
                             d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z
 ddlm	Z	 ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  G d de	j,                        Zy)zADecrypt an input file using an asymmetric-encryption key version.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)log)
console_io)filesc                   8    e Zd ZdZed        Zd Zd Zd Zd Z	y)AsymmetricDecrypta*  Decrypt an input file using an asymmetric-encryption key version.

  Decrypts the given ciphertext file using the provided asymmetric-encryption
  key version and saves the decrypted data to the plaintext file.

  By default, the command performs integrity verification on data sent to and
  received from Cloud KMS. Use `--skip-integrity-verification` to disable
  integrity verification.

  ## EXAMPLES
  The following command will read the file '/tmp/my/secret.file.enc', decrypt it
  using the asymmetric CryptoKey `dont-panic` Version 3 and write the plaintext
  to '/tmp/my/secret.file.dec'.

    $ {command} \
    --location=us-central1 \
    --keyring=hitchhiker \
    --key=dont-panic \
    --version=3 \
    --ciphertext-file=/tmp/my/secret.file.enc \
    --plaintext-file=/tmp/my/secret.file.dec

  c                     t        j                  | d       t        j                  | d       t        j                  | d       t        j                  | d       t        j
                  |        y )Nz!to use for asymmetric-decryption.z to use for asymmetric-decryptionz
to decryptz	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddCiphertextFileFlagAddPlaintextFileFlagAddSkipIntegrityVerification)parsers    %lib/surface/kms/asymmetric_decrypt.pyArgszAsymmetricDecrypt.Args:   sR    	f&IJ	!!&*LM	5	v{3	&&v.    c                     |j                    S )N)skip_integrity_verification)selfargss     r   _PerformIntegrityVerificationz/AsymmetricDecrypt._PerformIntegrityVerificationB   s    ////r   c                    	 t        j                  |j                  d      }t        j                         }t        j                  |      }|j                  |j                               }| j                  |      r/t        j                   |      }|j#                  ||      |_        |S |j#                  |      |_        |S # t        j                  $ r4}t        j                  dj                  |j                  |            d }~ww xY w)NT)binaryz)Failed to read ciphertext file [{0}]: {1})name)
ciphertextciphertextCrc32c)r"   )r   ReadFromFileOrStdinciphertext_filer   Errorr   BadFileExceptionformatcloudkms_baseGetMessagesModuler
   ParseCryptoKeyVersionNameTCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptRequestRelativeNamer   r   Crc32cAsymmetricDecryptRequestasymmetricDecryptRequest)r   r   r"   emessagescrypto_key_refreqciphertext_crc32cs           r   _CreateAsymmetricDecryptRequestz1AsymmetricDecrypt._CreateAsymmetricDecryptRequestE   s   (11


t-j ..0H44T:N

g
g((* h ,C))$/ --
3%-%F%F2C &G &Ec" J &.%F%F &G &!c" J% ;; (''
5
<
<""A'( ((s   !C D/DDc                    |j                   s't        j                  t        j                               t	        j
                  |j                  |j                        s't        j                  t        j                               y)z&Verifies integrity fields in response.N)	verifiedCiphertextCrc32cr	   $ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessager   Crc32cMatches	plaintextplaintextCrc32c*GetResponseFromServerCorruptedErrorMessage)r   r4   resps      r   _VerifyResponseIntegrityFieldsz0AsymmetricDecrypt._VerifyResponseIntegrityFields]   sq     ((>>

?
?
AC C 0D0DE>>

B
B
DF F Fr   c                    | j                  |      }t        j                         }	 |j                  j	                  |      }| j                  |      r| j                  |       	 t        j                  |j                  j                  xs dddd       y # t
        j                  $ r}t        j                  |       Y d }~d }~ww xY w# t        j                   $ r}t#        j$                  |      d }~ww xY w)N T)	overwriter    private)r6   r)   GetClientInstance8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr   r@   r   WriteToFileOrStdoutplaintext_filer<   r   r&   r   r'   )r   r   r4   clientr?   errorr1   s          r   RunzAsymmetricDecrypt.Runj   s    

.
.t
4C,,.F6

I
IS!  ))$/
))#t4+	



..
B 22 6..u556 ;; +''**+s/   B &2C C,CCC;!C66C;N)
__name__
__module____qualname____doc__staticmethodr   r   r6   r@   rN    r   r   r   r   !   s0    0 / /00F+r   r   N)rR   
__future__r   r   r   apitools.base.pyr   rG   googlecloudsdk.api_lib.cloudkmsr   r)   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   Commandr   rT   r   r   <module>r^      sD    H &  ' > A ( . 1 8 0 # 2 *`+ `+r   