failure: Cleanup apt files if apt install fails.
        )r¯   r7   N)rQ   ÚsuperÚinstall_packagesr�   r   ÚINSTALLING_SERVICE_PACKAGESrH   r8   rI   r®   r™   Ú_check_for_rebootr   Úaddr   ÚFIPS_SYSTEM_REBOOT_REQUIRED)r[   r�   r¯   r°   Úmandatory_packagesÚ	__class__s        €ra   r³   z&FIPSCommonEntitlement.install_packagesw  s¥   ø€ ð "Ÿ]™]ÐÙÜ‰GÑ$ØØ/ð %õ ð ×ÑÜ×4Ñ4×;Ñ;À$Ç*Á*Ð;ÓMôð ×*Ñ*Ô,Ø×4Ñ4°XÕ>à×7Ñ7¸ÔAà×!Ñ!Ô#Ü�K‰KÜ×2Ñ2õð $rb   c                 ó*   — t        j                  «       S )z=Check if system needs to be rebooted because of this service.)r   Úshould_reboot)r[   s    ra   rµ   z'FIPSCommonEntitlement._check_for_reboot�  s   € ä×#Ñ#Ó%Ð%rb   Ú	operationÚsilentc                 ó  — | j                  «       }t        j                  |«       |r_|s3t        j                  t        j
                  j                  |¬«      «       |dk(  r$t        j                  t        j                  «       yyy)zËCheck if user should be alerted that a reboot must be performed.

        @param operation: The operation being executed.
        @param silent: Boolean set True to silence print/log of messages
        )r¼   zdisable operationN)rµ   rx   Úneeds_rebootry   r   ÚENABLE_REBOOT_REQUIRED_TMPLrH   r   r¶   r   ÚFIPS_DISABLE_REBOOT_REQUIRED)r[   r¼   r½   Úreboot_requireds       ra   Ú_check_for_reboot_msgz+FIPSCommonEntitlement._check_for_reboot_msg¡  sy   € ð ×0Ñ0Ó2ˆÜ×Ñ˜?Ô+ÙÙÜ—
‘
Ü×8Ñ8×?Ñ?Ø"+ð @ó ôð
 Ð/Ò/Ü—‘Ü×7Ñ7õð 0ð rb   re   Úcloud_idc                 óœ   •— |dk(  rFt        j                  | j                  j                  d¬«      ry|dv ryt        dt        ‰| �  v «      S y)aV  Return False when FIPS is allowed on this cloud and series.

        On Xenial GCP there will be no cloud-optimized kernel so
        block default ubuntu-fips enable. This can be overridden in
        config with features.allow_xenial_fips_on_cloud.

        GCP doesn't yet have a cloud-optimized kernel or metapackage so
        block enable of fips if the contract does not specify ubuntu-gcp-fips.
        This also can be overridden in config with
        features.allow_default_fips_metapackage_on_gcp.

        :return: False when this cloud, series or config override allows FIPS.
