This library provides OpenPGP facilities in Python through the Sequoia PGP library. If you need to work with encryption and digital signatures using an IETF standardized protocol, this package is for you!
Note: This is a work in progress. The API is not stable!
set -euxo pipefail
python -m venv .env
source .env/bin/activate
pip install maturin
maturin developPySequoia can be installed through pip:
pip install pysequoiaPyPI version of PySequoia includes native wheels for a variety of architectures and OS combinations. If you are using a combination that is not yet provided a Rust toolchain will be necessary for the installation to succeed.
This entire document is used for end-to-end integration tests that exercise the package's API surface.
The tests assume that these keys exist:
# generate a key with password
gpg --batch --pinentry-mode loopback --passphrase hunter22 --quick-gen-key passwd@example.com rsa sign,encrypt
gpg --batch --pinentry-mode loopback --passphrase hunter22 --export-secret-key passwd@example.com > passwd.pgp
# generate a key without password
gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key no-passwd@example.com rsa sign,encrypt
gpg --batch --pinentry-mode loopback --passphrase '' --export-secret-key no-passwd@example.com > no-passwd.pgpAll examples assume that these basic classes have been imported:
frompysequoiaimportCert, Sig, TskSigns data and returns armored output:
frompysequoiaimportsign, SignatureModes=Tsk.from_file("tests/fixtures/signing-key.asc")
signed=sign(s.signer(), "data to be signed".encode("utf8"))
print(f"Signed data: {signed!r}")
assert"PGP MESSAGE"instr(signed)
detached=sign(
s.signer(), "data to be signed".encode("utf8"), mode=SignatureMode.DETACHED
)
print(f"Detached signature: {detached!r}")
assert"PGP SIGNATURE"instr(detached)
clear=sign(s.signer(), "data to be signed".encode("utf8"), mode=SignatureMode.CLEAR)
print(f"Clear signed: {clear!r}")
assert"PGP SIGNED MESSAGE"instr(clear)Signs data from a file and writes the signed output to another file:
frompysequoiaimportsign_file, SignatureModeimporttempfile, oss=Tsk.from_file("tests/fixtures/signing-key.asc")
# create a file with data to signwithtempfile.NamedTemporaryFile(delete=False, suffix=".txt") asinp:
inp.write("data to be signed".encode("utf8"))
input_path=inp.namewithtempfile.NamedTemporaryFile(delete=False, suffix=".pgp") asout:
output_path=out.namesign_file(s.signer(), input_path, output_path)
signed=open(output_path, "rb").read()
assertb"PGP MESSAGE"insigned# detached signature to filewithtempfile.NamedTemporaryFile(delete=False, suffix=".sig") asout:
detached_path=out.namesign_file(s.signer(), input_path, detached_path, mode=SignatureMode.DETACHED)
detached=open(detached_path, "rb").read()
assertb"PGP SIGNATURE"indetachedos.unlink(input_path)
os.unlink(output_path)
os.unlink(detached_path)Verifies signed data and returns verified data:
frompysequoiaimportverify# sign some datasigning_key=Tsk.from_file("tests/fixtures/signing-key.asc")
signed=sign(signing_key.signer(), "data to be signed".encode("utf8"))
defget_certs_verify(key_ids):
# key_ids is an array of required signing keysprint(f"For verification, we need these keys: {key_ids}")
return [signing_key.extract_certificate()]
# verify the dataresult=verify(signed, get_certs_verify)
assertresult.bytes.decode("utf8") =="data to be signed"# let's check the valid signature's certificate and signing subkey fingerprintsassertresult.valid_sigs[0].certificate=="afcf5405e8f49dbcd5dc548a86375b854b86acf9"assertresult.valid_sigs[0].signing_key=="afcf5405e8f49dbcd5dc548a86375b854b86acf9"The function that returns certificates (here get_certs_verify) may return more certificates than necessary.
