migrate code from googleapis/python-kms

.github/CODEOWNERS

@@ -69,3 +69,4 @@
 /trace/**/*                            @ymotongpoo @GoogleCloudPlatform/python-samples-reviewers
 /translate/**/*                        @nicain @GoogleCloudPlatform/python-samples-reviewers
 /workflows/**/*                        @GoogleCloudPlatform/python-samples-reviewers
+/kms/**/**                             @GoogleCloudPlatform/dee-infra @GoogleCloudPlatform/python-samples-reviewers

.github/blunderbuss.yml

@@ -126,6 +126,11 @@ assign_issues_by:
   - 'api: monitoring'
   to: 
   - GoogleCloudPlatform/dee-observability
+- labels:
+  - 'api: kms'
+  - 'api: cloudkms'
+  to: 
+  - GoogleCloudPlatform/dee-infra
 
 assign_prs_by:
 - labels:

kms/attestations/README.rst

@@ -0,0 +1,120 @@
+Google Cloud Key Management Service Python Samples
+===============================================================================
+
+.. image:: https://gstatic.com/cloudssh/images/open-btn.png
+   :target: https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/python-docs-samples&page=editor&open_in_editor=kms/attestations/README.rst
+
+
+This directory contains samples for Google Cloud Key Management Service. The `Cloud Key Management Service`_ allows you to create, import, and manage cryptographic keys and perform cryptographic operations in a single centralized cloud service.
+
+
+
+
+.. _Cloud Key Management Service: https://cloud.google.com/kms/docs/
+
+
+
+
+
+Setup
+-------------------------------------------------------------------------------
+
+
+Install Dependencies
+++++++++++++++++++++
+
+#. Clone python-kms and change directory to the sample directory you want to use.
+
+    .. code-block:: bash
+
+        $ git clone https://github.com/GoogleCloudPlatform/python-docs-samples.git
+
+#. Install `pip`_ and `virtualenv`_ if you do not already have them. You may want to refer to the `Python Development Environment Setup Guide`_ for Google Cloud Platform for instructions.
+
+   .. _Python Development Environment Setup Guide:
+       https://cloud.google.com/python/setup
+
+#. Create a virtualenv. Samples are compatible with Python 2.7 and 3.4+.
+
+    .. code-block:: bash
+
+        $ virtualenv env
+        $ source env/bin/activate
+
+#. Install the dependencies needed to run the samples.
+
+    .. code-block:: bash
+
+        $ pip install -r requirements.txt
+
+.. _pip: https://pip.pypa.io/
+.. _virtualenv: https://virtualenv.pypa.io/
+
+Samples
+-------------------------------------------------------------------------------
+
+Verify attestations and certificate chains for keys generated by Cloud HSM
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+.. image:: https://gstatic.com/cloudssh/images/open-btn.png
+   :target: https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/python-docs-samples&page=editor&open_in_editor=kms/attestations/verify_attestation_chains.py,kms/attestations/README.rst
+
+
+
+
+To run this sample:
+
+.. code-block:: bash
+
+    $ python verify_attestation_chains.py
+
+    usage: verify_attestation_chains.py [-h] [--certificates CERTIFICATES]
+                                        [--attestation ATTESTATION]
+
+    This application verifies HSM attestations using certificate chains
+    obtained from Cloud HSM and the HSM manufacturer.
+
+    For more information, visit https://cloud.google.com/kms/docs/attest-key.
+
+    optional arguments:
+      -h, --help            show this help message and exit
+      --certificates CERTIFICATES
+                            The certificate chains filename.
+      --attestation ATTESTATION
+                            The attestation filename.
+
+
+
+Verify attestations for keys generated by Cloud HSM
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+.. image:: https://gstatic.com/cloudssh/images/open-btn.png
+   :target: https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/python-docs-samples&page=editor&open_in_editor=kms/attestations/verify_attestation.py,kms/attestations/README.rst
+
+
+
+
+To run this sample:
+
+.. code-block:: bash
+
+    $ python verify_attestation.py
+
+    usage: verify_attestation.py [-h] attestation_file bundle_file
+
+    This application verifies HSM attestations using certificate bundles obtained
+    from Cloud HSM. For more information, visit https://cloud.google.com/kms/docs
+    /attest-key.
+
+    positional arguments:
+      attestation_file  Name of attestation file.
+      bundle_file       Name of certificate bundle file.
+
+    optional arguments:
+      -h, --help        show this help message and exit
+
+
+
+
+
+.. _Google Cloud SDK: https://cloud.google.com/sdk/