        Úgcez.features.allow_default_fips_metapackage_on_gcpr›   T)r"   r#   r4   )r   rž   rŸ   Úboolr²   rQ   )r[   re   rÄ   r¹   s      €ra   Ú_allow_fips_on_cloud_instancez3FIPSCommonEntitlement._allow_fips_on_cloud_instance·  sU   ø€ ð  �uÒÜ×(Ñ(Ø—x‘x—|‘|ØNõð ð Ð,Ñ,ØäÐ)¬U©WÑ-=Ð=Ó>Ð>àrb   .c                 ó  ‡ ‡‡— ddddœ}t        «       \  Š}‰€dŠt        j                  «       j                  Št        j
                  j                  ‰j                  «       |j                  ‰«      ¬«      }|ˆˆ ˆfd„dffS )	Nzan AWSzan Azureza GCP)ÚawsÚazurerÆ   r„   )re   Úcloudc                  ó(   •— ‰j                  ‰‰ «      S ©N)rÈ   )rÄ   r[   re   s   €€€ra   r†   z:FIPSCommonEntitlement.static_affordances.<locals>.<lambda>ä  s   ø€ ˜×:Ñ:¸6À8ÓL€ rb   T)	r   r   rd   re   r   ÚFIPS_BLOCK_ON_CLOUDrH   r8   rW   )r[   Úcloud_titlesÚ_Úblocked_messagerÄ   re   s   `   @@ra   Ústatic_affordancesz(FIPSCommonEntitlement.static_affordancesÖ  s…   ú€ à'°*ÀWÑMˆÜ$Ó&‰ˆ�!ØÐØˆHä×(Ñ(Ó*×1Ñ1ˆÜ"×6Ñ6×=Ñ=Ø—<‘<“>¨×)9Ñ)9¸(Ó)Cð >ó 
ˆð
  ÝLØðð
ð 	
rb   c                 óD   •— t        j                  «       rg S t        ‰| �  S rÎ   )r   rF   r²   rQ   ©r[   r¹   s    €ra   rQ   zFIPSCommonEntitlement.packagesé  s   ø€ ä×ÑÔ ØˆIÜ‰wÑÐrb   c                 ó”  •— t         ‰| �  «       \  }}t        j                  «       r;t        j                  «       s't        j                  t        j                  «       ||fS t        j                  j                  | j                  «      rÿt        j                  t        | j                  «      «      s#t        j                  t        j                  «       t        j                  | j                  «      j!                  «       dk(  r't        j                  t        j"                  «       ||fS t        j$                  t        j"                  «       t&        j(                  t*        j,                  j/                  | j                  ¬«      fS |t&        j0                  k7  r||fS t3        j4                  «       }g }| j                  D ]  }||vsŒ|j7                  |«       Œ |rJt&        j8                  t*        j:                  j/                  dj=                  |«      | j>                  ¬«      fS t&        j0                  t*        j@                  fS )NÚ1)Ú	file_namer¤   )rQ   rB   )!r²   Úapplication_statusr   rF   r»   r   Úremover   r·   ÚosÚpathÚexistsÚFIPS_PROC_FILEÚsetrQ   Ú	load_fileÚstripÚFIPS_MANUAL_DISABLE_URLr¶   r   ÚDISABLEDr   ÚFIPS_PROC_FILE_ERRORrH   ÚENABLEDr   r�   rZ   ÚWARNINGÚFIPS_PACKAGES_NOT_INSTALLEDr©   rY   ÚFIPS_REBOOT_REQUIRED)r[   Úsuper_statusÚ	super_msgr–   Úmissingr¬   r¹   s         €ra   rÙ   z(FIPSCommonEntitlement.application_statusï  sá  ø€ ô #(¡'Ñ"<Ó">Ñˆ�iä×ÑÔ ¬×)=Ñ)=Ô)?Ü�N‰NÜ×2Ñ2ôð   Ð*Ð*ä�7‰7�>‰>˜$×-Ñ-Ô.ô ×'Ñ'¬¨D¯M©MÓ(:Ô;Ü—‘Ü×6Ñ6ôô ×Ñ × 3Ñ 3Ó4×:Ñ:Ó<ÀÒCÜ—‘Ü×2Ñ2ôð $ YÐ.Ð.ä—‘Ü×2Ñ2ôô &×.Ñ.Ü×1Ñ1×8Ñ8Ø"&×"5Ñ"5ð 9ó ðð ð Ô,×4Ñ4Ò4Ø Ð*Ð*ä ×=Ñ=Ó?ÐØˆð —}‘}ò 	(ˆGØÐ0Ò0Ø—‘˜wÕ'ð	(ñ ä!×)Ñ)Ü×4Ñ4×;Ñ;Ø ŸX™X gÓ.¸¿	¹	ð <ó ðð ô ×%Ñ%Ü×)Ñ)ð
ð 	
rb   c                 ób  — t        t        j                  «       «      }t        | j                  «      j	                  t        | j
                  «      «      }|j                  |«      }|rHt        j                  t        |«      t        j                  j                  | j                  ¬«      «       yy)z¯Remove fips meta package to disable the service.