Detached signatures can be verified by passing additional parameter with the detached signature:
data="data to be signed".encode("utf8")
detached=sign(signing_key.signer(), data, mode=SignatureMode.DETACHED)
signature=Sig.from_bytes(detached)
result=verify(bytes=data, store=get_certs_verify, signature=signature)
# let's check the valid signature's certificate and signing subkey fingerprintsassertresult.valid_sigs[0].certificate=="afcf5405e8f49dbcd5dc548a86375b854b86acf9"assertresult.valid_sigs[0].signing_key=="afcf5405e8f49dbcd5dc548a86375b854b86acf9"This function can also work with files directly, which is beneficial if the file to be verified is large:
importtempfilewithtempfile.NamedTemporaryFile(delete=False) astmp:
data="data to be signed".encode("utf8")
detached=sign(signing_key.signer(), data, mode=SignatureMode.DETACHED)
signature=Sig.from_bytes(detached)
tmp.write(data)
tmp.close()
# verify a detached signature against a file nameresult=verify(file=tmp.name, store=get_certs_verify, signature=signature)
# let's check the valid signature's certificate and signing subkey fingerprintsassert (
result.valid_sigs[0].certificate=="afcf5405e8f49dbcd5dc548a86375b854b86acf9"
)
assert (
result.valid_sigs[0].signing_key=="afcf5405e8f49dbcd5dc548a86375b854b86acf9"
)verify succeeds if at least one correct signature has been made by any of the certificates supplied. If you need more advanced policies they can be implemented by inspecting the valid_sigs property.
Signs and encrypts a string to one or more recipients:
frompysequoiaimportencrypts=Tsk.from_file("passwd.pgp")
r=Cert.from_bytes(open("tests/fixtures/wiktor.asc", "rb").read())
content="content to encrypt"encrypted=encrypt(
signer=s.signer("hunter22"), recipients=[r], bytes=content.encode("utf8")
)
print(f"Encrypted data: {encrypted.decode('utf8')}")The signer argument is optional and when omitted the function will return an unsigned (but encrypted) message.
Encryption to symmetric keys is available via the passwords optional argument:
frompysequoiaimportencryptcontent="content to encrypt"encrypted=encrypt(passwords=["sekrit"], bytes=content.encode("utf8"))
print(f"Encrypted data: {encrypted.decode('utf8')}")Encrypts data from a file and writes the encrypted output to another file:
frompysequoiaimportencrypt_fileimporttempfile, oss=Tsk.from_file("passwd.pgp")
r=Cert.from_bytes(open("tests/fixtures/wiktor.asc", "rb").read())
# create a file with content to encryptwithtempfile.NamedTemporaryFile(delete=False, suffix=".txt") asinp:
inp.write("content to encrypt".encode("utf8"))
input_path=inp.namewithtempfile.NamedTemporaryFile(delete=False, suffix=".pgp") asout:
output_path=out.nameencrypt_file(
signer=s.signer("hunter22"),
recipients=[r],
input=input_path,
output=output_path,
)
assertb"PGP MESSAGE"inopen(output_path, "rb").read()
os.unlink(input_path)
os.unlink(output_path)Decrypts plain data:
frompysequoiaimportdecryptsender=Cert.from_file("no-passwd.pgp")
receiver=Cert.from_file("passwd.pgp")
content="Red Green Blue"encrypted=encrypt(recipients=[receiver], bytes=content.encode("utf8"))
decrypted=decrypt(
decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"), bytes=encrypted
)
assertcontent==decrypted.bytes.decode("utf8")
# this message did not contain any valid signaturesassertlen(decrypted.valid_sigs) ==0Decrypt can also verify signatures while decrypting:
frompysequoiaimportdecryptsender=Cert.from_file("no-passwd.pgp")
receiver=Cert.from_file("passwd.pgp")
content="Red Green Blue"encrypted=encrypt(
signer=Tsk.from_file("no-passwd.pgp").signer(),
recipients=[receiver],
bytes=content.encode("utf8"),
)
defget_certs_decrypt(key_ids):
print(f"For verification after decryption, we need these keys: {key_ids}")
return [sender]
decrypted=decrypt(
decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"),
bytes=encrypted,
store=get_certs_decrypt,
)
assertcontent==decrypted.bytes.decode("utf8")
# let's check the valid signature's certificate and signing subkey fingerprintsassertdecrypted.valid_sigs[0].certificate==sender.fingerprintassertdecrypted.valid_sigs[0].signing_key==sender.fingerprintHere, the same remarks as to verify also apply.
