Skip to content

Commit ac79bc8

Browse files
lucasmcdonald3lucasmcdonald3
authored
feat: Add MPL and hierarchy keyring example (#634)
1 parent ad6b02c commit ac79bc8

39 files changed

+1955
-36
lines changed

‎.coveragerc

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# .coveragerc file when running coverage WITHOUT coverage for the MPL
2+
# This prevents the ESDK without the MPL from considering the MPL-specific modules as "missed" coverage
3+
[run]
4+
omit = */aws_encryption_sdk/materials_managers/mpl/*
5+
6+
[report]
7+
omit = */aws_encryption_sdk/materials_managers/mpl/*

‎.coveragercmpl

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# .coveragerc file when running coverage WITH coverage for the MPL

‎.github/workflows/ci_tests.yaml

+30-3
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,11 @@ jobs:
2525
matrix:
2626
os:
2727
- ubuntu-latest
28-
- windows-latest
28+
# Windows fails due to "No module named 'Wrappers'"
29+
# This SHOULD be fixed once Dafny generates fully-qualified import statements
30+
# (i.e. doo files, per-package module names)
31+
# Disable for now
32+
# - windows-latest
2933
- macos-latest
3034
python:
3135
- 3.7
@@ -41,17 +45,40 @@ jobs:
4145
category:
4246
- local
4347
- accept
48+
- mpllocal
4449
# These require credentials.
4550
# Enable them once we sort how to provide them.
4651
# - integ
4752
# - examples
53+
# Append '-mpl' to some test environments.
54+
# This suffix signals to tox to install the MPL in the test environment.
55+
optional_mpl_dependency:
56+
- ""
57+
- -mpl
4858
exclude:
4959
# x86 builds are only meaningful for Windows
5060
- os: ubuntu-latest
5161
architecture: x86
5262
- os: macos-latest
5363
architecture: x86
64+
# MPL is not supported on <3.11
65+
- python: 3.7
66+
optional_mpl_dependency: -mpl
67+
- python: 3.8
68+
optional_mpl_dependency: -mpl
69+
- python: 3.9
70+
optional_mpl_dependency: -mpl
71+
- python: 3.10
72+
optional_mpl_dependency: -mpl
73+
# mpllocal requires the MPL to be installed
74+
- category: mpllocal
75+
optional_mpl_dependency: ""
5476
steps:
77+
# Support long Dafny filenames (used in MPL and DBESDK repos)
78+
- name: Support longpaths
79+
run: |
80+
git config --global core.longpaths true
81+
5582
- uses: actions/checkout@v4
5683
- uses: actions/setup-python@v4
5784
with:
@@ -62,7 +89,7 @@ jobs:
6289
pip install --upgrade -r dev_requirements/ci-requirements.txt
6390
- name: run test
6491
env:
65-
TOXENV: ${{ matrix.category }}
92+
TOXENV: ${{ matrix.category }}${{ matrix.optional_mpl_dependency }}
6693
run: tox -- -vv
6794
upstream-py311:
6895
runs-on: ubuntu-latest
@@ -82,5 +109,5 @@ jobs:
82109
pip install --upgrade -r dev_requirements/ci-requirements.txt
83110
- name: run test
84111
env:
85-
TOXENV: ${{ matrix.category }}
112+
TOXENV: ${{ matrix.category }}${{ matrix.optional_mpl_dependency }}
86113
run: tox -- -vv

‎.gitignore

+3-2
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,9 @@ docs/build
1919
__pycache__
2020
*.egg-info
2121

22-
# Coverage.py
23-
.coverage*
22+
# Coverage.py, NOT .coveragerc nor .coveragercmpl
23+
.coverage
24+
.coverage.py
2425

