Skip to content

Commit 31e4e49

Browse files
mattsb42-awsmattsb42-aws
authored
feat: remove specific value definition for keyring trace flags aws#215 (aws#225)
* feat: remove specific value definition for keyring trace flags aws#215 * chore: autoformat * feat: rename keyring trace flags to match names in specification * docs: add docs explaining each keyring trace flag * chore: fix linting
1 parent 1bd5fa6 commit 31e4e49

File tree

13 files changed

+85
-85
lines changed

13 files changed

+85
-85
lines changed

‎src/aws_encryption_sdk/identifiers.py

+20-5
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import struct
1515
from enum import Enum
1616

17+
import attr
1718
from cryptography.hazmat.primitives import hashes
1819
from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
1920
from cryptography.hazmat.primitives.ciphers import algorithms, modes
@@ -333,8 +334,22 @@ class ContentAADString(Enum):
333334
class KeyringTraceFlag(Enum):
334335
"""KeyRing Trace actions."""
335336

336-
WRAPPING_KEY_GENERATED_DATA_KEY = 1
337-
WRAPPING_KEY_ENCRYPTED_DATA_KEY = 1 << 1
338-
WRAPPING_KEY_DECRYPTED_DATA_KEY = 1 << 2
339-
WRAPPING_KEY_SIGNED_ENC_CTX = 1 << 3
340-
WRAPPING_KEY_VERIFIED_ENC_CTX = 1 << 4
337+
@attr.s
338+
class KeyringTraceFlagValue(object):
339+
"""Keyring trace flags do not have defined serializable values."""
340+
341+
name = attr.ib()
342+
343+
#: A flag to represent that a keyring has generated a plaintext data key.
344+
GENERATED_DATA_KEY = KeyringTraceFlagValue("GENERATED_DATA_KEY")
345+
#: A flag to represent that a keyring has created an encrypted data key.
346+
ENCRYPTED_DATA_KEY = KeyringTraceFlagValue("ENCRYPTED_DATA_KEY")
347+
#: A flag to represent that a keyring has obtained
348+
#: the corresponding plaintext data key from an encrypted data key.
349+
DECRYPTED_DATA_KEY = KeyringTraceFlagValue("DECRYPTED_DATA_KEY")
350+
#: A flag to represent that the keyring has cryptographically
351+
#: bound the encryption context to a newly created encrypted data key.
352+
SIGNED_ENCRYPTION_CONTEXT = KeyringTraceFlagValue("SIGNED_ENCRYPTION_CONTEXT")
353+
#: A flag to represent that the keyring has verified that an encrypted
354+
#: data key was originally created with a particular encryption context.
355+
VERIFIED_ENCRYPTION_CONTEXT = KeyringTraceFlagValue("VERIFIED_ENCRYPTION_CONTEXT")

‎src/aws_encryption_sdk/keyrings/aws_kms/__init__.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@
3434

3535
_LOGGER = logging.getLogger(__name__)
3636
_PROVIDER_ID = "aws-kms"
37-
_GENERATE_FLAGS = {KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY}
38-
_ENCRYPT_FLAGS = {KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY, KeyringTraceFlag.WRAPPING_KEY_SIGNED_ENC_CTX}
39-
_DECRYPT_FLAGS = {KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY, KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX}
37+
_GENERATE_FLAGS = {KeyringTraceFlag.GENERATED_DATA_KEY}
38+
_ENCRYPT_FLAGS = {KeyringTraceFlag.ENCRYPTED_DATA_KEY, KeyringTraceFlag.SIGNED_ENCRYPTION_CONTEXT}
39+
_DECRYPT_FLAGS = {KeyringTraceFlag.DECRYPTED_DATA_KEY, KeyringTraceFlag.VERIFIED_ENCRYPTION_CONTEXT}
4040

4141

4242
@attr.s

‎src/aws_encryption_sdk/keyrings/raw.py

+5-9
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ def _generate_data_key(
5555
raise GenerateKeyError("Unable to generate data encryption key.")
5656

