Skip to content

Commit 9cddd41

Browse files
lucasmcdonald3lucasmcdonald3
authored
feat(TestVectors): Decrypt "golden" manifest (#721)
1 parent 8383b06 commit 9cddd41

File tree

7 files changed

+160
-8
lines changed

7 files changed

+160
-8
lines changed

‎buildspec.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,14 @@ batch:
206206
buildspec: codebuild/py311/decrypt_keyrings_with_js.yml
207207
env:
208208
image: aws/codebuild/standard:7.0
209+
- identifier: py311_decrypt_golden_manifest_with_keyrings
210+
buildspec: codebuild/py311/decrypt_golden_manifest_with_keyrings.yml
211+
env:
212+
image: aws/codebuild/standard:7.0
213+
- identifier: py311_decrypt_golden_manifest_with_masterkey
214+
buildspec: codebuild/py311/decrypt_golden_manifest_with_masterkey.yml
215+
env:
216+
image: aws/codebuild/standard:7.0
209217

210218

211219
- identifier: py312_integ
@@ -318,6 +326,14 @@ batch:
318326
buildspec: codebuild/py312/decrypt_hkeyring_with_net.yml
319327
env:
320328
image: aws/codebuild/standard:7.0
329+
- identifier: py312_decrypt_golden_manifest_with_keyrings
330+
buildspec: codebuild/py312/decrypt_golden_manifest_with_keyrings.yml
331+
env:
332+
image: aws/codebuild/standard:7.0
333+
- identifier: py312_decrypt_golden_manifest_with_masterkey
334+
buildspec: codebuild/py312/decrypt_golden_manifest_with_masterkey.yml
335+
env:
336+
image: aws/codebuild/standard:7.0
321337

322338
- identifier: code_coverage
323339
buildspec: codebuild/coverage/coverage.yml

‎codebuild/py311/decrypt_golden_manifest_with_keyrings.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "py311-full_decrypt-mpl"
6+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
7+
arn:aws:kms:us-west-2:658956600833:key/b35311ef1-d8dc-4780-9f5a-55776cbb2f7f
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
9+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
11+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
13+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
15+
phases:
16+
install:
17+
runtime-versions:
18+
python: 3.11
19+
pre_build:
20+
commands:
21+
# Download "golden manifest"
22+
- curl -L -o python-2.3.0.zip https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-2.3.0.zip
23+
- unzip python-2.3.0.zip -d python-2.3.0
24+
build:
25+
commands:
26+
- pip install "tox < 4.0"
27+
- cd test_vector_handlers
28+
- |
29+
tox -- \
30+
--input ../python-2.3.0/manifest.json \
31+
--keyrings

‎codebuild/py311/decrypt_golden_manifest_with_masterkey.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "py311-full_decrypt-mpl"
6+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
7+
arn:aws:kms:us-west-2:658956600833:key/b35311ef1-d8dc-4780-9f5a-55776cbb2f7f
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
9+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
11+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
13+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
15+
phases:
16+
install:
17+
runtime-versions:
18+
python: 3.11
19+
pre_build:
20+
commands:
21+
# Download "golden manifest"
22+
- curl -L -o python-2.3.0.zip https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-2.3.0.zip
23+
- unzip python-2.3.0.zip -d python-2.3.0
24+
build:
25+
commands:
26+
- pip install "tox < 4.0"
27+
- cd test_vector_handlers
28+
- |
29+
tox -- \
30+
--input ../python-2.3.0/manifest.json

‎codebuild/py312/decrypt_golden_manifest_with_keyrings.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "py312-full_decrypt-mpl"
6+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
7+
arn:aws:kms:us-west-2:658956600833:key/b35311ef1-d8dc-4780-9f5a-55776cbb2f7f
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
9+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
11+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
13+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
15+
phases:
16+
install:
17+
runtime-versions:
18+
python: 3.12
19+
pre_build:
20+
commands:
21+
# Download "golden manifest"
22+
- curl -L -o python-2.3.0.zip https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-2.3.0.zip
23+
- unzip python-2.3.0.zip -d python-2.3.0
24+
build:
25+
commands:
26+
- pip install "tox < 4.0"
27+
- cd test_vector_handlers
28+
- |
29+
tox -- \
30+
--input ../python-2.3.0/manifest.json \
31+
--keyrings

