
                         \   S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSK
Jr  SS	K
Jr  SS
K
Jr  SSK
Jr  SSKJr  SSKJr  SSKJr  \	R(                  \	R*                  \	R,                  " \	R.                  R0                  5       " S S\	R2                  5      5       5       5       rg)zEvaluate policy command.    )absolute_import)division)unicode_literals)apis)platform_policy)base)flags)parsing)sigstore_image)util)log)yaml)Errorc                   .    \ rS rSrSr\S 5       rS rSrg)EvaluateAndSign!   a  Evaluate a Binary Authorization platform policy and sign the results, if conformant.

## EXAMPLES

To evaluate and sign a policy using its resource name:

  $ {command} projects/my-proj/platforms/gke/policies/my-policy
  --resource=$KUBERNETES_RESOURCE

To evaluate the same policy using flags against multiple images:

  $ {command} my-policy --platform=gke --project=my-proj --image=$IMAGE1
  --image=$IMAGE2

To return a modified resource with attestations added as an annotation on the
input resource, without uploading attestations to the registry:

  $ {command} projects/my-proj/platforms/gke/policies/my-policy
  --resource=$KUBERNETES_RESOURCE --output-file=$MODIFIED_RESOURCE --no-upload

To upload attestations using Docker credentials located in a custom directory:

  $ {command} projects/my-proj/platforms/gke/policies/my-policy
  --image=$IMAGE --use-docker-creds --docker-config-dir=$CUSTOM_DIR
c                     [         R                  " U S5        [         R                  " U 5        [         R                  " U 5        [         R                  " U 5        [         R
                  " U 5        g )Nzto evaluate and sign)r	   AddPlatformPolicyResourceArgAddEvaluationUnitArgAddNoUploadArgAddOutputFileArgAddDockerCredsArgs)parsers    :lib/surface/container/binauthz/policy/evaluate_and_sign.pyArgsEvaluateAndSign.Args?   sK    	&&v/EF	v&	 	6"	V$    c                 .   UR                   R                  R                  5       R                  5       nUR	                  S5      S   nUS:w  a  [        SR                  U5      5      eUR                  (       a'  UR                  (       d  [        R
                  " S5      eUR                  (       a'  UR                  (       a  [        R
                  " S5      eUR                  (       a'  UR                  (       d  [        R
                  " S5      eUR                  (       a!  [        R                  " UR                  5      nO [        R                  " UR                   5      n["        R$                  " S5      R'                  X$S	5      nUR(                  [*        R,                  " S5      R.                  R0                  R2                  :w  a	  S
U l        U$ UR                  (       d  UR6                   H}  n[8        R:                  " U5      n[<        R>                  " SR                  U5      5        [8        R@                  " U[8        RB                  " U5      UR                  UR                  S9  M     UR                  (       a  [        RD                  " XER6                  5      n[        RF                  " UR                  5      [        RH                  RJ                  :X  a  [L        RN                  " U5      n[<        RP                  " UR                  US	SS	S9  U$ )N/   gkezVFound unsupported platform '{}'. Currently only 'gke' platform policies are supported.z0Cannot specify --output-file without --resource.z3Cannot specify --use-docker-creds with --no-upload.z>Cannot specify --docker-config-dir without --use-docker-creds.v1T   zUploading attestation for {})	image_urlattestationuse_docker_credsdocker_config_dirF)	overwritebinaryprivate))CONCEPTSpolicy_resource_nameParseRelativeNamesplitr   formatoutput_fileresourcer   r&   	no_uploadr'   r
   LoadResourceFileGeneratePodSpecFromImagesimager   ClientEvaluateverdictr   GetMessagesModuleEvaluateGkePolicyResponseVerdictValueValuesEnum
CONFORMANT	exit_codeattestationsr   AttestationToImageUrlr   PrintUploadAttestationToRegistryStandardOrUrlsafeBase64DecodeAddInlineAttestationsToResourceGetResourceFileTypeResourceFileTypeYAMLr   dumpWriteToFileOrStdout)	selfargs
policy_refplatform_idresource_objresponser%   r$   modified_resources	            r   RunEvaluateAndSign.RunG   sR   3399;HHJJ""3'*Ke$$*F;$7 
 JJIJJJJLMMd&;&;JJ
J  }}--dmm<l33DJJ?l%%d+44$H 	!!

#
#$:$:::	F
 dno >>!..+"88E			077	BC22&DD "22"44	
 / >>
-- 
%
%dmm
4%%**+ !II&78	



 Or   )r>   N)	__name__
__module____qualname____firstlineno____doc__staticmethodr   rQ   __static_attributes__ r   r   r   r   !   s!    4 % %Gr   r   N)rW   
__future__r   r   r   )googlecloudsdk.api_lib.container.binauthzr   r   googlecloudsdk.callioper   -googlecloudsdk.command_lib.container.binauthzr	   r
   r   r   googlecloudsdk.corer   r   googlecloudsdk.core.exceptionsr   HiddenDefaultUniverseOnlyReleaseTracksReleaseTrackALPHACommandr   rZ   r   r   <module>rg      s     &  ' : E ( ? A H > # $ 0 D%%++,jdll j -  jr   