File: //lib/google-cloud-sdk/lib/surface/kms/__pycache__/decrypt.cpython-312.pyc
�
��C" � �� � d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z
ddl m Z ddl mZ ddl m
Z
ddl mZ dd l mZ dd
lmZ dd lmZ dd lmZ G d
� de j, � Zy)z&Decrypt a ciphertext file using a key.� )�absolute_import)�division)�unicode_literals)�
exceptions)�base)�crc32c)�
e2e_integrity)�flags)�log)�
console_io)�filesc �> � e Zd ZdZed� � Zd� Zd� Zd� Zd� Z d� Z
y) �Decrypta� Decrypt a ciphertext file using a Cloud KMS key.
`{command}` decrypts the given ciphertext file using the given Cloud KMS key
and writes the result to the named plaintext file. Note that to permit users
to decrypt using a key, they must be have at least one of the following IAM
roles for that key: `roles/cloudkms.cryptoKeyDecrypter`,
`roles/cloudkms.cryptoKeyEncrypterDecrypter`.
Additional authenticated data (AAD) is used as an additional check by Cloud
KMS to authenticate a decryption request. If an additional authenticated data
file is provided, its contents must match the additional authenticated data
provided during encryption and must not be larger than 64KiB. If you don't
provide a value for `--additional-authenticated-data-file`, an empty string is
used. For a thorough explanation of AAD, refer to this
guide: https://cloud.google.com/kms/docs/additional-authenticated-data
If `--ciphertext-file` or `--additional-authenticated-data-file` is set to
'-', that file is read from stdin. Note that both files cannot be read from
stdin. Similarly, if `--plaintext-file` is set to '-', the decrypted plaintext
is written to stdout.
By default, the command performs integrity verification on data sent to and
received from Cloud KMS. Use `--skip-integrity-verification` to disable
integrity verification.
## EXAMPLES
To decrypt the file 'path/to/ciphertext' using the key `frodo` with key
ring `fellowship` and location `global` and write the plaintext
to 'path/to/plaintext.dec', run:
$ {command} \
--key=frodo \
--keyring=fellowship \
--location=global \
--ciphertext-file=path/to/input/ciphertext \
--plaintext-file=path/to/output/plaintext.dec
To decrypt the file 'path/to/ciphertext' using the key `frodo` and the
additional authenticated data that was used to encrypt the ciphertext, and
write the decrypted plaintext to stdout, run:
$ {command} \
--key=frodo \
--keyring=fellowship \
--location=global \
--additional-authenticated-data-file=path/to/aad \
--ciphertext-file=path/to/input/ciphertext \
--plaintext-file='-'
c �� � t j | d� t j | d� t j | d� t j | � t j
| � y )Na� Cloud KMS key to use for decryption.
* For symmetric keys, Cloud KMS detects the decryption key version from the ciphertext. If you specify a key version as part of a symmetric decryption request, an error is logged and decryption fails.
* For asymmetric keys, the encryption key version can't be detected automatically. You must keep track of this information and provide the key version in the decryption request. The key version itself is not sensitive data and does not need to be encrypted.z^to decrypt. This file should contain the result of encrypting a file with `gcloud kms encrypt`z to output)r
�AddKeyResourceFlags�AddCiphertextFileFlag�AddPlaintextFileFlag�AddAadFileFlag� AddSkipIntegrityVerification)�parsers �lib/surface/kms/decrypt.py�Argsz Decrypt.ArgsU s` � � � � �� C� D�
� � �� +�,�
� � �v�{�3� ���� � �&�&�v�.� c � � t j |d�� }t |� |kD r%t j dj ||� � �|S )NT)�binaryz<The file [{0}] is larger than the maximum size of {1} bytes.)r �ReadFromFileOrStdin�lenr �BadFileException�format)�self�path� max_bytes�datas r �_ReadFileOrStdinzDecrypt._ReadFileOrStdinh sM � � � )� )�$�t� <�D�
�4�y�9� � � '� '�
H�
O�
O��I� �
� � �Kr c � � |j S )N)�skip_integrity_verification)r �argss r � _PerformIntegrityVerificationz%Decrypt._PerformIntegrityVerificationp s � ��/�/� /�/r c �B � |j dk( r%|j dk( rt j dd� � | j |j d�� }d }|j r | j |j d�� }t j |� }d |j v r/t j d
d j |j � � �t j � }|j |j � � � }| j! |� r]t# j$ |� }|�t# j$ |� nt# j$ d
� } |j' |||| �� |_ |S |j' ||�� |_ |S # t
j $ r4}t j dj |j |� � �d }~ww xY w# t
j $ r4}t j dj |j |� � �d }~ww xY w)N�-z--ciphertext-filezW--ciphertext-file and --additional-authenticated-data-file cannot both read from stdin.i )r" z)Failed to read ciphertext file [{0}]: {1}i z<Failed to read additional authenticated data file [{0}]: {1}z/cryptoKeyVersions/z--keyz<{} includes cryptoKeyVersion which is not valid for decrypt.)�namer )�
ciphertext�additionalAuthenticatedData�ciphertextCrc32c�!additionalAuthenticatedDataCrc32c)r, r- )�ciphertext_file�"additional_authenticated_data_filer �InvalidArgumentExceptionr$ r
�Errorr r r
�ParseCryptoKeyName� cryptoKeysId�
cloudkms_base�GetMessagesModule�9CloudkmsProjectsLocationsKeyRingsCryptoKeysDecryptRequest� RelativeNamer( r �Crc32c�DecryptRequest�decryptRequest)
r r' r, �e�aad�crypto_key_ref�messages�req�ciphertext_crc32c�
aad_crc32cs
r �_CreateDecryptRequestz Decrypt._CreateDecryptRequests s( � � � � ��#� �/�/�3�6� � /� /�
� "�
#� #�
(� �(�(�
�
�
�)� )� 5�j� �C� �.�.�A��#�#� � 3� 3�u� $� F�� �-�-�d�3�N�
�� ;� ;�;� � /� /�
� ��V�N� 7� 7�8�
:� :� �.�.�0�H�
�
L�
L�
�
(�
(�
*� M� ,�C� �)�)�$�/� �-�-�
�3��),� �6�=�=��%�f�m�m�C�>P�j�#�2�2� �&)�,�,6� 3� 8�c�� �J� $�2�2� �S� 3� B�c�� �J��[ �;�;� (� � '� '�
5�
<�
<��"�"�A� '�
(� (��(�� �[�[� A��)�)� J�
�V�D�;�;�Q�
?�A� A��A�s/ � F
�" G �
G� /G�G�H �*/H�H c � � t j |j |j � s't j
t j � � �y)z&Verifies integrity fields in response.N)r �
Crc32cMatches� plaintext�plaintextCrc32cr �$ClientSideIntegrityVerificationError�*GetResponseFromServerCorruptedErrorMessage)r rA �resps r � _VerifyResponseIntegrityFieldsz&Decrypt._VerifyResponseIntegrityFields� sE � � � � �����0D�0D� E� � >� >�
�
B�
B�
D�
F� F� Fr c � � | j |� }t j � } |j j |� }| j |� r| j |� j �?t j |j � 5 d d d � t j d� y t j" |j |j dd�� y # t
j $ r }t j |� Y d }~��d }~ww xY w# 1 sw Y ��xY w# t j$ $ r}t' j( |� �d }~ww xY w)NzDecrypted file is emptyT)r � overwrite)rD r6 �GetClientInstance�&projects_locations_keyRings_cryptoKeysr �apitools_exceptions�HttpBadRequestErrorr �ProcessHttpBadRequestErrorr( rL rG r
�
FileWriter�plaintext_filer �Print�WriteToFileOrStdoutr3 r r )r r' rA �clientrK �errorr= s r �Runz Decrypt.Run� s � �
�
$�
$�T�
*�C�
�
,�
,�
.�F�6�
�
:�
:�
B�
B�3�
G�d� �)�)�$�/�
�)�)�#�t�4�
+�
� � � �
�
�
�d� 1� 1�
2�
� 3� � � �+�,� � � � � � �� � ��� N�� � 2� 2� 6��.�.�u�5�5��6�� 3�
2�� �;�;� +� � '� '�� *�*��+�sM �C �&+D �D� D �1-D � D�2D � D�D �D � E
�3E�E
N) �__name__�
__module__� __qualname__�__doc__� staticmethodr r$ r( rD rL rZ � r r r r ! s7 � �1�f �/� �/�$�0�;�zF�+r r N)r^ �
__future__r r r �apitools.base.pyr rQ � googlecloudsdk.api_lib.cloudkmsr r6 �googlecloudsdk.calliope� googlecloudsdk.command_lib.kmsr r r
�googlecloudsdk.corer �googlecloudsdk.core.consoler �googlecloudsdk.core.utilr
�Commandr r` r r �<module>rj sC �� -� &� � '� >� A� (� .� 1� 8� 0� #� 2� *�n+�d�l�l� n+r