
                         \   d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
mZ dd	l
mZ dd
l
mZ ddl
mZ ddlmZ ddlmZ ddlmZ e	j(                  e	j*                   e	j,                  e	j.                  j0                         G d de	j2                                             Zy)zEvaluate policy command.    )absolute_import)division)unicode_literals)apis)platform_policy)base)flags)parsing)sigstore_image)util)log)yaml)Errorc                   &    e Zd ZdZed        Zd Zy)EvaluateAndSigna  Evaluate a Binary Authorization platform policy and sign the results, if conformant.

  ## EXAMPLES

  To evaluate and sign a policy using its resource name:

    $ {command} projects/my-proj/platforms/gke/policies/my-policy
    --resource=$KUBERNETES_RESOURCE

  To evaluate the same policy using flags against multiple images:

    $ {command} my-policy --platform=gke --project=my-proj --image=$IMAGE1
    --image=$IMAGE2

  To return a modified resource with attestations added as an annotation on the
  input resource, without uploading attestations to the registry:

    $ {command} projects/my-proj/platforms/gke/policies/my-policy
    --resource=$KUBERNETES_RESOURCE --output-file=$MODIFIED_RESOURCE --no-upload

  To upload attestations using Docker credentials located in a custom directory:

    $ {command} projects/my-proj/platforms/gke/policies/my-policy
    --image=$IMAGE --use-docker-creds --docker-config-dir=$CUSTOM_DIR
  c                     t        j                  | d       t        j                  |        t        j                  |        t        j                  |        t        j
                  |        y )Nzto evaluate and sign)r	   AddPlatformPolicyResourceArgAddEvaluationUnitArgAddNoUploadArgAddOutputFileArgAddDockerCredsArgs)parsers    :lib/surface/container/binauthz/policy/evaluate_and_sign.pyArgszEvaluateAndSign.Args?   sK    	&&v/EF	v&	 	6"	V$    c                    |j                   j                  j                         j                         }|j	                  d      d   }|dk7  rt        dj                  |            |j                  r!|j                  st        j
                  d      |j                  r!|j                  rt        j
                  d      |j                  r!|j                  st        j
                  d      |j                  r t        j                  |j                        }nt        j                  |j                         }t#        j$                  d      j'                  ||d	      }|j(                  t+        j,                  d      j.                  j0                  j2                  k7  r	d
| _        |S |j                  s|j6                  D ]{  }t9        j:                  |      }t=        j>                  dj                  |             t9        j@                  |t9        jB                  |      |j                  |j                         } |j                  rt        jD                  ||j6                        }t        jF                  |j                        t        jH                  jJ                  k(  rtM        jN                  |      }t=        jP                  |j                  |d	dd	       |S )N/   gkezVFound unsupported platform '{}'. Currently only 'gke' platform policies are supported.z0Cannot specify --output-file without --resource.z3Cannot specify --use-docker-creds with --no-upload.z>Cannot specify --docker-config-dir without --use-docker-creds.v1T   zUploading attestation for {})	image_urlattestationuse_docker_credsdocker_config_dirF)	overwritebinaryprivate))CONCEPTSpolicy_resource_nameParseRelativeNamesplitr   formatoutput_fileresourcer   r$   	no_uploadr%   r
   LoadResourceFileGeneratePodSpecFromImagesimager   ClientEvaluateverdictr   GetMessagesModuleEvaluateGkePolicyResponseVerdictValueValuesEnum
CONFORMANT	exit_codeattestationsr   AttestationToImageUrlr   PrintUploadAttestationToRegistryStandardOrUrlsafeBase64DecodeAddInlineAttestationsToResourceGetResourceFileTypeResourceFileTypeYAMLr   dumpWriteToFileOrStdout)	selfargs
policy_refplatform_idresource_objresponser#   r"   modified_resources	            r   RunzEvaluateAndSign.RunG   sV   3399;HHJJ""3'*Ke$$*F;$7 
 JJIJJJJLMMd&;&;JJ
J  }}--dmm<l33DJJ?l%%d+44L$H 	!!

#
#$:$:::	F
 dno >>!..+"88E			077	BC22&DD "22"44	
 / >>
-- 
%
%dmm
4%%**+ !II&78	



 Or   N)__name__
__module____qualname____doc__staticmethodr   rO    r   r   r   r   !   s!    4 % %Gr   r   N)rS   
__future__r   r   r   )googlecloudsdk.api_lib.container.binauthzr   r   googlecloudsdk.callioper   -googlecloudsdk.command_lib.container.binauthzr	   r
   r   r   googlecloudsdk.corer   r   googlecloudsdk.core.exceptionsr   HiddenDefaultUniverseOnlyReleaseTracksReleaseTrackALPHACommandr   rU   r   r   <module>rb      s     &  ' : E ( ? A H > # $ 0 D%%++,jdll j -  jr   