Decryption using symmetric keys is available via the passwords optional argument:
frompysequoiaimportencryptcontent="content to encrypt"encrypted=encrypt(passwords=["sekrit"], bytes=content.encode("utf8"))
print(f"Encrypted data: {encrypted.decode('utf8')}")
decrypted=decrypt(passwords=["sekrit"], bytes=encrypted)
print(f"Decrypted bytes: {decrypted.bytes!r}")
assertcontent==decrypted.bytes.decode("utf8")Decrypts data from a file and writes the decrypted output to another file:
frompysequoiaimportdecrypt_fileimporttempfile, ossender=Cert.from_file("no-passwd.pgp")
receiver=Cert.from_file("passwd.pgp")
content="Red Green Blue"encrypted=encrypt(recipients=[receiver], bytes=content.encode("utf8"))
# write encrypted data to a filewithtempfile.NamedTemporaryFile(delete=False, suffix=".pgp") asinp:
inp.write(encrypted)
input_path=inp.namewithtempfile.NamedTemporaryFile(delete=False, suffix=".txt") asout:
output_path=out.namedecrypted=decrypt_file(
decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"),
input=input_path,
output=output_path,
)
# content is written to the output file, not returned in memoryassertdecrypted.bytesisNone# read decrypted content from the output fileassertopen(output_path, "rb").read().decode("utf8") ==content# this message did not contain any valid signaturesassertlen(decrypted.valid_sigs) ==0os.unlink(input_path)
os.unlink(output_path)Decrypt file can also verify signatures while decrypting:
frompysequoiaimportdecrypt_fileimporttempfile, ossender=Cert.from_file("no-passwd.pgp")
receiver=Cert.from_file("passwd.pgp")
content="Red Green Blue"encrypted=encrypt(
signer=Tsk.from_file("no-passwd.pgp").signer(),
recipients=[receiver],
bytes=content.encode("utf8"),
)
# write encrypted data to a filewithtempfile.NamedTemporaryFile(delete=False, suffix=".pgp") asinp:
inp.write(encrypted)
input_path=inp.namewithtempfile.NamedTemporaryFile(delete=False, suffix=".txt") asout:
output_path=out.namedefget_certs_decrypt_file(key_ids):
print(f"For verification after decryption, we need these keys: {key_ids}")
return [sender]
decrypted=decrypt_file(
decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"),
input=input_path,
output=output_path,
store=get_certs_decrypt_file,
)
assertopen(output_path, "rb").read().decode("utf8") ==content# let's check the valid signature's certificate and signing subkey fingerprintsassertdecrypted.valid_sigs[0].certificate==sender.fingerprintassertdecrypted.valid_sigs[0].signing_key==sender.fingerprintos.unlink(input_path)
os.unlink(output_path)The Cert class represents one OpenPGP certificate (commonly called a
"public key").
This package additionally verifies the certificate using Sequoia PGP's
StandardPolicy. This means that certificates using weak
cryptography can fail to load, or present a different view than in
other OpenPGP software (e.g. if a User ID uses SHA-1 in its
back-signature, it may be missing from the list of User IDs returned
by this package).
Certificates have two forms, one is ASCII armored and one is raw bytes:
tsk=Tsk.generate("Test <test@example.com>")
cert=tsk.extract_certificate()
print(f"Armored cert: {cert}")
print(f"Bytes of the cert: {bytes(cert)!r}")The public Cert never contains secret key material. To export the secret
parts, serialize the Tsk itself:
print(f"Armored TSK: {tsk}")
print(f"Bytes of the TSK: {bytes(tsk)!r}")Certificates can be parsed from files (Cert.from_file) or bytes in
memory (Cert.from_bytes).
cert1=Tsk.generate("Test <test@example.com>").extract_certificate()
buffer=bytes(cert1)
parsed_cert=Cert.from_bytes(buffer)
assertstr(parsed_cert.user_ids[0]) =="Test <test@example.com>"They can also be picked from "keyring" files (Cert.split_file) or
bytes in memory (Cert.split_bytes) which are collections of binary
certificates.
