
                             S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r
  SSKJ	r	  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  \	R,                   " S S\	R.                  5      5       rg)z@Decapsulate an input file using a key-encapsulation key version.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)log)
console_io)filesc                   @    \ rS rSrSr\S 5       rS rS rS r	S r
Srg	)
Decapsulate!   a"  Decapsulate an input file using a key-encapsulation key version.

Decapsulates the given ciphertext file using the provided key-encapsulation
key version and saves the decapsulated shared secret to the shared secret file.

By default, the command performs integrity verification on data sent to and
received from Cloud KMS. Use `--skip-integrity-verification` to disable
integrity verification.

## EXAMPLES
The following command will read the file '/tmp/my/secret.file.enc', decapsulate it
using the key encapsulation CryptoKey `my-key` Version 3 and write the shared secret
to '/tmp/my/secret.file.dec'.

  $ {command} \
  --location=us-central1 \
  --keyring=my-keyring \
  --key=my-key \
  --version=3 \
  --ciphertext-file=/tmp/my/secret.file.enc \
  --shared-secret-file=/tmp/my/secret.file.dec

c                     [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R
                  " U 5        g )Nzto use for decapsulation.zto use for decapsulationzto decapsulatez	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddCiphertextFileFlagAddSharedSecretFileFlagAddSkipIntegrityVerification)parsers    lib/surface/kms/decapsulate.pyArgsDecapsulate.Args;   sS    	f&AB	!!&*DE	(89	!!&+6	&&v.    c                 $    UR                   (       + $ )N)skip_integrity_verification)selfargss     r   _PerformIntegrityVerification)Decapsulate._PerformIntegrityVerificationC   s    ////r   c                     [         R                  " UR                  SS9n[        R                  " 5       n[        R                  " U5      nUR                  UR                  5       S9nU R                  U5      (       a,  [        R                   " U5      nUR#                  X'S9Ul        U$ UR#                  US9Ul        U$ ! [        R                   a5  n[
        R                  " SR                  UR                  U5      5      eS nAff = f)NT)binaryz)Failed to read ciphertext file [{0}]: {1})name)
ciphertextciphertextCrc32c)r%   )r   ReadFromFileOrStdinciphertext_filer   Errorr   BadFileExceptionformatcloudkms_baseGetMessagesModuler
   ParseCryptoKeyVersionNameNCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDecapsulateRequestRelativeNamer    r   Crc32cDecapsulateRequestdecapsulateRequest)r   r   r%   emessagescrypto_key_refreqciphertext_crc32cs           r   _CreateDecapsulateRequest%Decapsulate._CreateDecapsulateRequestF   s   (11


t-j ..0H44T:N

a
a((* b C ))$// --
3'::  ;  c J	  (::  ;  c J+ ;; (''
5
<
<""A'( ((s   C D
0DD
c                 *   UR                   (       d)  [        R                  " [        R                  " 5       5      e[        R
                  " UR                  UR                  5      (       d)  [        R                  " [        R                  " 5       5      eg)z&Verifies integrity fields in response.N)	verifiedCiphertextCrc32cr	   $ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessager   Crc32cMatchessharedSecretsharedSecretCrc32c*GetResponseFromServerCorruptedErrorMessage)r   r7   resps      r   _VerifyResponseIntegrityFields*Decapsulate._VerifyResponseIntegrityFieldsa   sv     ((>>

?
?
AC C  1 143J3JKK>>

B
B
DF F Lr   c                    U R                  U5      n[        R                  " 5       n UR                  R	                  U5      nU R                  U5      (       a  U R                  X$5        [        R                  " UR                  UR                  =(       d    SSSSS9  g ! [        R                   a   n[        R                  " U5         S nAg S nAf[        R                    a  n["        R$                  " U5      eS nAff = f)N T)	overwriter#   private)r9   r,   GetClientInstance8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   r    rD   r   WriteToFileOrStdoutshared_secret_filer@   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr   r)   r   r*   )r   r   r7   clientrC   errorr4   s          r   RunDecapsulate.Runn   s    

(
(
.C,,.F+LLXX
d 
	+	+D	1	1++C6	

!
!



!r 22 6..u55;; +''**+s$   A7B   D4CD&C<<D N)__name__
__module____qualname____firstlineno____doc__staticmethodr   r    r9   rD   rS   __static_attributes__rU   r   r   r   r   !   s0    0 / /06F+r   r   N)rZ   
__future__r   r   r   apitools.base.pyr   rN   googlecloudsdk.api_lib.cloudkmsr   r,   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   UniverseCompatibleCommandr   rU   r   r   <module>rg      sZ    G &  ' > A ( . 1 8 0 # 2 * d+$,, d+ d+r   