        FIPS meta-package will unset grub config options which will deactivate
        FIPS on any related packages.
        r7   N)rß   r   r�   rQ   Ú
differencerh   ÚintersectionÚremove_packagesÚlistr   ÚDISABLE_FAILED_TMPLrH   r8   )r[   r–   Úfips_metapackagerï   s       ra   rï   z%FIPSCommonEntitlement.remove_packages*  s�   € ô !¤×!AÑ!AÓ!CÓDÐÜ˜tŸ}™}Ó-×8Ñ8Ü�×)Ñ)Ó*ó
Ðð +×7Ñ7Ð8JÓKˆÙÜ×ÑÜÐ%Ó&Ü×,Ñ,×3Ñ3¸$¿*¹*Ð3ÓEõð rb   c                 óø   •— t         ‰| �  |«      rjt        j                  t        j
                  «       t        j                  t        j                  «       t        j                  t        j                  «       yy©NTF)r²   Ú_perform_enabler   rÚ   r   ÚWRONG_FIPS_METAPACKAGE_ON_CLOUDrè   rÁ   ©r[   r�   r¹   s     €ra   rõ   z%FIPSCommonEntitlement._perform_enable;  sQ   ø€ Ü‰7Ñ" 8Ô,Ü�N‰NÜ×6Ñ6ôô �N‰Nœ6×6Ñ6Ô7Ü�N‰Nœ6×>Ñ>Ô?Øàrb   c                 óŒ   •— t         ‰| �  |«      r4| j                  «       r#t        j                  t
        j                  «       yyrô   )r²   Ú_perform_disablerµ   r   r¶   r   rÁ   r÷   s     €ra   rù   z&FIPSCommonEntitlement._perform_disableF  s9   ø€ Ü‰7Ñ# HÔ-Ø×%Ñ%Ô'Ü—‘Ü×7Ñ7ôð àrb   c                 ó†  — ddg}t        j                  |t        j                  j	                  dj                  |«      ¬«      «      }g }|j                  «       D ]  }||v sŒ|j                  |«       Œ |rKddg|z   }t        j                  |t        j                  j	                  dj                  |«      ¬«      «      }y y )Nzapt-markÚ	showholdsr¤   )ÚcommandÚunhold)r   Úrun_apt_commandr   ÚEXECUTING_COMMAND_FAILEDrH   r©   Ú
splitlinesrZ   )r[   Úpackage_namesÚcmdÚholdsÚunholdsÚholdÚ
unhold_cmds          ra   rª   z%FIPSCommonEntitlement.unhold_packagesP  sÂ   € Ø˜;Ð'ˆÜ×#Ñ#ØÜ×-Ñ-×4Ñ4¸S¿X¹XÀc»]Ð4ÓKó
ˆð ˆØ×$Ñ$Ó&ò 	%ˆDØ�}Ò$Ø—‘˜tÕ$ð	%ñ Ø$ hÐ/°'Ñ9ˆJÜ×'Ñ'ØÜ×1Ñ1×8Ñ8ØŸH™H ZÓ0ð 9ó ó‰Eð rb   c                 óZ   •— | j                  | j                  «       t        ‰| �  |«       y)zÚSetup apt config based on the resourceToken and directives.