cert1=Tsk.generate("Test 1 <test-1@example.com>").extract_certificate()
cert2=Tsk.generate("Test 2 <test-2@example.com>").extract_certificate()
cert3=Tsk.generate("Test 3 <test-3@example.com>").extract_certificate()
buffer=bytes(cert1) +bytes(cert2) +bytes(cert3)
certs=Cert.split_bytes(buffer)
assertlen(certs) ==3Creates a new general purpose key with a given User ID:
alice=Tsk.generate("Alice <alice@example.com>")
alice_pub=alice.extract_certificate()
fpr=alice_pub.fingerprintprint(f"Generated cert with fingerprint {fpr}:\n{alice_pub}")Multiple User IDs can be passed as a list to the generate function:
cert=Tsk.generate(user_ids=["First", "Second", "Third"]).extract_certificate()
assertlen(cert.user_ids) ==3Newly generated certificates are usable in both encryption and signing contexts:
alice=Tsk.generate("Alice <alice@example.com>")
bob=Tsk.generate("Bob <bob@example.com>").extract_certificate()
content="content to encrypt"encrypted=encrypt(
signer=alice.signer(), recipients=[bob], bytes=content.encode("utf8")
)
print(f"Encrypted data: {encrypted!r}")The default is to generate keys according to RFC4880. By
providing a profile parameter to the generate function, modern PGP
keys can also be generated:
frompysequoiaimportProfilemary=Tsk.generate(
"Modern Mary <mary@example.com>", profile=Profile.RFC9580
).extract_certificate()
print(f"Generated cert with fingerprint {mary.fingerprint}:\n{mary}")Note that legacy PGP implementations may not be able to consume these certificates yet.
The cryptographic algorithms used for the generated key can be selected
with the cipher_suite parameter. The default is Cv25519; RSA, NIST,
and Curve448 suites are also available:
frompysequoiaimportCipherSuitetsk=Tsk.generate("RSA <rsa@example.com>", cipher_suite=CipherSuite.RSA4k)
cert=tsk.extract_certificate()
print(f"Generated RSA cert with fingerprint {cert.fingerprint}")The full list of suites is Cv25519, Cv448, RSA2k, RSA3k,
RSA4k, P256, P384, P521, MLDSA65_Ed25519, and MLDSA87_Ed448.
The two MLDSA* cipher suites generate post-quantum keys that
combine ML-DSA/ML-KEM with a classical algorithm. These suites require
Profile.RFC9580 (v6 keys):
frompysequoiaimportCipherSuite, Profilepqc=Tsk.generate(
"Post-Quantum <pqc@example.com>",
profile=Profile.RFC9580,
cipher_suite=CipherSuite.MLDSA65_Ed25519,
)
# these keys sign, verify, encrypt, and decrypt like any otherdata="post-quantum signed data".encode("utf8")
signed=sign(pqc.signer(), data)
result=verify(signed, lambdakey_ids: [pqc.extract_certificate()])
assertresult.bytes==dataUsing MLDSA65_Ed25519 produces an ML-DSA-65 + Ed25519 signing key and
an ML-KEM-768 + X25519 encryption subkey; MLDSA87_Ed448 selects the
higher-security ML-DSA-87 + Ed448 / ML-KEM-1024 + X448 variant.
For combinations beyond the paired presets, the signing and encryption
algorithms can be chosen independently with the keyword-only
signing_algorithm and encryption_algorithm parameters. This enables
mixes such as stateless SLH-DSA signing with classical encryption, or a
classical signing key with a post-quantum ML-KEM encryption subkey:
frompysequoiaimportProfile, SigningAlgorithm, EncryptionAlgorithm# SLH-DSA signing key with the default encryption subkeyslh=Tsk.generate(
"SLH-DSA <slh@example.com>",
profile=Profile.RFC9580,
signing_algorithm=SigningAlgorithm.SLHDSA128f,
)
signed=sign(slh.signer(), b"slh-dsa signed data")
result=verify(signed, lambdakey_ids: [slh.extract_certificate()])
assertresult.bytes==b"slh-dsa signed data"# classical signing paired with a post-quantum encryption subkeymixed=Tsk.generate(
"Mixed <mixed@example.com>",
profile=Profile.RFC9580,
encryption_algorithm=EncryptionAlgorithm.MLKEM768_X25519,
)
encrypted=encrypt(recipients=[mixed.extract_certificate()], bytes=b"secret")
decrypted=decrypt(decryptor=mixed.decryptor(), bytes=encrypted)
assertdecrypted.bytes==b"secret"Signing algorithms are Ed25519, Ed448, MLDSA65_Ed25519,
MLDSA87_Ed448, SLHDSA128s, SLHDSA128f, and SLHDSA256s.