5757
# Create a keyring trace
58-
keyring_trace = KeyringTrace(wrapping_key=key_provider, flags={KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY})
58+
keyring_trace = KeyringTrace(wrapping_key=key_provider, flags={KeyringTraceFlag.GENERATED_DATA_KEY})
5959

6060
# plaintext_data_key to RawDataKey
6161
data_encryption_key = RawDataKey(key_provider=key_provider, data_key=plaintext_data_key)
@@ -150,7 +150,7 @@ def on_encrypt(self, encryption_materials):
150150

151151
# Update Keyring Trace
152152
keyring_trace = KeyringTrace(
153-
wrapping_key=encrypted_data_key.key_provider, flags={KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY}
153+
wrapping_key=encrypted_data_key.key_provider, flags={KeyringTraceFlag.ENCRYPTED_DATA_KEY}
154154
)
155155

156156
# Add encrypted data key to encryption_materials
@@ -201,9 +201,7 @@ def on_decrypt(self, decryption_materials, encrypted_data_keys):
201201
return decryption_materials
202202

203203
# Create a keyring trace
204-
keyring_trace = KeyringTrace(
205-
wrapping_key=self._key_provider, flags={KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY}
206-
)
204+
keyring_trace = KeyringTrace(wrapping_key=self._key_provider, flags={KeyringTraceFlag.DECRYPTED_DATA_KEY})
207205

208206
# Update decryption materials
209207
data_encryption_key = RawDataKey(key_provider=self._key_provider, data_key=plaintext_data_key)
@@ -367,7 +365,7 @@ def on_encrypt(self, encryption_materials):
367365

368366
# Update Keyring Trace
369367
keyring_trace = KeyringTrace(
370-
wrapping_key=encrypted_data_key.key_provider, flags={KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY}
368+
wrapping_key=encrypted_data_key.key_provider, flags={KeyringTraceFlag.ENCRYPTED_DATA_KEY}
371369
)
372370

373371
# Add encrypted data key to encryption_materials
@@ -408,9 +406,7 @@ def on_decrypt(self, decryption_materials, encrypted_data_keys):
408406
continue
409407

410408
# Create a keyring trace
411-
keyring_trace = KeyringTrace(
412-
wrapping_key=self._key_provider, flags={KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY}
413-
)
409+
keyring_trace = KeyringTrace(wrapping_key=self._key_provider, flags={KeyringTraceFlag.DECRYPTED_DATA_KEY})
414410

415411
# Update decryption materials
416412
data_encryption_key = RawDataKey(key_provider=self._key_provider, data_key=plaintext_data_key)

‎src/aws_encryption_sdk/materials_managers/__init__.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ def add_data_encryption_key(self, data_encryption_key, keyring_trace):
280280
self._add_data_encryption_key(
281281
data_encryption_key=data_encryption_key,
282282
keyring_trace=keyring_trace,
283-
required_flags={KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY},
283+
required_flags={KeyringTraceFlag.GENERATED_DATA_KEY},
284284
)
285285

286286
def add_encrypted_data_key(self, encrypted_data_key, keyring_trace):
@@ -299,7 +299,7 @@ def add_encrypted_data_key(self, encrypted_data_key, keyring_trace):
299299
if self.data_encryption_key is None:
300300
raise AttributeError("Data encryption key is not set.")
301301

302-
if KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY not in keyring_trace.flags:
302+
if KeyringTraceFlag.ENCRYPTED_DATA_KEY not in keyring_trace.flags:
303303
raise InvalidKeyringTraceError("Keyring flags do not match action.")
304304

305305
if keyring_trace.wrapping_key != encrypted_data_key.key_provider:
@@ -445,7 +445,7 @@ def add_data_encryption_key(self, data_encryption_key, keyring_trace):
445445
self._add_data_encryption_key(
446446
data_encryption_key=data_encryption_key,
447447
keyring_trace=keyring_trace,
448-
required_flags={KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY},
448+
required_flags={KeyringTraceFlag.DECRYPTED_DATA_KEY},
449449
)
450450

451451
def add_verification_key(self, verification_key):