        FIPS-specifically handle apt-mark unhold

        :raise UbuntuProError: on failure to setup any aspect of this apt
           configuration
        N)rª   Úfips_pro_package_holdsr²   Úsetup_apt_configr÷   s     €ra   r	  z&FIPSCommonEntitlement.setup_apt_configc  s&   ø€ ð 	×Ñ˜T×8Ñ8Ô9Ü‰Ñ  Õ*rb   ©NT)F)r5   N).Ú__name__Ú
__module__Ú__qualname__Úrepo_pin_priorityÚrepo_key_filerÞ   r   ÚPROMPT_FIPS_PRE_ENABLErK   Úsupports_access_onlyÚapt_noninteractiveÚurlsÚFIPS_HOME_PAGEÚhelp_doc_urlr  Úpropertyr   r]   rh   rÇ   rO   r   ÚProgressWrapperr™   rI   r®   r   r   Ústrr³   rµ   rÃ   rÈ   r   r   rÓ   rQ   r   ÚNamedMessagerÙ   rï   rõ   rù   rª   r	  Ú__classcell__©r¹   s   @ra   r,   r,   V   s  ø„ ØÐØ)€MØ4€NØ×4Ñ4€NØÐð
 Ðà—=‘=×/Ñ/€LòÐð@ ðRÐ2ò Ró ðRðh ñ9ó ð9ð$6¸ð 6Àó 6ðp!Ø×+Ñ+ó!ðF
E¨Dó 
Eð"NØ×+Ñ+ó"NðN -1Ø#'ñ	$à×%Ñ%ð$ð ˜t C™yÑ)ð$ð !ð	$ð
 
õ$ðL& 4ó &ð
 .3ñØðØ&*ðà	óð,ØðØ%(ðà	õð> ð
 EÐ*:¸CÐ*?Ñ$@ò 
ó ð
ð$ ð ˜$˜s™)ô  ó ð ð
9
à	Ð  (¨8×+@Ñ+@Ñ"AÐAÑ	Bõ9
óvð"	¨×(;Ñ(;ð 	Àõ 	ð¨×)<Ñ)<ð Àõ òð&	+¨×)<Ñ)<ð 	+À÷ 	+ñ 	+rb   r,   c                   óè   ‡ — e Zd ZdZej
                  Zej                  Zej                  Z
dZej                  Zedeedf   fd„«       Zedeedf   fˆ fd„«       Zdej*                  defˆ fd„Zˆ xZS )	ÚFIPSEntitlementÚfipsÚ
UbuntuFIPSr5   .c                 ó¼   — ddl m} ddlm} t	        |t
        j                  «      t	        t        t
        j                  «      t	        |t
        j                  «      fS )Nr   )ÚLivepatchEntitlement©ÚRealtimeKernelEntitlement)
Úuaclient.entitlements.livepatchr!  Úuaclient.entitlements.realtimer#  r   r   ÚLIVEPATCH_INVALIDATES_FIPSÚFIPSUpdatesEntitlementÚFIPS_UPDATES_INVALIDATES_FIPSÚREALTIME_FIPS_INCOMPATIBLE)r[   r!  r#  s      ra   Úincompatible_servicesz%FIPSEntitlement.incompatible_servicesw  sQ   € åHÝLô #Ø$¤h×&IÑ&Ióô #Ü&¬×(NÑ(Nóô #Ø)¬8×+NÑ+Nóð

ð 
	
rb   c                 óà  •‡‡— t         ‰| �  }t        | j                  ¬«      }t        j
                  }t        |j                  «       d   |k7  «      Št        j                  «       }|r|j                  ndŠ|t        j                  j                  | j                  |j                  ¬«      ˆfd„dft        j                  j                  | j                  |j                  ¬«      ˆfd„dffz   S )N)rŸ   r   F)r  Úfips_updatesc                  ó   •— ‰ S rÎ   © )Úis_fips_updates_enableds   €ra   r†   z4FIPSEntitlement.static_affordances.