Encryption algorithms are X25519, X448, MLKEM768_X25519, and
MLKEM1024_X448. As with the PQC cipher suites, post-quantum
algorithms require Profile.RFC9580.
The expiration is controlled via validity_seconds keyword argument:
assert (
Tsk.generate(user_id="test", validity_seconds=3600).extract_certificate().expirationisnotNone
)Using None generates a certificate with no expiration:
assert (
Tsk.generate(user_id="test", validity_seconds=None).extract_certificate().expirationisNone
)By default certificates are generated without expiration time:
assertTsk.generate("test").extract_certificate().expirationisNoneWarning
This behavior differs from the (now deprecated) Cert.generate which had a default expiration of 3 years.
Merges packets from a new version into an old version of a certificate:
old=Cert.from_file("tests/fixtures/wiktor.asc")
new=Cert.from_file("tests/fixtures/wiktor-fresh.asc")
merged=old.merge(new)Listing existing User IDs:
cert=Cert.from_file("tests/fixtures/wiktor.asc")
user_id=cert.user_ids[0]
assertstr(user_id).startswith("Wiktor Kwapisiewicz")Adding new User IDs:
tsk=Tsk.generate("Alice <alice@example.com>")
cert=tsk.extract_certificate()
assertlen(cert.user_ids) ==1cert=cert.add_user_id(
value="Alice <alice@company.invalid>", certifier=tsk.certifier()
)
assertlen(cert.user_ids) ==2Revoking User IDs:
tsk=Tsk.generate("Bob <bob@example.com>")
cert=tsk.extract_certificate()
cert=cert.add_user_id(value="Bob <bob@company.invalid>", certifier=tsk.certifier())
assertlen(cert.user_ids) ==2# create User ID revocationrevocation=cert.revoke_user_id(user_id=cert.user_ids[1], certifier=tsk.certifier())
# merge the revocation with the certcert=Cert.from_bytes(bytes(cert) +bytes(revocation))
assertlen(cert.user_ids) ==1Notations are small pieces of data that can be attached to signatures (and, indirectly, to User IDs).
The following example reads and displays a Keyoxide proof URI:
cert=Cert.from_file("tests/fixtures/wiktor.asc")
user_id=cert.user_ids[0]
notation=user_id.notations[0]
assertnotation.key=="proof@metacode.biz"assertnotation.value=="dns:metacode.biz?type=TXT"Notations can also be added:
frompysequoiaimportNotationtsk=Tsk.from_file("tests/fixtures/signing-key.asc")
cert=tsk.extract_certificate()
# No notations initiallyassertlen(cert.user_ids[0].notations) ==0cert=cert.set_notations(
tsk.certifier(), [Notation("proof@metacode.biz", "dns:metacode.biz")]
)
# Has one notation nowprint(str(cert.user_ids[0].notations))
assertlen(cert.user_ids[0].notations) ==1# Check the notation datanotation=cert.user_ids[0].notations[0]
assertnotation.key=="proof@metacode.biz"assertnotation.value=="dns:metacode.biz"Certs have an expiration getter for retrieving the current key
expiry time:
cert=Cert.from_file("tests/fixtures/signing-key.asc")
# Cert does not have any expiration date:assertcert.expirationisNonecert=Cert.from_file("tests/fixtures/wiktor.asc")
# Cert expires on New Year's Eveassertstr(cert.expiration) =="2022-12-31 12:00:02+00:00"Key expiration can also be adjusted with set_expiration:
fromdatetimeimportdatetimetsk=Tsk.from_file("tests/fixtures/signing-key.asc")
cert=tsk.extract_certificate()
# Cert does not have any expiration date:assertcert.expirationisNone# Set the expiration to some specified point in timeexpiration=datetime.fromisoformat("2021-11-04T00:05:23+00:00")
cert=cert.set_expiration(expiration=expiration, certifier=tsk.certifier())
assertstr(cert.expiration) =="2021-11-04 00:05:23+00:00"Certs can be revoked. While expiration makes the key unusable temporarily to encourage the user to refresh a copy revocation is irreversible.