‎codebuild/py312/decrypt_golden_manifest_with_masterkey.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "py312-full_decrypt-mpl"
6+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
7+
arn:aws:kms:us-west-2:658956600833:key/b35311ef1-d8dc-4780-9f5a-55776cbb2f7f
8+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
9+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
11+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
13+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
14+
15+
phases:
16+
install:
17+
runtime-versions:
18+
python: 3.12
19+
pre_build:
20+
commands:
21+
# Download "golden manifest"
22+
- curl -L -o python-2.3.0.zip https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-2.3.0.zip
23+
- unzip python-2.3.0.zip -d python-2.3.0
24+
build:
25+
commands:
26+
- pip install "tox < 4.0"
27+
- cd test_vector_handlers
28+
- |
29+
tox -- \
30+
--input ../python-2.3.0/manifest.json

‎test_vector_handlers/src/awses_test_vectors/manifests/full_message/decrypt.py

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ def __init__(
264264
attr.validate(self)
265265

266266
@classmethod
267-
def from_scenario(
267+
def from_scenario( # noqa: C901
268268
cls,
269269
scenario, # type: DECRYPT_SCENARIO_SPEC
270270
plaintext_reader, # type: Callable[[str], bytes]
@@ -273,7 +273,7 @@ def from_scenario(
273273
keyrings, # type: bool
274274
keys_uri, # type: str
275275
):
276-
# pylint: disable=too-many-locals
276+
# pylint: disable=too-many-locals,too-many-branches
277277
# type: (...) -> MessageDecryptionTestScenario
278278
"""Load from a scenario specification.
279279
@@ -330,11 +330,16 @@ def master_key_provider_fn():
330330
# If unspecified, set "Default" as the default
331331
cmm_type = "Default"
332332

333-
# If this scenario does not have any key providers,
334-
# do not create a scenario.
335-
# Caller logic should expect `None` to mean "no scenario".
336-
if master_key_provider_fn() is None:
337-
return None
333+
try:
334+
# If this scenario does not have any key providers,
335+
# do not create a scenario.
336+
# Caller logic should expect `None` to mean "no scenario".
337+
if master_key_provider_fn() is None:
338+
return None
339+
except Exception: # nosec,pylint: disable=broad-except
340+
# If there is any exception when loading the key, continue to create the test scenario.
341+
# Some test scenarios have bad keys that should fail during the test execution.
342+
pass
338343

339344
return cls(
340345
ciphertext_uri=scenario["ciphertext"],

‎test_vector_handlers/src/awses_test_vectors/manifests/mpl_keyring.py

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,8 @@ def from_scenario(cls, spec):
9090
padding_hash=spec.get("padding-hash"),
9191
)
9292

93-
def keyring(self, keys_uri, mode):
93+
def keyring(self, keys_uri, mode): # noqa: C901
94+
# pylint: disable=too-many-branches
9495
# type: (KeysManifest) -> IKeyring
9596
"""Build a keyring using this specification.
9697
:param str keys_uri: Path to the keys manifest
@@ -113,6 +114,14 @@ def keyring(self, keys_uri, mode):
113114
input_kwargs["padding-algorithm"] = self.padding_algorithm
114115
if self.padding_hash is not None:
115116
input_kwargs["padding-hash"] = self.padding_hash
117+
if self.default_mrk_region is not None:
118+
input_kwargs["default-mrk-region"] = self.default_mrk_region
119+
if self.discovery_filter is not None:
120+
input_kwargs["aws-kms-discovery-filter"] = {}
121+
if self.discovery_filter.partition is not None:
122+
input_kwargs["aws-kms-discovery-filter"]["partition"] = self.discovery_filter.partition
123+
if self.discovery_filter.account_ids is not None:
124+
input_kwargs["aws-kms-discovery-filter"]["account-ids"] = self.discovery_filter.account_ids
116125

117126
if input_kwargs["type"] == "raw" \
118127
and input_kwargs["encryption-algorithm"] == "rsa":

0 commit comments

Comments
 (0)