<locals>.<lambda>ž  s   ø€ Ð/€ rb   c                  ó   •— ‰ S rÎ   r.  )Úfips_updates_once_enableds   €ra   r†   z4FIPSEntitlement.static_affordances.<locals>.<lambda>¥  s   ø€ Ð1€ rb   )r²   rÓ   r'  rŸ   r   rã   rÇ   rÙ   r   Úreadr,  r   Ú$FIPS_ERROR_WHEN_FIPS_UPDATES_ENABLEDrH   r8   Ú)FIPS_ERROR_WHEN_FIPS_UPDATES_ONCE_ENABLED)r[   rÓ   r,  Údisabled_statusÚservices_once_enabled_objr1  r/  r¹   s        @@€ra   rÓ   z"FIPSEntitlement.static_affordancesˆ  só   ú€ ä"™WÑ7Ðä-°$·(±(Ô;ˆÜ+×4Ñ4ˆÜ"&Ø×+Ñ+Ó-¨aÑ0°OÑCó#
Ðô %?×$CÑ$CÓ$EÐ!ñ )ð &×2Ò2àð 	"ð "ä×=Ñ=×DÑDØŸ™°,×2DÑ2Dð Eó ó 0Øðô ×BÑB×IÑIØŸ™°,×2DÑ2Dð Jó ó 2Øðð%
ñ 
ð 	
rb   r�   c                 ó   •— t        «       \  }}|€K|t        j                  k(  r8t        j	                  d«       t
        j                  t        j                  «       t        ‰| �)  |«      r$t        j                  t        j                  «       yy)Nz>Could not determine cloud, defaulting to generic FIPS package.TF)r   r   ÚCLOUD_ID_ERRORrq   rr   rx   ry   r   Ú.FIPS_COULD_NOT_DETERMINE_CLOUD_DEFAULT_PACKAGEr²   rõ   r   rÚ   r   ÚFIPS_INSTALL_OUT_OF_DATE)r[   r�   Ú
cloud_typeÚerrorr¹   s       €ra   rõ   zFIPSEntitlement._perform_enableª  ss   ø€ Ü*Ó,Ñˆ
�EØÐ %Ô+<×+KÑ+KÒ"KÜ�K‰Kð6ôô �J‰J”x×NÑNÔOÜ‰7Ñ" 8Ô,Ü�N‰NÜ×/Ñ/ôð àrb   )r  r  r  rY   r   Ú
FIPS_TITLEr8   ÚFIPS_DESCRIPTIONÚdescriptionÚFIPS_HELP_TEXTÚ	help_textr¦   r  rK   r  r   r   r*  r   rÓ   r   r  rÇ   rõ   r  r  s   @ra   r  r  o  s¢   ø„ Ø€DØ×Ñ€EØ×+Ñ+€KØ×'Ñ'€IØ€FØ×4Ñ4€Nàð
 uÐ-CÀSÐ-HÑ'Iò 
ó ð
ð  ð
 EÐ*:¸CÐ*?Ñ$@ô 
ó ð
ðB¨×(;Ñ(;ð À÷ ñ rb   r  c                   óÄ   ‡ — e Zd ZdZej
                  ZdZej                  Z	ej                  Zej                  Zedeedf   fd„«       Zdej&                  defˆ fd„Zˆ xZS )r'  zfips-updatesÚUbuntuFIPSUpdatesr5   .c                 ó~   — ddl m} t        t        t        j
                  «      t        |t        j                  «      fS )Nr   r"  )r%  r#  r   r  r   ÚFIPS_INVALIDATES_FIPS_UPDATESÚ"REALTIME_FIPS_UPDATES_INCOMPATIBLE)r[   r#  s     ra   r*  z,FIPSUpdatesEntitlement.incompatible_servicesÃ  s:   € åLô #Ü¤×!GÑ!Góô #Ø)Ü×;Ñ;óð	
ð 	
