
    !                         S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r
  SSKJ	r	  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr   " S S\	R,                  5      rg)z%Encrypt a plaintext file using a key.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)log)
console_io)filesc                   L    \ rS rSrSr\S 5       rS rS rS r	S r
S rS	 rS
rg)Encrypt!   a  Encrypt a plaintext file using a key.

Encrypts the given plaintext file using the given CryptoKey and writes the
result to the named ciphertext file. The plaintext file must not be larger
than 64KiB.

If an additional authenticated data file is provided, its contents must also
be provided during decryption. The file must not be larger than 64KiB.

The flag `--version` indicates the version of the key to use for
encryption. By default, the primary version is used.

If `--plaintext-file` or `--additional-authenticated-data-file` is set to '-',
that file is read from stdin. Similarly, if `--ciphertext-file` is set to '-',
the ciphertext is written to stdout.

By default, the command performs integrity verification on data sent to and
received from Cloud KMS. Use `--skip-integrity-verification` to disable
integrity verification.

## EXAMPLES
The following command will read the file 'path/to/plaintext', encrypt it using
the CryptoKey `frodo` with the KeyRing `fellowship` and Location `global`, and
write the ciphertext to 'path/to/ciphertext'.

  $ {command} \
      --key=frodo \
      --keyring=fellowship \
      --location=global \
      --plaintext-file=path/to/input/plaintext \
      --ciphertext-file=path/to/output/ciphertext
c                    [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R                  " U S5        [         R
                  " U 5        [         R                  " U 5        g )NzThe key to use for encryption.zto use for encryptionz
to encryptz	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddPlaintextFileFlagAddCiphertextFileFlagAddAadFileFlagAddSkipIntegrityVerification)parsers    lib/surface/kms/encrypt.pyArgsEncrypt.ArgsC   s`    	f&FG	!!&*AB	v|4	4	 	&&v.    c                     [         R                  " USS9n[        U5      U:  a%  [        R                  " SR                  X5      5      eU$ )NT)binaryz<The file [{0}] is larger than the maximum size of {1} bytes.)r   ReadFromFileOrStdinlenr   BadFileExceptionformat)selfpath	max_bytesdatas       r   _ReadFileOrStdinEncrypt._ReadFileOrStdinL   sK    ))$t<D
4y9''
H
O
O    Kr   c                 $    UR                   (       + $ )N)skip_integrity_verification)r#   argss     r   _PerformIntegrityVerification%Encrypt._PerformIntegrityVerificationT   s    ////r   c                 X    UR                  S5      S:X  a  UR                  S5      S   $ U$ )a  Strips the trailing '/cryptoKeyVersions/xx' from Response's resource name.

If request's resource name is a key and not a version, returns response's
resource name with the trailing '/cryptoKeyVersions/xx' suffix stripped.
Args:
  req_name: String.
    CloudkmsProjectsLocationsKeyRingsCryptoKeysEncryptRequest.name.
  resp_name: String. EncryptResponse.name.

Returns:
  resp_resource_name with '/cryptoKeyVersions/xx' suffix stripped.
z/cryptoKeyVersions/r   )find	partition)r#   req_name	resp_names      r   _MaybeStripResourceVersion"Encrypt._MaybeStripResourceVersionW   s3     }}*+r1  !67::r   c                 &   UR                   S:X  a'  UR                  S:X  a  [        R                  " SS5      e U R	                  UR                   SS9nS nUR                  (       a   U R	                  UR                  SS9nUR                  (       a  [        R                  " U5      nO[        R                  " U5      n[        R                  " 5       nUR                  UR!                  5       S9nU R#                  U5      (       a^  [$        R&                  " U5      nUb  [$        R&                  " U5      O[$        R&                  " S	5      n	UR)                  UUUU	S
9Ul        U$ UR)                  X$S9Ul        U$ ! [
        R                   a5  n[        R                  " SR                  UR                   U5      5      eS nAff = f! [
        R                   a5  n[        R                  " SR                  UR                  U5      5      eS nAff = f)N-z--plaintext-filezV--plaintext-file and --additional-authenticated-data-file cannot both read from stdin.i   )r%   z(Failed to read plaintext file [{0}]: {1}z<Failed to read additional authenticated data file [{0}]: {1})namer   )	plaintextadditionalAuthenticatedDataplaintextCrc32c!additionalAuthenticatedDataCrc32c)r9   r:   )plaintext_file"additional_authenticated_data_filer   InvalidArgumentExceptionr'   r   Errorr!   r"   versionr
   ParseCryptoKeyVersionNameParseCryptoKeyNamecloudkms_baseGetMessagesModule9CloudkmsProjectsLocationsKeyRingsCryptoKeysEncryptRequestRelativeNamer,   r   Crc32cEncryptRequestencryptRequest)
r#   r+   r9   eaadcrypto_key_refmessagesreqplaintext_crc32c
aad_crc32cs
             r   _CreateEncryptRequestEncrypt._CreateEncryptRequesti   s   s"//36//
"# #
'''(;(;u'Mi C..A##33u $ F ||66t<n//5n..0H