tsk=Tsk.generate("Test Revocation <revoke@example.com>")
cert=tsk.extract_certificate()
revocation=cert.revoke(certifier=tsk.certifier())
# creating revocation signature does not revoke the keyassertnotcert.is_revoked# importing revocation signature marks the key as revokedrevoked_cert=Cert.from_bytes(bytes(cert) +bytes(revocation))
assertrevoked_cert.is_revokedCertificates with secret keys are generated through Tsk.generate()
and can be used for signing and decryption.
c=Tsk.generate("Testing key <test@example.com>")Detached signatures can be read directly from files (Sig.from_file) or bytes in memory (Sig.from_bytes):
frompysequoiaimportSigsig=Sig.from_file("tests/fixtures/sig.pgp")
print(f"Parsed signature: {repr(sig)}")
assertsig.issuer_fingerprint=="e8f23996f23218640cb44cbe75cf5ac418b8e74c"assertsig.issuer_key_id=="75cf5ac418b8e74c"assertsig.created==datetime.fromisoformat("2023-07-19T18:14:01+00:00")
assertsig.expiration==Noneassertsig.signers_user_id==NoneThe PacketPile class provides low-level access to individual OpenPGP
packets in a key block, signed message, or other OpenPGP data. Each
packet exposes a tag property identifying the packet type, along with
type-specific accessors for extracting fields.
frompysequoia.packetimportPacketPile, Tag, SignatureTypecert=Tsk.generate("Test <test@example.com>").extract_certificate()
pile=PacketPile.from_bytes(bytes(cert))
forpacketinpile:
ifpacket.tag==Tag.PublicKeyorpacket.tag==Tag.PublicSubkey:
print(
f"Key: fpr={packet.fingerprint}, algo={packet.key_algorithm}, created={packet.key_created}"
)
elifpacket.tag==Tag.UserID:
print(
f"User ID: {packet.user_id} (name={packet.user_id_name}, email={packet.user_id_email})"
)
elifpacket.tag==Tag.Signature:
print(
f"Signature: type={packet.signature_type}, hash={packet.hash_algorithm}, created={packet.signature_created}"
)
ifpacket.issuer_fingerprintisnotNone:
print(f" issuer: {packet.issuer_fingerprint}")
ifpacket.signature_validity_periodisnotNone:
print(f" expires in: {packet.signature_validity_period}")
ifpacket.signature_expiration_timeisnotNone:
print(f" expiration time: {packet.signature_expiration_time}")
ifpacket.key_flagsisnotNone:
print(f" key flags: {packet.key_flags}")
if (
packet.signature_type==SignatureType.DirectKeyandpacket.key_validity_periodisnotNone
):
print(f" key validity period: {packet.key_validity_period}")Individual packets also carry their raw body bytes (without the tag and length header), which can be useful for hashing or storing packet data:
frompysequoia.packetimportPacketPile, Tagpacket=list(PacketPile.from_bytes(bytes(cert)))[0]
assertpacket.tag==Tag.PublicKeyassertlen(packet.body) >0The armor function wraps raw binary data in ASCII armor, adding the
appropriate header, base64 encoding, and CRC24 checksum:
frompysequoiaimportarmor, ArmorKindcert=Tsk.generate("Test <test@example.com>").extract_certificate()
armored=armor(bytes(cert), ArmorKind.PublicKey) # same as: str(cert)assert"-----BEGIN PGP PUBLIC KEY BLOCK-----"inarmoredassert"-----END PGP PUBLIC KEY BLOCK-----"inarmoredOther armor kinds are available for different data types:
frompysequoiaimportarmor, ArmorKindarmored_msg=armor(b"dummy data", ArmorKind.Message)
assert"BEGIN PGP MESSAGE"inarmored_msgarmored_sig=armor(b"dummy data", ArmorKind.Signature)
assert"BEGIN PGP SIGNATURE"inarmored_sigNote that both Cert and Sig when converted to strings (str(...))
will produce correct ASCII-armored representation.
This project is licensed under Apache License, Version 2.0.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the package by you shall be under the terms and conditions of this license, without any additional terms or conditions.