chore(xtest): Add test of key mgmt create WIP

[dmihalcik-virtru]

No description provided.

[gemini-code-assist]

Summary of Changes

Hello @dmihalcik-virtru, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request primarily focuses on expanding the xtest suite to incorporate and validate key management capabilities. My changes introduce refined data models for KAS keys, enable programmatic key creation via the command-line tool, and establish a clear mechanism for associating these managed keys with attributes. The core outcome is a new end-to-end test that confirms the proper functioning of encryption and decryption when attributes are tied to KAS-managed keys, thereby bolstering the robustness of the key management system's testing.

Highlights

• Key Management Models: I've introduced new Pydantic models (SimpleKasPublicKey, SimpleKasKey, PrivateKeyCtx, KeyProviderConfig) and refactored existing ones (PublicKeyCtx, AsymmetricKey) in xtest/abac.py. These changes provide a more comprehensive representation of KAS key structures, including private key contexts and key provider configurations.
• KAS Key Creation Functionality: I've added a kas_registry_key_create method to xtest/abac.py's OpentdfCommandLineTool. This new method allows for programmatic creation of KAS keys using the otdfctl CLI, supporting local mode, RSA 2048 algorithm, and specified wrapping keys.
• Attribute-Key Association: The AttributeValue model in xtest/abac.py has been enhanced to include an optional kas_keys field. This enables the direct association of SimpleKasKey instances with attributes, linking policy attributes to specific KAS-managed keys.
• New Test Fixture for Managed Keys: I've created a new pytest fixture, attribute_with_managed_keys, in xtest/conftest.py. This fixture sets up a test scenario by creating a KAS-managed key and associating it with a test attribute, ensuring tests can easily leverage this new functionality. It also includes a skip condition if key management is not enabled.
• End-to-End Test for Managed Keys: I've implemented test_key_mapping_from_mgmt in xtest/test_abac.py. This new test validates the complete encryption and decryption flow when data is protected with attributes linked to KAS-managed keys, including verification of the manifest's key access information.
• Build Instructions Update: A minor update was made to xtest/README.md to include the go mod tidy command in the build instructions, ensuring module dependencies are correctly managed during the setup process.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces tests for key management creation. I've identified a critical issue in abac.py with a duplicated command-line argument, and high-severity issues in subprocess error handling and environment variable access. A test bug in test_abac.py could lead to incorrect test results. Please address these comments.

[gemini-code-assist]

The --wrapping-key argument is added twice to the command list. Remove the duplicate on this line to avoid unexpected behavior.

[gemini-code-assist]

Direct access to os.environ['OT_ROOT_KEY'] can raise a KeyError if the environment variable is not set. Use os.getenv() with a default value or explicit error handling to prevent this ¹.

Style Guide References

Footnotes

1. Using os.getenv with a default value or explicit error handling prevents KeyError exceptions when environment variables are not set. (link) ↩

[gemini-code-assist]

The subprocess execution lacks proper error handling. Capture stderr, check process.returncode, decode the error output, and remove the redundant assert ¹.

Style Guide References

Suggested change

	process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
	out, err = process.communicate()
	if err:
	print(err, file=sys.stderr)
	raise RuntimeError(f"Error creating KAS key: {err.decode()}")
	if out:
	print(out)
	assert process.returncode == 0
	return KasKey.model_validate_json(out)
	process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
	out, err = process.communicate()
	if process.returncode != 0:
	error_output = err.decode() if err else "Unknown error"
	print(error_output, file=sys.stderr)
	raise RuntimeError(f"Error creating KAS key: {error_output}")
	if out:
	print(out)
	return KasKey.model_validate_json(out)

Footnotes

1. Capture stderr, check return code, decode output, and avoid redundant assertions for robust error handling. (link) ↩

[gemini-code-assist]

The sample_name is not unique, potentially causing the test to reuse ciphertext files from test_key_mapping_multiple_mechanisms. Use a unique name to avoid collisions and ensure correct test behavior.

Suggested change

	sample_name = f"multimechanism-{encrypt_sdk}"
	sample_name = f"keymgmt-from-mgmt-{encrypt_sdk}"

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
10.1% Duplication on New Code (required ≤ 8%)

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
8.5% Duplication on New Code (required ≤ 8%)

See analysis details on SonarQube Cloud