kms/attestations/noxfile_config.py

@@ -0,0 +1,42 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Default TEST_CONFIG_OVERRIDE for python repos.
+
+# You can copy this file into your directory, then it will be imported from
+# the noxfile.py.
+
+# The source of truth:
+# https://github.com/GoogleCloudPlatform/python-docs-samples/blob/main/noxfile_config.py
+
+TEST_CONFIG_OVERRIDE = {
+    # You can opt out from the test for specific Python versions.
+    "ignored_versions": ["2.7"],
+    # Old samples are opted out of enforcing Python type hints
+    # All new samples should feature them
+    "enforce_type_hints": False,
+    # An envvar key for determining the project id to use. Change it
+    # to 'BUILD_SPECIFIC_GCLOUD_PROJECT' if you want to opt in using a
+    # build specific Cloud project. You can also use your own string
+    # to use your own Cloud project.
+    "gcloud_project_env": "GOOGLE_CLOUD_PROJECT",
+    # 'gcloud_project_env': 'BUILD_SPECIFIC_GCLOUD_PROJECT',
+    # If you need to use a specific version of pip,
+    # change pip_version_override to the string representation
+    # of the version number, for example, "20.2.4"
+    "pip_version_override": None,
+    # A dictionary you want to inject into your test. Don't put any
+    # secrets here. These values will override predefined values.
+    "envs": {},
+}

kms/attestations/requirements-test.txt

@@ -0,0 +1 @@
+pytest==7.2.0

kms/attestations/requirements.txt

@@ -0,0 +1,3 @@
+cryptography==38.0.2
+pem==21.2.0
+requests==2.28.1

kms/attestations/verify_attestation.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python
+
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""This application verifies HSM attestations using certificate bundles
+obtained from Cloud HSM.
+
+For more information, visit https://cloud.google.com/kms/docs/attest-key.
+"""
+
+# [START kms_verify_attestations]
+import argparse
+import gzip
+
+from cryptography import exceptions
+from cryptography import x509
+from cryptography.hazmat import backends
+from cryptography.hazmat.primitives.asymmetric import padding
+import pem
+
+
+def verify(attestation_file, bundle_file):
+    """Verifies an attestation using a bundle of certificates.
+
+    Args:
+      attestation_file: The name of the attestation file.
+      bundle_file: The name of the bundle file containing the certificates
+        used to verify the attestation.
+
+    Returns:
+      True if at least one of the certificates in bundle_file can verify the
+      attestation data and its signature.
+    """
+    with gzip.open(attestation_file, 'rb') as f:
+        # An attestation file consists of a data portion and a 256 byte
+        # signature portion concatenated together.
+        attestation = f.read()
+        # Separate the components.
+        data = attestation[:-256]
+        signature = attestation[-256:]
+
+        # Verify the attestation with one of the certificates in the bundle
+        for cert in pem.parse_file(bundle_file):
+            cert_obj = x509.load_pem_x509_certificate(
+                str(cert).encode('utf-8'), backends.default_backend())
+            try:
+                # Check if the data was signed by the private key associated
+                # with the public key in the certificate. The data should have
+                # been signed with PKCS1v15 padding.
+                cert_obj.public_key().verify(
+                    signature, data, padding.PKCS1v15(),
+                    cert_obj.signature_hash_algorithm)
+                return True
+            except exceptions.InvalidSignature:
+                # Certificate bundles contain certificates that will not be
+                # able to verify the attestation, so the InvalidSignature
+                # errors can be ignored.
+                continue
+        return False
+# [END kms_verify_attestations]
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(
+            description=__doc__)
+    parser.add_argument('attestation_file', help="Name of attestation file.")
+    parser.add_argument('bundle_file', help="Name of certificate bundle file.")
+
+    args = parser.parse_args()
+
+    if verify(args.attestation_file, args.bundle_file):
+        print('Signature verified.')
+    else:
+        print('Signature verification failed.')