2526
# MyPy
2627
.mypy_cache

‎buildspec.yml

+28
Original file line numberDiff line numberDiff line change
@@ -58,30 +58,58 @@ batch:
5858
buildspec: codebuild/py311/integ.yml
5959
env:
6060
image: aws/codebuild/standard:7.0
61+
- identifier: py311_integ_mpl
62+
buildspec: codebuild/py311/integ_mpl.yml
63+
env:
64+
image: aws/codebuild/standard:7.0
6165
- identifier: py311_examples
6266
buildspec: codebuild/py311/examples.yml
6367
env:
6468
image: aws/codebuild/standard:7.0
69+
- identifier: py311_examples_mpl
70+
buildspec: codebuild/py311/examples_mpl.yml
71+
env:
72+
image: aws/codebuild/standard:7.0
6573
- identifier: py311_awses_latest
6674
buildspec: codebuild/py311/awses_local.yml
6775
env:
6876
image: aws/codebuild/standard:7.0
77+
- identifier: py311_awses_latest_mpl
78+
buildspec: codebuild/py311/awses_local_mpl.yml
79+
env:
80+
image: aws/codebuild/standard:7.0
6981

7082
- identifier: py312_integ
7183
buildspec: codebuild/py312/integ.yml
7284
env:
7385
image: aws/codebuild/standard:7.0
86+
- identifier: py312_integ_mpl
87+
buildspec: codebuild/py312/integ_mpl.yml
88+
env:
89+
image: aws/codebuild/standard:7.0
7490
- identifier: py312_examples
7591
buildspec: codebuild/py312/examples.yml
7692
env:
7793
image: aws/codebuild/standard:7.0
94+
- identifier: py312_examples_mpl
95+
buildspec: codebuild/py312/examples_mpl.yml
96+
env:
97+
image: aws/codebuild/standard:7.0
7898
- identifier: py312_awses_latest
7999
buildspec: codebuild/py312/awses_local.yml
80100
env:
81101
image: aws/codebuild/standard:7.0
102+
- identifier: py312_awses_latest_mpl
103+
buildspec: codebuild/py312/awses_local_mpl.yml
104+
env:
105+
image: aws/codebuild/standard:7.0
82106

83107
- identifier: code_coverage
84108
buildspec: codebuild/coverage/coverage.yml
109+
- identifier: code_coverage_mpl
110+
buildspec: codebuild/coverage/coverage_mpl.yml
111+
env:
112+
image: aws/codebuild/standard:7.0
85113

86114
- identifier: compliance
87115
buildspec: codebuild/compliance/compliance.yml

‎codebuild/coverage/coverage_mpl.yml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "mplcoverage-mpl"
6+
7+
phases:
8+
install:
9+
runtime-versions:
10+
python: 3.11
11+
build:
12+
commands:
13+
- pip install "tox < 4.0"
14+
- tox

‎codebuild/py311/awses_local_mpl.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "py311-awses_local-mpl"
6+
REGION: "us-west-2"
7+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
8+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
9+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
10+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
11+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
12+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
13+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
14+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
15+
AWS_ENCRYPTION_SDK_PYTHON_DECRYPT_ORACLE_API_DEPLOYMENT_ID: "xi1mwx3ttb"
16+
AWS_ENCRYPTION_SDK_PYTHON_DECRYPT_ORACLE_REGION: "us-west-2"
17+
18+
phases:
19+
install:
20+
runtime-versions:
21+
python: 3.11
22+
build:
23+
commands:
24+
- pip install "tox < 4.0"
25+
- cd test_vector_handlers
26+
- tox

‎codebuild/py311/examples_mpl.yml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
# No TOXENV. This runs multiple environments.
6+
REGION: "us-west-2"
7+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
8+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
9+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
10+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
11+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
12+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
13+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
14+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
15+
16+
phases:
17+
install:
18+
runtime-versions:
19+
python: 3.11
20+
build:
21+
commands:
22+
- pip install "tox < 4.0"
23+
# Run non-MPL-specific tests with the MPL installed
24+
- tox -e py311-examples-mpl
25+
# Assume special role to access keystore
26+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Python-Role-us-west-2" --role-session-name "CB-Py311ExamplesMpl")
27+
- export TMP_ROLE
28+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
29+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
30+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
31+
- aws sts get-caller-identity
32+
# Run MPL-specific tests with special role
33+
- tox -e py311-mplexamples-mpl
34+

‎codebuild/py311/integ_mpl.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
TOXENV: "py311-integ-mpl"
6+
REGION: "us-west-2"
7+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
8+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
9+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
10+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
11+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
12+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
13+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
14+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
15+
16+
phases:
17+
install:
18+
runtime-versions:
19+
python: 3.11
20+
build:
21+
commands:
22+
- pip install "tox < 4.0"
23+
- tox