‎test/functional/keyrings/aws_kms/test_aws_kms.py

+14-14
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,9 @@ def test_aws_kms_single_cmk_keyring_on_encrypt_empty_materials(fake_generator):
6161
MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=fake_generator), result_materials.keyring_trace
6262
)
6363

64-
assert KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY in generator_flags
65-
assert KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY in generator_flags
66-
assert KeyringTraceFlag.WRAPPING_KEY_SIGNED_ENC_CTX in generator_flags
64+
assert KeyringTraceFlag.GENERATED_DATA_KEY in generator_flags
65+
assert KeyringTraceFlag.ENCRYPTED_DATA_KEY in generator_flags
66+
assert KeyringTraceFlag.SIGNED_ENCRYPTION_CONTEXT in generator_flags
6767

6868

6969
def test_aws_kms_single_cmk_keyring_on_encrypt_existing_data_key(fake_generator):
@@ -86,9 +86,9 @@ def test_aws_kms_single_cmk_keyring_on_encrypt_existing_data_key(fake_generator)
8686
MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=fake_generator), result_materials.keyring_trace
8787
)
8888

89-
assert KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY not in generator_flags
90-
assert KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY in generator_flags
91-
assert KeyringTraceFlag.WRAPPING_KEY_SIGNED_ENC_CTX in generator_flags
89+
assert KeyringTraceFlag.GENERATED_DATA_KEY not in generator_flags
90+
assert KeyringTraceFlag.ENCRYPTED_DATA_KEY in generator_flags
91+
assert KeyringTraceFlag.SIGNED_ENCRYPTION_CONTEXT in generator_flags
9292

9393

9494
@mock_kms
@@ -155,8 +155,8 @@ def test_aws_kms_single_cmk_keyring_on_decrypt_single_cmk(fake_generator):
155155
MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=fake_generator), result_materials.keyring_trace
156156
)
157157

158-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY in generator_flags
159-
assert KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX in generator_flags
158+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY in generator_flags
159+
assert KeyringTraceFlag.VERIFIED_ENCRYPTION_CONTEXT in generator_flags
160160

161161

162162
def test_aws_kms_single_cmk_keyring_on_decrypt_multiple_cmk(fake_generator_and_child):
@@ -186,8 +186,8 @@ def test_aws_kms_single_cmk_keyring_on_decrypt_multiple_cmk(fake_generator_and_c
186186
MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=child), result_materials.keyring_trace
187187
)
188188

189-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY in child_flags
190-
assert KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX in child_flags
189+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY in child_flags
190+
assert KeyringTraceFlag.VERIFIED_ENCRYPTION_CONTEXT in child_flags
191191

192192

193193
def test_aws_kms_single_cmk_keyring_on_decrypt_no_match(fake_generator_and_child):
@@ -274,8 +274,8 @@ def test_aws_kms_discovery_keyring_on_decrypt(encryption_materials_for_discovery
274274
MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=generator_key_id), result_materials.keyring_trace
275275
)
276276

277-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY in generator_flags
278-
assert KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX in generator_flags
277+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY in generator_flags
278+
assert KeyringTraceFlag.VERIFIED_ENCRYPTION_CONTEXT in generator_flags
279279

280280

281281
@mock_kms
@@ -380,8 +380,8 @@ def test_try_aws_kms_decrypt_succeed(fake_generator):
380380
MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=fake_generator), result_materials.keyring_trace
381381
)
382382

383-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY in generator_flags
384-
assert KeyringTraceFlag.WRAPPING_KEY_VERIFIED_ENC_CTX in generator_flags
383+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY in generator_flags
384+
assert KeyringTraceFlag.VERIFIED_ENCRYPTION_CONTEXT in generator_flags
385385

386386

387387
@mock_kms

‎test/functional/keyrings/raw/test_raw_aes.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ def sample_encryption_materials():
5757
keyring_trace=[
5858
KeyringTrace(
5959
wrapping_key=MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=_KEY_ID),
60-
flags={KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY},
60+
flags={KeyringTraceFlag.GENERATED_DATA_KEY},
6161
)
6262
],
6363
),

