
                             S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r
  SSKJ	r	  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr   " S S\	R*                  5      rg)z7Sign a user input file using an asymmetric-signing key.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)
get_digest)log)filesc                   \    \ rS rSrSr\S 5       rS rS rS r	S r
S rS	 rSS
 jrS rSrg)AsymmetricSign!   a  Sign a user input file using an asymmetric-signing key version.

Creates a digital signature of the input file using the provided
asymmetric-signing key version and saves the base64 encoded signature.

The required flag `signature-file` indicates the path to store signature.

By default, the command performs integrity verification on data sent to and
received from Cloud KMS. Use `--skip-integrity-verification` to disable
integrity verification.

## EXAMPLES
The following command will read the file '/tmp/my/file.to.sign', digest it
with the digest algorithm 'sha256' and sign it using the asymmetric CryptoKey
`dont-panic` Version 3, and save the signature in base64 format to
'/tmp/my/signature'.

  $ {command} \
  --location=us-central1 \
  --keyring=hitchhiker \
  --key=dont-panic \
  --version=3 \
  --digest-algorithm=sha256 \
  --input-file=/tmp/my/file.to.sign \
  --signature-file=/tmp/my/signature

c                    [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R
                  " U S5        [         R                  " U 5        g )Nzto use for signing.zto use for signingz"The algorithm to digest the input.zto signz	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddDigestAlgorithmFlagAddInputFileFlagAddSignatureFileFlagAddSkipIntegrityVerification)parsers    "lib/surface/kms/asymmetric_sign.pyArgsAsymmetricSign.Args>   sc    	f&;<	!!&*>?	  )MN	69-	v{3	&&v.    c                 $    UR                   (       + $ N)skip_integrity_verificationselfargss     r   _PerformIntegrityVerification,AsymmetricSign._PerformIntegrityVerificationG   s    ////r   c                     UR                   S L$ r   )digest_algorithmr    s     r   _SignOnDigestAsymmetricSign._SignOnDigestJ   s      ,,r   c                     [         R                  " U5      n[        U5      U:  a%  [        R                  " SR                  X5      5      eU$ )Nz<The file [{0}] is larger than the maximum size of {1} bytes.)r   ReadBinaryFileContentslenr   BadFileExceptionformat)r!   path	max_bytesdatas       r   _ReadBinaryFileAsymmetricSign._ReadBinaryFileM   sI    ''-D
4y9''
H
O
O    Kr   c                 @    [         R                  " UR                  UR                  5      n[        R                  " 5       nUR                  [        R                  " U5      R                  5       S9nU R                  U5      (       a?  [        R                   " [#        X!R                  5      5      nUR%                  X&S9Ul        U$ UR%                  US9Ul        U$ ! [         a5  n[
        R                  " SR                  UR                  U5      5      eS nAff = f)N$Failed to read input file [{0}]: {1}name)digestdigestCrc32c)r7   )r   	GetDigestr&   
input_fileEnvironmentErrorr   r,   r-   cloudkms_baseGetMessagesModuleQCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSignRequestr
   ParseCryptoKeyVersionNameRelativeNamer#   r   Crc32cgetattrAsymmetricSignRequestasymmetricSignRequest)r!   r"   r7   emessagesreqdigest_crc32cs          r   $_CreateAsymmetricSignRequestOnDigest3AsymmetricSign._CreateAsymmetricSignRequestOnDigestU   s   M##D$9$94??Kf
 ..0H

d
d,,T2??A e CC ))$//mmGF4I4I$JKm"*"@"@ #A #5c
 J #+"@"@"@"OcJ!  M''
0
7
7
KM MMs   +C 
D(0DDc                     U R                  UR                  SS9n[        R                  " 5       nUR                  [        R                  " U5      R                  5       S9nU R                  U5      (       a,  [        R                  " U5      nUR!                  X&S9Ul        U$ UR!                  US9Ul        U$ ! [        R                   a5  n[        R
                  " SR                  UR                  U5      5      eSnAff = f)a&  Returns an AsymmetricSignRequest for use with a data input.

