# Path: kinto-remote-settings/src/kinto_remote_settings/signer/utils.py
# def get_first_matching_setting(setting_name, settings, prefixes, default=None):
#     for prefix in prefixes:
#         prefixed_setting_name = prefix + setting_name
#         if prefixed_setting_name in settings:
#             return settings[prefixed_setting_name]
#     return default
# 
# Path: kinto-remote-settings/src/kinto_remote_settings/signer/backends/base.py
# class SignerBase(object):
#     def sign(self, payload):
#         """
#         Signs the specified `payload` and returns the signature metadata.
# 
#         :returns: A mapping with every attributes about the signature
#             (e.g. "signature", "hash_algorithm", "signature_encoding"...)
#         :rtype: dict
#         """
#         raise NotImplementedError
# 
# Path: kinto-remote-settings/src/kinto_remote_settings/signer/backends/exceptions.py
# class BadSignatureError(Exception):
#     pass


import base64
import hashlib
import warnings
import ecdsa
from ecdsa import NIST384p, SigningKey, VerifyingKey
from ..utils import get_first_matching_setting
from .base import SignerBase
from .exceptions import BadSignatureError
        signature = signature_bundle["signature"]
        if isinstance(signature, str):  # pragma: nocover
            signature = signature.encode("utf-8")

        signature_bytes = base64.urlsafe_b64decode(signature)

        public_key = self.load_public_key()
        try:
            public_key.verify(
                signature_bytes,
                payload,
                hashfunc=hashlib.sha384,
                sigdecode=ecdsa.util.sigdecode_string,
            )
        except Exception as e:
            raise BadSignatureError(e)


def load_from_settings(settings, prefix="", *, prefixes=None):
    if prefixes is None:
        prefixes = [prefix]

    if prefix != "":
        message = (
            "signer.load_from_settings `prefix` parameter is deprecated, please "
            "use `prefixes` instead."
        )
        warnings.warn(message, DeprecationWarning)

    private_key = get_first_matching_setting("ecdsa.private_key", settings, prefixes)

# Path: kinto-remote-settings/src/kinto_remote_settings/signer/utils.py
# def get_first_matching_setting(setting_name, settings, prefixes, default=None):
#     for prefix in prefixes:
#         prefixed_setting_name = prefix + setting_name
#         if prefixed_setting_name in settings:
#             return settings[prefixed_setting_name]
#     return default
# 
# Path: kinto-remote-settings/src/kinto_remote_settings/signer/backends/base.py
# class SignerBase(object):
#     def sign(self, payload):
#         """
#         Signs the specified `payload` and returns the signature metadata.
# 
#         :returns: A mapping with every attributes about the signature
#             (e.g. "signature", "hash_algorithm", "signature_encoding"...)
#         :rtype: dict
#         """
#         raise NotImplementedError
# 
# Path: kinto-remote-settings/src/kinto_remote_settings/signer/backends/exceptions.py
# class BadSignatureError(Exception):
#     pass


# Path: kinto-remote-settings/src/kinto_remote_settings/signer/backends/local_ecdsa.py
import base64
import hashlib
import warnings
import ecdsa
from ecdsa import NIST384p, SigningKey, VerifyingKey
from ..utils import get_first_matching_setting
from .base import SignerBase
from .exceptions import BadSignatureError

        signature = signature_bundle["signature"]
        if isinstance(signature, str):  # pragma: nocover
            signature = signature.encode("utf-8")

        signature_bytes = base64.urlsafe_b64decode(signature)

        public_key = self.load_public_key()
        try:
            public_key.verify(
                signature_bytes,
                payload,
                hashfunc=hashlib.sha384,
                sigdecode=ecdsa.util.sigdecode_string,
            )
        except Exception as e:
            raise BadSignatureError(e)


def load_from_settings(settings, prefix="", *, prefixes=None):
    if prefixes is None:
        prefixes = [prefix]

    if prefix != "":
        message = (
            "signer.load_from_settings `prefix` parameter is deprecated, please "
            "use `prefixes` instead."
        )
        warnings.warn(message, DeprecationWarning)

    private_key = get_first_matching_setting("ecdsa.private_key", settings, prefixes)

    public_key = get_first_matching_setting("ecdsa.public_key", settings, prefixes)