‎test/functional/keyrings/raw/test_raw_rsa.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ def sample_encryption_materials():
133133
keyring_trace=[
134134
KeyringTrace(
135135
wrapping_key=MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=_KEY_ID),
136-
flags={KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY},
136+
flags={KeyringTraceFlag.GENERATED_DATA_KEY},
137137
)
138138
],
139139
),

‎test/functional/keyrings/test_multi.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
keyring_trace=[
4545
KeyringTrace(
4646
wrapping_key=MasterKeyInfo(provider_id=_PROVIDER_ID, key_info=_KEY_ID),
47-
flags={KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY},
47+
flags={KeyringTraceFlag.GENERATED_DATA_KEY},
4848
)
4949
],
5050
)

‎test/unit/keyrings/raw/test_raw_aes.py

+10-10
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,8 @@ def test_keyring_trace_on_encrypt_when_data_encryption_key_given(raw_aes_keyring
129129

130130
for keyring_trace in test.keyring_trace:
131131
if keyring_trace.wrapping_key.key_info == _KEY_ID:
132-
# Check keyring trace does not contain KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY
133-
assert KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY not in keyring_trace.flags
132+
# Check keyring trace does not contain KeyringTraceFlag.GENERATED_DATA_KEY
133+
assert KeyringTraceFlag.GENERATED_DATA_KEY not in keyring_trace.flags
134134

135135

136136
def test_on_encrypt_when_data_encryption_key_not_given(raw_aes_keyring):
@@ -152,11 +152,11 @@ def test_on_encrypt_when_data_encryption_key_not_given(raw_aes_keyring):
152152
for keyring_trace in test.keyring_trace:
153153
if (
154154
keyring_trace.wrapping_key.key_info == _KEY_ID
155-
and KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY in keyring_trace.flags
155+
and KeyringTraceFlag.GENERATED_DATA_KEY in keyring_trace.flags
156156
):
157-
# Check keyring trace contains KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY
157+
# Check keyring trace contains KeyringTraceFlag.GENERATED_DATA_KEY
158158
generated_flag_count += 1
159-
if KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY in keyring_trace.flags:
159+
if KeyringTraceFlag.ENCRYPTED_DATA_KEY in keyring_trace.flags:
160160
encrypted_flag_count += 1
161161

162162
assert generated_flag_count == 1
@@ -187,8 +187,8 @@ def test_keyring_trace_on_decrypt_when_data_key_given(raw_aes_keyring):
187187
)
188188
for keyring_trace in test.keyring_trace:
189189
if keyring_trace.wrapping_key.key_info == _KEY_ID:
190-
# Check keyring trace does not contain KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY
191-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY not in keyring_trace.flags
190+
# Check keyring trace does not contain KeyringTraceFlag.DECRYPTED_DATA_KEY
191+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY not in keyring_trace.flags
192192

193193

194194
@pytest.mark.parametrize(
@@ -208,7 +208,7 @@ def test_on_decrypt_when_data_key_and_edk_not_provided(
208208

209209
for keyring_trace in test.keyring_trace:
210210
if keyring_trace.wrapping_key.key_info == _KEY_ID:
211-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY not in keyring_trace.flags
211+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY not in keyring_trace.flags
212212

213213
assert test.data_encryption_key is None
214214

@@ -235,7 +235,7 @@ def test_keyring_trace_when_data_key_not_provided_and_edk_provided(raw_aes_keyri
235235
decrypted_flag_count = 0
236236

237237
for keyring_trace in test.keyring_trace:
238-
if KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY in keyring_trace.flags:
238+
if KeyringTraceFlag.DECRYPTED_DATA_KEY in keyring_trace.flags:
239239
decrypted_flag_count += 1
240240

241241
assert decrypted_flag_count == 1
@@ -277,6 +277,6 @@ def test_generate_data_key_keyring_trace():
277277
generate_flag_count = 0
278278