Populates an AsymmetricSignRequest with its data field populated by data
read from args.input_file. dataCrc32c is populated if integrity verification
is not skipped.

Args:
  args: Input arguments.

Returns:
  An AsymmetricSignRequest with data populated and dataCrc32c populated if
  integrity verification is not skipped.

Raises:
  exceptions.BadFileException: An error occurred reading the input file.
  This can occur if the file can't be read or if the file is larger than
  64 KiB.
i   )r/   r4   Nr5   )r0   
dataCrc32c)r0   )r1   r:   r   Errorr   r,   r-   r<   r=   r>   r
   r?   r@   r#   r   rA   rC   rD   )r!   r"   r0   rE   rF   rG   data_crc32cs          r   "_CreateAsymmetricSignRequestOnData1AsymmetricSign._CreateAsymmetricSignRequestOnDataj   s   &M!!$//U!Cd
 ..0H

d
d,,T2??A e CC ))$//MM$'k"*"@"@ #A #-c
 J #+"@"@d"@"KcJ ;; M''
0
7
7
KM MMs   B: :D0C>>Dc                 r    U R                  U5      (       a  U R                  U5      $ U R                  U5      $ r   )r'   rI   rO   r    s     r   _CreateAsymmetricSignRequest+AsymmetricSign._CreateAsymmetricSignRequest   s5    $66t<<44T::r   c                 `   UR                   UR                   :w  a?  [        R                  " [        R                  " UR                   UR                   5      5      eU(       a;  UR                  (       d)  [        R
                  " [        R                  " 5       5      eO:UR                  (       d)  [        R
                  " [        R                  " 5       5      e[        R                  " UR                  UR                  5      (       d)  [        R
                  " [        R                  " 5       5      eg)z4Verifies integrity fields in AsymmetricSignResponse.N)r6   r	   ResourceNameVerificationError#GetResourceNameMismatchErrorMessageverifiedDigestCrc32c$ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessageverifiedDataCrc32cr   Crc32cMatches	signaturesignatureCrc32c*GetResponseFromServerCorruptedErrorMessage)r!   rG   resp
use_digests       r   _VerifyResponseIntegrityFields-AsymmetricSign._VerifyResponseIntegrityFields   s     xx49977

;
;hh		#$ $ &&@@AACE 	E '
 $$@@AACE 	E 0D0DEE>>

B
B
DF F Fr   c                     [         R                  " 5       nU R                  U5      n UR                  R	                  U5      nU R                  U5      (       a   U R                  UWU R                  U5      S9   [        R                  " UR                  WR                  SSSS9  g ! [
        R                   a   n[        R                  " U5         S nANS nAff = f! [         R"                   a  n[$        R&                  " U5      eS nAff = f)N)r`   T)	overwritebinaryprivate)r<   GetClientInstancerR   8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr#   ra   r'   r   WriteToFileOrStdoutsignature_filer\   r   rM   r   r,   )r!   r"   clientrG   r_   errorrE   s          r   RunAsymmetricSign.Run   s    ,,.F

+
+D
1C6

I
I>#  ))$//
))
t 2 24 8 * :+	



.. 22 6..u556 ;; +''**+s/   B' :,C 'C;CCD2DD N)T)__name__
__module____qualname____firstlineno____doc__staticmethodr   r#   r'   r1   rI   rO   rR   ra   rp   __static_attributes__rr   r   r   r   r   !   sE    8 / /0-*%N;F2+r   r   N)rw   
__future__r   r   r   apitools.base.pyr   ri   googlecloudsdk.api_lib.cloudkmsr   r<   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   r   googlecloudsdk.corer   googlecloudsdk.core.utilr   Commandr   rr   r   r   <module>r      sC    > &  ' > A ( . 1 8 0 5 # *g+T\\ g+r   