‎codebuild/py312/awses_local_mpl.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Runs the same tests as awses_local in an environment with the MPL installed.
2+
# This asserts existing tests continue to pass with the MPL installed.
3+
version: 0.2
4+
5+
env:
6+
variables:
7+
TOXENV: "py312-awses_local-mpl"
8+
REGION: "us-west-2"
9+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
10+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
11+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
12+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
13+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
14+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
15+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
16+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
17+
AWS_ENCRYPTION_SDK_PYTHON_DECRYPT_ORACLE_API_DEPLOYMENT_ID: "xi1mwx3ttb"
18+
AWS_ENCRYPTION_SDK_PYTHON_DECRYPT_ORACLE_REGION: "us-west-2"
19+
20+
phases:
21+
install:
22+
runtime-versions:
23+
python: latest
24+
build:
25+
commands:
26+
- cd /root/.pyenv/plugins/python-build/../.. && git pull && cd -
27+
- pyenv install --skip-existing 3.12.0
28+
- pyenv local 3.12.0
29+
- pip install --upgrade pip
30+
- pip install setuptools
31+
- pip install "tox < 4.0"
32+
- cd test_vector_handlers
33+
- tox

‎codebuild/py312/examples_mpl.yml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Runs the same tests as examples in an environment with the MPL installed
2+
# to assert existing tests continue to pass with the MPL installed.
3+
# Then, run MPL-specific tests.
4+
version: 0.2
5+
6+
env:
7+
variables:
8+
# No TOXENV. This runs multiple environments.
9+
REGION: "us-west-2"
10+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
11+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
12+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
13+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
14+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
15+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
16+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
17+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
18+
19+
phases:
20+
install:
21+
runtime-versions:
22+
python: latest
23+
build:
24+
commands:
25+
- cd /root/.pyenv/plugins/python-build/../.. && git pull && cd -
26+
- pyenv install --skip-existing 3.12.0
27+
- pyenv local 3.12.0
28+
- pip install --upgrade pip
29+
- pip install setuptools
30+
- pip install "tox < 4.0"
31+
# Run non-MPL-specific tests with the MPL installed
32+
- tox -e py312-examples-mpl
33+
# Assume special role to access keystore
34+
- TMP_ROLE=$(aws sts assume-role --role-arn "arn:aws:iam::370957321024:role/GitHub-CI-Public-ESDK-Python-Role-us-west-2" --role-session-name "CB-Py311ExamplesMpl")
35+
- export TMP_ROLE
36+
- export AWS_ACCESS_KEY_ID=$(echo "${TMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
37+
- export AWS_SECRET_ACCESS_KEY=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
38+
- export AWS_SESSION_TOKEN=$(echo "${TMP_ROLE}" | jq -r '.Credentials.SessionToken')
39+
- aws sts get-caller-identity
40+
# Run MPL-specific tests with special role
41+
- tox -e py312-mplexamples-mpl

‎codebuild/py312/integ_mpl.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Runs the same tests as integ in an environment with the MPL installed.
2+
# This asserts existing tests continue to pass with the MPL installed.
3+
version: 0.2
4+
5+
env:
6+
variables:
7+
TOXENV: "py312-integ-mpl"
8+
REGION: "us-west-2"
9+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
10+
arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
11+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-
12+
arn:aws:kms:eu-central-1:658956600833:key/75414c93-5285-4b57-99c9-30c1cf0a22c2
13+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_1: >-
14+
arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
15+
AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_MRK_KEY_ID_2: >-
16+
arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7
17+
18+
phases:
19+
install:
20+
runtime-versions:
21+
python: latest
22+
build:
23+
commands:
24+
- cd /root/.pyenv/plugins/python-build/../.. && git pull && cd -
25+
- pyenv install --skip-existing 3.12.0
26+
- pyenv local 3.12.0
27+
- pip install --upgrade pip
28+
- pip install setuptools
29+
- pip install "tox < 4.0"
30+
- tox

‎examples/src/keyrings/__init__.py

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
"""Stub module indicator to make linter configuration simpler."""

0 commit comments

Comments
 (0)