rb   r�   c                 óf   •— t         ‰| �  |¬«      r t        j                  t	        d¬«      «       yy)N)r�   T)r,  F)r²   rõ   r   Úwriter   r÷   s     €ra   rõ   z&FIPSUpdatesEntitlement._perform_enableÑ  s1   ø€ Ü‰7Ñ"¨HÐ"Ô5Ü&×,Ñ,Ü'°TÔ:ôð àrb   )r  r  r  rY   r   ÚFIPS_UPDATES_TITLEr8   r¦   ÚFIPS_UPDATES_DESCRIPTIONr?  ÚFIPS_UPDATES_HELP_TEXTrA  ÚPROMPT_FIPS_UPDATES_PRE_ENABLErK   r  r   r   r*  r   r  rÇ   rõ   r  r  s   @ra   r'  r'  »  s{   ø„ Ø€DØ×'Ñ'€EØ €FØ×3Ñ3€KØ×/Ñ/€IØ×<Ñ<€Nàð
 uÐ-CÀSÐ-HÑ'Iò 
ó ð
ð¨×(;Ñ(;ð À÷ ñ rb   r'  c                   ó¸   ‡ — e Zd ZdZej
                  Zej                  Zej                  Z
dZej                  ZdZedeedf   fˆ fd„«       Zdededefd	„Zˆ xZS )
ÚFIPSPreviewEntitlementzfips-previewÚUbuntuFIPSPreviewzubuntu-pro-fips-preview.gpgr5   .c                 óX   •— t         ‰| �  t        t        t        j
                  «      fz   S rÎ   )r²   r*  r   r  r   rE  rÕ   s    €ra   r*  z,FIPSPreviewEntitlement.incompatible_servicesä  s-   ø€ ä‰wÑ,Ü"Ü¤×!GÑ!Góð0
ñ 
ð 	
rb   re   rÄ   c                  ó   — yr
  r.  )r[   re   rÄ   s      ra   rÈ   z4FIPSPreviewEntitlement._allow_fips_on_cloud_instanceì  s   € ð rb   )r  r  r  rY   r   ÚFIPS_PREVIEW_TITLEr8   ÚFIPS_PREVIEW_DESCRIPTIONr?  ÚFIPS_PREVIEW_HELP_TEXTrA  r¦   ÚPROMPT_FIPS_PREVIEW_PRE_ENABLErK   r  r  r   r   r*  r  rÇ   rÈ   r  r  s   @ra   rN  rN  Û  s   ø„ Ø€DØ×'Ñ'€EØ×3Ñ3€KØ×/Ñ/€IØ €FØ×<Ñ<€NØ1€Màð
 uÐ-CÀSÐ-HÑ'Iô 
ó ð
ðØðØ%(ðà	÷rb   rN  )7ÚloggingrÛ   rR   Ú	itertoolsr   Útypingr   r   r   Úuaclientr   r   r	   r
   r   r   r   Úuaclient.clouds.identityr   r   Úuaclient.entitlementsr   Úuaclient.entitlements.baser   Ú(uaclient.entitlements.entitlement_statusr   Úuaclient.filesr   Úuaclient.files.noticesr   Úuaclient.files.state_filesr   r   Úuaclient.typesr   r   r   Úget_event_loggerrx   Ú	getLoggerÚreplace_top_level_logger_namer  rq   ÚCONDITIONAL_PACKAGES_EVERYWHEREÚ!CONDITIONAL_PACKAGES_OPENSSH_HMACrg   Ú&UBUNTU_FIPS_METAPACKAGE_DEPENDS_XENIALÚ&UBUNTU_FIPS_METAPACKAGE_DEPENDS_BIONICÚ%UBUNTU_FIPS_METAPACKAGE_DEPENDS_FOCALrf   ÚRepoEntitlementr,   r  r'  rN  r.  rb   ra   ú<module>rk     sD  ðÛ Û 	Û 	Ý ß (Ñ (ç O× OÑ Oß FÝ &Ý =Ý FÝ "Ý )÷÷ñ ð 	&ˆ×%Ñ%Ó'€Ø€g×ÑÐ:˜×:Ñ:¸8ÓDÓE€ò#Ð ð Øð%Ð !ð
 .Ø'ñ(à-Ø'ñ(à,ñÐ ò"*Ð &ò
*Ð &ò)Ð %ð .Ø'ñ(à,ñ-ð .Ø'ñ(à,ñ-ð -Ø+ñ,ñ	'Ð #ôV+˜D×0Ñ0ô V+ôrIÐ+ô IôXÐ2ô ô@˜_õ rb   