
                             d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z
 ddlm	Z	 ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ e	j,                   G d de	j.                               Zy)z@Decapsulate an input file using a key-encapsulation key version.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)log)
console_io)filesc                   8    e Zd ZdZed        Zd Zd Zd Zd Z	y)DecapsulateaD  Decapsulate an input file using a key-encapsulation key version.

  Decapsulates the given ciphertext file using the provided key-encapsulation
  key version and saves the decapsulated shared secret to the shared secret file.

  By default, the command performs integrity verification on data sent to and
  received from Cloud KMS. Use `--skip-integrity-verification` to disable
  integrity verification.

  ## EXAMPLES
  The following command will read the file '/tmp/my/secret.file.enc', decapsulate it
  using the key encapsulation CryptoKey `my-key` Version 3 and write the shared secret
  to '/tmp/my/secret.file.dec'.

    $ {command} \
    --location=us-central1 \
    --keyring=my-keyring \
    --key=my-key \
    --version=3 \
    --ciphertext-file=/tmp/my/secret.file.enc \
    --shared-secret-file=/tmp/my/secret.file.dec

  c                     t        j                  | d       t        j                  | d       t        j                  | d       t        j                  | d       t        j
                  |        y )Nzto use for decapsulation.zto use for decapsulationzto decapsulatez	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddCiphertextFileFlagAddSharedSecretFileFlagAddSkipIntegrityVerification)parsers    lib/surface/kms/decapsulate.pyArgszDecapsulate.Args;   sS    	f&AB	!!&*DE	(89	!!&+6	&&v.    c                     |j                    S )N)skip_integrity_verification)selfargss     r   _PerformIntegrityVerificationz)Decapsulate._PerformIntegrityVerificationC   s    ////r   c                    	 t        j                  |j                  d      }t        j                         }t        j                  |      }|j                  |j                               }| j                  |      r/t        j                   |      }|j#                  ||      |_        |S |j#                  |      |_        |S # t        j                  $ r4}t        j                  dj                  |j                  |            d }~ww xY w)NT)binaryz)Failed to read ciphertext file [{0}]: {1})name)
ciphertextciphertextCrc32c)r"   )r   ReadFromFileOrStdinciphertext_filer   Errorr   BadFileExceptionformatcloudkms_baseGetMessagesModuler
   ParseCryptoKeyVersionNameNCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDecapsulateRequestRelativeNamer   r   Crc32cDecapsulateRequestdecapsulateRequest)r   r   r"   emessagescrypto_key_refreqciphertext_crc32cs           r   _CreateDecapsulateRequestz%Decapsulate._CreateDecapsulateRequestF   s   (11


t-j ..0H44T:N

a
a((* b C ))$/ --
3'::2C  ;  c J	  (::  ;  c J+ ;; (''
5
<
<""A'( ((s   !C D/DDc                    |j                   s't        j                  t        j                               t	        j
                  |j                  |j                        s't        j                  t        j                               y)z&Verifies integrity fields in response.N)	verifiedCiphertextCrc32cr	   $ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessager   Crc32cMatchessharedSecretsharedSecretCrc32c*GetResponseFromServerCorruptedErrorMessage)r   r4   resps      r   _VerifyResponseIntegrityFieldsz*Decapsulate._VerifyResponseIntegrityFieldsa   ss     ((>>

?
?
AC C  1 143J3JK>>

B
B
DF F Lr   c                    | j                  |      }t        j                         }	 |j                  j	                  |      }| j                  |      r| j                  ||       t        j                  |j                  |j                  xs dddd       y # t        j                  $ r}t        j                  |       Y d }~y d }~wt        j                   $ r}t#        j$                  |      d }~ww xY w)N T)	overwriter    private)r6   r)   GetClientInstance8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   r   r@   r   WriteToFileOrStdoutshared_secret_filer<   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr   r&   r   r'   )r   r   r4   clientr?   errorr1   s          r   RunzDecapsulate.Runn   s    

(
(
.C,,.F+LLXX
d 
	+	+D	1++C6	

!
!



!r 22 6..u55;; +''**+s$   A0B C5+CC5C00C5N)
__name__
__module____qualname____doc__staticmethodr   r   r6   r@   rN    r   r   r   r   !   s0    0 / /06F+r   r   N)rR   
__future__r   r   r   apitools.base.pyr   rI   googlecloudsdk.api_lib.cloudkmsr   r)   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   UniverseCompatibleCommandr   rT   r   r   <module>r_      sZ    G &  ' > A ( . 1 8 0 # 2 * d+$,, d+ d+r   