Add dedicated function for decrypting tokens
The newly added function not only removes duplicate code, but can also be used by aggregate_incompatible_flags_test_result to safely retrieve a GitHub API token in a future commit.
@@ -553,6 +553,32 @@ P9w8kNhEbw==
self._token = self._get_buildkite_token()
def _get_buildkite_token(self):
+ return decrypt_token(
+ encrypted_token=self._ENCRYPTED_BUILDKITE_API_TESTING_TOKEN
+ if THIS_IS_TESTING
+ else self._ENCRYPTED_BUILDKITE_API_TOKEN,
+ kms_key="buildkite-testing-api-token"
+ if THIS_IS_TESTING
+ else "buildkite-untrusted-api-token",
+ )
+
+ def _open_url(self, url):
+ return (
+ urllib.request.urlopen("{}?access_token={}".format(url, self._token))
+ .read()
+ .decode("utf-8")
+ )
+
+ def get_build_info(self, build_number):
+ url = self._BUILD_STATUS_URL_TEMPLATE.format(self._org, self._pipeline, build_number)
+ output = self._open_url(url)
+ return json.loads(output)
+
+ def get_build_log(self, job):
+ return self._open_url(job["raw_log_url"])
+
+
+def decrypt_token(encrypted_token, kms_key):
return (
subprocess.check_output(
[
@@ -566,40 +592,19 @@ P9w8kNhEbw==
"--keyring",
"buildkite",
"--key",
- "buildkite-testing-api-token"
- if THIS_IS_TESTING
- else "buildkite-untrusted-api-token",
+ kms_key,
"--ciphertext-file",
"-",
"--plaintext-file",
"-",
],
- input=base64.b64decode(
- self._ENCRYPTED_BUILDKITE_API_TESTING_TOKEN
- if THIS_IS_TESTING
- else self._ENCRYPTED_BUILDKITE_API_TOKEN
- ),
+ input=base64.b64decode(encrypted_token),
env=os.environ,
)
.decode("utf-8")
.strip()
)
- def _open_url(self, url):
- return (
- urllib.request.urlopen("{}?access_token={}".format(url, self._token))
- .read()
- .decode("utf-8")
- )
-
- def get_build_info(self, build_number):
- url = self._BUILD_STATUS_URL_TEMPLATE.format(self._org, self._pipeline, build_number)
- output = self._open_url(url)
- return json.loads(output)
-
- def get_build_log(self, job):
- return self._open_url(job["raw_log_url"])
-
def eprint(*args, **kwargs):
"""
@@ -999,30 +1004,9 @@ def start_sauce_connect_proxy(platform, tmpdir):
def saucelabs_token():
- return (
- subprocess.check_output(
- [
- gcloud_command(),
- "kms",
- "decrypt",
- "--project",
- "bazel-untrusted",
- "--location",
- "global",
- "--keyring",
- "buildkite",
- "--key",
- "saucelabs-access-key",
- "--ciphertext-file",
- "-",
- "--plaintext-file",
- "-",
- ],
- input=base64.b64decode(ENCRYPTED_SAUCELABS_TOKEN),
- env=os.environ,
- )
- .decode("utf-8")
- .strip()
+ return decrypt_token(
+ encrypted_token=ENCRYPTED_SAUCELABS_TOKEN,
+ kms_key="saucelabs-access-key"
)
