
                             S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r
  SSKJ	r	  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr   " S S\	R,                  5      rg)zADecrypt an input file using an asymmetric-encryption key version.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)log)
console_io)filesc                   @    \ rS rSrSr\S 5       rS rS rS r	S r
Srg	)
AsymmetricDecrypt!   a  Decrypt an input file using an asymmetric-encryption key version.

Decrypts the given ciphertext file using the provided asymmetric-encryption
key version and saves the decrypted data to the plaintext file.

By default, the command performs integrity verification on data sent to and
received from Cloud KMS. Use `--skip-integrity-verification` to disable
integrity verification.

## EXAMPLES
The following command will read the file '/tmp/my/secret.file.enc', decrypt it
using the asymmetric CryptoKey `dont-panic` Version 3 and write the plaintext
to '/tmp/my/secret.file.dec'.

  $ {command} \
  --location=us-central1 \
  --keyring=hitchhiker \
  --key=dont-panic \
  --version=3 \
  --ciphertext-file=/tmp/my/secret.file.enc \
  --plaintext-file=/tmp/my/secret.file.dec

c                     [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R
                  " U 5        g )Nz!to use for asymmetric-decryption.z to use for asymmetric-decryptionz
to decryptz	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddCiphertextFileFlagAddPlaintextFileFlagAddSkipIntegrityVerification)parsers    %lib/surface/kms/asymmetric_decrypt.pyArgsAsymmetricDecrypt.Args:   sR    	f&IJ	!!&*LM	5	v{3	&&v.    c                 $    UR                   (       + $ )N)skip_integrity_verification)selfargss     r   _PerformIntegrityVerification/AsymmetricDecrypt._PerformIntegrityVerificationB   s    ////r   c                     [         R                  " UR                  SS9n[        R                  " 5       n[        R                  " U5      nUR                  UR                  5       S9nU R                  U5      (       a,  [        R                   " U5      nUR#                  X'S9Ul        U$ UR#                  US9Ul        U$ ! [        R                   a5  n[
        R                  " SR                  UR                  U5      5      eS nAff = f)NT)binaryz)Failed to read ciphertext file [{0}]: {1})name)
ciphertextciphertextCrc32c)r%   )r   ReadFromFileOrStdinciphertext_filer   Errorr   BadFileExceptionformatcloudkms_baseGetMessagesModuler
   ParseCryptoKeyVersionNameTCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptRequestRelativeNamer    r   Crc32cAsymmetricDecryptRequestasymmetricDecryptRequest)r   r   r%   emessagescrypto_key_refreqciphertext_crc32cs           r   _CreateAsymmetricDecryptRequest1AsymmetricDecrypt._CreateAsymmetricDecryptRequestE   s   (11


t-j ..0H44T:N

g
g((* h ,C))$// --
3%-%F%F &G &Ec" J &.%F%F &G &!c" J% ;; (''
5
<
<""A'( ((s   C D
0DD
c                 *   UR                   (       d)  [        R                  " [        R                  " 5       5      e[        R
                  " UR                  UR                  5      (       d)  [        R                  " [        R                  " 5       5      eg)z&Verifies integrity fields in response.N)	verifiedCiphertextCrc32cr	   $ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessager   Crc32cMatches	plaintextplaintextCrc32c*GetResponseFromServerCorruptedErrorMessage)r   r7   resps      r   _VerifyResponseIntegrityFields0AsymmetricDecrypt._VerifyResponseIntegrityFields]   st     ((>>

?
?
AC C 0D0DEE>>

B
B
DF F Fr   c                    U R                  U5      n[        R                  " 5       n UR                  R	                  U5      nU R                  U5      (       a  U R                  UW5         [        R                  " UR                  WR                  =(       d    SSSSS9  g ! [
        R                   a   n[        R                  " U5         S nANS nAff = f! [        R                    a  n["        R$                  " U5      eS nAff = f)N T)	overwriter#   private)r9   r,   GetClientInstance8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr    rD   r   WriteToFileOrStdoutplaintext_filer@   r   r)   r   r*   )r   r   r7   clientrC   errorr4   s          r   RunAsymmetricDecrypt.Runj   s    

.
.t
4C,,.F6

I
IS!  ))$//
))#t4+	



..
B 22 6..u556 ;; +''**+s/   B" ,5C "C6CCD-DD N)__name__
__module____qualname____firstlineno____doc__staticmethodr   r    r9   rD   rS   __static_attributes__rU   r   r   r   r   !   s0    0 / /00F+r   r   N)rZ   
__future__r   r   r   apitools.base.pyr   rL   googlecloudsdk.api_lib.cloudkmsr   r,   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   Commandr   rU   r   r   <module>rf      sD    H &  ' > A ( . 1 8 0 # 2 *`+ `+r   