279279
for keyring_trace in encryption_materials_without_data_key.keyring_trace:
280-
if KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY in keyring_trace.flags:
280+
if KeyringTraceFlag.GENERATED_DATA_KEY in keyring_trace.flags:
281281
generate_flag_count += 1
282282
assert generate_flag_count == 1

‎test/unit/keyrings/raw/test_raw_rsa.py

+10-10
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,8 @@ def test_keyring_trace_on_encrypt_when_data_encryption_key_given(raw_rsa_keyring
130130

131131
for keyring_trace in test.keyring_trace:
132132
if keyring_trace.wrapping_key.key_info == _KEY_ID:
133-
# Check keyring trace does not contain KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY
134-
assert KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY not in keyring_trace.flags
133+
# Check keyring trace does not contain KeyringTraceFlag.GENERATED_DATA_KEY
134+
assert KeyringTraceFlag.GENERATED_DATA_KEY not in keyring_trace.flags
135135

136136

137137
def test_on_encrypt_when_data_encryption_key_not_given(raw_rsa_keyring):
@@ -152,11 +152,11 @@ def test_on_encrypt_when_data_encryption_key_not_given(raw_rsa_keyring):
152152
for keyring_trace in test.keyring_trace:
153153
if (
154154
keyring_trace.wrapping_key.key_info == _KEY_ID
155-
and KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY in keyring_trace.flags
155+
and KeyringTraceFlag.GENERATED_DATA_KEY in keyring_trace.flags
156156
):
157-
# Check keyring trace contains KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY
157+
# Check keyring trace contains KeyringTraceFlag.GENERATED_DATA_KEY
158158
generated_flag_count += 1
159-
if KeyringTraceFlag.WRAPPING_KEY_ENCRYPTED_DATA_KEY in keyring_trace.flags:
159+
if KeyringTraceFlag.ENCRYPTED_DATA_KEY in keyring_trace.flags:
160160
encrypted_flag_count += 1
161161

162162
assert generated_flag_count == 1
@@ -183,8 +183,8 @@ def test_keyring_trace_on_decrypt_when_data_key_given(raw_rsa_keyring):
183183
)
184184
for keyring_trace in test.keyring_trace:
185185
if keyring_trace.wrapping_key.key_info == _KEY_ID:
186-
# Check keyring trace does not contain KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY
187-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY not in keyring_trace.flags
186+
# Check keyring trace does not contain KeyringTraceFlag.DECRYPTED_DATA_KEY
187+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY not in keyring_trace.flags
188188

189189

190190
def test_on_decrypt_when_data_key_and_edk_not_provided(raw_rsa_keyring, patch_decrypt_on_wrapping_key):
@@ -196,7 +196,7 @@ def test_on_decrypt_when_data_key_and_edk_not_provided(raw_rsa_keyring, patch_de
196196
assert not patch_decrypt_on_wrapping_key.called
197197

198198
for keyring_trace in test.keyring_trace:
199-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY not in keyring_trace.flags
199+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY not in keyring_trace.flags
200200

201201
assert test.data_encryption_key is None
202202

@@ -212,7 +212,7 @@ def test_on_decrypt_when_data_key_not_provided_and_edk_not_in_keyring(raw_rsa_ke
212212

213213
for keyring_trace in test.keyring_trace:
214214
if keyring_trace.wrapping_key.key_info == _KEY_ID:
215-
assert KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY not in keyring_trace.flags
215+
assert KeyringTraceFlag.DECRYPTED_DATA_KEY not in keyring_trace.flags
216216

217217
assert test.data_encryption_key is None
218218

@@ -242,7 +242,7 @@ def test_keyring_trace_when_data_key_not_provided_and_edk_provided(raw_rsa_keyri
242242
decrypted_flag_count = 0
243243

244244
for keyring_trace in test.keyring_trace:
245-
if KeyringTraceFlag.WRAPPING_KEY_DECRYPTED_DATA_KEY in keyring_trace.flags:
245+
if KeyringTraceFlag.DECRYPTED_DATA_KEY in keyring_trace.flags:
246246
decrypted_flag_count += 1
247247

248248
assert decrypted_flag_count == 1

0 commit comments

Comments
 (0)