
                             d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z
 ddlm	Z	 ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  G d de	j,                        Zy)z/Sign a user input file using a MAC signing key.    )absolute_import)division)unicode_literals)
exceptions)base)crc32c)e2e_integrity)flags)log)
console_io)filesc                   >    e Zd ZdZed        Zd Zd Zd Zd Z	d Z
y)	MacSignaV  Sign a user input file using a MAC key version.

  Creates a digital signature of the input file using the provided
  MAC signing key version and saves the base64 encoded signature.

  The required flag `signature-file` indicates the path to store signature.

  By default, the command performs integrity verification on data sent to and
  received from Cloud KMS. Use --skip-integrity-verification to disable
  integrity verification.

  ## EXAMPLES
  The following command will read the file '/tmp/my/file.to.sign', and sign it
  using the symmetric MAC CryptoKey `dont-panic` Version 3, and save the
  signature in base64 format to '/tmp/my/signature'.

    $ {command} \
    --location=us-central1 \
    --keyring=hitchhiker \
    --key=dont-panic \
    --version=3 \
    --input-file=/tmp/my/file.to.sign \
    --signature-file=/tmp/my/signature

  c                     t        j                  | d       t        j                  | d       t        j                  | d       t        j                  | d       t        j
                  |        y )Nzto use for signing.zto use for signingzto signz	to output)r
   AddKeyResourceFlagsAddCryptoKeyVersionFlagAddInputFileFlagAddSignatureFileFlagAddSkipIntegrityVerification)parsers    lib/surface/kms/mac_sign.pyArgszMacSign.Args<   sR    	f&;<	!!&*>?	69-	v{3	&&v.    c                     t        j                  |d      }t        |      |kD  r%t        j                  dj                  ||            |S )NT)binaryz<The file [{0}] is larger than the maximum size of {1} bytes.)r   ReadFromFileOrStdinlenr   BadFileExceptionformat)selfpath	max_bytesdatas       r   _ReadFileOrStdinzMacSign._ReadFileOrStdinD   sM    ))$t<D
4y9''
H
O
OI    Kr   c                     |j                    S )N)skip_integrity_verification)r    argss     r   _PerformIntegrityVerificationz%MacSign._PerformIntegrityVerificationL   s    ////r   c                    	 | j                  |j                  d      }t        j                         }|j                  t        j                  |      j                               }| j                  |      r/t        j                  |      }|j                  ||      |_        |S |j                  |      |_        |S # t        $ r4}t        j                  dj                  |j                  |            d }~ww xY w)Ni   )r"   z$Failed to read input file [{0}]: {1})name)r#   
dataCrc32c)r#   )r$   
input_fileEnvironmentErrorr   r   r   cloudkms_baseGetMessagesModuleJCloudkmsProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsMacSignRequestr
   ParseCryptoKeyVersionNameRelativeNamer(   r   Crc32cMacSignRequestmacSignRequest)r    r'   r#   emessagesreqdata_crc32cs          r   _CreateMacSignRequestzMacSign._CreateMacSignRequestO   s    M""4??e"Dd
 ..0H

]
],,T2??A ^ CC ))$/MM$'k#22 3 -c
 J $222=cJ  M''
0
7
7
KM MMs   B? ?	C</C77C<c                    |j                   |j                   k7  r=t        j                  t        j                  |j                   |j                               |j                  s't        j
                  t        j                               t        j                  |j                  |j                        s't        j
                  t        j                               y)z-Verifies integrity fields in MacSignResponse.N)r*   r	   ResourceNameVerificationError#GetResourceNameMismatchErrorMessageverifiedDataCrc32c$ClientSideIntegrityVerificationError'GetRequestToServerCorruptedErrorMessager   Crc32cMatchesmac	macCrc32c*GetResponseFromServerCorruptedErrorMessage)r    r8   resps      r   _VerifyResponseIntegrityFieldsz&MacSign._VerifyResponseIntegrityFieldsd   s     xx49977

;
;hh		#$ $
 "">>

?
?
AC C $..9>>

B
B
DF F :r   c                    t        j                         }| j                  |      }	 |j                  j	                  |      }| j                  |      r| j                  |       	 t        j                  |j                  j                  ddd       y # t
        j                  $ r}t        j                  |       Y d }~d }~ww xY w# t        j                   $ r}t#        j$                  |      d }~ww xY w)NT)	overwriter   private)r.   GetClientInstancer:   8projects_locations_keyRings_cryptoKeys_cryptoKeyVersionsr   apitools_exceptionsHttpBadRequestErrorr	   ProcessHttpBadRequestErrorr(   rF   r   WriteToFileOrStdoutsignature_filerB   r   Errorr   r   )r    r'   clientr8   rE   errorr6   s          r   RunzMacSign.Runw   s    ,,.F

$
$T
*C6

I
I73<  ))$/
))#t4+	



(( 22 6..u556 ;; +''**+s/   B &.C
 C(CC
C7C22C7N)__name__
__module____qualname____doc__staticmethodr   r$   r(   r:   rF   rT    r   r   r   r   !   s5    4 / /0*F&+r   r   N)rX   
__future__r   r   r   apitools.base.pyr   rL   googlecloudsdk.api_lib.cloudkmsr   r.   googlecloudsdk.calliopegooglecloudsdk.command_lib.kmsr   r	   r
   googlecloudsdk.corer   googlecloudsdk.core.consoler   googlecloudsdk.core.utilr   Commandr   rZ   r   r   <module>rd      sC    6 &  ' > A ( . 1 8 0 # 2 *m+dll m+r   