L
L((* M ,C ))$//y1),6==%fmmC>Pj#22&)*,6	 3 8c J $22 3 @c JS ;; '''
4
;
;!!1&' '' [[ A))JVD;;Q?A 	AAs/   E; 'G ;G0F??GH0HHc                 t   U R                  UR                  UR                  5      nUR                  U:w  a5  [        R                  " [        R                  " UR                  U5      5      eUR
                  (       d)  [        R                  " [        R                  " 5       5      eUR                  (       d)  [        R                  " [        R                  " 5       5      e[        R                  " UR                  UR                  5      (       d)  [        R                  " [        R                  " 5       5      eg)a%  Verifies integrity fields in EncryptResponse.

Note: This methods assumes that self._PerformIntegrityVerification() is True
and that all request CRC32C fields were pupolated.
Args:
  req: messages.CloudkmsProjectsLocationsKeyRingsCryptoKeysEncryptRequest()
    object
  resp: messages.EncryptResponse() object.

Returns:
  Void.
Raises:
  e2e_integrity.ServerSideIntegrityVerificationError if the server reports
  request integrity verification error.
  e2e_integrity.ClientSideIntegrityVerificationError if response integrity
  verification fails.
N)r4   r8   r	   ResourceNameVerificationError#GetResourceNameMismatchErrorMessageverifiedPlaintextCrc32c$ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessage)verifiedAdditionalAuthenticatedDataCrc32cr   Crc32cMatches
ciphertextciphertextCrc32c*GetResponseFromServerCorruptedErrorMessage)r#   rO   respr3   s       r   _VerifyResponseIntegrityFields&Encrypt._VerifyResponseIntegrityFields   s    * //$))DI
xx977

;
;hh	#$ $
 ''>>

?
?
AC C 99>>

?
?
AC C 1F1FGG>>

B
B
DF F Hr   c                    [         R                  " 5       nU R                  U5      n UR                  R	                  U5      nU R                  U5      (       a  U R                  UW5         [        R                  " UR                  WR                  SSS9  g ! [
        R                   a   n[        R                  " U5         S nANS nAff = f! [        R                    a  n["        R$                  " U5      eS nAff = f)NT)r   	overwrite)rD   GetClientInstancerR   &projects_locations_keyRings_cryptoKeysr   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr,   r`   r   WriteToFileOrStdoutciphertext_filer\   r   r@   r   r!   )r#   r+   clientrO   r_   errorrK   s          r   RunEncrypt.Run   s    ,,.F

$
$T
*C6::BB3Gd ))$//
))#t4+	


N 22 6..u556 ;; +''**+s/   B ,+C C,CCC>#C99C> N)__name__
__module____qualname____firstlineno____doc__staticmethodr   r'   r,   r4   rR   r`   rm   __static_attributes__ro   r   r   r   r   !   s=    B / /0$4l(FT+r   r   N)rt   
__future__r   r   r   apitools.base.pyr   rf   googlecloudsdk.api_lib.cloudkmsr   rD   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   Commandr   ro   r   r   <module>r      sC    , &  ' > A ( . 1 8 0 # 2 *y+dll y+r   